Description

This detector identifies path traversal vulnerabilities in FastAPI applications where user-controlled input is passed to file write operations without proper sanitization. Attackers can manipulate file paths to write files outside intended directories, potentially overwriting critical system files or placing malicious content in unauthorized locations.

Detection Strategy

• Verify that FastAPI framework is imported in the Python code

• Identify file write operations that use destination sinks (methods that write to file paths)

• Check if the file path parameter comes from FastAPI user input sources (path parameters, query parameters, request body, headers, etc.)

• Exclude operations that use pathlib constructors as they provide some built-in path validation

• Flag cases where user-controlled input reaches file write operations without proper path validation or sanitization

Vulnerable code example

from pathlib import Path
import os
import shutil
from fastapi import FastAPI, Query

app = FastAPI()

@app.get("/write")...

✅ Secure code example

from pathlib import Path
import os
import shutil
from fastapi import FastAPI, Query

app = FastAPI()

BASE_DIR = Path("uploads")...