Description

This vulnerability detector identifies path traversal vulnerabilities in Python applications using the Starlette web framework. It detects when user-controlled input is passed directly to file opening operations without proper sanitization, allowing attackers to access files outside the intended directory structure using sequences like "../".

Detection Strategy

• The application must import the Starlette web framework (checked by library import detection)

• Code contains file opening operations (such as open(), pathlib operations, or similar file access functions)

• The path parameter used in file operations originates from user-controllable input sources specific to Starlette (such as request parameters, form data, or URL path segments)

• No proper path sanitization or validation is performed on the user input before it reaches the file operation

• The data flow from the Starlette input source to the file operation is direct without adequate security controls

Vulnerable code example

from starlette.requests import Request
from starlette.responses import PlainTextResponse

async def vulnerable_file_read(request: Request):
    filename = request.query_params["file"]
    
    # VULNERABLE: User input directly passed to open() - enables path traversal
    return PlainTextResponse(open(filename).read())

✅ Secure code example

from pathlib import Path
from starlette.requests import Request
from starlette.responses import PlainTextResponse

BASE_DIR = Path("/srv/files")

async def secure_file_read(request: Request):
    filename = request.query_params["file"]...