Description

This detector identifies Django applications vulnerable to path traversal attacks during file deletion operations. When user-controlled input is used to construct file paths for deletion without proper validation, attackers can use directory traversal sequences (like "../") to delete files outside the intended directory, potentially compromising system integrity.

Detection Strategy

• The code must import Django framework libraries (checked by library import prefix matching)

• Code must contain file deletion operations (using functions like os.remove, os.unlink, pathlib.unlink, shutil methods, or other file deletion APIs)

• A vulnerability is reported when user-controlled data reaches a file deletion operation without proper path validation or sanitization

• The taint analysis specifically focuses on Django-related data sources that could contain malicious path traversal sequences

Vulnerable code example

import os
from django.http import HttpResponse
from pathlib import Path

BASE_DIR = Path("/var/www/uploads")

def delete_file(request):
    filename = request.GET.get("file")  # User-controlled input...

✅ Secure code example

import os
from django.http import HttpResponse, HttpResponseBadRequest
from pathlib import Path

BASE_DIR = Path("/var/www/uploads").resolve()

def delete_file(request):
    filename = request.GET.get("file")...