mcp-server-semgrep/semgrep-rules/python/django/security/injection/request-data-fileresponse.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: request-data-fileresponse
  message: Found user-controlled request data being passed into a file open, which is them passed as an
    argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary
    file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted
    filename in the request data before using it in FileResponse.
  metadata:
    cwe:
    - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    references:
    - https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  languages: [python]
  severity: WARNING
  patterns:
  - pattern-inside: |
      def $FUNC(...):
        ...
  - pattern-either:
    - pattern: django.http.FileResponse(..., request.$W.get(...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        django.http.FileResponse(..., open($DATA, ...), ...)
    - pattern: |
        $DATA = request.$W.get(...)
        ...
        $INTERM = open($DATA, ...)
        ...
        django.http.FileResponse(..., $INTERM, ...)
    - pattern: $A = django.http.FileResponse(..., request.$W.get(...), ...)
    - pattern: return django.http.FileResponse(..., request.$W.get(...), ...)
    - pattern: django.http.FileResponse(..., request.$W(...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        django.http.FileResponse(..., open($DATA, ...), ...)
    - pattern: |
        $DATA = request.$W(...)
        ...
        $INTERM = open($DATA, ...)
        ...
        django.http.FileResponse(..., $INTERM, ...)
    - pattern: $A = django.http.FileResponse(..., request.$W(...), ...)
    - pattern: return django.http.FileResponse(..., request.$W(...), ...)
    - pattern: django.http.FileResponse(..., request.$W[...], ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        django.http.FileResponse(..., open($DATA, ...), ...)
    - pattern: |
        $DATA = request.$W[...]
        ...
        $INTERM = open($DATA, ...)
        ...
        django.http.FileResponse(..., $INTERM, ...)
    - pattern: $A = django.http.FileResponse(..., request.$W[...], ...)
    - pattern: return django.http.FileResponse(..., request.$W[...], ...)
    - pattern: django.http.FileResponse(..., request.$W, ...)
    - pattern: |
        $DATA = request.$W
        ...
        django.http.FileResponse(..., open($DATA, ...), ...)
    - pattern: |
        $DATA = request.$W
        ...
        $INTERM = open($DATA, ...)
        ...
        django.http.FileResponse(..., $INTERM, ...)
    - pattern: $A = django.http.FileResponse(..., request.$W, ...)
    - pattern: return django.http.FileResponse(..., request.$W, ...)