Skip to content

Commit

Permalink
Modify rule S5144: Add aiohttp support (APPSEC-1248) (#3373)
Browse files Browse the repository at this point in the history
## Review

A dedicated reviewer checked the rule description successfully for:

- [ ] logical errors and incorrect information
- [ ] information gaps and missing content
- [ ] text style and tone
- [ ] PR summary and labels follow [the
guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule)

---------

Co-authored-by: Egon Okerman <egon.okerman@sonarsource.com>
  • Loading branch information
1 parent 0985aec commit 32a9027
Show file tree
Hide file tree
Showing 3 changed files with 54 additions and 0 deletions.
1 change: 1 addition & 0 deletions docs/header_names/allowed_framework_names.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@
* Django
* Django Templates
* Flask
* aiohttp
* Jinja
* lxml
* Paramiko
Expand Down
50 changes: 50 additions & 0 deletions rules/S5144/python/how-to-fix-it/aiohttp.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
== How to fix it in aiohttp

=== Code examples

include::../../common/fix/code-rationale.adoc[]

==== Noncompliant code example

[source,python,diff-id=31,diff-type=noncompliant]
----
from fastapi import FastAPI
import aiohttp
app = FastAPI()
@app.get('/example')
async def example(url: str):
async with aiohttp.request('GET', url) as response: # Noncompliant
return {"response": await response.text()}
----

==== Compliant solution

[source,python,diff-id=31,diff-type=compliant]
----
from fastapi import FastAPI
from fastapi.responses import JSONResponse
import aiohttp
from urllib.parse import urlparse
DOMAINS_ALLOWLIST = ['trusted1.example.com', 'trusted2.example.com'];
app = FastAPI()
@app.get('/example')
async def example(url: str):
if urlparse(url).hostname not in DOMAINS_ALLOWLIST:
return JSONResponse({"error": f"URL {url} is not whitelisted."}, 400)
async with aiohttp.request('GET', url.unicode_string()) as response:
return {"response": await response.text()}
----

=== How does this work?

include::../../common/fix/pre-approved-list.adoc[]

The compliant code example uses such an approach.

=== Pitfalls

include::../../common/pitfalls/starts-with.adoc[]
3 changes: 3 additions & 0 deletions rules/S5144/python/rule.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ include::how-to-fix-it/requests.adoc[]

include::how-to-fix-it/httpx.adoc[]

include::how-to-fix-it/aiohttp.adoc[]


== Resources

include::../common/resources/standards.adoc[]
Expand Down

0 comments on commit 32a9027

Please sign in to comment.