apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-12 19:55:14 +02:00
Code Issues Projects Releases Packages Wiki Activity

Performance and precision pass (#64)

Browse source
This commit is contained in:
Eli Peter 2026-05-04 19:58:04 -04:00 • committed by GitHub
parent c7c5e0f3a1
commit fb698d2c27
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
97 changed files with 9932 additions and 517 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/patterns/python.rs
View file

@ -206,4 +206,26 @@ pub const PATTERNS: &[Pattern] = &[
category: PatternCategory::Xss,
confidence: Confidence::High,
},
// Flask `make_response(<f-string-or-concat>)` reflection — Tier B
// heuristic mirroring `py.sqli.execute_format` / `py.sqli.text_format`.
// Catches CVE-2023-6568 (mlflow auth `create_user` reflected the
// attacker-controlled `Content-Type` header into the response body
// via `make_response(f"Invalid content type: '{content_type}'", 400)`)
// and the equivalent `+`-concat shape. Recognises both bare
// `make_response(...)` and `flask.make_response(...)`.
Pattern {
id: "py.xss.make_response_format",
description: "flask make_response with f-string or concat risks reflected XSS",
query: r#"(call
function: [(identifier) @fn (attribute attribute: (identifier) @fn)]
(#eq? @fn "make_response")
arguments: (argument_list
[(binary_operator)
(string (interpolation))] @arg))
@vuln"#,
severity: Severity::Medium,
tier: PatternTier::B,
category: PatternCategory::Xss,
confidence: Confidence::Medium,
},
];