Skip to content

Create new_pr_comments.py #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vivekkhimani wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Create new_pr_comments.py #43

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions new_pr_comments.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
import flask

app = flask.Flask(__name__)

# ruleid: active-debug-code-flask
app.run(debug=True, use_debugger=False, use_reloader=False)

@semgrep-app semgrep-app Bot May 9, 2024

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.

Ignore this finding from active-debug-code-flask.

@semgrep-app semgrep-app Bot May 9, 2024

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.

Ignore this finding from debug-enabled.

@semgrep-app semgrep-app Bot May 9, 2024

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function

Ignore this finding from avoid_using_app_run_directly.


app.run(passthrough_errors=True)

@semgrep-app semgrep-app Bot May 9, 2024

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function

Ignore this finding from avoid_using_app_run_directly.


# ok: active-debug-code-flask
app.run()

@semgrep-app semgrep-app Bot May 9, 2024

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function

Ignore this finding from avoid_using_app_run_directly.


app = flask.Flask(__name__)

# ruleid: active-debug-code-flask
app.debug = True

@semgrep-app semgrep-app Bot May 9, 2024

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.

Ignore this finding from active-debug-code-flask.