Cekin da aka rasa wanda zai iya kashe maka kuɗi: Requests.get da Flask Request Form
Ka yi tunanin wannan: wani ƙaramin mai haɓaka software yana aiki ƙarƙashin matsin lamba don aika wani fasali. Suna buɗe manhajar Flask, ƙara sabuwar hanya, kama sigar tambaya, sannan su ci gaba.
# Demonstrative example only — NOT executable, not exploitable
from flask import Flask, request
@app.route("/items")
def get_items():
# Type casting avoids unsafe string injection
item_id = request.args.get("id", type=int)
# Safe usage: forces integer input, prevents injection
Da farko kallo, wannan amfani da buƙatar Flask yayi kyau. Amma a cire nau'i = int kuma ka buɗe ƙofar zuwa hare-haren allura. Waɗannan su ne irin haɗarin da ke ɓacewa bayan sake duba lambar saboda "kawai yana kawo ƙima."
Inda Hadarin Ya Boye FBuƙatar Last da kuma FFom ɗin Buƙatar Last
Dukansu buƙatar kwalba da kuma fom ɗin buƙata wuraren shiga ne da ba a amince da su ba. Kowace ƙima da suka dawo ta fito ne kai tsaye daga abokin ciniki kuma ya kamata a ɗauke ta a matsayin mai yuwuwar zama mai adawa.
Rashin tabbatarwa ko tsaftace wannan bayanan na iya haifar da matsalolin tsaro masu mahimmanci, gami da:
- SQL allurar
- Rubutun giciye (XSS)
- Samfurin allura
- Allurar umarnin Shell
Waɗannan haɗarin ba wai kawai sun shafi rumbun adana bayanai ko kuma na'urar nuna bayanai ta gaba ba ne; masu kai hari kuma suna iya amfani da bayanan da aka yi amfani da su a cikin samfura ko kuma waɗanda aka tura zuwa ƙananan hanyoyin aiki.
Tsarin lambar karya mai aminci:
python
# ⚠️ Educational example only — not functional
env_target = input("Enter deployment environment: ")
simulate_deploy(env_target) # Simulated for demonstration
M CI/CD tilastawa:
# 1. Query parameter — Safe with casting
user_id = request.args.get("id", type=int) # Enforces integer type
# 2. Form parameter — Safe with casting
username = request.form.get("username", type=str) # Enforces string type
# 3. Template rendering safeguard
template_data = {"name": request.args.get("name", type=str)} # Avoids untrusted HTML injection
# 4. Shell command safe handling
filename = request.args.get("file", type=str)
# Validate filename against known safe values before use in subprocess (not shown)
Ko da tsarin yana kama da lafiya, amfani da ƙimomin da ba a tantance su ba ko waɗanda ba a tantance su ba a cikin samfura ko umarnin tsarin na iya zama babban hanyar allura.
Guduwar Allura Mai Aiki (Kayan Kwaikwayo Mai Inganci)
Ga yadda matsalar allura ke bayyana, ta amfani da wani labari mai ban mamaki da aminci:
- Mai amfani yana aika sigar tambaya da aka ƙera zuwa aikace-aikacen.
- Manhajar tana karanta ƙimar ta amfani da buƙata.args.get() ba tare da tabbatarwa ba.
- Wannan ƙimar an haɗa ta kai tsaye cikin tambayar SQL, tsarin samfuri, ko umarnin harsashi.
- Tsarin yana aiwatar da wannan dabarar, ba tare da sanin abin da aka yi allurar ba.
Lambar karya (mara tsaro, misali kawai):
# Insecure example — do not run in production
user_id = request.args.get("id") # Missing type casting, no validation
query = f"SELECT * FROM users WHERE id = {user_id}" # Risk of injection
Alamar tarihin almara:
[INFO] Incoming request: /user?id=unexpected_input
[DEBUG] Parsed user_id: unexpected_input
[DEBUG] Constructed SQL: SELECT * FROM users WHERE id = unexpected_input
Ko da yake wannan misali yana amfani da masu riƙe wurare, yana nuna yadda ƙananan kurakurai a cikin sarrafa shigarwar na iya haifar da mummunan rauni.
Gwaje-gwajen atomatik na iya rasa wannan saboda yawanci suna gwada nau'ikan shigarwa masu inganci, ba na rashin kyau ko na mugunta ba.
Haɗarin da ke Ɓoye a Amfani da Abubuwan da Aka Dogara da Su Buƙatar Fakiti da kuma Fom ɗin Buƙatar Fakitin
Lambarka na iya zama mai tsabta, amma fakitin wasu na iya karya maka.
Wasu plugins na Flask ko ɗakunan karatu suna kiran buƙatar flask ko fom ɗin buƙatar flask a cikin gida ba tare da tabbatarwa ba.
Misali tare da fakitin almara:
python
# Insecure example — do not run in production
return AutoFormHandler.process() # May use request.form.get() without validation
python
# Insecure example — do not run in production
query = build_query(request.args) # May use request.args.get() without casting
In CI/CD, sabuntawar dogaro ta atomatik na iya gabatar da buƙatun da ba su da haɗari a hankali. sami kira ko tsarin sarrafa shigarwar da ba ta da haɗari.
Yaya Ba Shi Da Lafiya Buƙatar Fakiti Sharhin Lambobin da suka gabata na Amfani
A cikin yanayi mai sauri, ƙananan kurakurai masu haɗari galibi ba sa lura, musamman lokacin da canjin ya zama kamar ba shi da lahani.
Example pull request bambanci:
# Insecure example — do not run in production
- user_id = request.args.get("id")
+ user_id = request.args.get("id") # Still missing type casting
Sharhin mai bita:
"Yana da kyau, kawai dai yana samun siga ne."
Wannan nau'in rashin kulawa yana da yawa saboda:
- Son zuciya a fahimta: masu bita na iya ɗauka cewa request.args.get() yana da aminci ta hanyar tsoho.
- Matsin lokaci: binciken tsaro zai ɗauki matsayi a baya idan wa'adin ƙarshe ya yi.
- Sabani daban-daban: canjin ya yi kama da ƙarami, don haka ba a yi nazari sosai ba.
Ba tare da ƙa'idodi bayyanannu ko aiwatar da su ta atomatik ba, waɗannan ƙananan haɗarin suna shiga cikin samarwa ba tare da an sani ba.
Rigakafin da ke Aiki
Don rage haɗarin allura, haɗa tabbatar da shigarwar bayanai, duba ta atomatik, da kuma ɗaukar hoto na gwaji.
Tabbatar da shigarwa tare da jefawa da kuma yin rajistar farin kaya:
user_id = request.args.get("id", type=int)
if user_id not in [1, 2, 3]:
abort(400, "Invalid ID")
Jefawa yana tilasta ƙimar zuwa wani nau'in aminci, yayin da yin rajistar farin kaya yana tabbatar da cewa ƙimar da aka sani kawai ta ci gaba.
Gwajin Tsaron Aikace-aikace Mai Tsayi (SAST) a cikin CI/CD:
name: Run SAST scan
run: sast-tool --scan src/ --fail-on "request.args.get without type"
Wannan matakin yana taimakawa wajen gano waɗanda ba a tabbatar da su ba buƙata.args.get() or buƙata.form.samun() kira kafin su isa ga samarwa.
Gwaje-gwajen na'ura don tilasta tsaftace jiki:
def test_invalid_type(client):
response = client.get("/items?id=abc")
assert response.status_code == 400
These tests ensure the app rejects malformed or malicious input consistently.
Integrating Into DevSecOps Pipelines
Middleware enforcement:
@app.before_request
Waɗannan gwaje-gwajen suna tabbatar da cewa manhajar tana ƙin shigar da bayanai marasa kyau ko na mugunta akai-akai.
Haɗawa cikin DevSecOps Pipelines
Aiwatar da Middleware:
@app.kafin_buƙata
def sanitize_input():
if "id" in request.args and not request.args.get("id", type=int):
abort(400, "Invalid ID")
Pre-commit hook:
bash
if grep -R "request.args.get(" . | grep -v "type="; then
echo "Unsafe request.args.get detected — please add type casting."
exit 1
fi
Ana bincika lambar ku da kuma abubuwan da suka dogara da wasu yana taimakawa wajen kama buƙatun da ba su da aminci. samu, buƙatar kwalba, da kuma amfani da fom ɗin buƙatar kwalba kafin ya kai ga samarwa.
Wannan Matsalar Ta Wuce Flask
Gudanar da shigarwa mara aminci ba wai kawai ga Flask ba ne, yana wanzuwa a cikin tsarin yanar gizo. Abin farin ciki, mafita tana da daidaito: tabbatar da shigarwar da wuri kuma a hankali.
Django (lambar sirri mai aminci):
# Enforces integer type and applies whitelist
user_id = int(request.GET.get("id", "0"))
if user_id not in [1, 2, 3]:
return HttpResponseBadRequest()
FastAPI (amintacce ta hanyar ƙira ta amfani da alamun nau'i):
from fastapi import Query
@app.get("/items")
def read_items(id: int = Query(..., ge=1, le=3)):
return {"id": id}
Dukansu misalai suna tilasta nau'in shigarwa da kewayon, suna tabbatar da cewa an amince da bayanan da ke shigowa kafin su kai ga ma'ana mai mahimmanci.
Ko Flask ne, Django, ko FastAPI, kowane sigar buƙata tana iya zama wurin allura idan ba a tabbatar da ita yadda ya kamata ba.
Amfani da Xygeni don Ganowa a cikin DevSecOps
A cikin yanayin DevSecOps, sake dubawa da hannu bai isa ba. Xygeni yana gano buƙatar kwalba mara aminci ta atomatik, fom ɗin buƙatar kwalba, da buƙatun.samun amfani.
Aikace-aikacen DevSecOps masu amfani:
- Sikanin da ba a canzawa ba: Yi alama ga kowane buƙata.args.get() ba tare da irin=, da kuma buƙatar fom ɗin da ba a tabbatar da ingancinsa ba.
- Binciken dogaro: Yana sa ido kan ɗakunan karatu don ganin alamu marasa aminci waɗanda za su iya bayyana ta hanyar kira kai tsaye.
- Toshe haɗin gwiwa marasa aminci: CI/CD ya gaza idan sabuwar lambar ta gabatar da buƙatun haɗari.sami ko samun damar fom ɗin da ba a tabbatar ba.
- Aiwatar da tushe: Yana bin diddigin canje-canje don kiyaye kira mai aminci daga komawa baya zuwa na marasa aminci.
Yin amfani da waɗannan duba ta atomatik yana rage haɗarin kuskuren ɗan adam da kuma yana ci gaba da kiyaye tsaro ba tare da rage jinkirin isar da kaya ba.
Don haka, Tabbatarwa, Tsaftace, Tsaftace atomatik
Ga dai abin da ke ƙasa: requests.get, flask request, da flask request duk suna nan. ba a amince da shi ta hanyar tsoho baZa su isar da bayanai marasa amfani cikin farin ciki sai dai idan ka ɗauki mataki.
Dokokinka guda uku:
- inganta shigarwa ta amfani da simintin da kuma jerin sunayen masu amfani.
- Sanitize kafin bayanai su taɓa ayyuka masu mahimmanci.
- Koma aiki cak a cikin asusunka pipeline don dakatar da lambar da ba ta da aminci kafin a fara aiki.
Mai kula da buƙatar kwalba ɗaya mara aminci, filin fom ɗin buƙatar kwalbar da ba a duba ba, ko kuma buƙatar samun kira mara tsaro na iya yin illa ga aikace-aikacenku. Ku ɗauki kowane sigogi a matsayin mai yuwuwar ƙiyayya, kuma ku bar DevSecOps ɗinku ya yi aiki. pipeline aiwatar da dokoki a kowane lokaci.
