Skip to content

Python: FP in py/reflective-xss when using flask's make_response #1572

@s0

Description

@s0

As reported here: https://discuss.lgtm.com/t/possibly-incorrect-ql-python-cwe79/2186

It seems that we are not correctly identifying calls to make_response() as sinks for the xss query, even though it's used as an example in the query help.

Namely, lines 20 and 25 should be flagged but are not here: https://lgtm.com/projects/g/xia0AL/seven_flask/latest/files/hello.py?sort=name&dir=ASC&mode=heatmap#L20

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions