Rule for wildcard CORS in FastAPI

[theinfosecguy]

FastAPI supports adding middleware using app.add_middleware(). Developers usually add a wildcard origin policy, that can lead to security risks.

[inkz]

@theinfosecguy

• Please add

subcategory:
- vuln

like in https://github.com/returntocorp/semgrep-rules/blob/develop/python/flask/security/injection/nan-injection.yaml#L38

• and make sure that all ruleids are in the right place
• also please add an ok test case with a non-vulnerable example

[theinfosecguy]

Thanks for the feedback, @inkz. I've updated the rule.

[inkz]

Change code of the test to the following (I cant edit your branch):

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

origins = ["*"]


app.add_middleware(
    CORSMiddleware,
    # rule-id: wildcard-cors
    allow_origins=origins,
    allow_credentials=True,
    allow=["*"]
)


app.add_middleware(
    CORSMiddleware,
    # rule-id: wildcard-cors
    allow_origins=["*"],
    allow_credentials=True,
    allow=["*"]
)


app.add_middleware(
    CORSMiddleware,
    # ok-id: wildcard-cors
    allow_origins=["https://github.com"],
    allow_credentials=True,
    allow=["*"]
)

app.add_middleware(
    CORSMiddleware,
    # ok: wildcard-cors
    allow_origins=["https://github.com"],
    allow_credentials=True,
    allow=["www.semgrep.dev"]
)


@app.get("/")
async def main():
    return {"message": "Hello Semgrep"}

[theinfosecguy]

@inkz It's done.

[inkz]

@inkz It's done.

@theinfosecguy
Ok my bad, was too quick to copy paste 😆
can you update it to:

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

origins = ["*"]


app.add_middleware(
    CORSMiddleware,
    # ruleid: wildcard-cors
    allow_origins=origins,
    allow_credentials=True,
    allow=["*"]
)


app.add_middleware(
    CORSMiddleware,
    # ruleid: wildcard-cors
    allow_origins=["*"],
    allow_credentials=True,
    allow=["*"]
)


app.add_middleware(
    CORSMiddleware,
    # ok: wildcard-cors
    allow_origins=["https://github.com"],
    allow_credentials=True,
    allow=["*"]
)

app.add_middleware(
    CORSMiddleware,
    # ok: wildcard-cors
    allow_origins=["https://github.com"],
    allow_credentials=True,
    allow=["www.semgrep.dev"]
)


@app.get("/")
async def main():
    return {"message": "Hello Semgrep"}

should work this time 😄

there must be ruleid comments, not rule-ids

[theinfosecguy]

hahah, my bad. 😆

Should work now.

[inkz]

ok now lgtm! thank you!