New Published Rules - khanhldt.flask-route-decorator

khanhldt/flask-route-decorator.py

@@ -0,0 +1,46 @@
+from flask import Blueprint
+
+blueprint = Blueprint()
+
+
+# FP: Only 1 decorator
+@blueprint.route("HAI")
+def f():
+    pass
+
+# FP: Correct order
+@blueprint.route("HAI")
+@another.func("HAI")
+def f():
+    pass
+
+# FP: "func" not "route"
+@another.func("HAI")
+@blueprint.func("HAI")
+def f():
+    pass
+
+# FP: Correct order with app
+@app.route("HAI")
+@another.func("HAI")
+def f():
+    pass
+
+@blueprint.route("HAI")
+@app.route("HAI")
+def f():
+    pass
+
+@another.func("HAI")
+@app.route("HAI")
+@app.route("HAI")
+def f():
+    pass
+
+@app.route("ABC")
+@app.route("HAI")
+@another.func("HAI")
+@app.route("BCD")
+@app.route("HAI")
+def f():
+    pass

khanhldt/flask-route-decorator.yaml

@@ -0,0 +1,30 @@
+rules:
+- id: flask-route-decorator
+  patterns:
+  - pattern-either:
+    - pattern-inside: |
+        import flask
+        ...
+    - pattern-inside: |
+        import flask_protobuf
+        ...
+  - pattern-inside: |
+      @$TARGET_DECORATOR(...)
+      def $F(...):
+        ...
+  - metavariable-pattern:
+      metavariable: $TARGET_DECORATOR
+      patterns:
+      - pattern-regex: ^(.*\.)?route$
+  - pattern-regex: \@((?!route\().)*\n@(.*\.)?route\(
+  message: In Flask, the route() decorator has to be the outermost. Everything outside
+    of route() will take no effect.
+  languages:
+  - python
+  severity: ERROR
+  metadata:
+    category: correctness
+    technology:
+    - flask
+    references:
+    - https://flask.palletsprojects.com/en/2.3.x/patterns/viewdecorators/#login-required-decorator