DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
Python

Python

Made by DeepSource
Use Analyzer

Audit required: External control of file name or path PTC-W6004

Security
Minor
 a01 a04 cwe-73 owasp top 10

Python's open() function can take in a relative or absolute path and read its file contents. If a user is provided direct access to the path that is opened, it can have serious security risks.

Bad practice

def read_file(path):
    with open(os.path.join('some/path', path)) as f:
        f.read()

# Someone can exploit `read_file` and see your secrets this way:
read_file('../../../secrets.txt')

Recommended

Either use a static path:

def read_file(path):
    with open('some/path/to/file.txt') as f:
        f.read()

Or, do some kind of validation to make sure you're not allowing arbitrary file access:

def read_file(filename):
    if filename not in ('x.txt', 'y.txt'):
        return 'Invalid filename'

    with open(os.path.join('some/path', path)) as f:
        f.read()

References