测试版 Shoulder 目前处于测试阶段 — 结果有时可能不正确。您的反馈塑造我们接下来要修复的内容。 分享反馈
Shoulder.dev

开发者威胁情报
🐍

Python Security Rules

97 detection rules for Python across 65 vulnerability classes.

14 Critical
47 High
31 Medium
4 Low
Scan your Python code
npx @shoulderdev/cli trust --lang=python .

Frameworks

ariadne bottle django falcon fastapi flask graphene jinja2 motor pymongo pyramid python sanic strawberry tornado
CWE-200 Information Exposure 5 rules
Information Disclosure MEDIUM flask django
LLM Model Theft HIGH flask django fastapi
LLM Sensitive Information Disclosure HIGH flask django fastapi
Sensitive Field Exposure in API Response CRITICAL flask fastapi django pyramid bottle tornado
Server Information Disclosure LOW flask django fastapi
CWE-94 Code Injection 4 rules
Code Injection via eval/exec CRITICAL django flask fastapi
Dangerous Function Usage CRITICAL
LLM Insecure Output Handling HIGH flask django fastapi
Server-Side Template Injection (SSTI) CRITICAL flask django jinja2
CWE-942 CWE-942 4 rules
FastAPI CORS Misconfiguration MEDIUM fastapi
Flask CORS Misconfiguration MEDIUM flask
CORS Misconfiguration MEDIUM flask django fastapi
CORS Regex Bypass Vulnerability HIGH django flask fastapi
CWE-502 Deserialization of Untrusted Data 3 rules
LLM Training Data Poisoning HIGH flask django fastapi
Unsafe Deserialization CRITICAL django flask fastapi
Unsafe YAML Deserialization CRITICAL
CWE-798 Hardcoded Credentials 3 rules
Django Insecure SECRET_KEY CRITICAL django
Hardcoded Credentials HIGH django flask fastapi
Hardcoded Secrets / Credentials HIGH
CWE-915 Mass Assignment 3 rules
Django Mass Assignment Vulnerability HIGH django
Class/Attribute Pollution HIGH
Serializer/Form Exposes Privilege Fields HIGH django
CWE-20 Improper Input Validation 2 rules
FastAPI Missing Request Validation MEDIUM fastapi
Business Logic Input Validation MEDIUM flask fastapi django
CWE-22 Path Traversal 2 rules
Path Traversal / Directory Traversal HIGH django flask fastapi pyramid tornado bottle
Zip Slip / Archive Path Traversal HIGH
CWE-89 SQL Injection 2 rules
GraphQL Injection / Unsafe Query Construction HIGH graphene ariadne strawberry
SQL Injection via Database Queries CRITICAL django flask fastapi pyramid tornado bottle falcon sanic
CWE-209 Error Message Information Leak 2 rules
Error Message Information Disclosure MEDIUM django flask fastapi
Internal Path and IP Address Disclosure MEDIUM
CWE-269 CWE-269 2 rules
Default Privilege Assignment in User Creation HIGH django flask fastapi
Missing Role/Permission Checks HIGH django flask fastapi
CWE-295 Improper Certificate Validation 2 rules
SSL/TLS Certificate Validation Disabled HIGH
SSL/TLS Certificate Verification Disabled HIGH
CWE-306 CWE-306 2 rules
Django View Missing Authentication HIGH django
FastAPI Endpoint Missing Authentication HIGH fastapi
CWE-326 CWE-326 2 rules
JWT Signed with Weak Secret HIGH django flask fastapi
Weak Cryptographic Key Generation HIGH
CWE-338 Weak PRNG 2 rules
Insecure Random Number Generation MEDIUM
Cryptographically Weak Random Number Generation MEDIUM
CWE-347 Improper Signature Verification 2 rules
FastAPI JWT Security Issues HIGH fastapi
JWT Algorithm Confusion Attack CRITICAL django flask fastapi
CWE-400 Resource Exhaustion 2 rules
LLM Denial of Service MEDIUM flask django fastapi
Resource Exhaustion / Denial of Service MEDIUM
CWE-489 CWE-489 2 rules
Django Debug Mode in Production CRITICAL django
Flask Debug Mode in Production HIGH flask
CWE-614 Sensitive Cookie Without Secure Flag 2 rules
Flask Insecure Session Configuration MEDIUM flask
Insecure Cookie Configuration MEDIUM flask django fastapi
CWE-639 Authorization Bypass Through User-Controlled Key 2 rules
Insecure Direct Object Reference (IDOR) HIGH django flask fastapi
Potential IDOR - Generic Data Access MEDIUM django flask fastapi
CWE-755 CWE-755 2 rules
Security Check Failing Open HIGH django flask fastapi
Missing Exception Handling in Critical Operations MEDIUM
CWE-778 Insufficient Logging 2 rules
Avoid print() when logging module exists low flask django fastapi
Insufficient Security Event Logging MEDIUM flask django fastapi
CWE-16 CWE-16 1 rules
Missing Security Headers MEDIUM django flask fastapi
CWE-74 Injection 1 rules
AI Prompt Injection HIGH flask django fastapi
CWE-78 OS Command Injection 1 rules
OS Command Injection CRITICAL django flask fastapi pyramid tornado bottle
CWE-79 Cross-Site Scripting (XSS) 1 rules
Cross-Site Scripting (XSS) in Templates HIGH django flask fastapi
CWE-90 LDAP Injection 1 rules
LDAP Injection HIGH django flask fastapi pyramid tornado
CWE-93 CWE-93 1 rules
Email Header Injection HIGH
CWE-113 HTTP Response Splitting 1 rules
HTTP Header Injection HIGH flask django fastapi
CWE-117 Log Injection 1 rules
Log Injection / Log Forging MEDIUM flask django fastapi
CWE-176 CWE-176 1 rules
Unicode Normalization Issues MEDIUM
CWE-190 CWE-190 1 rules
Integer Overflow / Large Number Handling LOW
CWE-201 CWE-201 1 rules
Credential Exfiltration via User-Controlled Endpoint CRITICAL flask django fastapi
CWE-235 CWE-235 1 rules
HTTP Parameter Pollution MEDIUM flask django fastapi
CWE-284 Improper Access Control 1 rules
LLM Insecure Plugin Design HIGH flask django fastapi
CWE-287 Improper Authentication 1 rules
Authentication Bypass Vulnerability CRITICAL flask django fastapi
CWE-319 CWE-319 1 rules
HTTP Used Instead of HTTPS HIGH
CWE-327 Broken Cryptographic Algorithm 1 rules
Weak Cryptographic Algorithm MEDIUM django flask fastapi
CWE-352 Cross-Site Request Forgery 1 rules
Django Missing CSRF Protection HIGH
CWE-362 Race Condition 1 rules
Potential Race Condition MEDIUM
CWE-367 CWE-367 1 rules
Time-of-Check Time-of-Use (TOCTOU) Race Condition MEDIUM
CWE-377 CWE-377 1 rules
Insecure Temporary File Creation MEDIUM
CWE-384 Session Fixation 1 rules
Session Fixation Vulnerability HIGH flask django
CWE-391 CWE-391 1 rules
Empty Exception Handler MEDIUM django flask fastapi
CWE-396 CWE-396 1 rules
Overly Broad Exception Handler LOW django flask fastapi
CWE-425 CWE-425 1 rules
Exposed Administrative Endpoint HIGH flask django fastapi
CWE-434 Unrestricted File Upload 1 rules
Insecure File Upload HIGH django flask fastapi
CWE-444 CWE-444 1 rules
HTTP Cache Poisoning MEDIUM flask django fastapi
CWE-532 Information Exposure Through Logs 1 rules
Sensitive Data in Logging HIGH
CWE-547 CWE-547 1 rules
Hardcoded Development URLs LOW django flask fastapi
CWE-598 CWE-598 1 rules
Sensitive Tokens in URL Parameters HIGH django flask fastapi
CWE-601 Open Redirect 1 rules
Open Redirect MEDIUM flask django fastapi
CWE-611 XXE 1 rules
XML External Entity (XXE) Injection HIGH django flask fastapi
CWE-626 CWE-626 1 rules
Null Byte Injection HIGH
CWE-640 Weak Password Recovery 1 rules
Weak Password Reset Token HIGH django flask fastapi
CWE-770 Allocation Without Limits 1 rules
Missing API Rate Limiting MEDIUM flask django fastapi
CWE-807 CWE-807 1 rules
Client-Controlled Authorization Data CRITICAL django flask fastapi
CWE-829 Inclusion of Untrusted Functionality 1 rules
LLM Supply Chain Vulnerabilities HIGH django flask fastapi python
CWE-840 CWE-840 1 rules
Business Logic Bypass HIGH flask fastapi django
CWE-862 Missing Authorization 1 rules
LLM Excessive Agency HIGH flask django fastapi
CWE-916 CWE-916 1 rules
Weak Password Hashing Algorithm HIGH django flask fastapi
CWE-918 Server-Side Request Forgery 1 rules
Server-Side Request Forgery (SSRF) HIGH flask django fastapi
CWE-943 NoSQL Injection 1 rules
NoSQL Injection HIGH django flask fastapi pymongo motor
CWE-1333 ReDoS 1 rules
Regular Expression Denial of Service (ReDoS) MEDIUM
CWE-clickjacking CWE-clickjacking 1 rules
Missing Clickjacking Protection MEDIUM django flask fastapi
← All Rules