Skip to content

Create test.py #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RZB1088 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Create test.py #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# sql_injection.py
import sqlite3
from flask import Flask, request
from articles.config import Config


app = Flask(__name__)
DB = "test.db"

if __name__ == '__main__':
app.run(host='0.0.0.0', debug=Config.DEBUG, port=Config.FLASK_PORT, use_reloader=Config.USE_RELOADER)

@arnica-github-connector arnica-github-connector Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Static Code Analysis Risk: Broken Access Control - Avoid app run with bad host

The Flask application is configured to run with host="0.0.0.0", which binds the development server to all network interfaces. This makes the server accessible from any machine on the network, not just localhost. An attacker on the same network, or on the internet if no firewall is in place, can reach the application directly. The Flask development server is not designed for production use and lacks security hardening, so exposing it publicly significantly increases the attack surface, potentially allowing unauthorized access, denial of service, or exploitation of debug features if debug mode is also enabled.

Recommendation: Bind the Flask development server to 127.0.0.1 (the default) by removing the host parameter or explicitly setting host="127.0.0.1" in app.run(). If the application needs to be accessible externally, deploy it behind a production-grade WSGI server such as Gunicorn or uWSGI, fronted by a reverse proxy like Nginx, rather than using the built-in Flask development server.

Severity: High 🚨
Status: Open 🔴

References:

  1. https://owasp.org/Top10/A01_2021-Broken_Access_Control

More details:

🌻 View in Arnica

Take action by replying with an [arnica] command 💬

Actions

Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.

To acknowledge the finding as a valid code risk: [arnica] ack <acknowledge additional details>

To dismiss the risk with a reason: [arnica] dismiss <fp|accept|capacity> <dismissal reason>

Examples

  • [arnica] ack This is a valid risk and I'm looking into it

  • [arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive)

  • [arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system

  • [arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint