python-security/pyt

{
    "sources": [
        "request.args.get(",
        "request.get_json(",
        ".data",
        "form[",
        "form(",
        "Markup(",
        "cookies[",
        "files[",
        "SQLAlchemy"
    ],
    "sinks": {
        "replace(": {
            "sanitisers": [
                "escape"
            ]
        },
        "send_file(": {
            "sanitisers": [
                "'..'",
                "'..' in"
            ]
        },
        "execute(": {},
        "system(": {},
        "filter(": {},
        "subprocess.call(": {},
        "render_template(": {},
        "set_cookie(": {},
        "redirect(": {},
        "url_for(": {},
        "flash(": {},
        "jsonify(": {}
    }
}