|
| 1 | +""" |
| 2 | +Static analysis test: verify @login_optionally_required is always applied |
| 3 | +AFTER (inner to) @blueprint.route(), not before it. |
| 4 | +
|
| 5 | +In Flask, @route() must be the outermost decorator because it registers |
| 6 | +whatever function it receives. If @login_optionally_required is placed |
| 7 | +above @route(), the raw unprotected function gets registered and auth is |
| 8 | +silently bypassed (GHSA-jmrh-xmgh-x9j4). |
| 9 | +
|
| 10 | +Correct order (route outermost, auth inner): |
| 11 | + @blueprint.route('/path') |
| 12 | + @login_optionally_required |
| 13 | + def view(): ... |
| 14 | +
|
| 15 | +Wrong order (auth never called): |
| 16 | + @login_optionally_required ← registered by route, then discarded |
| 17 | + @blueprint.route('/path') |
| 18 | + def view(): ... |
| 19 | +""" |
| 20 | + |
| 21 | +import ast |
| 22 | +import pathlib |
| 23 | +import pytest |
| 24 | + |
| 25 | +REPO_ROOT = pathlib.Path(__file__).parents[3] # …/changedetection.io/ |
| 26 | +SOURCE_ROOT = REPO_ROOT / "changedetectionio" |
| 27 | + |
| 28 | + |
| 29 | +def _is_route_decorator(node: ast.expr) -> bool: |
| 30 | + """Return True if the decorator looks like @something.route(...).""" |
| 31 | + return ( |
| 32 | + isinstance(node, ast.Call) |
| 33 | + and isinstance(node.func, ast.Attribute) |
| 34 | + and node.func.attr == "route" |
| 35 | + ) |
| 36 | + |
| 37 | + |
| 38 | +def _is_auth_decorator(node: ast.expr) -> bool: |
| 39 | + """Return True if the decorator is @login_optionally_required.""" |
| 40 | + return isinstance(node, ast.Name) and node.id == "login_optionally_required" |
| 41 | + |
| 42 | + |
| 43 | +def collect_violations() -> list[str]: |
| 44 | + violations = [] |
| 45 | + |
| 46 | + for path in SOURCE_ROOT.rglob("*.py"): |
| 47 | + try: |
| 48 | + tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path)) |
| 49 | + except SyntaxError: |
| 50 | + continue |
| 51 | + |
| 52 | + for node in ast.walk(tree): |
| 53 | + if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)): |
| 54 | + continue |
| 55 | + |
| 56 | + decorators = node.decorator_list |
| 57 | + auth_indices = [i for i, d in enumerate(decorators) if _is_auth_decorator(d)] |
| 58 | + route_indices = [i for i, d in enumerate(decorators) if _is_route_decorator(d)] |
| 59 | + |
| 60 | + # Bad order: auth decorator appears at a lower index (higher up) than a route decorator |
| 61 | + for auth_idx in auth_indices: |
| 62 | + for route_idx in route_indices: |
| 63 | + if auth_idx < route_idx: |
| 64 | + rel = path.relative_to(REPO_ROOT) |
| 65 | + violations.append( |
| 66 | + f"{rel}:{node.lineno} — `{node.name}`: " |
| 67 | + f"@login_optionally_required (line {decorators[auth_idx].lineno}) " |
| 68 | + f"is above @route (line {decorators[route_idx].lineno}); " |
| 69 | + f"auth wrapper will never be called" |
| 70 | + ) |
| 71 | + |
| 72 | + return violations |
| 73 | + |
| 74 | + |
| 75 | +def test_auth_decorator_order(): |
| 76 | + violations = collect_violations() |
| 77 | + if violations: |
| 78 | + msg = ( |
| 79 | + "\n\nFound routes where @login_optionally_required is placed ABOVE @blueprint.route().\n" |
| 80 | + "This silently disables authentication — @route() registers the raw function\n" |
| 81 | + "and the auth wrapper is never called.\n\n" |
| 82 | + "Fix: move @blueprint.route() to be the outermost (topmost) decorator.\n\n" |
| 83 | + + "\n".join(f" • {v}" for v in violations) |
| 84 | + ) |
| 85 | + pytest.fail(msg) |
0 commit comments