Home / Companies / Semgrep / Blog / Post Details
Content Deep Dive

Flask check: send_file() with a file handle

Blog post from Semgrep

Post Details
Company
Date Published
Author
Grayson Hardaway
Word Count
698
Language
English
Hacker News Points
-
Summary

R2c's new developer tool, Bento, aims to improve software security and reliability by offering custom program analysis checks alongside existing tools like Flake8, Bandit, and ESLint. One such check focuses on detecting potential issues in Flask applications, such as ensuring the correct usage of the `send_file` function to prevent a ValueError due to missing filename or mimetype parameters. This issue arises because Flask no longer infers the mimetype of file-like objects as of version 0.12. The check was tested on 1,200 GitHub repositories using Flask and found 109 instances of the issue across 15 repositories. The results highlight the check's utility in catching mistakes early in development, thus reducing the need for dynamic testing later. Bento, as of version 0.6, includes this check by default, assisting developers in identifying and resolving critical bugs efficiently.