aiohttp provides async HTTP client and server. ClientSession.get / post and the top-level request() are SSRF sinks on user-controlled URLs. aiohttp.web request handlers expose sources via request.query, request.post, request.json.
.Request.query().Request.post().Request.json().ClientSession.get().ClientSession.post().request().Request.query()Sourcerequest.query: MultiDict[str, str]
URL query parameters on aiohttp.web handlers. User-controlled.
return.Request.post()Sourceasync request.post() -> MultiDict[str, str]
Form body. User-controlled.
return.Request.json()Sourceasync request.json(*, loads=json.loads) -> Any
Parsed JSON body. User-controlled.
return.ClientSession.get()Sinkasync ClientSession.get(url, *, allow_redirects=True, ...) -> ClientResponse
Async GET. SSRF sink on url.
0.ClientSession.post()Sinkasync ClientSession.post(url, *, data=None, json=None, ...) -> ClientResponse
Async POST. SSRF sink.
0.request()Sinkasync aiohttp.request(method, url, **kwargs) -> ClientResponse
Top-level async request helper. SSRF sink on url.
1| FQN | Field | |
|---|---|---|
| aiohttp | fqns[0] | |
| aiohttp.ClientSession | fqns[1] | |
| aiohttp.web | fqns[2] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyAiohttp