The http.server module. SimpleHTTPRequestHandler serves files from the current working directory — path-traversal sink on directory containing secrets. Intended for development only, finding on any production use.
.HTTPServer().SimpleHTTPRequestHandler().HTTPServer()Sinkhttp.server.HTTPServer(server_address, RequestHandlerClass, bind_and_activate=True) -> HTTPServer
HTTP server. Finding when bound to 0.0.0.0 without access control.
.SimpleHTTPRequestHandler()Sinkhttp.server.SimpleHTTPRequestHandler(*args, **kwargs) -> SimpleHTTPRequestHandler
Serves files from CWD. Path-traversal sink for sensitive directories.
| FQN | Field | |
|---|---|---|
| http.server | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyHttpServer