flask-cors configures CORS headers on Flask apps. CORS(app, origins='*') with supports_credentials=True is a major finding (wildcard origin with credentials is explicitly forbidden by browsers but some configurations still emit it).
.CORS().cross_origin().CORS()SinkCORS(app=None, *, resources=..., origins=None, supports_credentials=False, ...) -> CORS
Installs CORS headers. Finding when origins='*' and supports_credentials=True.
.cross_origin()Sinkcross_origin(origins=None, methods=None, supports_credentials=False, ...) -> Callable
Per-view CORS decorator. Same credential wildcard finding applies.
| FQN | Field | |
|---|---|---|
| flask_cors | fqns[0] | |
| flask_cors.CORS | fqns[1] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyFlaskCors