Django REST Framework (DRF). request.data is the primary source for JSON / form payloads; serializers validate input (sanitizer when is_valid is called with raise_exception=True). Response() with tainted data is generally safe due to DRF's renderers but render_template is still worth watching.
.Request.data().Request.query_params().Serializer.is_valid().Serializer.is_valid()SanitizerSerializer.is_valid(raise_exception=False) -> bool
Validates input. Sanitizer when raise_exception=True.
return.Response()NeutralResponse(data=None, status=None, template_name=None, headers=None, ...) -> Response
DRF response. Data is rendered safely; template_name can be an SSTI sink.
| FQN | Field | |
|---|---|---|
| rest_framework | fqns[0] | |
| rest_framework.request | fqns[1] | |
| rest_framework.response | fqns[2] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyRestFramework