Skip to content

Conversation

@dilanbhalla
Copy link
Contributor

Query to detect use of the http.server module, which has been given a security warning for production use within the Python 3 official documentation, as it only implements basic security checks.

@dilanbhalla dilanbhalla requested review from a team and felicitymay as code owners June 30, 2020 20:35
@intrigus-lgtm
Copy link
Contributor

I think you should move your query to the experimental folder as stated here

Also see this existing comment:
#3396 (review)

@felicitymay felicitymay removed their request for review July 9, 2020 07:46
@adityasharad adityasharad changed the base branch from master to main August 14, 2020 18:34
@RasmusWL
Copy link
Member

I looked into this PR now. It's true that using python -m http.server or using unmodified http.server.SimpleHTTPRequestHandler as a handler pose some security problems, and should not be used in production.

However, it does seem a bit too broad to alert on any use of the http.server module. My understanding is that using your own BaseHTTPRequestHandler subclass to handle requests does not have the same security problems.

So I'm going to close this PR, since it's simply too broad. Sorry for the long delay in responding.

@RasmusWL RasmusWL closed this Jun 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants