github / github/codeql

Flask ImmutableMultiDict type cannot be accurately determined when calling to_dict

Open
#19,902 1 comment 0 reactions 0 assignees View on GitHub
question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

In Flask, the ImmutableMultiDict type cannot be accurately determined when calling to_dict()

```
from flask import Flask, render_template, request, redirect, url_for

def post(self):
f = request.form
param = f.to_dict()
vv = param["vv"]
pp = "/test/%s" % (vv)
os.system(pp)
```

![Image](https://github.com/user-attachments/assets/2fb58e31-495b-4512-a9f8-9df2e600d595)

Contributor guide

Open the contributing guide

Research direction

Start with the Flask example using request.form and to_dict(), then inspect the CodeQL modeling for Flask's ImmutableMultiDict and its to_dict() return type. Confirm the reported type-resolution behavior and identify the relevant CodeQL tests; done means the type is accurately determined for this case.

Written by the indexing model from the issue text.

Assessment

Tech stack
flask, python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.