github / github/codeql

False negatives of `py/flask-debug`

Open
#21,616 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

`py/flask-debug` misses some common ways to enable debug mode in Flask.

For example:
```python
app = Flask(__name__)
app.config['DEBUG'] = True # Enables debug mode
app.run()

---
class Settings:
DEBUG = True

settings = Settings()
app.run(debug=settings.DEBUG)
```

Contributor guide

Open the contributing guide

Research direction

Start by locating the py/flask-debug query and reproducing the two examples in the issue. Compare the query's behavior with both configuration-based and argument-based debug activation; done means these common Flask patterns are detected without regressing existing cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
flask, python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.