Create test.py

[RZB1088]

No description provided.

[arnica-github-connector]

Static Code Analysis Risk: Broken Access Control - Avoid app run with bad host

The Flask application is configured to run with host="0.0.0.0", which binds the development server to all network interfaces. This makes the server accessible from any machine on the network, not just localhost. An attacker on the same network, or on the internet if no firewall is in place, can reach the application directly. The Flask development server is not designed for production use and lacks security hardening, so exposing it publicly significantly increases the attack surface, potentially allowing unauthorized access, denial of service, or exploitation of debug features if debug mode is also enabled.

Recommendation: Bind the Flask development server to 127.0.0.1 (the default) by removing the host parameter or explicitly setting host="127.0.0.1" in app.run(). If the application needs to be accessible externally, deploy it behind a production-grade WSGI server such as Gunicorn or uWSGI, fronted by a reverse proxy like Nginx, rather than using the built-in Flask development server.

Severity: High 🚨
Status: Open 🔴

References:

1. https://owasp.org/Top10/A01_2021-Broken_Access_Control

More details:

🌻 View in Arnica

---

Take action by replying with an [arnica] command 💬

Actions

Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.

To acknowledge the finding as a valid code risk: [arnica] ack <acknowledge additional details>

To dismiss the risk with a reason: [arnica] dismiss <fp|accept|capacity> <dismissal reason>

Examples

• [arnica] ack This is a valid risk and I'm looking into it

• [arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive)

• [arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system

• [arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint