Possible high severity issue which exposes the Werkzeug debugger and allows the execution of arbitrary code

[usmanovbf]

➜  vakt git:(master) bandit -r ./ -lll
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.10.8
Working... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
Run started:2022-12-25 20:21:25.524801

Test results:
>> Issue: [B201:flask_debug_true] A Flask app appears to be run with debug=True, which exposes the Werkzeug debugger and allows the execution of arbitrary code.
   Severity: High   Confidence: Medium
   CWE: CWE-94 (https://cwe.mitre.org/data/definitions/94.html)
   More Info: https://bandit.readthedocs.io/en/1.7.5/plugins/b201_flask_debug_true.html
   Location: ./examples/regex-policies/server.py:158:4
157	    init()
158	    app.run(debug=True)

--------------------------------------------------

Code scanned:
	Total lines of code: 8214
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 773
		Medium: 20
		High: 1
	Total issues (by confidence):
		Undefined: 0
		Low: 13
		Medium: 5
		High: 776
Files skipped (0):

The output above is the result of the execution https://github.com/PyCQA/bandit

[kolotaev]

Hello! Thank you for the issue! This vulnerability is only within the example directory, which is basically an extremely simple non-production example, so I think there's nothing to be worried about :)

OTOH, I think I need to delete debug=True from the example, because it doesn't bring much value to the table, but on the contrary shows a potentially insecure practice.