Type Confusion in Flask

Manual Detection:

• Search codebase for request.args.get(), request.form.get(), and request.json accesses without explicit type conversion.
• Identify comparisons between request-derived values and typed variables (e.g., if user_id == some_int).
• Check raw SQL/ORM queries that interpolate request parameters without casting (e.g., f"... WHERE id = {value}").
• Review pagination/filtering endpoints for missing type=int in get() calls.

Dynamic Scanning with middleBrick:

middleBrick's black-box scanner probes for type confusion through its Input Validation and Property Authorization checks, which are part of its 12 parallel security tests. The scanner:

1. Sends Mismatched Types: For parameters defined as integer in the OpenAPI spec, middleBrick submits string values (e.g., "page": "abc"), non-numeric strings, and floating-point numbers.
2. Observes Behavioral Changes: It analyzes responses for:
• HTTP 200 with data that should be restricted (indicating authorization bypass).
• HTTP 500 errors from unhandled type errors (information leakage).
• Differential responses between typed and mistyped probes (e.g., different record counts).
3. Cross-References OpenAPI Specs: middleBrick resolves $ref in Swagger/OpenAPI definitions to identify expected types, then tests runtime tolerance for type violations.

Example scan using middleBrick's CLI:

# Scan a Flask API endpoint
middlebrick scan https://api.example.com/v1/users

The report maps findings to OWASP API Top 10 categories (e.g., Broken Object Property Level Authorization for bypasses, Security Misconfiguration for missing validation). Each finding includes the parameter name, sent payload, observed response, and severity.

1. Enforce Types for Query/Form Parameters

Use the type argument in request.args.get() and request.form.get():

@app.route('/api/orders')
def list_orders():
    # Safe: converts to integer or returns None
    page = request.args.get('page', type=int, default=1)
    limit = request.args.get('limit', type=int, default=50)
    if page < 1 or limit < 1:
        abort(400, "Invalid pagination")
    # Now page and limit are integers
    return get_orders(page, limit)

type=int rejects non-integer strings (e.g., "abc") and returns None, allowing explicit validation.

2. Validate JSON Payloads with Explicit Casting

Flask does not auto-convert JSON values. Validate manually or with a schema library. Native approach:

@app.route('/api/user', methods=['POST'])
def update_user():
    data = request.get_json(silent=True) or {}
    # Explicit type checks
    if 'age' in data and not isinstance(data['age'], int):
        abort(400, "'age' must be integer")
    if 'active' in data and not isinstance(data['active'], bool):
        abort(400, "'active' must be boolean")
    # Safe to use typed values
    user = User.query.get(current_user.id)
    user.age = data.get('age', user.age)
    user.active = data.get('active', user.active)
    db.session.commit()
    return jsonify(user.to_dict())

For complex APIs, integrate marshmallow or pydantic:

from marshmallow import Schema, fields

class UserSchema(Schema):
    age = fields.Int(required=True)
    active = fields.Bool(required=True)

schema = UserSchema()

@app.route('/api/user', methods=['POST'])
def update_user():
    errors = schema.validate(request.get_json())
    if errors:
        return jsonify(errors), 400
    # validated_data has correct types
    data = schema.load(request.get_json())
    ...

3. Use Route Converters for Path Parameters

Flask's built-in converters (<int:id>, <float:price>) ensure path parameters are typed before view execution:

@app.route('/api/product/<int:product_id>')
def get_product(product_id):  # product_id is integer
    product = Product.query.get_or_404(product_id)
    return jsonify(product.to_dict())

4. Avoid String Interpolation in Queries

Never concatenate request values into SQL/ORM queries. Use parameterized statements:

# UNSAFE:
query = f"SELECT * FROM users WHERE id = {user_id}"

# SAFE (SQLAlchemy):
user = User.query.filter_by(id=user_id).first()

# SAFE (raw SQL with params):
result = db.session.execute(text("SELECT * FROM users WHERE id = :id"), {'id': user_id})

5. Normalize Boolean Parameters

For query flags like ?active=true, normalize to boolean:

def str_to_bool(value):
    if isinstance(value, bool):
        return value
    if isinstance(value, str):
        return value.lower() in ('true', '1', 'yes')
    return bool(value)

active = str_to_bool(request.args.get('active', False))

These practices ensure Flask handles types consistently, eliminating confusion that leads to authorization bypasses or injection.