Unrestricted upload of dangerous file type
Insufficiently restricted file uploads can allow a file to be uploaded that runs malicious code. For example, a website that doesn't check the file extension of an image   can be exploited by uploading a script with an extension, such as `.php` or `.asp`,   that can be run on the server.
from flask import app


@app.route('/', methods=['GET', 'POST'])
def file_upload_non_compliant():
    import os
    from flask import request
    upload_file = request.files['file']
    # Noncompliant: the uploaded file can have any extension.
    upload_file.save(os.path.join('/path/to/the/uploads',
                                  upload_file.filename))
from flask import app


@app.route('/', methods=['GET', 'POST'])
def file_upload_compliant():
    import os
    from flask import request
    extensions = {'txt', 'pdf', 'png', 'jpg', 'jpeg', 'gif'}
    upload_file = request.files['file']
    # Compliant: the uploaded file must have one of the allowed extensions.
    if '.' in upload_file.filename and \
            upload_file.filename.split('.')[-1] in extensions:
        upload_file.save(os.path.join('/path/to/the/uploads',
                                      upload_file.filename))