File inclusion injection (ARCH2139)

Key python.security.file-inclusion-injection · Severity critical · Category security · CWE CWE-98

Resolving the module or template path to include from user input lets an attacker load arbitrary local files and execute malicious code (LFI/RFI).

Incorrect

import importlib

def load(request):
    name = request.GET["module"]
    return importlib.import_module(name)

Correct

import importlib

ALLOWED = {"reports", "exports"}

def load(request):
    name = request.GET["module"]
    if name not in ALLOWED:
        raise Http404
    return importlib.import_module(f"plugins.{name}")

Fix

Restrict includable module/file names to a fixed allowlist; never use raw path input.