fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

Summary

fastapi-code-generator (koxudaxi) emits an operation's summary as the generated route handler's docstring, using a triple-quoted string without escaping """. A """ in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body -- which runs when the route handler is CALLED (the endpoint is hit). The summary is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 / FastAPI.

Details

def get_thing() -> None:
 (
 """
 x"""
 + (__import__("os").system('…') or "")
 + """y
 """
 )
 pass

The generator post-processes with black/isort, so a syntax-breaking payload aborts generation; a valid-Python breakout ("""+expr+""", kept valid with (… or "")) is written and executes at call time. info.description, tags, parameter defaults are escaped; operation description is not emitted into the function body; the summary in the handler docstring is the unescaped sink. Models come from datamodel-code-generator (repr-escaped, no RCE).

Not a duplicate: distinct product from OpenAPI Generator's python-fastapi; and distinct field/sink from the route path -> @app.get('…') decorator (import-time) in the same product -- this is the operation summary in the handler docstring (call-time).

PoC

reproduce.sh (+ make_spec.py) attached: generates the app and calls the route handler; the injected expression runs and writes a marker. Verified on 0.8.0.

Impact

Code execution on the server when the affected endpoint is invoked, in any app generated with fastapi-code-generator from an attacker-controlled or attacker-influenced spec.

Suggested fix

Escape the summary for the docstring context (escape """/backslashes via repr, or strip triple-quotes) before emitting it as the handler docstring; apply the same to any free-text field rendered into a docstring. maintainer-report.txt make_spec.py reproduce.sh