python-s8389-fastapi-file-upload-form-mining

Read-only mining codemod for python:S8389: FastAPI file upload endpoints should use Form() with Pydantic validators instead of Body() or Depends().

Emits python_security_finding metric rows with blocking severity. Source files are never modified.

Rule

• ID: python:S8389
• Severity: blocking
• Remediation: Use Form() with Pydantic validators for file upload endpoints

Usage

bash
Copy
pnpm dlx codemod@latest workflow run -w codemods/python-security-mining/python-s8389-fastapi-file-upload-form-mining/workflow.yaml --target /path/to/python/project

Development

bash
Copy
pnpm --filter ./codemods/python-security-mining/python-s8389-fastapi-file-upload-form-mining test