Advisories for Pypi/Fastapi-Code-Generator package

fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (@app.get('/u/<path>/x')) without escaping the '. A ' in the path closes the decorator string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) – code execution, no request needed. The path is a pure data field. Verified on fastapi-code-generator …

fastapi-code-generator (koxudaxi) emits an operation's extra responses into the route decorator's responses={…} dict, using each response's status-code key as a single-quoted string literal without escaping the '. A ' in a status-code key closes the dict-key string and, via concatenation, injects a live expression that the decorator argument evaluates when main.py is imported (the ASGI server imports it at startup) – code execution, no request. The status-code key is a …

fastapi-code-generator (koxudaxi) emits an operation's summary as the generated route handler's docstring, using a triple-quoted string without escaping """. A """ in the summary closes the docstring and, via concatenation, injects a live expression that becomes an expression statement in the handler body – which runs when the route handler is CALLED (the endpoint is hit). The summary is a pure data field. Verified on fastapi-code-generator 0.8.0 / Python 3 …