GHSA-jg6c-wvfg-fx69: 
Python Análise e mitigação de vulnerabilidades

Summary

Starting in version 0.29.0, the multipart form boundary in generated clients was a fixed, predictable value. If the generated client accepted untrusted input into a multipart body, then the input could override other fields form.

Details

The vulnerability is not in openapi-python-client itself, but in the clients generated by it. If the client is deployed in such a way that some input is trusted to set only some of the fields in the form, than the client is vulnerable to that input setting other arbitrary fields.

Proof of concept

1. Generate a client with multipart/form body with at least two fields
2. Submit content to one field containing +++
3. Confirm that content after the +++ is treated like a new field

Impact

If all of these conditions are met:

1. The generated client produces multipart/form data
2. The generated client accepts untrusted input to an endpoint which sets that multipart/form body
3. The untrusted input is only allowed to set some, not all, fields of that body Then the generated client is vulnerable to having other fields set.