Check dynamic imports with whitelist

xlwings · Feb 26, 2025 · bde483e · bde483e
1 parent ab977aa
commit bde483e
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/app/dependencies.py b/app/dependencies.py
@@ -64,6 +64,9 @@ async def authenticate(
         )
     else:
         provider = auth_provider
+    # Validate the provider before import to prevent non-literal-import SAST flagging
+    if provider not in settings.auth_providers:
+        raise ValueError(f"Unsupported authentication provider: {provider}")
     try:
         module = importlib.import_module(f"app.auth.{provider}")
         current_user = await module.validate_token(token_string)