Python / Django "path method" Cache Deception

cache_deception.py


from django.urls import path
from .views import HomePageView, PostDetailView, AddPostView

app_name = 'feed'

urlpatterns = [
    path('', HomePageView.as_view(), name='index'),
    path('test/', HomePageView.as_view(), name='index'),
    path('detail//', PostDetailView.as_view(), name='detail'),
    path('post/', AddPostView.as_view(), name='post'),
    path("/test*"),
    path("/test/sdfsdf/sdfdsf*"),
    path("/test/sdfsdf/*"),
    path("/index*", views.index, name="main-view"),
    path("index*/", views.index, name="main-view"),
    path("bio/*", views.bio, name="bio"),
    path("articles//*", views.article, name="article-detail"),
    path("articles///", views.section, name="article-section"),
    path("blog/", include("blog.urls")),

]


cache_deception_rule.yaml


rules:
  - id: django_route_decorator_detection
    patterns:
      - pattern-either:
        - pattern: path($X, ...)
        - pattern-inside: |
            import path
            ...
      - metavariable-pattern:
          metavariable: $X
          patterns:
            - pattern-regex: \/[^'"]*path:(.+)>
    message: "Detected Django route decorator usage: {{source()}}"
    severity: INFO
    languages: [python]
metadata:
  category: security
  cwe: "CWE-525: Use of Web Browser Cache Containing Sensitive Information"
  subcategory: [audit]
  confidence: HIGH
  impact: HIGH
  technology: [python, django]
  description: "`Django Path` Possible Web Cache Deception"