rules:
- id: avoid-accessing-request-in-wrong-handler
  patterns:
  - pattern-inside: |
      @app.route(..., method="GET")
      def $X(...):
        ...
  - pattern-either:
    - pattern: |
        $Y = flask.request.json
    - pattern: |
        $Y = flask.request.form
    - pattern: |
        $Y = flask.request.data
  message: Accessing request object inside a route handle for HTTP GET command will throw due to missing request body.
  languages: [python]
  severity: WARNING
  metadata:
    category: correctness
    technology:
    - flask