diff --git a/python/flask.py b/python/flask.py index c78931d..d3dc879 100644 --- a/python/flask.py +++ b/python/flask.py @@ -4,8 +4,10 @@ app = Flask(__name__) # curl -X GET "http://localhost:5000/tainted7/touch%20HELLO" + @app.route("/tainted7/") def test_sources_7(something): + os.system(request.remote_addr) @@ -14,10 +16,13 @@ def test_sources_7(something): @app.route("/sanitized/") def test_sources_7(something): data = flask.request.args.get("key") + sanitized_data = bleach.clean(data) os.system(sanitized_data) + return "bar" if __name__ == "__main__": app.run(debug=True) +