mirror of
https://github.com/github/codeql.git
synced 2026-04-30 19:26:02 +02:00
Python: Fix minor problems in security examples
This commit is contained in:
@@ -11,7 +11,6 @@ urlpatterns = [
|
||||
|
||||
def user_picture1(request):
|
||||
"""A view that is vulnerable to malicious file access."""
|
||||
base_path = '/server/static/images'
|
||||
filename = request.GET.get('p')
|
||||
# BAD: This could read any file on the file system
|
||||
data = open(filename, 'rb').read()
|
||||
|
||||
@@ -20,5 +20,4 @@ def command_execution_safe(request):
|
||||
if request.method == 'POST':
|
||||
action = request.POST.get('action', '')
|
||||
#GOOD -- Use a whitelist
|
||||
subprocess.call(["application", COMMAND[action]])
|
||||
|
||||
subprocess.call(["application", COMMANDS[action]])
|
||||
|
||||
Reference in New Issue
Block a user