Files
codeql/python/ql/test/query-tests/Security/CWE-943-NoSqlInjection/flask_pymongo_bad.py
Rasmus Lerchedahl Petersen bf8bfd91cd Python: Add inline query test
2023-09-07 10:22:30 +02:00

18 lines
370 B
Python

from flask import Flask, request
from flask_pymongo import PyMongo
import json
app = Flask(__name__)
mongo = PyMongo(app)
@app.route("/")
def home_page():
unsafe_search = request.args['search']
json_search = json.loads(unsafe_search)
return mongo.db.user.find({'name': json_search}) #$ result=BAD
# if __name__ == "__main__":
# app.run(debug=True)