mirror of
https://github.com/github/codeql.git
synced 2025-12-17 17:23:36 +01:00
77021ae119
We were mixing between things, so this is just to keep things consistent. Even though it's not strictly needed for all queries, it does look nice I think
23 lines
535 B
Python
23 lines
535 B
Python
from flask import Flask, request
|
|
app = Flask(__name__)
|
|
|
|
@app.route("/code-execution")
|
|
def code_execution():
|
|
code = request.args.get("code")
|
|
exec(code) # NOT OK
|
|
eval(code) # NOT OK
|
|
cmd = compile(code, "<filename>", "exec")
|
|
exec(cmd) # NOT OK
|
|
|
|
|
|
@app.route("/safe-code-execution")
|
|
def code_execution():
|
|
foo = 42
|
|
bar = 43
|
|
|
|
obj_name = request.args.get("obj")
|
|
if obj_name == "foo" or obj_name == "bar":
|
|
# TODO: Should not alert on this
|
|
obj = eval(obj_name) # OK
|
|
print(obj, obj*10)
|