mirror of
https://github.com/github/codeql.git
synced 2025-12-18 01:33:15 +01:00
77021ae119
We were mixing between things, so this is just to keep things consistent. Even though it's not strictly needed for all queries, it does look nice I think
29 lines
702 B
Python
29 lines
702 B
Python
import json
|
|
from flask import Flask, request, make_response, escape
|
|
|
|
app = Flask(__name__)
|
|
|
|
|
|
@app.route("/unsafe")
|
|
def unsafe():
|
|
first_name = request.args.get("name", "")
|
|
return make_response("Your name is " + first_name) # NOT OK
|
|
|
|
|
|
@app.route("/safe")
|
|
def safe():
|
|
first_name = request.args.get("name", "")
|
|
return make_response("Your name is " + escape(first_name)) # OK
|
|
|
|
|
|
@app.route("/unsafe/json")
|
|
def unsafe_json():
|
|
data = json.loads(request.data)
|
|
return make_response(json.dumps(data)) # NOT OK
|
|
|
|
|
|
@app.route("/safe/json")
|
|
def safe_json():
|
|
data = json.loads(request.data)
|
|
return make_response(json.dumps(data), 200, {'Content-Type': 'application/json'}) # OK, FP
|