mirror of
https://github.com/github/codeql.git
synced 2025-12-18 09:43:15 +01:00
77021ae119
We were mixing between things, so this is just to keep things consistent. Even though it's not strictly needed for all queries, it does look nice I think
22 lines
412 B
Python
22 lines
412 B
Python
import flask
|
|
import pickle
|
|
import yaml
|
|
import marshal
|
|
|
|
from yaml import SafeLoader
|
|
|
|
from flask import Flask, request
|
|
app = Flask(__name__)
|
|
|
|
|
|
@app.route("/")
|
|
def hello():
|
|
payload = request.args.get("payload")
|
|
pickle.loads(payload) # NOT OK
|
|
yaml.load(payload) # NOT OK
|
|
yaml.load(payload, Loader=SafeLoader) # OK
|
|
marshal.loads(payload) # NOT OK
|
|
|
|
import dill
|
|
dill.loads(payload) # NOT OK
|