mirror of
https://github.com/github/codeql.git
synced 2026-07-05 19:45:29 +02:00
37 lines
1.1 KiB
Python
37 lines
1.1 KiB
Python
from flask import Flask, request # $ Source
|
|
import lxml.etree
|
|
import markupsafe
|
|
|
|
app = Flask(__name__)
|
|
|
|
@app.route("/vuln-handler")
|
|
def vuln_handler():
|
|
xml_content = request.args['xml_content']
|
|
return lxml.etree.fromstring(xml_content).text # $ Alert
|
|
|
|
@app.route("/safe-handler")
|
|
def safe_handler():
|
|
xml_content = request.args['xml_content']
|
|
parser = lxml.etree.XMLParser(resolve_entities=False)
|
|
return lxml.etree.fromstring(xml_content, parser=parser).text
|
|
|
|
@app.route("/super-vuln-handler")
|
|
def super_vuln_handler():
|
|
xml_content = request.args['xml_content']
|
|
parser = lxml.etree.XMLParser(
|
|
# allows XXE
|
|
resolve_entities=True,
|
|
# allows remote XXE
|
|
no_network=False,
|
|
# together with `no_network=False`, allows DTD-retrival
|
|
load_dtd=True,
|
|
# allows DoS attacks
|
|
huge_tree=True,
|
|
)
|
|
return lxml.etree.fromstring(xml_content, parser=parser).text # $ Alert
|
|
|
|
@app.route("/sanitized-handler")
|
|
def sanitized_handler():
|
|
xml_content = request.args['xml_content']
|
|
xml_content = markupsafe.escape(xml_content)
|
|
return lxml.etree.fromstring(xml_content).text |