mirror of
https://github.com/github/codeql.git
synced 2026-03-26 17:28:29 +01:00
27 lines
572 B
Python
27 lines
572 B
Python
#!/usr/bin/env python
|
||
# -*- coding: UTF-8 -*-
|
||
"""
|
||
@Desc ：Timing Attack Against Header
|
||
"""
|
||
from flask import Flask
|
||
from flask import request
|
||
from django.utils.crypto import constant_time_compare
|
||
|
||
app = Flask(__name__)
|
||
|
||
@app.route('/bad')
|
||
def bad1():
|
||
if not request.headers.get('X-Auth-Token') == "key":
|
||
raise Exception('bad token')
|
||
return 'bad1'
|
||
|
||
@app.route('/good')
|
||
def good1():
|
||
if not constant_time_compare(Secret, "token"):
|
||
raise Exception('bad token')
|
||
return 'good1'
|
||
|
||
if __name__ == '__main__':
|
||
app.debug = True
|
||
app.run()
|