secDevLabs icon indicating copy to clipboard operation
secDevLabs copied to clipboard

[A3] fix template injection

Open Ramon5 opened this issue 2 years ago • 0 comments

This solution refers to which of the apps?

[A3] # - sstype

What did you do to mitigate the vulnerability?

I refactored get method in MainHandler, first got name parameter forcing value escape, after i used 'render' method for pass variables with context format to template and in template i used jinja sintax to render values of the context

Images are not necessary but are greatly appreciated! 📸

Did you test your changes? What commands did you run?

I used parameters describe in read me, passing values with query params and trying execute commands

Ramon5 avatar Sep 21 '23 12:09 Ramon5