secDevLabs
secDevLabs copied to clipboard
[A3] fix template injection
This solution refers to which of the apps?
[A3] # - sstype
What did you do to mitigate the vulnerability?
I refactored get method in MainHandler, first got name parameter forcing value escape, after i used 'render' method for pass variables with context format to template and in template i used jinja sintax to render values of the context
Images are not necessary but are greatly appreciated! 📸
Did you test your changes? What commands did you run?
I used parameters describe in read me, passing values with query params and trying execute commands