INNER CODE UNIT · Python
ensure_session_and_security
pgalko/BambooAI · web_app/app.py:801
def ensure_session_and_security():
"""Simple session handling and security filtering. KEEP IT LIGHT!"""
# Session handling (existing code)
if 'session_id' not in session:
session_id = str(uuid.uuid4())
session['session_id'] = session_id
# Security filtering - only check if there's a query string
if request.query_string:
qs = request.query_string.decode('utf-8', errors='ignore').lower()
# Quick checks for obvious attacks
# Using 'in' is faster than regex for simple patterns
dangerous_patterns = [
# Command injection (Linux-focused but keep Windows too)
'wget ', 'curl ', 'bash ', ' sh ', 'chmod ', 'exec(',
'passwd', 'sudo ', 'eval(', 'perl ', ' nc ', 'netcat',
'/bin/', '/usr/bin/', 'cmd.exe', 'powershell', # Keep Windows ones - attackers try them anyway