INNER CODE UNIT · Python

index

The-Art-of-Hacking/websploit · additional-labs/deserial-gate/app.py:24

def index():
    cookie_data = request.cookies.get('user_prefs')
    if cookie_data:
        try:
            # VULNERABILITY: Insecure pickle.loads of user controlled data
            pref_obj = pickle.loads(base64.b64decode(cookie_data))
            return render_template_string(HOME_HTML, pref=str(pref_obj))
        except:
            return render_template_string(HOME_HTML, pref="Corrupted Data")
    return render_template_string(HOME_HTML, pref="Default")

@app.route('/set_pref', methods=['POST'])
def set_pref():
    mode = request.form.get('pref', 'Light Mode')
    pref_obj = UserPrefs(mode)
    serialized = base64.b64encode(pickle.dumps(pref_obj)).decode()
    
    resp = make_response("Preference saved!")

View source record →