INNER CODE UNIT · Python

__str__

The-Art-of-Hacking/websploit · additional-labs/deserial-gate/app.py:20

    def __str__(self):
        return self.mode

@app.route('/')
def index():
    cookie_data = request.cookies.get('user_prefs')
    if cookie_data:
        try:
            # VULNERABILITY: Insecure pickle.loads of user controlled data
            pref_obj = pickle.loads(base64.b64decode(cookie_data))
            return render_template_string(HOME_HTML, pref=str(pref_obj))
        except:
            return render_template_string(HOME_HTML, pref="Corrupted Data")
    return render_template_string(HOME_HTML, pref="Default")

@app.route('/set_pref', methods=['POST'])
def set_pref():
    mode = request.form.get('pref', 'Light Mode')

View source record →