INNER CODE UNIT · Python

UserPrefs

The-Art-of-Hacking/websploit · additional-labs/deserial-gate/app.py:17

class UserPrefs:
    def __init__(self, mode):
        self.mode = mode
    def __str__(self):
        return self.mode

@app.route('/')
def index():
    cookie_data = request.cookies.get('user_prefs')
    if cookie_data:
        try:
            # VULNERABILITY: Insecure pickle.loads of user controlled data
            pref_obj = pickle.loads(base64.b64decode(cookie_data))
            return render_template_string(HOME_HTML, pref=str(pref_obj))
        except:
            return render_template_string(HOME_HTML, pref="Corrupted Data")
    return render_template_string(HOME_HTML, pref="Default")

View source record →