Browse Source

What if we weren't vulnerable to XSS

Kirk Trombley 3 years ago
parent
commit
ce1f836342
1 changed files with 12 additions and 2 deletions
  1. 12 2
      server/app.py

+ 12 - 2
server/app.py

@@ -149,10 +149,20 @@ def get_status():
     return jsonify({"users": [u.replace(r"\s", " ") for u in get_users()[0]]})
 
 
+def default_to(hex_in, hex_def):
+    if hex_in is None or len(hex_in) > 6:
+        return hex_def
+    try:
+        int(hex_in, 16)
+        return hex_in
+    except ValueError:
+        return hex_def
+
+
 @app.route("/page")
 def get_page():
-    bg = request.args.get("bg", "111")
-    tc = request.args.get("tc", "ddd")
+    bg = default_to(request.args.get("bg", None), "111")
+    tc = default_to(request.args.get("tc", None), "ccc")
     return render_template_string("""
     <!DOCTYPE html>
     <html lang="en">