Explorar el Código

What if we weren't vulnerable to XSS

Kirk Trombley hace 3 años
padre
commit
ce1f836342
Se han modificado 1 ficheros con 12 adiciones y 2 borrados
  1. 12 2
      server/app.py

+ 12 - 2
server/app.py

@@ -149,10 +149,20 @@ def get_status():
     return jsonify({"users": [u.replace(r"\s", " ") for u in get_users()[0]]})
 
 
+def default_to(hex_in, hex_def):
+    if hex_in is None or len(hex_in) > 6:
+        return hex_def
+    try:
+        int(hex_in, 16)
+        return hex_in
+    except ValueError:
+        return hex_def
+
+
 @app.route("/page")
 def get_page():
-    bg = request.args.get("bg", "111")
-    tc = request.args.get("tc", "ddd")
+    bg = default_to(request.args.get("bg", None), "111")
+    tc = default_to(request.args.get("tc", None), "ccc")
     return render_template_string("""
     <!DOCTYPE html>
     <html lang="en">