xss-example/main.py at 9588a0d35437e19afe7421fd8eb6461933174d0d · pcewebpython/xss-example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
import base64
import os
import random

from flask import Flask, request, session

from model import Message

app = Flask(__name__)
app.secret_key = b'\x9d\xb1u\x08%\xe0\xd0p\x9bEL\xf8JC\xa3\xf4J(hAh\xa4\xcdw\x12S*,u\xec\xb8\xb8'

@app.route('/', methods=['GET', 'POST'])
def home():

    if 'csrf_token' not in session:
        session['csrf_token'] = str(random.randint(10000000, 99999999))

    if request.method == 'POST':
        if request.form.get('csrf_token', None) == session['csrf_token']:
            m = Message(content=request.form['content'])
            m.save()

    body = """
<html>
<body>
<h1>Class Message Board</h1>
<h2>Contribute to the Knowledge of Others</h2>
<form method="POST">
    <input type="hidden" name="csrf_token" value="{}">

    <textarea name="content"></textarea>
    <input type="submit" value="Submit">
</form>

<h2>Wisdom From Your Fellow Classmates</h2>
""".format(session['csrf_token'])

    for m in Message.select():
        body += """
<div class="message">
{}
</div>
""".format(m.content.replace('<', '&lt;').replace('>', '&gt;'))

    return body


if __name__ == "__main__":
    port = int(os.environ.get("PORT", 6738))
    app.run(host='0.0.0.0', port=port)