Tags: programming secure-coding
Rating:
# Science!
We need to fix the vulnerability exploited in Web: Science!
This is a fairly simply fix. We just need to get rid of opening curly brace characters. The Python script in question is tamuctf/views.py.
Insecure code:
```python
import requests
import json
import sys
from tamuctf import app
from flask import Flask, render_template, request, jsonify, render_template_string
@app.route('/')
@app.route('/index')
def index():
return render_template('index.html')
@app.route('/science', methods=['POST'])
def science():
try:
chem1 = request.form['chem1']
chem2 = request.form['chem2']
template = '''<html>
<div style="text-align:center">
<h3>The result of combining {} and {} is:</h3>
<iframe src="https://giphy.com/embed/AQ2tIhLp4cBa" width="468" height="480" frameBorder="0" class="giphy-embed" allowFullScreen></iframe></div>
</html>'''.format(chem1, chem2)
return render_template_string(template, dir=dir, help=help, locals=locals)
except:
return "Something went wrong"
```
These are the two problem lines:
```python
chem1 = request.form['chem1']
chem2 = request.form['chem2']
```
We can easily prevent injection by getting rid of opening curly braces.
```python
chem1 = request.form['chem1'].replace("{","")
chem2 = request.form['chem2'].replace("{","")
```
Secure code:
```python
import requests
import json
import sys
from tamuctf import app
from flask import Flask, render_template, request, jsonify, render_template_string
@app.route('/')
@app.route('/index')
def index():
return render_template('index.html')
@app.route('/science', methods=['POST'])
def science():
try:
chem1 = request.form['chem1'].replace("{","")
chem2 = request.form['chem2'].replace("{","")
template = '''<html>
<div style="text-align:center">
<h3>The result of combining {} and {} is:</h3>
<iframe src="https://giphy.com/embed/AQ2tIhLp4cBa" width="468" height="480" frameBorder="0" class="giphy-embed" allowFullScreen></iframe></div>
</html>'''.format(chem1, chem2)
return render_template_string(template, dir=dir, help=help, locals=locals)
except:
return "Something went wrong"
```
Upon committing and pushing the code upstream, we're presented with the flag.
