FilesExpand file tree

main

/

BenchmarkTest00100.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

55 lines (41 loc) · 1.54 KB

main

/

BenchmarkTest00100.py

Copy path

Top

File metadata and controls

• Code
• Blame

55 lines (41 loc) · 1.54 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

'''

OWASP Benchmark for Python v0.1

This file is part of the Open Web Application Security Project (OWASP) Benchmark Project.

For details, please see https://owasp.org/www-project-benchmark.

The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms

of the GNU General Public License as published by the Free Software Foundation, version 3.

The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY

WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR

PURPOSE. See the GNU General Public License for more details.

Author: Theo Cartsonis

Created: 2025

'''

from flask import redirect, url_for, request, make_response, render_template

from helpers.utils import escape_for_html

def init(app):

@app.route('/benchmark/sqli-00/BenchmarkTest00100', methods=['GET'])

def BenchmarkTest00100_get():

return BenchmarkTest00100_post()

@app.route('/benchmark/sqli-00/BenchmarkTest00100', methods=['POST'])

def BenchmarkTest00100_post():

RESPONSE = ""

param = request.form.get("BenchmarkTest00100")

if not param:

param = ""

map87 = {}

map87['keyA-87'] = 'a-Value'

map87['keyB-87'] = param

map87['keyC'] = 'another-Value'

bar = "safe!"

bar = map87['keyB-87']

bar = map87['keyA-87']

import helpers.db_sqlite

sql = f'SELECT username from USERS where password = ?'

con = helpers.db_sqlite.get_connection()

cur = con.cursor()

cur.execute(sql, (bar,))

RESPONSE += (

helpers.db_sqlite.results(cur, sql)

)

con.close()

return RESPONSE