Arbitrary code executes from cookie
Review this Python session/cache loader.
What a strong answer looks like
Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.
0:00 of about 25 min
Mark a line and say what kind of problem it is.0 findings
1import pickle, base64
2from flask import request
3
4@app.route('/restore-state')
5def restore_state():
6 blob = request.cookies.get('app_state')
7 if not blob:
8 return 'no state', 400
9 raw = base64.b64decode(blob)
10 state = pickle.loads(raw) # rebuild the user's UI state
11 return render_state(state)
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.