# 危險示例
import os
from flask import send_file

@app.route('/download')
def download():
    filename = request.args.get('file')
    path = os.path.join("static/files", filename)
    return send_file(path)

>>> os.path.join("/a", "/b")  # 第二個絕對路徑會完全覆蓋第一個
'/b'
>>> os.path.join("static/files", "../../etc/passwd")  # 相對路徑穿越
'static/files/../../etc/passwd'

# 危險示例：日志查看功能
@app.route('/view_log')
def view_log():
    log_date = request.args.get('date')  # 如2023-01-01
    log_file = f"/var/log/app/{log_date}.log"
    with open(log_file, 'r') as f:
        return f.read()

# 危險示例：使用zipfile模塊但不檢查路徑
import zipfile

with zipfile.ZipFile("upload.zip", 'r') as zip_ref:
    zip_ref.extractall("uploads/")

# 危險示例：Jinja2模板注入
from flask import render_template_string

@app.route('/greet')
def greet():
    name = request.args.get('name', 'Guest')
    template = f"Hello, {name}!"
    return render_template_string(template)

import pickle

# 危險示例：反序列化用戶數(shù)據(jù)
data = request.cookies.get('data')
obj = pickle.loads(base64.b64decode(data))

from lxml import etree

# 危險示例：解析XML時不禁用實體
xml_data = request.body
doc = etree.fromstring(xml_data)

import os
from pathlib import Path

def safe_join(base_dir, user_path):
    # 轉(zhuǎn)換為絕對路徑并規(guī)范化
    base = Path(base_dir).resolve()
    try:
        path = (base / user_path).resolve()
        # 確保最終路徑仍在基目錄下
        path.relative_to(base)
        return str(path)
    except (ValueError, RuntimeError):
        raise ValueError("非法路徑")

import re
if not re.match(r'^[a-zA-Z0-9_-]+\.log$', filename):
    raise ValueError("非法文件名")

def safe_extract(zip_path, extract_to):
    with zipfile.ZipFile(zip_path) as z:
        for info in z.infolist():
            # 檢查是否有路徑穿越
            dest = os.path.join(extract_to, info.filename)
            if not os.path.realpath(dest).startswith(os.path.realpath(extract_to)):
                raise ValueError("非法壓縮包內(nèi)容")
            z.extract(info, extract_to)