mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-21 20:18:06 +02:00
72 lines
2.1 KiB
Python
72 lines
2.1 KiB
Python
|
import os
|
||
|
|
import subprocess
|
||
|
|
import pickle
|
||
|
|
import yaml
|
||
|
|
import hashlib
|
||
|
|
import tempfile
|
||
|
|
|
||
|
|
# ───── Deserialization ─────
|
||
|
|
|
||
|
|
def load_cached_session(session_file):
|
||
|
|
"""Loads a pickled session from disk.
|
||
|
|
VULN: pickle.load on untrusted data (arbitrary code execution)
|
||
|
|
"""
|
||
|
|
with open(session_file, "rb") as f:
|
||
|
|
session = pickle.load(f)
|
||
|
|
return session
|
||
|
|
|
||
|
|
def load_yaml_config(config_path):
|
||
|
|
"""Loads YAML configuration.
|
||
|
|
VULN: yaml.load without SafeLoader (arbitrary code execution)
|
||
|
|
"""
|
||
|
|
with open(config_path) as f:
|
||
|
|
config = yaml.load(f)
|
||
|
|
return config
|
||
|
|
|
||
|
|
# ───── File operations ─────
|
||
|
|
|
||
|
|
def process_upload(request):
|
||
|
|
"""Saves an uploaded file to a path constructed from user input.
|
||
|
|
VULN: request.form flows into open() path (path traversal)
|
||
|
|
"""
|
||
|
|
filename = request.form.get("filename")
|
||
|
|
content = request.form.get("content")
|
||
|
|
upload_path = os.path.join("/uploads", filename)
|
||
|
|
with open(upload_path, "w") as f:
|
||
|
|
f.write(content)
|
||
|
|
return {"saved": upload_path}
|
||
|
|
|
||
|
|
# ───── System commands ─────
|
||
|
|
|
||
|
|
def check_disk_usage():
|
||
|
|
"""Reports disk usage from an env-configured mount point.
|
||
|
|
VULN: os.getenv flows into subprocess.check_output
|
||
|
|
"""
|
||
|
|
mount = os.getenv("MOUNT_POINT")
|
||
|
|
output = subprocess.check_output(["df", "-h", mount])
|
||
|
|
return output.decode()
|
||
|
|
|
||
|
|
def compile_template(template_path):
|
||
|
|
"""Compiles a template by calling an external tool.
|
||
|
|
VULN: os.getenv flows into exec (code injection via env)
|
||
|
|
"""
|
||
|
|
compiler = os.getenv("TEMPLATE_COMPILER")
|
||
|
|
exec(compiler + "('" + template_path + "')")
|
||
|
|
|
||
|
|
# ───── Hashing ─────
|
||
|
|
|
||
|
|
def hash_token(token):
|
||
|
|
"""VULN: MD5 is cryptographically weak, should use sha256+salt."""
|
||
|
|
return hashlib.md5(token.encode()).hexdigest()
|
||
|
|
|
||
|
|
# ───── Safe utilities ─────
|
||
|
|
|
||
|
|
def sanitize_filename(name):
|
||
|
|
"""Strips path traversal characters from a filename."""
|
||
|
|
return os.path.basename(name).replace("..", "")
|
||
|
|
|
||
|
|
def safe_hash(data):
|
||
|
|
"""SAFE: uses SHA-256 with proper salt."""
|
||
|
|
salt = os.urandom(16)
|
||
|
|
return hashlib.sha256(salt + data.encode()).hexdigest()
|