def superuser_action(request, user):
assert user.is_super_user
# execute action as super useros.makdirs 函数可以在操作系统中创建一个或多个文件夹。它的第二个参数 mode 用于指定创建的文件夹的默认权限。在下面代码的第 2 行中，文件夹 A/B/C 是用 rwx------ (0o700) 权限创建的。这意味着只有当前用户（所有者）拥有这些文件夹的读、写和执行权限。def init_directories(request):
os.makedirs("A/B/C", mode=0o700)
return HttpResponse("Done!")os.makdirs 函数等价于 Linux 的这条命令：mkdir -m 700 -p A/B/C。
有些开发者没有意识到版本之间的差异，这已经在 Django 中造成了一个权限越级漏洞（cve - 2022 -24583），无独有偶，这在 WordPress 中也造成了一个加固绕过问题。os.path.join(path, *paths) 函数用于将多个文件路径连接成一个组合的路径。第一个参数通常包含了基础路径，而之后的每个参数都被当做组件拼接到基础路径后。def read_file(request):
filename = request.POST['filename']
file_path = os.path.join("var", "lib", filename)
if file_path.find(".") != -1:
return HttpResponse("Failed!")
with open(file_path) as f:
return HttpResponse(f.read(), content_type='text/plain')def touch_tmp_file(request):
id = request.GET['id']
tmp_file = tempfile.NamedTemporaryFile(prefix=id)
return HttpResponse(f"tmp file: {tmp_file} created!", content_type='text/plain')def extract_html(request):
filename = request.FILES['filename']
zf = zipfile.ZipFile(filename.temporary_file_path(), "r")
for entry in zf.namelist():
if entry.endswith(".html"):
file_content = zf.read(entry)
with open(entry, "wb") as fp:
fp.write(file_content)
zf.close()
return HttpResponse("HTML files extracted!")def is_sql_injection(request):
pattern = re.compile(r".*(union)|(select).*")
name_to_test = request.GET['name']
if re.search(pattern, name_to_test):
return True
return Falseimport unicodedata
from django.shortcuts import render
from django.utils.html import escape
def render_input(request):
user_input = escape(request.GET['p'])
normalized_user_input = unicodedata.normalize("NFKC", user_input)
context = {'my_input': normalized_user_input}
return render(request, 'test.html', context)<!DOCTYPE html>
<html lang="en">
<body>
{{ my_input | safe}}
</body>
</html>from django.core.mail import send_mail
from django.http import HttpResponse
from vuln.models import User
def reset_pw(request):
email = request.GET['email']
result = User.objects.filter(email__exact=email.upper()).first()
if not result:
return HttpResponse("User not found!")
send_mail('Reset Password','Your new pw: 123456.', 'from@example.com', [email], fail_silently=False)
return HttpResponse("Password reset email send!")import requests
import ipaddress
def send_request(request):
ip = request.GET['ip']
try:
if ip in ["127.0.0.1", "0.0.0.0"]:
return HttpResponse("Not allowed!")
ip = str(ipaddress.IPv4Address(ip))
except ipaddress.AddressValueError:
return HttpResponse("Error at validation!")
requests.get('https://' + ip)
return HttpResponse("Request send!")GET https://victim.com/?a=1;b=2GET https://internal.backend/?a=1;b=2