Python 防止注射成型的烧瓶_Python_Jquery_Flask_Csrf

Python 防止注射成型的烧瓶

python jquery flask

Python 防止注射成型的烧瓶,python,jquery,flask,csrf,Python,Jquery,Flask,Csrf,python/flask如何阻止异物注射？考虑以下mwe： app.py from flask import Flask, request, render template app = Flask(__name__) @app.route('/', methods=['GET','POST']) def helloworld(): if request.method == 'GET': return render_template('index.html')

python/flask如何阻止异物注射？

考虑以下mwe：

app.py

from flask import Flask, request, render template

app = Flask(__name__)

@app.route('/', methods=['GET','POST'])
def helloworld():
    if request.method == 'GET':
        return render_template('index.html') 
    if request.method == 'POST':
        print(request.form['info'])

        ## do something with the info, like write to a database

        return 'nothing'

if __name__ == '__main__':
    app.run(debug=True)

模板/index.html

<html>
<head>
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>
<script type='text/javascript' src="{{ url_for('static', filename='js/fire.js') }}"></script>
</head>

<body>
<p>Hello world!</p>
</body>
</html>

我的问题是：

可以从国外网站进行注射吗？跟进：如何做到这一点？（例如，可能通过发布到我的网站url的表单？）

如果可以进行注入，我可以在app.py脚本中执行哪些操作来阻止注入

编辑下面是一个非常基本的脚本，可用于针对上述烧瓶应用程序测试注射。接受的答案会阻止此脚本：

<!DOCTYPE html>
<html>
<body>

<h2>Malicious Form Injection</h2>

<form action='http://127.0.0.1:5000/' method='post'>
  Input 1:<br>
  <input name="info" value="mal1"><br>
  <input type="submit" value="Submit">
</form>


</body>
</html>


恶意表单注入
输入1:

app.py 无需将密钥传递给html模板，因为

CSRFProtect

将自动传递密钥

模板/index.html 您需要的是csrf（跨站点请求伪造）保护。。。这是为django内置的。。。但在烧瓶中，您需要类似于

烧瓶csrf

<!DOCTYPE html>
<html>
<body>

<h2>Malicious Form Injection</h2>

<form action='http://127.0.0.1:5000/' method='post'>
  Input 1:<br>
  <input name="info" value="mal1"><br>
  <input type="submit" value="Submit">
</form>


</body>
</html>

from flask import Flask, request, render template
from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)

CSRFProtect(app)

app.config['SECRET_KEY'] = 'somethignrandom'

@app.route('/', methods=['GET','POST'])
def helloworld():
    if request.method == 'GET':
        return render_template('index.html') 
    if request.method == 'POST': # anything post will autocheck csrf
        print(request.form['info'])

        ## do something with the info, like write to a database

        return 'nothing'

if __name__ == '__main__':
    app.run(debug=True)

<html>
<head>
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>
<meta name='csrf-token' content="{{ csrf_token() }}">
<script type='text/javascript' src="{{ url_for('static', filename='js/fire.js') }}"></script>

</head>

<body>
<p>Hello world!</p>
</body>
</html>

$(document).click(function() {

    // post data to flask

    $.post('/', {'info': 'test', '_csrf_token':$('meta[name="csrf-token"]').attr('content')});

    return false;

};