Merge pull request #7 from r2c-CSE/vuln-1

Create vuln-1.py

Author: nnayar-r2c

vuln-1.py

@@ -0,0 +1,23 @@
+import os
+import flask
+
+app = flask.Flask(__name__)
+
+
+@app.route("/route_param/<route_param>")
+def route_param(route_param):
+
+    # ruleid:dangerous-os-exec
+    os.execl("/bin/bash", "/bin/bash", "-c", route_param)
+
+    return "oops!"
+
+
+# Flask true negatives
+@app.route("/route_param/<route_param>")
+def route_param2(route_param):
+
+    # ok:dangerous-os-exec
+    os.execl("static")
+
+    return "ok!"