Sha256: 575cc017d05f96fdf14126758da124f4bbc1d6f3f106d8196ac5ffea5c85a6ad
Contents?: true
Size: 568 Bytes
Versions: 14
Compression:
Stored size: 568 Bytes
Contents
require 'sinatra'
# stupid to way to pretend vulnerability for :os_cmd_injection_timing
def eval( str )
if delay = str.to_s.gsub( /\D/, ' ' ).split( ' ' ).uniq.last
sleep delay.to_i
end
end
get '/' do
<<-HTML
<form action='/trusted'>
<input name="trusted_input"/>
</form>
<form action='/untrusted'>
<input name="untrusted_input"/>
</form>
HTML
end
get '/trusted' do
eval( params['trusted_input'] )
end
get '/untrusted' do
sleep( 4 )
eval( params['untrusted_input'] )
end
Version data entries
14 entries across 14 versions & 1 rubygems