Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 76 additions & 0 deletions introduction/other_views.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
import hashlib
from django.shortcuts import render,redirect
from django.http import HttpResponse, HttpResponseBadRequest, JsonResponse
from .models import FAANG, AF_session_id,info,login,comments,authLogin, tickits, sql_lab_table,Blogs,CF_user,AF_admin
from django.core import serializers
from requests.structures import CaseInsensitiveDict
from django.contrib.auth import login,authenticate
from django.contrib.auth.forms import UserCreationForm
import random
import string
import os
from hashlib import md5
import datetime
from .forms import NewUserForm
from django.contrib import messages
#*****************************************Lab Requirements****************************************************#

from .models import FAANG,info,login,comments,otp
from random import randint
from xml.dom.pulldom import parseString, START_ELEMENT
from xml.sax.handler import feature_external_ges
from xml.sax import make_parser
from django.views.decorators.csrf import csrf_exempt
from django.template import loader
from django.template.loader import render_to_string
import subprocess
import pickle
import base64
import yaml
import json
from dataclasses import dataclass
import uuid
from .utility import filter_blog, customHash
import jwt
from PIL import Image,ImageMath
import base64
from io import BytesIO
from argon2 import PasswordHasher
import logging
import requests
import re
#*****************************************Login and Registration****************************************************#

@csrf_exempt
def cmd_lab3(request):
if request.user.is_authenticated:
if (request.method=="POST"):
domain=request.POST.get('domain')
domain=domain.replace("https://www.",'')
os=request.POST.get('os')
print(os)
if(os=='win'):
command="nslookup {}".format(domain)
else:
command = "dig {}".format(domain)
try:
# output=subprocess.check_output(command,shell=True,encoding="UTF-8")
process = subprocess.Popen(
command,
shell=True,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE)
Comment on lines +58 to +62

Check failure

Code scanning / SonarCloud

OS commands should not be vulnerable to command injection attacks High

Change this code to not construct the OS command from user-controlled data. See more on SonarQube Cloud
stdout, stderr = process.communicate()
data = stdout.decode('utf-8')
stderr = stderr.decode('utf-8')
# res = json.loads(data)
# print("Stdout\n" + data)
output = data + stderr
print(data + stderr)
except:
output = "Something went wrong"
return render(request,'Lab/CMD/cmd_lab.html',{"output":output})
print(output)
return render(request,'Lab/CMD/cmd_lab.html',{"output":output})
else:
return redirect('login')
3 changes: 3 additions & 0 deletions test.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
foo
bar
baz