b4stet / py_aqua Goto Github PK

After loading of the JSON content in the analyze web handler, the content is not validated like it is performed in the quiz web handler:

Validation expected:

The current logger exposed in web handlers do not perforn any control over the content logged (length, escaping...) so it expose its usage by the web handlers to log injection:

Moreover the file destination is configured to used a single file by day allowing a attacker, once a way has been identified to log content from a controlled source (ex: error or request param) to send massive requests to try to fill the HDD via the log file:

Use BaseRotatingHandler if possible.