search

corydolphin / flask-cors

Cross Origin Resource Sharing ( CORS ) support for Flask
https://flask-cors.corydolphin.com/
MIT License
867 stars 140 forks source link

Update extension.py to clean request.path before logging it #351

Closed aneshujevic closed 2 months ago

aneshujevic commented 2 months ago

Hi @corydolphin

In this PR I've used Python's repr method to escape special characters and print them as ordinary characters as a bugfix for CVE-2024-1681 - https://nvd.nist.gov/vuln/detail/CVE-2024-1681.

This should resolve https://github.com/corydolphin/flask-cors/issues/349.

andrew-womeldorf commented 2 months ago

Confirmed that the exploit PoC is resolved with this patch

corydolphin commented 2 months ago

Thank you very much for the contribution and fixing this issue.