Allow submitting xml using the body or using a POST request

AikidoSec · Aug 21, 2024 · b6c7d02 · b6c7d02
1 parent 1f8fd30
commit b6c7d02
Show file tree

Hide file tree

Showing 3 changed files with 74 additions and 25 deletions.
diff --git a/sample-apps/flask-postgres-xml/app.py b/sample-apps/flask-postgres-xml/app.py
@@ -9,6 +9,7 @@
 
 from flask import Flask, render_template, request
 import psycopg2
+import xml.etree.ElementTree as ET
 
 app = Flask(__name__)
 if __name__ == '__main__':
@@ -36,21 +37,36 @@ def get_dogpage(dog_id):
     dog = cursor.fetchmany(1)[0]
     return render_template('dogpage.html', title=f'Dog', dog=dog, isAdmin=("Yes" if dog[2] else "No"))
 
-@app.route("/upload_xml", methods=['GET'])
+@app.route("/xml", methods=['GET'])
 def show_upload_xml():
-    return render_template('upload_xml.html')
+    return render_template('xml.html')
 
 
 
-@app.route("/upload_xml", methods=['POST'])
+@app.route("/xml_body", methods=['POST'])
 def post_upload_xml():
-    #dog_name = request.form['dog_name']
-    dog_name = ""
+    raw_xml = request.form['raw_xml']
+    root = ET.fromstring(raw_xml)
+    conn = get_db_connection()
+    cursor =  conn.cursor()
+    for dog in root.findall('dog'):
+        dog_name = dog.get('dog_name')
+        cursor.execute(f"INSERT INTO dogs (dog_name, isAdmin) VALUES ('%s', FALSE)" % (dog_name))
+        conn.commit()
+    cursor.close()
+    conn.close()
+    return f'Dogs created successfully'
 
+@app.route("/xml_post", methods=['POST'])
+def post_xml():
+    raw_xml = request.data.decode('utf-8')
+    root = ET.fromstring(raw_xml)
     conn = get_db_connection()
     cursor =  conn.cursor()
-    cursor.execute(f"INSERT INTO dogs (dog_name, isAdmin) VALUES ('%s', FALSE)" % (dog_name))
-    conn.commit()
+    for dog in root.findall('dog'):
+        dog_name = dog.get('dog_name')
+        cursor.execute(f"INSERT INTO dogs (dog_name, isAdmin) VALUES ('%s', FALSE)" % (dog_name))
+        conn.commit()
     cursor.close()
     conn.close()
-    return f'Dog {dog_name} created successfully'
+    return f'Dogs created successfully'
diff --git a/sample-apps/flask-postgres-xml/templates/upload_xml.html b/sample-apps/flask-postgres-xml/templates/upload_xml.html
diff --git a/sample-apps/flask-postgres-xml/templates/xml.html b/sample-apps/flask-postgres-xml/templates/xml.html
@@ -0,0 +1,50 @@
+html
+
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>XML</title>
+</head>
+<body>
+    <h1>Send XML Data (application/xml)</h1>
+    <textarea id="xmlData" rows="10" cols="50"></textarea>
+    <br>
+    <button id="sendRequest">Send XML</button>
+    <div id="response"></div>
+
+    <h1>Send XML Data (Body)</h1>
+    <form method="post" action="/xml_body">
+        <textarea id="raw_xml" name="raw_xml" rows="10" cols="50"></textarea>
+        <br>
+        <button type="submit">Send XML</button>
+    </form>
+
+    <script>
+        document.getElementById('sendRequest').addEventListener('click', function() {
+            const xmlData = document.getElementById('xmlData').value;
+            const endpoint = '/xml_post'; // Change this to your XML endpoint
+
+            fetch(endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/xml',
+                },
+                body: xmlData,
+            })
+            .then(response => {
+                if (!response.ok) {
+                    throw new Error('Network response was not ok ' + response.statusText);
+                }
+            })
+            .then(data => {
+                document.getElementById('response').innerText = "OK"
+            })
+            .catch(error => {
+                document.getElementById('response').innerText = 'Error: ' + error.message;
+            });
+        });
+    </script>
+</body>
+</html>