Added authentication logic : XSS vuln detected

[MoroccanTea]

• Login using Google OAuth
• Improved file structure
• Added env vars and secrets to github

[white-b1nary]

The code you've posted is vulnerable to Cross-Site Scripting (XSS) because it directly includes user-provided data (request.args['error_reason'], request.args['error_description'], user_info.data['id'], and user_info.data['name']) in the response without any sanitization

def authorized():
    resp = google.authorized_response()
    if resp is None or resp.get('access_token') is None:
        return 'Access denied: reason={0} error={1}'.format(
            request.args['error_reason'],
            request.args['error_description']
 session['google_token'] = (resp['access_token'], '')
    user_info = google.get('userinfo')
    return 'Logged in as id={0} name={1} redirecting to profile...'.format(
        user_info.data['id'], user_info.data['name'])
        )

Make sure to use the escape function before including it in the response