The application lacks protection against CSRF

[atx]

The application lacks any sort of protection against CSRF (let alone DNS rebinding).

As some, uhhh, creative development time saving techniques are used, an attacker can execute arbitrary shell commands on the computer running this software by redirecting the users browser to something like:

<a href="http://127.0.0.1:5000/stack/?filename=%3Bxcalc%3Bfoo.gz">Link</a>

[brendangregg]

Thanks @atx! I've fixed the filename escapes. We still need to look at the CSRF and DNS rebinding.

[spiermar]

@brendangregg recent PR merge might have fixed a few of those issues.

[spiermar]

Assuming this was fixed. Closing.