Nov-01-2020, 10:56 PM
(Nov-01-2020, 09:18 PM)buran Wrote: the problem you have is somewhere before the code you show here
i.e.
how it happened that cgi.FieldStorage instance
FieldStorage (None, None, [MiniFieldStorage ('v_name', 'John'), MiniFieldStorage ('v_sname', 'Aguiar')])become a str
"FieldStorage (None, None, [MiniFieldStorage ('v_name', 'John'), MiniFieldStorage ('v_sname', 'Aguiar')])"somewhere you convertedcgi.FieldStorage
object intstr
object and that is where the problem is.
there are appropriate methods to parsecgi.FieldStorage
and acceess theMiniFiledStorage
objects in the list and their values. Don't manipulate strings
import cgi # let recreate what you SHOULD have instead of str array_input = cgi.FieldStorage() array_input.list = [cgi.MiniFieldStorage('v_name', 'John'), cgi.MiniFieldStorage('v_sname', 'Aguiar')] # what we have and how we access data print(type(array_input)) print(type(array_input['v_name'])) print(array_input.getvalue('v_name'))
Output:<class 'cgi.FieldStorage'> <class 'cgi.MiniFieldStorage'> John
It all starts with the code below:
# Retrieves form field entries in the environment variable (wsgi.input) and assigns the variable (array_input): array_input = cgi.FieldStorage(environ["wsgi.input"], environ=environ)After that I send the variable array_input via parameter to the method of another class that processes deconstruction of the value of the variable (array_input) so that I can remove the characters that conflict in the threat detection (xss), because I don't know if it is possible to manipulate the type <class 'cgi.FieldStorage'> using regular expressions from the python re module, below is the code that receives the parameter and decouples the variable:
# Function -> Importa module cgi que trata form request e re (regex) import re # Class Function -> class ProcessInputPost: # Method Function -> def spark (v_response, v_uri, array_input): # Function -> Convert to tuple a_inp = (array_input) # Function -> Convert tuple to string: o_inp = str(a_inp) # Function -> Remove parentheses for checking data: v_inp = re.sub ("[()]", "", o_inp) # Function -> from cern.safe.threatdetect import ThreatDetect # Function -> return ThreatDetect.m_post (v_response, v_uri, array_input)
User has been warned for this post. Reason: Edit post content after receiving reply