webserver.py 文件源码

def blind(engine):

    template = request.values.get('tpl')
    if not template:
        template = '%s'

    injection = request.values.get('inj')

    if engine == 'mako':
        MakoTemplates(template % injection, lookup=mylookup).render()
    elif engine == 'jinja2':
        Jinja2Env.from_string(template % injection).render()
    elif engine == 'eval':
        eval(template % injection)
    elif engine == 'tornado':
        tornado.template.Template(template % injection).generate()

    return randomword()