Swalloow

public class test {
  private int test;
}

Swalloow

def save_db(df, table):
    try:
        engine = create_engine("mysql+mysqldb://root:"+"password"+"@localhost/"+table, encoding='utf-8')
        conn = engine.connect()

        # Save dataframe to database
        df.to_sql(name=table, con=engine, if_exists='append')
        print("Saved successfully!!")
        
    except:

Swalloow

<!-- 버튼이나 input을 제출하면 주식이 팔린다! -->
<form action='/stock/sell' method='get'>
    <input type=submit value=sell_stock>
</form>
<a href="/stock/sell/"> click me!</a>
<form action='/stock/sell' method='post'>
    <input type=submit value=sell_stock>
</form>

<!-- 플라스크에서는 `Flask-WTF` 패키지를 통해 입력 폼을 검증하고 CSRF를 방지가능 -->

Swalloow

@app.route("/user/<user_id>")
def show_user(user_id):
    cur = db.cursor()
    query = "SELECT * FROM user_table where user = %s"%user_id
    c.execute(query)
    return c.fetchall()

Swalloow

@app.route('/hi/<user>')
def hi(user):
    return "<h1>hello, %s!</h1>"%user

# 위와 같은 간단한 라우팅에서 아래와 같이 공격할 수 있습니다.

# GET /hi/alert("hacked!")
# <h1> hello, alert("hacked!") </h1>
# 이걸 본 유저는 javascript alert창이 나타난다

Swalloow

# GET /jobs/application/6337
@app.route(/jobs/application/<job_id>)
def find_job(job_id):
    SELECT * FROM job where id = job_id ...

# 대응방안으로는 `Flask-Login` 등을 사용하여 간접 참조하는 방법이 있습니다.

from flask.ext.login import login_required, current_user

@app.route("/mypage/<id>")

Swalloow

@app.route("/mypage/<id>")
@jwt_required(scope='admin')
def mypage(id):
    ...

Swalloow

val file = spark.textFile("hdfs://...")
val counts = file.flatMap(line => line.split(" "))
  .map(word => (word, 1))
  .reduceByKey(_ + _)
counts.saveAsTextFile("hdfs://...")

Swalloow

//package org.myorg;
import java.io.IOException;
import java.util.*;

import org.apache.hadoop.fs.Path;
import org.apache.hadoop.conf.*;
import org.apache.hadoop.io.*;
import org.apache.hadoop.mapred.*;
import org.apache.hadoop.util.*;

Swalloow

From flask import Flask
app = Flask(__name__)

@app.route('/')
def hello_world():
    return 'Hello, world!'

if __name__ == '__main__':
    app.run(debug=True,host='0.0.0.0')