Add files via upload

This sample code contains str.format vulnerability which can be exploited to retrieve secret in global variable

Author: benedictkwok

PeopleInfo.py

@@ -0,0 +1,28 @@
+# Let us assume this CONFIG holds some sensitive information
+CONFIG = {
+    "KEY": "ASXFYFGK78989"
+}
+
+
+class PeopleInfo:
+    def __init__(self, fname, lname):
+        self.fname = fname
+        self.lname = lname
+
+
+def get_name_for_avatar(avatar_str, people_obj):
+    return avatar_str.format(people_obj=people_obj)
+
+
+# Driver Code
+people = PeopleInfo('GEEKS', 'FORGEEKS')
+
+# case 1: st obtained from user
+# st = input()
+# get_name_for_avatar(st, people_obj = people)
+# enter: Avatar_{people_obj.fname}_{people_obj.lname}
+# case 2: st obtained from user
+st = input()
+result=get_name_for_avatar(st, people_obj=people)
+print(result)
+# enter {people_obj.__init__.__globals__[CONFIG][KEY]}