asked on JavaScript Cross-Site Scripting issue
What is the proper syntax to change the following JavaScript to create a new p element using textContent for each comment and then add the p element to the div element using appendChild
function renderComments(comments) {
const $comments = document.createElement("div");
let commentHTML = "";
for (const comment of comments) {
commentHTML += "<p>" + comment + "</p>";
}
$comments.innerHTML = commentHTML;
return $comments;
};
I tried this but it is not displaying correctly for me and still failing XSS testing, I know this is a mess and trying to learn. Thanks for any direction you can give me.
function renderComments(comments) {
const $comments = document.createElement("div");
let commentHTML = "";
function add1(){
var comments = document.createElement("comments")
comment1.appendChild(comments)
document.getElementById("comments").appendChild(comment1);
}
$comments.textContent = commentHTML;
return $comments;
};
JavaScript
Last Comment
SteveO
ASKER
Hi Julian,
The XSS is triggered when entering text in a comment box then clicking submit.
The code I posted in the first box works but fails cross-site testing. I get no warnings just not passing the security test. The code in my second box is my weak attempt of creating create a new p element using textContent, (instead of innerHTML), for each comment and then add the p element to the div element using appendChild .
The JavaScript you posted is not working for me. I think it is because my site takes the comment entered into a text box and submitted one at a time. Is there a way to not use an array and just take the one comment per submit?
Thanks for all your direction!
-Steve
The XSS is triggered when entering text in a comment box then clicking submit.
The code I posted in the first box works but fails cross-site testing. I get no warnings just not passing the security test. The code in my second box is my weak attempt of creating create a new p element using textContent, (instead of innerHTML), for each comment and then add the p element to the div element using appendChild .
The JavaScript you posted is not working for me. I think it is because my site takes the comment entered into a text box and submitted one at a time. Is there a way to not use an array and just take the one comment per submit?
Thanks for all your direction!
-Steve
The second script does not make much sense. You have a commentHTML you do not use
Here is my take, using textNodes and a container - it is quite similar to Julians...
https://jsfiddle.net/mplungjan/8hcsbzj5/
Here is my take, using textNodes and a container - it is quite similar to Julians...
https://jsfiddle.net/mplungjan/8hcsbzj5/
<div id="comments"></div>
const commentContainer = document.getElementById("comments");
const add1 = str => {
const comment = document.createElement("div")
comment.append(document.createTextNode(str))
return comment;
};
const renderComments = comments => {
comments.forEach(commentString => commentContainer.append(add1(commentString)))
};
const strings = ["This is comment 1", "This is comment 2"]
renderComments(strings)
The JavaScript you posted is not working for me. I think it is because my site takes the comment entered into a text box and submitted one at a time. Is there a way to not use an array and just take the one comment per submit?
Can you post the code that demonstrates how the comments are captured.
The code I posted assumes the comments are an array of strings - if that is not the case - it is a simple fix - but it would help to know what the input data is.
ASKER
Thanks Michel and Julian,
That is not working when I attempt to run it. My challenge is I must use the first 3 lines since this is coming from code I can not view or change, (I missed posting the first line exports._ line previously):
exports._ = (document) =>
function renderComments(comments) {
const $comments = document.createElement("div");
My team suggested of instead of concatenating to innerHTML, create a new p element with the textContent for each comment, then add the new p element to the div element with the appendChild function. Is there an example using these I can try?
Thanks for any direction you can give me.
-Steve
That is not working when I attempt to run it. My challenge is I must use the first 3 lines since this is coming from code I can not view or change, (I missed posting the first line exports._ line previously):
exports._ = (document) =>
function renderComments(comments) {
const $comments = document.createElement("div");
My team suggested of instead of concatenating to innerHTML, create a new p element with the textContent for each comment, then add the new p element to the div element with the appendChild function. Is there an example using these I can try?
Thanks for any direction you can give me.
-Steve
ASKER
In the box below I pasted what I see when I inspected the page where I enter the text and click submit. The <p> elements where you see Steve is where the new text will be displayed
<body >
<div class="container">
<div class="header">
<nav>
<ul class="nav nav-pills pull-right">
</ul>
</nav>
<h3 class="text-muted">Blog</h3>
</div>
<h3>
This is my blog. I hope you like what we have to say. If not please comment below.
</h3>
</br>
<p>
<p>Steve comment: This website is not safe.</p><p>Steve comment: Testing!</p>
</p>
<div class="comments">
<h3 align="center">Enter a comment:</h3>
<form class="form-lookup" method="post" action="/comment" autocomplete="off">
<label for="comment" class="sr-only">Comment:</label>
<textarea type="text" name="comment" id="comment" class="form-control" placeholder="Comment" required
autofocus></textarea>
<button id="btnSearch" class="btn btn-lg btn-primary btn-block" type="submit">Submit</button>
</form>
</div>
<footer class="footer">
<p>© Steve's Blog</p>
</footer>
</div>
</body>
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Thanks Julian for explaining and creating the detail example, I am learning a lot! I am currently traveling and will try your solution tonight and let you know how it goes. I really appreciate all your direction and look forward to testing.
ASKER
Hi Julian,
I tried your script and I am getting an error. Here is what I am running:
Here is the dump from "view source"
I tried your script and I am getting an error. Here is what I am running:
exports._ = (document) =>
function renderComments(comments, parent) {
const div = document.createElement('div');
comments.forEach(c => {
const p = document.createElement('p'); // <=== CREATE A <p>
p.innerText = c; // ADD TO innerText
div.appendChild(p); // appendChild()
});
return parent.appendChild(div);
};
document.forms[0].addEventListener('submit', e => {
e.preventDefault();
const frm = e.target;
const comments = frm.comment.value.split("\n");
renderComments(comments, document.getElementById('comments'));
});
json.decoder.JSONDecodeError
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)Here is the dump from "view source"
<head>
<title>json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) // Werkzeug Debugger</title>
<link rel="stylesheet" href="?__debugger__=yes&cmd=resource&f=style.css" type="text/css">
<!-- We need to make sure this has a favicon so that the debugger does
not by accident trigger a request to /favicon.ico which might
change the application state. -->
<link rel="shortcut icon" href="?__debugger__=yes&cmd=resource&f=console.png">
<script src="?__debugger__=yes&cmd=resource&f=jquery.js"></script>
<script src="?__debugger__=yes&cmd=resource&f=debugger.js"></script>
<script type="text/javascript">
var TRACEBACK = 139688046111312,
CONSOLE_MODE = false,
EVALEX = true,
EVALEX_TRUSTED = false,
SECRET = "aaQU7htxVj6NLgStZjzd";
</script>
</head>
<body style="background-color: #fff">
<div class="debugger">
<h1>json.decoder.JSONDecodeError</h1>
<div class="detail">
<p class="errormsg">json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)</p>
</div>
<h2 class="traceback" style="cursor: pointer;">Traceback <em>(most recent call last)</em></h2>
<div class="traceback">
<ul><li><div class="frame" id="frame-139688046167952">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/json/decoder.py"</cite>,
line <em class="line">353</em>,
in <code class="function">raw_decode</code></h4>
<div class="source library expanded"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>This can be used to decode a JSON document from a string that may</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>have extraneous data at the end.</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>"""</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>try:</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>obj, end = self.scan_once(s, idx)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>except StopIteration as err:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise JSONDecodeError("Expecting value", s, err.value) from None</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return obj, end</pre></div>
</div>
</li><li><div class="exc-divider">During handling of the above exception, another exception occurred:</div>
</li><li><div class="frame" id="frame-139688043963984">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/app.py"</cite>,
line <em class="line">2464</em>,
in <code class="function">__call__</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def __call__(self, environ, start_response):</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>"""The WSGI server calls the Flask application object as the</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>WSGI application. This calls :meth:`wsgi_app` which can be</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>wrapped to applying middleware."""</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return self.wsgi_app(environ, start_response)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def __repr__(self):</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return "<%s %r>" % (self.__class__.__name__, self.name)</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043964432">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/app.py"</cite>,
line <em class="line">2450</em>,
in <code class="function">wsgi_app</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>try:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>ctx.push()</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>response = self.full_dispatch_request()</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>except Exception as e:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>error = e</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>response = self.handle_exception(e)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>except: # noqa: B001</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>error = sys.exc_info()[1]</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return response(environ, start_response)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>finally:</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043963024">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/app.py"</cite>,
line <em class="line">1867</em>,
in <code class="function">handle_exception</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span># if we want to repropagate the exception, we can attempt to</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span># raise it with the whole traceback in case we can do that</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span># (the function was actually called from the except part)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span># otherwise, we just raise the error again</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if exc_value is e:</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>reraise(exc_type, exc_value, tb)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>else:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise e</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>self.log_exception((exc_type, exc_value, tb))</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>server_error = InternalServerError()</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043962512">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/_compat.py"</cite>,
line <em class="line">39</em>,
in <code class="function">reraise</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>import collections.abc as collections_abc</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def reraise(tp, value, tb=None):</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if value.__traceback__ is not tb:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise value.with_traceback(tb)</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise value</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>implements_to_string = _identity</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span>else:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>iterkeys = lambda d: d.iterkeys()</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043966224">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/app.py"</cite>,
line <em class="line">2447</em>,
in <code class="function">wsgi_app</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>ctx = self.request_context(environ)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>error = None</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>try:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>try:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>ctx.push()</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>response = self.full_dispatch_request()</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>except Exception as e:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>error = e</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>response = self.handle_exception(e)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>except: # noqa: B001</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>error = sys.exc_info()[1]</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043964560">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/app.py"</cite>,
line <em class="line">1952</em>,
in <code class="function">full_dispatch_request</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>request_started.send(self)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>rv = self.preprocess_request()</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if rv is None:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>rv = self.dispatch_request()</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>except Exception as e:</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>rv = self.handle_user_exception(e)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return self.finalize_request(rv)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def finalize_request(self, rv, from_error_handler=False):</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>"""Given the return value from a view function this finalizes</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>the request by converting it into a response and invoking the</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043963536">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/app.py"</cite>,
line <em class="line">1821</em>,
in <code class="function">handle_user_exception</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return self.handle_http_exception(e)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>handler = self._find_error_handler(e)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if handler is None:</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>reraise(exc_type, exc_value, tb)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return handler(e)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def handle_exception(self, e):</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>"""Handle an exception that did not have an error handler</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>associated with it, or that was raised from an error handler.</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043963280">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/_compat.py"</cite>,
line <em class="line">39</em>,
in <code class="function">reraise</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>import collections.abc as collections_abc</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def reraise(tp, value, tb=None):</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if value.__traceback__ is not tb:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise value.with_traceback(tb)</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise value</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>implements_to_string = _identity</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span>else:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>iterkeys = lambda d: d.iterkeys()</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043964304">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/app.py"</cite>,
line <em class="line">1950</em>,
in <code class="function">full_dispatch_request</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>self.try_trigger_before_first_request_functions()</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>try:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>request_started.send(self)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>rv = self.preprocess_request()</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if rv is None:</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>rv = self.dispatch_request()</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>except Exception as e:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>rv = self.handle_user_exception(e)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return self.finalize_request(rv)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def finalize_request(self, rv, from_error_handler=False):</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043963728">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/site-packages/flask/app.py"</cite>,
line <em class="line">1936</em>,
in <code class="function">dispatch_request</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>getattr(rule, "provide_automatic_options", False)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>and req.method == "OPTIONS"</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>):</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return self.make_default_options_response()</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span># otherwise dispatch to the handler for that endpoint</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return self.view_functions[rule.endpoint](**req.view_args)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def full_dispatch_request(self):</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>"""Dispatches the request and on top of that performs request</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>pre and postprocessing as well as HTTP exception catching and</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>error handling.</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043965520">
<h4>File <cite class="filename">"/usr/src/app/app.py"</cite>,
line <em class="line">93</em>,
in <code class="function">signin</code></h4>
<div class="source "><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return render_template('signin.html', error=errors)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>else:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>session['logged_in'] = True</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>session['username'] = username</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>conn.close()</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return loggedin()</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>else:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>errors = 'Enter the required fields'</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return render_template('login.html', error=errors)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre></div>
</div>
</li><li><div class="frame" id="frame-139688043966032">
<h4>File <cite class="filename">"/usr/src/app/app.py"</cite>,
line <em class="line">140</em>,
in <code class="function">loggedin</code></h4>
<div class="source "><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span>@app.route('/loggedin')</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span>def loggedin():</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if not session.get('logged_in'):</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return render_template('signin.html')</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>else:</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return render_template('loggedin.html', login=True, comments=getblogs())</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span>@app.route("/register")</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span>def register():</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return render_template('signup.html')</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043962832">
<h4>File <cite class="filename">"/usr/src/app/app.py"</cite>,
line <em class="line">39</em>,
in <code class="function">getblogs</code></h4>
<div class="source "><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>})</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>}</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>r = requests.post("http://repl:4000/eval", data=json.dumps(payload))</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>response = r.json()</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>data = json.loads(response["payload"])</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return data["comments"]</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span>def add_comment(username, comment):</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043966160">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/json/__init__.py"</cite>,
line <em class="line">348</em>,
in <code class="function">loads</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>s = s.decode(detect_encoding(s), 'surrogatepass')</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if (cls is None and object_hook is None and</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>parse_int is None and parse_float is None and</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>parse_constant is None and object_pairs_hook is None and not kw):</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return _default_decoder.decode(s)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if cls is None:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>cls = JSONDecoder</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if object_hook is not None:</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>kw['object_hook'] = object_hook</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if object_pairs_hook is not None:</pre></div>
</div>
</li><li><div class="frame" id="frame-139688043964880">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/json/decoder.py"</cite>,
line <em class="line">337</em>,
in <code class="function">decode</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>def decode(self, s, _w=WHITESPACE.match):</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>"""Return the Python representation of ``s`` (a ``str`` instance</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>containing a JSON document).</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>"""</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>obj, end = self.raw_decode(s, idx=_w(s, 0).end())</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>end = _w(s, end).end()</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>if end != len(s):</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise JSONDecodeError("Extra data", s, end)</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return obj</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre></div>
</div>
</li><li><div class="frame" id="frame-139688046167120">
<h4>File <cite class="filename">"/usr/local/lib/python3.7/json/decoder.py"</cite>,
line <em class="line">355</em>,
in <code class="function">raw_decode</code></h4>
<div class="source library"><pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"></span> </pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>"""</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>try:</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>obj, end = self.scan_once(s, idx)</pre>
<pre class="line before"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>except StopIteration as err:</pre>
<pre class="line current"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>raise JSONDecodeError("Expecting value", s, err.value) from None</pre>
<pre class="line after"><img src="?__debugger__=yes&cmd=resource&f=console.png" title="Open an interactive python shell in this frame"><span class="ws"> </span>return obj, end</pre></div>
</div>
</li></ul>
<blockquote>json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)</blockquote>
</div>
<div class="plain" style="display: none;">
<form action="/?__debugger__=yes&cmd=paste" method="post">
<p>
<input type="hidden" name="language" value="pytb">
This is the Copy/Paste friendly version of the traceback. <span class="pastemessage">You can also paste this traceback into
a <a href="https://gist.github.com/">gist</a>:
<input type="submit" value="create paste"></span>
</p>
<pre>Traceback (most recent call last):
File "/usr/local/lib/python3.7/json/decoder.py", line 353, in raw_decode
obj, end = self.scan_once(s, idx)
StopIteration: 0
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 2464, in __call__
return self.wsgi_app(environ, start_response)
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 2450, in wsgi_app
response = self.handle_exception(e)
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1867, in handle_exception
reraise(exc_type, exc_value, tb)
File "/usr/local/lib/python3.7/site-packages/flask/_compat.py", line 39, in reraise
raise value
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 2447, in wsgi_app
response = self.full_dispatch_request()
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1952, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1821, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/usr/local/lib/python3.7/site-packages/flask/_compat.py", line 39, in reraise
raise value
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1950, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1936, in dispatch_request
return self.view_functions[rule.endpoint](**req.view_args)
File "/usr/src/app/app.py", line 93, in signin
return loggedin()
File "/usr/src/app/app.py", line 140, in loggedin
return render_template('loggedin.html', login=True, comments=getblogs())
File "/usr/src/app/app.py", line 39, in getblogs
data = json.loads(response["payload"])
File "/usr/local/lib/python3.7/json/__init__.py", line 348, in loads
return _default_decoder.decode(s)
File "/usr/local/lib/python3.7/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/local/lib/python3.7/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)</pre>
</form>
</div>
<div class="explanation">
The debugger caught an exception in your WSGI application. You can now
look at the traceback which led to the error. <span class=""><p>To switch between the interactive traceback and the plaintext one, you can click on the "Traceback" headline. From the text traceback you can also create a paste of it. For code execution mouse-over the frame you want to debug and click on the console icon on the right side.</p><p>You can execute arbitrary Python code in the stack frames and there are some extra helpers available for introspection:</p><ul><li><code>dump()</code> shows all variables in the frame</li><li><code>dump(obj)</code> dumps all that's known about the object</li></ul></span>
</div>
<div class="footer">
Brought to you by <strong class="arthur">DON'T PANIC</strong>, your
friendly Werkzeug powered traceback interpreter.
</div>
</div>
<div class="pin-prompt">
<div class="inner">
<h3>Console Locked</h3>
<p>
The console is locked and needs to be unlocked by entering the PIN.
You can find the PIN printed out on the standard output of your
shell that runs the server.
</p><form>
<p>PIN:
<input type="text" name="pin" size="14">
<input type="submit" name="btn" value="Confirm Pin">
</p></form>
</div>
</div>
<!--
Traceback (most recent call last):
File "/usr/local/lib/python3.7/json/decoder.py", line 353, in raw_decode
obj, end = self.scan_once(s, idx)
StopIteration: 0
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 2464, in __call__
return self.wsgi_app(environ, start_response)
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 2450, in wsgi_app
response = self.handle_exception(e)
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1867, in handle_exception
reraise(exc_type, exc_value, tb)
File "/usr/local/lib/python3.7/site-packages/flask/_compat.py", line 39, in reraise
raise value
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 2447, in wsgi_app
response = self.full_dispatch_request()
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1952, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1821, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/usr/local/lib/python3.7/site-packages/flask/_compat.py", line 39, in reraise
raise value
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1950, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1936, in dispatch_request
return self.view_functions[rule.endpoint](**req.view_args)
File "/usr/src/app/app.py", line 93, in signin
return loggedin()
File "/usr/src/app/app.py", line 140, in loggedin
return render_template('loggedin.html', login=True, comments=getblogs())
File "/usr/src/app/app.py", line 39, in getblogs
data = json.loads(response["payload"])
File "/usr/local/lib/python3.7/json/__init__.py", line 348, in loads
return _default_decoder.decode(s)
File "/usr/local/lib/python3.7/json/decoder.py", line 337, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/local/lib/python3.7/json/decoder.py", line 355, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
-->
</body>
Assuming comments is an array of lines of text you can do this
Open in new window
What is triggering the XSS? Where are you seeing the warning?The above should be safe as it does not use innerHTML - instead creating the elements directly and populating the innerText property.