Briggs599 · Briggs599 · Mar 10, 2026
diff --git a/requirements.txt b/requirements.txt
@@ -19,6 +19,7 @@ cffi==1.17.1
 charset-normalizer==3.4.2
 click==8.2.1
 cryptography==44.0.3
+defusedxml==0.7.1
 dnspython==2.6.1
 elementpath==5.0.3
 Flask==3.1.0

diff --git a/templates/js/testsuiteutils.js b/templates/js/testsuiteutils.js
@@ -148,7 +148,7 @@ function submitParameterNamesForm(testcase) {
 
 function decodeEscapeSequence(html) {
     var txt = document.createElement("textarea");
-    txt.innerHTML = html;
+    txt.textContent = html;
     return txt.value;
 };
 

diff --git a/testcode/BenchmarkTest00001.py b/testcode/BenchmarkTest00001.py
@@ -41,10 +41,17 @@ def BenchmarkTest00001_post():
 		bar = param
 
 		import codecs
+		import os
 		import helpers.utils
+		from werkzeug.utils import secure_filename
 
 		try:
-			fileTarget = codecs.open(f'{helpers.utils.TESTFILES_DIR}/{bar}','r','utf-8')
+			sanitized_filename = secure_filename(bar)
+			full_path = os.path.abspath(os.path.join(helpers.utils.TESTFILES_DIR, sanitized_filename))
+			base_dir = os.path.abspath(helpers.utils.TESTFILES_DIR)
+			if os.path.commonpath([base_dir, full_path]) != base_dir:
+				raise ValueError("Path traversal detected")
+			fileTarget = codecs.open(full_path,'r','utf-8')
 
 			RESPONSE += (
 				f"Access to file: \'{escape_for_html(fileTarget.name)}\' created."

diff --git a/testcode/BenchmarkTest00003.py b/testcode/BenchmarkTest00003.py
@@ -44,10 +44,16 @@ def BenchmarkTest00003_post():
 		bar = thing.doSomething(param)
 
 		import codecs
+		import os
 		import helpers.utils
+		from werkzeug.utils import secure_filename
 
 		try:
-			fileTarget = codecs.open(f'{helpers.utils.TESTFILES_DIR}/{bar}','r','utf-8')
+			safe_bar = secure_filename(bar)
+			file_path = os.path.join(helpers.utils.TESTFILES_DIR, safe_bar)
+			if os.path.commonpath([os.path.abspath(file_path), os.path.abspath(helpers.utils.TESTFILES_DIR)]) != os.path.abspath(helpers.utils.TESTFILES_DIR):
+				raise ValueError("Invalid path")
+			fileTarget = codecs.open(file_path, 'r', 'utf-8')
 
 			RESPONSE += (
 				f"Access to file: \'{escape_for_html(fileTarget.name)}\' created."

diff --git a/testcode/BenchmarkTest00005.py b/testcode/BenchmarkTest00005.py
@@ -15,7 +15,9 @@
   Created: 2025
 '''
 
+import os
 from flask import redirect, url_for, request, make_response, render_template
+from werkzeug.utils import secure_filename
 from helpers.utils import escape_for_html
 
 def init(app):
@@ -49,15 +51,19 @@ def BenchmarkTest00005_post():
 		fileName = None
 		fd = None
 
-		if '../' in bar:
-			RESPONSE += (
-				'File name must not include \'../\''
-			)
-			return RESPONSE
+		bar = secure_filename(bar)
+		if not bar:
+			return "Invalid filename"
+
+		base_dir = os.path.abspath(helpers.utils.TESTFILES_DIR)
+		file_path = os.path.abspath(os.path.join(base_dir, bar))
+
+		if not file_path.startswith(base_dir):
+			return "Access denied: path outside allowed directory"
 
 		try:
-			fileName = f'{helpers.utils.TESTFILES_DIR}/{bar}'
-			fd = open(fileName, 'rb')
+			fileName = file_path
+			fd = open(file_path, 'rb')
 			RESPONSE += (
 				f'The beginning of file: \'{escape_for_html(fileName)}\' is:\n\n'
 				f'{escape_for_html(fd.read(1000).decode('utf-8'))}'

diff --git a/testcode/BenchmarkTest00006.py b/testcode/BenchmarkTest00006.py
@@ -15,7 +15,9 @@
   Created: 2025
 '''
 
+import os
 from flask import redirect, url_for, request, make_response, render_template
+from werkzeug.utils import secure_filename
 from helpers.utils import escape_for_html
 
 def init(app):
@@ -56,8 +58,14 @@ def BenchmarkTest00006_post():
 			return RESPONSE
 
 		try:
-			fileName = f'{helpers.utils.TESTFILES_DIR}/{bar}'
-			fd = open(fileName, 'wb')
+			safe_bar = secure_filename(bar)
+			fileName = f'{helpers.utils.TESTFILES_DIR}/{safe_bar}'
+			base_dir = os.path.abspath(helpers.utils.TESTFILES_DIR)
+			resolved_path = os.path.abspath(fileName)
+			if os.path.commonpath([base_dir, resolved_path]) != base_dir:
+				RESPONSE += 'Invalid file path: path traversal detected'
+				return RESPONSE
+			fd = open(resolved_path, 'wb')
 			RESPONSE += (
 				f'Now ready to write to file: {escape_for_html(fileName)}'
 			)

diff --git a/testcode/BenchmarkTest00013.py b/testcode/BenchmarkTest00013.py
@@ -48,7 +48,7 @@ def BenchmarkTest00013_post():
 			bar = lst[1]
 
 		import elementpath
-		import xml.etree.ElementTree as ET
+		from defusedxml import ElementTree as ET
 		import helpers.utils
 
 		try:

diff --git a/testcode/BenchmarkTest00014.py b/testcode/BenchmarkTest00014.py
@@ -43,7 +43,7 @@ def BenchmarkTest00014_post():
 		bar = base64.b64decode(tmp).decode('utf-8')
 
 		import elementpath
-		import xml.etree.ElementTree as ET
+		from defusedxml import ElementTree as ET
 		import helpers.utils
 
 		if '\'' in bar:

diff --git a/testcode/BenchmarkTest00015.py b/testcode/BenchmarkTest00015.py
@@ -43,7 +43,7 @@ def BenchmarkTest00015_post():
 			bar = param
 
 		import elementpath
-		import xml.etree.ElementTree as ET
+		import defusedxml.ElementTree as ET
 		import helpers.utils
 
 		if '\'' in bar:

diff --git a/testcode/BenchmarkTest00016.py b/testcode/BenchmarkTest00016.py
@@ -45,7 +45,7 @@ def BenchmarkTest00016_post():
 			bar = param
 
 		import elementpath
-		import xml.etree.ElementTree as ET
+		from defusedxml.ElementTree import parse
 		import helpers.utils
 
 		if '\'' in bar:
@@ -55,7 +55,7 @@ def BenchmarkTest00016_post():
 			return RESPONSE
 
 		try:
-			root = ET.parse(f'{helpers.utils.RES_DIR}/employees.xml')
+			root = parse(f'{helpers.utils.RES_DIR}/employees.xml')
 			query = f"/Employees/Employee[@emplid=\'{bar}\']"
 			nodes = elementpath.select(root, query)
 			node_strings = []

diff --git a/testcode/BenchmarkTest00018.py b/testcode/BenchmarkTest00018.py
@@ -46,9 +46,8 @@ def BenchmarkTest00018_post():
 		try:
 			fd = open(f'{helpers.utils.RES_DIR}/employees.xml', 'rb')
 			root = lxml.etree.parse(fd)
-			query = f'/Employees/Employee[@emplid=\'{bar}\']'
-			run_query = lxml.etree.XPath(query)
-			nodes = run_query(root)
+			run_query = lxml.etree.XPath("//Employees/Employee[@emplid=$id]")
+			nodes = run_query(root, id=bar)
 			node_strings = []
 			for node in nodes:
 				node_strings.append(' '.join([e.text for e in node]))
@@ -58,7 +57,7 @@ def BenchmarkTest00018_post():
 			)
 		except:
 			RESPONSE += (
-				f'Error parsing XPath Query: \'{escape_for_html(query)}\''
+				'Error parsing XPath Query'
 			)
 
 		return RESPONSE

diff --git a/testcode/BenchmarkTest00019.py b/testcode/BenchmarkTest00019.py
@@ -50,9 +50,8 @@ def BenchmarkTest00019_post():
 		try:
 			fd = open(f'{helpers.utils.RES_DIR}/employees.xml', 'rb')
 			root = lxml.etree.parse(fd)
-			query = f'/Employees/Employee[@emplid=\'{bar}\']'
-			run_query = lxml.etree.XPath(query)
-			nodes = run_query(root)
+			run_query = lxml.etree.XPath("/Employees/Employee[@emplid=$id]")
+			nodes = run_query(root, id=bar)
 			node_strings = []
 			for node in nodes:
 				node_strings.append(' '.join([e.text for e in node]))
@@ -62,7 +61,7 @@ def BenchmarkTest00019_post():
 			)
 		except:
 			RESPONSE += (
-				f'Error parsing XPath Query: \'{escape_for_html(query)}\''
+				'Error parsing XPath Query.'
 			)
 
 		return RESPONSE

diff --git a/testcode/BenchmarkTest00075.py b/testcode/BenchmarkTest00075.py
@@ -50,10 +50,11 @@ def BenchmarkTest00075_post():
 			return RESPONSE
 
 		try:
-			exec(bar)
-		except:
+			import ast
+			ast.literal_eval(bar)
+		except (ValueError, SyntaxError):
 			RESPONSE += (
-				f'Error executing statement \'{escape_for_html(bar)}\''
+				f'Error evaluating literal \'{escape_for_html(bar)}\''
 			)
 
 		return RESPONSE

diff --git a/testcode/BenchmarkTest00078.py b/testcode/BenchmarkTest00078.py
@@ -43,17 +43,17 @@ def BenchmarkTest00078_post():
 		string9895 += 'snapes on a plane'
 		bar = string9895[4:-17]
 
-		import pickle
+		import json
 		import base64
 		import helpers.utils
 
 		helpers.utils.sharedstr = "no pickles to be seen here"
 
 		try:
-			unpickled = pickle.loads(base64.urlsafe_b64decode(bar))
+			unpickled = json.loads(base64.urlsafe_b64decode(bar))
 		except:
 			RESPONSE += (
-				'Unpickling failed!'
+				'Deserialization failed!'
 			)
 			return RESPONSE
 

diff --git a/testcode/BenchmarkTest00085.py b/testcode/BenchmarkTest00085.py
@@ -15,7 +15,9 @@
   Created: 2025
 '''
 
+import os
 from flask import redirect, url_for, request, make_response, render_template
+from werkzeug.utils import secure_filename
 from helpers.utils import escape_for_html
 
 def init(app):
@@ -41,7 +43,12 @@ def BenchmarkTest00085_post():
 		import helpers.utils
 
 		try:
-			fileName = f'{helpers.utils.TESTFILES_DIR}/{bar}'
+			fileName = f'{helpers.utils.TESTFILES_DIR}/{secure_filename(bar)}'
+			# Verify the resolved path stays within the intended directory
+			abs_path = os.path.abspath(fileName)
+			base_dir = os.path.abspath(helpers.utils.TESTFILES_DIR)
+			if os.path.commonpath([abs_path, base_dir]) != base_dir:
+				raise IOError("Invalid file path: path traversal detected")
 			fd = open(fileName, 'wb')
 			RESPONSE += (
 				f'Now ready to write to file: {escape_for_html(fileName)}'

diff --git a/testcode/BenchmarkTest00086.py b/testcode/BenchmarkTest00086.py
@@ -17,6 +17,8 @@
 
 from flask import redirect, url_for, request, make_response, render_template
 from helpers.utils import escape_for_html
+from werkzeug.utils import secure_filename
+import os
 
 def init(app):
 
@@ -41,14 +43,18 @@ def BenchmarkTest00086_post():
 
 		import helpers.utils
 
-		if '../' in bar:
-			RESPONSE += (
-				'File name must not contain \'../\''
-			)
+		safe_name = secure_filename(bar)
+		if not safe_name:
+			RESPONSE += 'Invalid file name'
+			return RESPONSE
+
+		full_path = os.path.abspath(os.path.join(helpers.utils.TESTFILES_DIR, safe_name))
+		if not full_path.startswith(os.path.abspath(helpers.utils.TESTFILES_DIR)):
+			RESPONSE += 'Path traversal detected'
 			return RESPONSE
 
 		try:
-			fileName = f'{helpers.utils.TESTFILES_DIR}/{bar}'
+			fileName = full_path
 			fd = open(fileName, 'wb')
 			RESPONSE += (
 				f'Now ready to write to file: {escape_for_html(fileName)}'

diff --git a/testcode/BenchmarkTest00095.py b/testcode/BenchmarkTest00095.py
@@ -15,7 +15,9 @@
   Created: 2025
 '''
 
+import os
 from flask import redirect, url_for, request, make_response, render_template
+from werkzeug.utils import secure_filename
 from helpers.utils import escape_for_html
 
 def init(app):
@@ -39,7 +41,11 @@ def BenchmarkTest00095_post():
 		import helpers.utils
 
 		try:
-			fileName = f'{helpers.utils.TESTFILES_DIR}/{bar}'
+			fileName = f'{helpers.utils.TESTFILES_DIR}/{secure_filename(bar)}'
+			abs_path = os.path.abspath(fileName)
+			base_dir = os.path.abspath(helpers.utils.TESTFILES_DIR)
+			if os.path.commonpath([abs_path, base_dir]) != base_dir:
+				raise IOError("Path traversal detected")
 			with open(fileName, 'wb') as fd:
 				RESPONSE += (
 					f'Now ready to write to file: {escape_for_html(fileName)}'

diff --git a/testcode/BenchmarkTest00105.py b/testcode/BenchmarkTest00105.py
@@ -45,9 +45,9 @@ def BenchmarkTest00105_post():
 		try:
 			fd = open(f'{helpers.utils.RES_DIR}/employees.xml', 'rb')
 			root = lxml.etree.parse(fd)
-			query = f'/Employees/Employee[@emplid=\'{bar}\']'
+			query = '/Employees/Employee[@emplid=$id]'
 			run_query = lxml.etree.XPath(query)
-			nodes = run_query(root)
+			nodes = run_query(root, id=bar)
 			node_strings = []
 			for node in nodes:
 				node_strings.append(' '.join([e.text for e in node]))

diff --git a/testcode/BenchmarkTest00106.py b/testcode/BenchmarkTest00106.py
@@ -39,12 +39,12 @@ def BenchmarkTest00106_post():
 		import lxml.etree
 		import helpers.utils
 
+		query = '/Employees/Employee[@emplid=$id]'
 		try:
 			fd = open(f'{helpers.utils.RES_DIR}/employees.xml', 'rb')
 			root = lxml.etree.parse(fd)
-			query = f'/Employees/Employee[@emplid=\'{bar}\']'
 			run_query = lxml.etree.XPath(query)
-			nodes = run_query(root)
+			nodes = run_query(root, id=bar)
 			node_strings = []
 			for node in nodes:
 				node_strings.append(' '.join([e.text for e in node]))

diff --git a/testcode/BenchmarkTest00156.py b/testcode/BenchmarkTest00156.py
@@ -15,6 +15,7 @@
   Created: 2025
 '''
 
+import ast
 from flask import redirect, url_for, request, make_response, render_template
 from helpers.utils import escape_for_html
 
@@ -41,7 +42,7 @@ def BenchmarkTest00156_post():
 
 		try:
 			RESPONSE += (
-				eval(bar)
+				str(ast.literal_eval(bar))
 			)
 		except:
 			RESPONSE += (

diff --git a/testcode/BenchmarkTest00159.py b/testcode/BenchmarkTest00159.py
@@ -42,7 +42,8 @@ def BenchmarkTest00159_post():
 			bar = lst[0]
 
 		try:
-			exec(bar)
+			import ast
+			ast.literal_eval(bar)
 		except:
 			RESPONSE += (
 				f'Error executing statement \'{escape_for_html(bar)}\''

diff --git a/testcode/BenchmarkTest00161.py b/testcode/BenchmarkTest00161.py
@@ -37,7 +37,7 @@ def BenchmarkTest00161_post():
 		bar = "This should never happen" if (7*42) - num > 200 else param
 
 		try:
-			exec(bar)
+			RESPONSE += escape_for_html(bar)
 		except:
 			RESPONSE += (
 				f'Error executing statement \'{escape_for_html(bar)}\''