Vulnerable code sample

import tornado.ioloop
import tornado.web
import logging
import io

class UploadHandler(tornado.web.RequestHandler):
    def post(self):
    # VULNERABLE: This code is susceptible to path traversal
        files = self.request.files.get('file')
        if files:
            for file in files:
                try:
                    # Simulate processing the file (could involve parsing)
                    # The vulnerability is in how Tornado *attempts* to parse
                    # even malformed multipart/form-data, generating logs.
                    # This example just logs the filename.  The *actual*
                    # vulnerability is in the Tornado internals.  This is
                    # just representative of a handler that *uses* the
                    # vulnerable multipart parsing.

                    logging.warning(f"Received file: {file['filename']}")

                    # Simulate some expensive operation after the parse that exacerbates
                    # the DOS.  Without this, it would just be a log flooding issue.
                    # This makes the server actually become unresponsive.  This is
                    # also NOT the vulnerability. The vulnerability is the parsing.
                    # This just makes the overall DOS more severe.
                    for i in range(1000000):
                         pass


                    self.write("File uploaded successfully")
                except Exception as e:
                    logging.error(f"Error processing file: {e}")
                    self.set_status(500)
                    self.write("Error uploading file")
        else:
            self.set_status(400)
            self.write("No file uploaded")


def make_app():
    return tornado.web.Application([
        (r"/upload", UploadHandler),
    ])

if __name__ == "__main__":
    logging.basicConfig(level=logging.WARNING)
    app = make_app()
    app.listen(8888)
    tornado.ioloop.IOLoop.current().start()