Vulnerable code sample

import os
from pathlib import Path
from fastapi import Request
from fastapi.responses import Response, FileResponse
from nicegui import app, ui

DUMMY_FILE_PATH = Path("large_vulnerable_file.bin")
DUMMY_FILE_SIZE = 100 * 1024 * 1024  # 100 MB

if not DUMMY_FILE_PATH.exists():
    print(f"Creating a {DUMMY_FILE_SIZE // 1024 // 1024}MB dummy file...")
    with open(DUMMY_FILE_PATH, "wb") as f:
        f.write(os.urandom(DUMMY_FILE_SIZE))
    print("Dummy file created.")

# The following custom route simulates the vulnerable logic that existed
# in NiceGUI's internal media file handling prior to version 3.9.0.
# The vulnerability was that a user-controlled query parameter could
# bypass the intended streaming response.
@app.get("/media")
async def vulnerable_media_endpoint(request: Request):
    # An attacker provides a query parameter, here simulated as 'bypass_chunking'.
    # The vulnerable code path is triggered without proper validation.
    if "bypass_chunking" in request.query_params:
        # VULNERABLE PATH: The entire file is read into server memory at once.
        # Concurrent requests will lead to high memory usage and DoS.
        with open(DUMMY_FILE_PATH, "rb") as f:
            content = f.read()
        return Response(content, media_type="application/octet-stream")
    
    # NORMAL PATH: The file is streamed using FileResponse, which properly
    # handles HTTP Range requests for efficient delivery of large files.
    else:
        return FileResponse(DUMMY_FILE_PATH)

# UI to provide links for demonstrating the vulnerability.
ui.label("Demonstration of CVE-2026-33332")
ui.link(
    "Access file normally (safe, streaming)",
    "/media",
    new_tab=True
)
ui.link(
    "Access file with exploit (VULNERABLE, loads 100MB into server RAM)",
    "/media?bypass_chunking=true",
    new_tab=True,
)

ui.run()