Vulnerable code sample

from flask import Flask, request, render_template_string
import os

app = Flask(__name__)

# This represents a feature where a user can define a custom transformation
# on some data. The user's input is a template string.
@app.route('/apply-transformation')
def apply_transformation():
    # Get the user-defined transformation logic from a request parameter.
    # In the vulnerable version, this input is not sanitized.
    user_transformation_template = request.args.get('transformation', 'No transformation provided.')

    # Some dummy data that the transformation would be applied to.
    data_context = {
        'username': 'testuser',
        'value': 42
    }
    
    # VULNERABILITY: The user-provided string is directly rendered as a template.
    # An attacker can inject template syntax to execute Python code.
    # Example malicious payload for 'transformation' parameter:
    # {{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}
    try:
        rendered_output = render_template_string(user_transformation_template, data=data_context)
        return f"Transformation Result: {rendered_output}"
    except Exception as e:
        return f"Error during transformation: {str(e)}", 500

if __name__ == '__main__':
    # Running in debug mode on 0.0.0.0 to simulate a typical containerized app setup.
    app.run(host='0.0.0.0', port=8080, debug=True)