Vulnerable code sample

import os
from flask import Flask, request, jsonify
from mako.lookup import TemplateLookup

app = Flask(__name__)

# Simulate Tautulli's in-memory configuration for a newsletter agent.
# This would be settable via an unauthenticated API on a fresh install.
NEWSLETTER_CONFIG = {
    'template_folder': 'default_templates',
    'template_file': 'newsletter.mako'
}

@app.route('/api/v2/set_newsletter_config', methods=['POST'])
def set_newsletter_config():
    """
    Simulates the unauthenticated endpoint allowing an attacker to set the
    custom template directory for a newsletter agent.
    """
    data = request.get_json()
    # VULNERABLE: The 'template_folder' path from the user is not sanitized or validated.
    # An attacker can set this to a remote path like an SMB share, e.g., '\\\\attacker-ip\\share'.
    if 'template_folder' in data:
        NEWSLETTER_CONFIG['template_folder'] = data['template_folder']
    return jsonify({"response": {"result": "success", "message": "Configuration saved"}})

@app.route('/api/v2/render_newsletter_template', methods=['GET'])
def render_newsletter_template():
    """
    Simulates the endpoint that renders the template from the configured directory.
    This triggers code execution if the path points to a malicious template.
    """
    try:
        template_dir = NEWSLETTER_CONFIG.get('template_folder')
        template_file = NEWSLETTER_CONFIG.get('template_file')

        # VULNERABLE: TemplateLookup is initialized with the user-controlled path.
        # It will attempt to read files from this path, including remote SMB shares.
        mylookup = TemplateLookup(directories=[template_dir])
        mytemplate = mylookup.get_template(template_file)

        # The Mako template engine executes any Python code embedded in the template
        # during rendering. A malicious template could contain: <% import os; os.system('calc') %>
        return mytemplate.render()
    except Exception as e:
        return f"Error: {e}", 500