Vulnerable code sample

import logging
from flask import Flask, request

app = Flask(__name__)

# In a real application, this log file would be the main application log.
LOG_FILE = 'vulnerable_app.log'
logging.basicConfig(
    filename=LOG_FILE,
    level=logging.INFO,
    format='%(asctime)s - %(message)s'
)

@app.route('/log_js_errors', methods=['POST'])
def log_js_errors():
    """
    This endpoint is accessible to any authenticated user, including guests.
    It takes an 'error_message' from a JSON payload.
    """
    data = request.get_json()
    if data and 'error_message' in data:
        # The attacker-controlled string is written directly into the log file.
        logging.info(f"CLIENT_ERROR: {data['error_message']}")
    return {"status": "logged"}, 200

@app.route('/logFile')
def view_log_file():
    """
    This is an administrator-only view for the log file.
    """
    try:
        with open(LOG_FILE, 'r', encoding='utf-8') as f:
            log_content = f.read()
    except FileNotFoundError:
        log_content = "Log file is empty or does not exist."

    # VULNERABILITY: The raw log content is read and embedded directly
    # into the HTML response without any escaping. If a guest user submitted
    # a malicious script via /log_js_errors, it will be rendered and
    # executed in the administrator's browser.
    html_template = f"""
    <!DOCTYPE html>
    <html>
    <head>
        <title>Log Viewer</title>
    </head>
    <body>
        <h1>Application Log</h1>
        <pre>{log_content}</pre>
    </body>
    </html>
    """
    return html_template