Pymiers's Blog

import ast
import traceback
from flask import Flask, render_template, request

app = Flask(__name__)

@app.get("/")
def home():
    return render_template("index.html")

@app.post("/check")
def check():
    try:
        ast.parse(**request.json)
        return {"status": True, "error": None}
    except Exception:
        return {"status": False, "error": traceback.format_exc()}

if __name__ == '__main__':
    app.run(debug=True)

def main():
    print("Here's the flag: ")
    print(FLAG)

FLAG = "TRX{fake_flag_for_testing}"

main()

Python 3.10.12 (main, Feb  4 2025, 14:57:36) [GCC 11.4.0] on linux
>>> import ast
>>> print(ast.parse.__doc__)

Parse the source into an AST node.
Equivalent to compile(source, filename, mode, PyCF_ONLY_AST).
Pass type_comments=True to get back type comments where the syntax allows.

>>> print(compile.__doc__)
Compile source into a code object that can be executed by exec() or eval().

The source code may represent a Python module, statement or expression.
The filename will be used for run-time error messages.
The mode must be 'exec' to compile a module, 'single' to compile a
single (interactive) statement, or 'eval' to compile an expression.
The flags argument, if present, controls which future statements influence
the compilation of the code.
The dont_inherit argument, if true, stops the compilation inheriting
the effects of any future statements in effect in the code calling
compile; if absent or false these statements do influence the compilation,
in addition to any features explicitly specified.

ast.parse(source, filename='<unknown>', mode='exec', *, type_comments=False, feature_version=None)¶

>>> ast.parse(open(ast.__file__).read(), '<unknown>')
<ast.Module object at 0x752c51f9d7e0>
>>> ast.parse('for i in range(10):\n    print(i)', '<unknown>')
<ast.Module object at 0x752c520ebcd0>
>>> ast.parse('for i in range(10):\n    print(i', '<unknown>')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
  File "<unknown>", line 2
    print(i
         ^
SyntaxError: '(' was never closed

>>> ast.parse("for i in range(10):\n    print(i", "secret.py")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
  File "secret.py", line 2
    def main():
             ^
SyntaxError: '(' was never closed

>>> ast.parse("\n\n\n\n\ndef", "secret.py")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
  File "secret.py", line 6
    FLAG = "TRX{fake_flag_for_testing}"
       ^
SyntaxError: invalid syntax

>>> ast.parse("def", "/etc/passwd")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.10/ast.py", line 50, in parse
    return compile(source, filename, mode, flags,
  File "/etc/passwd", line 1
    root:x:0:0:root:/root:/bin/bash
       ^
SyntaxError: invalid syntax

PyObject *
_PyErr_ProgramDecodedTextObject(PyObject *filename, int lineno, const char* encoding)
{
...
    FILE *fp = _Py_fopen_obj(filename, "r" PY_STDIOTEXTMODE);