flask-confusion

Confusion & Inconsistent Interpretation

Running the Examples

All examples in this category share a single Docker Compose environment:

cd vulnerabilities/python/flask/confusion
docker compose up -d

# View logs
docker compose logs -f

# Stop and clean up
docker compose down

The application will be available at http://localhost:8000.

Subcategories

1. Input Source — Source precedence bugs occur when different code paths read the "same" logical input from different locations (path vs. query vs. body vs. headers vs. cookies).
2. Authentication — Authentication confusion occurs when the code that verifies identity examines a different value than the code that acts on identity.
3. Authorization — Authorization confusion happens when the code that checks permissions examines a different resource or identity than the code that performs the action.
4. Cardinality — Cardinality confusion occurs when one part of the code treats a parameter as a single value while another treats it as a list. The parser, validator, and business logic disagree on whether you sent one item or many.
5. Normalization — Character normalization confusion happens when two code paths apply different string transformations to the same logical input.