Find the safe one

Web & API Security Difficulty ~7 min +10 XP

Four handlers from the same account service, written in the same style by the same team, all decorated with login_required and all reading input from the request. Three of them contain a different, genuine vulnerability: one is injectable, one reflects attacker-controlled markup, and one will fetch any address you point it at. The fourth does everything correctly. This is the inverse of the usual exercise, so being able to name one bug is not enough: you have to clear a handler completely, which means proving the other three wrong. Submit the name of the only function that is safe.

Play freely - sign up to submit your answer and earn XP.

Solved! +10 XP