# xxe_upload_server.py - Uploads SVG, renders with lxml resolving entities
from flask import Flask, request
from lxml import etree

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload_svg():
    svg_data = request.data
    # Vulnerable: parses with entity resolution enabled
    parser = etree.XMLParser(resolve_entities=True, no_network=False)
    doc = etree.fromstring(svg_data, parser)
    # Extract something from SVG
    return etree.tostring(doc)

if __name__ == '__main__':
    app.run(port=5000)