Security review of a code snippet with exploit-level detail

Fill in

{{untrusted_sources}}

Where attacker-controlled data enterse.g. Query strings, path parameters, and any URL a user submits

{{code}}

The code to reviewe.g. Three Flask routes: invoice download, link preview, product search

{{context}}

How and where it's deployed, plus relevant infrastructuree.g. Flask behind nginx on AWS EC2, Postgres on RDS, multi-tenant

Example input

untrusted_sources: query strings, path parameters, and any URL a user submits
context: Flask app behind nginx on AWS EC2, Postgres on RDS, multi-tenant (each customer only sees their own invoices). Logged-in users are customers of our SaaS.
code:
```python
@app.route("/invoices/<invoice_id>/download")
@login_required
def download_invoice(invoice_id):
    filename = request.args.get("file", f"{invoice_id}.pdf")
    path = os.path.join("/srv/app/invoices", filename)
    return send_file(path)

@app.route("/api/link-preview")
@login_required
def link_preview():
    url = request.args["url"]
    resp = requests.get(url, timeout=5)
    title = re.search(r"<title>(.*?)</title>", resp.text, re.S)
    return {"title": title.group(1) if title else None, "status": resp.status_code}

@app.route("/search")
def search():
    q = request.args.get("q", "")
    rows = db.execute(f"SELECT id, name FROM products WHERE name ILIKE '%{q}%'").fetchall()
    return f"<h2>Results for {q}</h2>" + "".join(f"<p>{r.name}</p>" for r in rows)
```