Where does the command stop and the data start?

Type a value for /ping?host=, then flip between this week's three real implementations. Watch where the boundary between command and data is — and where an argument vector moves it. Nothing runs; this is a tokenizer, not a shell.

The host parameter

Payloads from the worksheet:

Server implementation vulnerable_app.py — shell=True argv, shell=False — no allow-list solution_app.py — allow-list + argv

Where does the command stop and the data start?

What the server does