Upload app.py

app.py

@@ -31,7 +31,8 @@ FORBIDDEN_KEYWORDS = [
     "reverse shell", "sqlmap", "chmod", "chown", "exec "
 ]
 FORBIDDEN_CMDLIKE = ["curl ", "wget ", "sudo ", "bash -i", "nc ", "ncat ", "rm -rf"]
-FORBIDDEN_SUBSTR = ["$(", "${", "\x", "base64 -d"]
+# OJO: usar \\x aquí para que el archivo final contenga \x y no sea interpretado como escape por Python
+FORBIDDEN_SUBSTR = ["$(", "${", "\\x", "base64 -d"]
 FORBIDDEN_HEX_RE = re.compile(r"0x[0-9a-fA-F]{2,}")  # compilar por separado, simple y seguro
 
 def contains_forbidden(text: str) -> bool: