Is request data already sanitized by Flask?
Flask does nothing to request data besides parsing it from the raw HTTP request. It has no way to know what constraints an arbitrary function has. It's up to you to check any constraints. All data will be strings by default.  Don't use eval or exec.  Use your database driver's parametrized queries to avoid SQL injection.  If you render a template with Jinja it will escape data for use in HTML by default.
Should data which comes from the user (like cookie values, variable parts in a route, query args) be treated as insecure and processed in a particular way? Does Flask already sanitize escape input data so passing it to a function test(input_data) is secure?