const express = require("express")
const { graphqlHTTP } = require("express-graphql")
const { buildSchema } = require("graphql")
const path = require("path");
const crypto = require('crypto');

const STRENGTH_CHALLENGE = 999;
const NUM_CHALLENGE = 40;
const ERROR_MSG = "Wrong !!!";
const CORRECT_MSG = "OK !!!";

var otps = Object.create(null);
otps["admin"] = Object.create(null);
function genOtp(ip, force = false) {
  if (force || !otps["admin"][ip]) {
    function intToString(v) {
      let s = v.toString();
      while (s.length !== STRENGTH_CHALLENGE.toString().length) s = '0' + s;
      return s;
    }
    const otp = [];
    for (let i = 0; i < NUM_CHALLENGE; ++i)
      otp.push(
        intToString(crypto.randomInt(0, STRENGTH_CHALLENGE))
      );
    otps["admin"][ip] = otp;
  }
}

const rateLimiter = require('express-rate-limit')({
  windowMs: 30 * 60 * 1000,
  max: 5,
  standardHeaders: true,
  legacyHeaders: false,
  onLimitReached: async (req) => genOtp(req.ip, true)
});

function checkOtp(username, ip, idx, otp) {
  if (!otps[username]) return false;
  if (!otps[username][ip]) return false;
  return otps[username][ip][idx] === otp;
}

// Construct a schema, using GraphQL schema language
const schema = buildSchema(`
  type Query {
    otp(u: String!, i: Int!, otp: String!): String!
  }
`);

const root = {
  otp: ({ u, i, otp }, req) => {
    if (i >= NUM_CHALLENGE || i < 0) return ERROR_MSG;
    if (!checkOtp(u, req.ip, i, otp)) return ERROR_MSG;
    rateLimiter.resetKey(req.ip);
    otps[u][req.ip][i] = 1;
    return CORRECT_MSG;
  },
}

const app = express();

... 

app.use((req, res, next) => { genOtp(req.ip); next() });
app.use(require('body-parser').json({ limit: '128b' }));
app.use(
  "/graphql",
  rateLimiter,
  graphqlHTTP({
    schema: schema,
    rootValue: root,
  })
);

app.get('/admin', (req, res) => {
  let sum = 0;
  for (let i = 0; i < NUM_CHALLENGE; ++i)
    sum += otps["admin"][req.ip][i]; 
  res.send((sum === NUM_CHALLENGE) ? process.env.FLAG : ERROR_MSG);
});

function isDangerousValue(s) {
  return s.includes('admin') || s.includes('\\'); // Linux does not need to support "\"
}

/** Secured WAF for admin on Linux */
function isDangerousPayload(obj) {
  if (!obj) return false;
  const keys = Object.keys(obj);

  // check key, value
  for (let i = 0; i < keys.length; ++i) {
    const key = keys[i];
    if (isDangerousValue(key)) return true;
    if (typeof obj[key] === 'object') {
      if (isDangerousPayload(obj[key])) return true;
    } else {
      const val = obj[key].toString();
      if (isDangerousValue(val)) return true;
    }
  }
  return false;
}

module.exports = {
  isDangerousValue,
  isDangerousPayload,
}

const { isDangerousPayload, isDangerousValue } = require('./waf');
app.use((req, res, next) => {
  if (isDangerousValue(req.url)) return res.send(ERROR_MSG);
  if (isDangerousPayload(req.query)) return res.send(ERROR_MSG);
  next();
});

import { $, escapeHTML } from "bun";
import qs from "qs";

const port = process.env.PORT || 3000;
const logFile = process.env.LOGFILE || ".log";

const server = Bun.serve({
    host: "0.0.0.0",
    port: port,
    async fetch(req) {
        const url = new URL(req.url);
        if (url.pathname === "/chall") {
            const params = qs.parse(url.search, { ignoreQueryPrefix: true });
            if (params.url.length < escapeHTML(params.url).length) {    // dislike suspicious chars
                return new Response("sorry, but the given URL is too complex for me");
            }

            const lyURL = new URL(params.url, "https://www.lycorp.co.jp");
            if (lyURL.origin !== "https://www.lycorp.co.jp") {
                return new Response("don't you know us?");
            }

            const rawFetched = await $`curl -sL ${lyURL}`.text();
            const counts = {
                "L": [...rawFetched.matchAll(/LINE/g)].length,
                "Y": [...rawFetched.matchAll(/Yahoo!/g)].length,
            }

            await $`echo $(date '+%Y-%m-%dT%H:%M:%S%z') - ${params.url} ::: ${JSON.stringify(counts)} >> ${logFile}`;

            const highlighted = escapeHTML(rawFetched)
                .replace(/LINE/g, "<mark style='color: #06C755'>$&</mark>")
                .replace(/Yahoo!/g, "<mark style='color: #FF0033'>$&</mark>");
            const html = `
                <h1>Your score is... 🐐<${counts.L + counts.Y}</h1>
                <details open>
                    <summary>Result</summary>
                    <blockquote>${highlighted}</blockquote>            
                </details>
            `;
            return new Response(html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
        } else {
            return new Response("🎶😺≡≡≡😺🎶 Happy Happy Happy~")
        }
    }
});

console.log(`😺 on http://localhost:${server.port}`);

import { $ } from "bun";

await $`echo ${{ raw: '$(foo) `bar` "baz"' }}`
// => bun: command not found: foo
// => bun: command not found: bar
// => baz