services

services_vulnerable/rusgram/content/Dockerfile

@@ -0,0 +1,6 @@
+FROM python:3.9-alpine
+WORKDIR /app
+ADD requirements.txt .
+RUN pip3 install -r requirements.txt
+ADD content.py .
+ENTRYPOINT ["python3", "content.py"]

services_vulnerable/rusgram/content/content.py

@@ -0,0 +1,49 @@
+#!/usr/bin/python3
+from flask import Flask, render_template, request, redirect
+import requests as r
+app = Flask(__name__, template_folder='files')
+database_node_port = 5002
+content_node_port = 5004
+database_node = "database:" + str(database_node_port)
+
+
+@app.route('/<path:path>', methods=["GET", "POST"])
+def route(path):
+    def get_login():
+        if "session" not in request.cookies:
+            return None
+        username, password = request.cookies["session"].split("||")
+        correct_password = r.get(f"http://{database_node}/users/{username}/password").json()["data"]
+        if correct_password != password:
+            return None
+        return username
+    if path == "index.html":
+        if (username := get_login()) is None:
+            return redirect("/login.html", code=302)
+        imgs = list()
+        for i in range(1, 17):
+            imgs.append(r.get(f"http://{database_node}/images/{i}").json()["data"])
+            imgs[-1]["id"] = str(i).zfill(2)
+        user = dict()
+        first_name_resp = r.get(f"http://{database_node}/users/{username}/first_name")
+        user["first_name"] = first_name_resp.json()["data"] if first_name_resp.status_code == 200 else ""
+        second_name_resp = r.get(f"http://{database_node}/users/{username}/second_name")
+        user["second_name"] = second_name_resp.json()["data"] if second_name_resp.status_code == 200 else ""
+        email_resp = r.get(f"http://{database_node}/users/{username}/email")
+        user["email"] = email_resp.json()["data"] if email_resp.status_code == 200 else ""
+        msg_resp = r.get(f"http://{database_node}/users/{username}/msg")
+        user["msg"] = msg_resp.json()["data"] if msg_resp.status_code == 200 else ""
+        return render_template("index.html", data=imgs, user=user)
+    elif path == "specific.html":
+        if get_login() is None:
+            return redirect("/login.html", code=302)
+        img_id = request.args.get('img')
+        img = r.get(f"http://{database_node}/images/{img_id}").json()["data"]
+        img["id"] = img_id
+        return render_template("specific.html", img=img)
+    else:
+        return render_template(path)
+
+
+if __name__ == '__main__':
+    app.run(host="0.0.0.0", port=content_node_port)

services_vulnerable/rusgram/content/requirements.txt

@@ -0,0 +1,3 @@
+flask==2.0.2
+requests
+Werkzeug==2.2.2