Custom .py experiment files

bci/evaluations/custom/custom_evaluation.py

@@ -166,27 +166,43 @@ def add_page(self, project: str, poc: str, domain: str, path: str, file_type: st
         if os.path.exists(file_path):
             return False
         with open(file_path, 'w') as file:
-            file.write('')
-        headers_file_path = os.path.join(page_path, 'headers.json')
-        if not os.path.exists(headers_file_path):
-            with open(headers_file_path, 'w') as file:
-                file.write(
-                    textwrap.dedent(
-                        """\
-                        [
-                            {
-                                "key": "Header-Name",
-                                "value": "Header-Value"
-                            }
-                        ]
-                    """
+            file.write(self.get_default_file_content(file_type))
+
+        if self.include_file_headers(file_type):
+            headers_file_path = os.path.join(page_path, 'headers.json')
+            if not os.path.exists(headers_file_path):
+                with open(headers_file_path, 'w') as file:
+                    file.write(
+                        textwrap.dedent(
+                            """\
+                            [
+                                {
+                                    "key": "Header-Name",
+                                    "value": "Header-Value"
+                                }
+                            ]
+                        """
+                        )
                     )
-                )
         self.sync_with_folders()
         # Notify clients of change (an experiment might now be runnable)
         Clients.push_experiments_to_all()
         return True
 
+    @staticmethod
+    def get_default_file_content(file_type: str) -> str:
+        if file_type != 'py':
+            return ''
+
+        with open('experiments/pages/Support/PythonServer/a.test/py-server/index.py', 'r') as file:
+            template_content = file.read()
+
+        return template_content
+
+    @staticmethod
+    def include_file_headers(file_type: str) -> bool:
+        return file_type != 'py'
+
     def sync_with_folders(self):
         self.dir_tree = self.initialize_dir_tree()
         self.tests_per_project = self.initialize_tests_and_url_queues(self.dir_tree)

bci/web/blueprints/experiments.py

@@ -1,6 +1,8 @@
 import datetime
 import logging
 import threading
+import importlib.util
+import sys
 
 import requests
 from flask import Blueprint, make_response, render_template, request, url_for
@@ -130,5 +132,25 @@ def report_leak_if_contains(expected_header_name: str, expected_header_value: st
     )
 
 
+@exp.route("/<string:project>/<string:experiment>/<string:directory>/")
+def python_evaluation(project: str, experiment: str, directory: str):
+    """
+    Evaluates the python script and returns its result.
+    """
+    host = request.host.lower()
+
+    module_name = f"{host}/{project}/{experiment}/{directory}"
+    path = f"experiments/pages/{project}/{experiment}/{host}/{directory}/index.py"
+
+    # Dynamically import the file
+    sys.dont_write_bytecode = True
+    spec = importlib.util.spec_from_file_location(module_name, path)
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[module_name] = module
+    spec.loader.exec_module(module)
+
+    return module.main(request)
+
+
 def get_all_GET_parameters(request):
     return {k: v for k, v in request.args.items()}

bci/web/page_parser.py

@@ -68,6 +68,10 @@ def get_content(subdir_folder_path: str):
         {
             "file_name": "index.js",
             "content_type": "text/javascript"
+        },
+        {
+            "file_name": "index.py",
+            "content_type": "text/x-python"
         }
     ]
     content = None

bci/web/vue/src/components/poc-editor.vue

@@ -1,5 +1,9 @@
 <script>
   import ace from "ace-builds";
+  import { Mode as HtmlMode } from 'ace-builds/src-noconflict/mode-html';
+  import { Mode as JsMode } from 'ace-builds/src-noconflict/mode-javascript';
+  import { Mode as JsonMode } from 'ace-builds/src-noconflict/mode-json';
+  import { Mode as PyMode } from 'ace-builds/src-noconflict/mode-python';
   import 'ace-builds/src-min-noconflict/ext-modelist';
   import 'ace-builds/src-min-noconflict/theme-twilight';
   import 'ace-builds/src-min-noconflict/theme-xcode';
@@ -38,6 +42,7 @@
         available_file_types: [
           'html',
           'js',
+          'py',
         ],
         dialog: {
           domain: {
@@ -73,6 +78,7 @@
             this.editor.setValue(res.data.content);
             this.editor.clearSelection();
             this.active_file.should_update_server = true;
+            this.update_editor_mode(file_name);
           }
         })
         .catch((error) => {
@@ -123,13 +129,19 @@
         });
       },
       update_editor_mode(file_name) {
-        file_ext = file_name.split('.').pop();
+        const file_ext = file_name.split('.').pop();
         switch (file_ext) {
           case "html":
-            this.editor.session.setMode("ace/mode/html");
+            this.editor.session.setMode(new HtmlMode());
             break;
           case "js":
-            this.editor.session.setMode("ace/mode/js");
+            this.editor.session.setMode(new JsMode());
+            break;
+          case "json":
+            this.editor.session.setMode(new JsonMode());
+            break;
+          case "py":
+            this.editor.session.setMode(new PyMode());
             break;
         }
       },

experiments/pages/Support/PythonServer/a.test/main/headers.json

@@ -0,0 +1,6 @@
+[
+    {
+        "key": "Header-Name",
+        "value": "Header-Value"
+    }
+]

experiments/pages/Support/PythonServer/a.test/main/index.html

@@ -0,0 +1,11 @@
+<html>
+    <body>
+        <script>
+            (async () => {
+                const res = await fetch('https://a.test/Support/PythonServer/py-server/');
+                const x = await res.text();
+                document.location = `https://a.test/report/?leak=PythonServer&response=${encodeURIComponent(JSON.stringify(x))}`;
+            })();
+        </script>
+    </body>
+</html>

experiments/pages/Support/PythonServer/a.test/py-server/index.py

@@ -0,0 +1,15 @@
+from flask import Request
+
+# Make sure that your page directory starts with 'py-'
+
+def main(req: Request):
+    # TODO - implement your functionality and return a Flask response
+
+    return {
+        "agent": req.headers.get("User-Agent"),
+        "cookies": req.cookies,
+        "host": req.host,
+        "path": req.path,
+        "scheme": req.scheme,
+        "url": req.url
+    }

nginx/config/experiments.conf

@@ -21,6 +21,14 @@ location ~ ^/report(/.+)*/?$ {
     proxy_set_header X-Forwarded-Proto $scheme;
 }
 
+location ~ ^/(.+)/(.+)/py-(.+)/$ {
+    proxy_pass http://core:5000;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+}
+
 location ~ ^/(.+)/(.+)/(.+)/$ {
     root /www/data/pages;
     index index.html index.js;