use actix_files::NamedFile;
use actix_web::{get, middleware::Logger, post, web, App, HttpServer, Responder};
use futures_core::future::BoxFuture;
use futures_util::FutureExt;
use mysql_async::{
    prelude::{GlobalHandler, Queryable},
    Conn, InfileData, LocalInfileError, OptsBuilder,
};
use serde::Deserialize;
use tokio::fs::File;
use tokio_util::io::ReaderStream;

struct UnsafeFsHandler;

impl GlobalHandler for UnsafeFsHandler {
    fn handle(&self, file_name: &[u8]) -> BoxFuture<'static, Result<InfileData, LocalInfileError>> {
        let path = String::from_utf8_lossy(file_name).to_string();
        async move {
            println!("reading file: {}", path);
            let file = File::open(path).await?;
            Ok(Box::pin(ReaderStream::new(file)) as InfileData)
        }
        .boxed()
    }
}

#[derive(Deserialize)]
struct ConnInfo {
    host: String,
    port: u16,
    user: String,
    pass: String,
    db: String,
    query: String,
}

#[get("/")]
async fn index() -> impl Responder {
    NamedFile::open("./public/index.html")
}

#[post("/connect")]
async fn connect(info: web::Json<ConnInfo>) -> Result<impl Responder, Box<dyn std::error::Error>> {
    let conn_info = info.into_inner();

    let opts = OptsBuilder::default()
        .ip_or_hostname(conn_info.host)
        .tcp_port(conn_info.port)
        .user(Some(conn_info.user))
        .pass(Some(conn_info.pass))
        .db_name(Some(conn_info.db))
        .local_infile_handler(Some(UnsafeFsHandler));

    let mut conn = Conn::new(opts).await?;
    let v: String = conn.query_first(conn_info.query).await?.unwrap();

    Ok(v)
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    env_logger::init();

    HttpServer::new(|| {
        App::new()
            .wrap(Logger::new(
                r#"%{r}a "%r" %s %b "%{Referer}i" "%{User-Agent}i" %T"#,
            ))
            .service(index)
            .service(connect)
    })
    .bind(("0.0.0.0", 8000))?
    .run()
    .await
}

from flask import Flask, request
import json

app = Flask(__name__)

'''
'''
def merge(src, dst):
    # Recursive merge function
    for k, v in src.items():
        if hasattr(dst, '__getitem__'):
            if dst.get(k) and type(v) == dict:
                merge(v, dst.get(k))
            else:
                dst[k] = v
        elif hasattr(dst, k) and type(v) == dict:
            merge(v, getattr(dst, k))
        else:
            setattr(dst, k, v)


class Dst():
    def __init__(self):
        pass


dst = Dst()


@app.route('/',methods=['GET','POST'])
def index():
    if request.method=='GET':
        return open("main.py").read()
    merge(request.get_json(), dst)
    return "Success"


if __name__ == '__main__':
    app.run(host="0.0.0.0", port=8000)

{
    "__init__":{
        "__globals__":{
            "app":{
 "_static_folder":"./"
            }
        }
    }
}

from flask import Flask, request

app = Flask(__name__)

functions=globals()['__builtins__'].__dict__


@app.route('/', methods=['GET'])
def index():
    return open(__file__).read()

@app.route('/pwn',methods=['POST'])
def pwn():
    stack = []
    stack.append('print')
    name=request.get_json().get("name")
    if not name:
        return "Fail"
    stack.extend(name)
    args=stack.pop()
    func=stack.pop()
    functions[func](args)
    return "Success"

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8000)