0
175
VistasHow can I return only what's inside my <pre> tag if someone makes a cURL or wget request to my link?
I have a simple "hello world" python script here
print("Hello World")
I uploaded it to my site (similar to Pastebin or GitHub gist)
https://www.bunlongheng.com/raw/YWFjOGMxYTktM2Y5Mi00ZDdlLWI1NWQtOTg0Y2EwYjVlMDM5
When I shared the link, I can see the icon, and the title field as the actual text, it's nice. Tested in iPhone below
When I curl the link, I got <title> & <link> tags come with it like this:
<title>print("Hello World")</title><link rel="shortcut icon" href="https://i.imgur.com/yRk5mqb.png" /><pre>print("Hello World")</pre>
Which of course will break if I remotely executed my codes like this
curl https://www.bunlongheng.com/raw/YWFjOGMxYTktM2Y5Mi00ZDdlLWI1NWQtOTg0Y2EwYjVlMDM5 | python
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 153 0 153 0 0 354 0 --:--:-- --:--:-- --:--:-- 353
File "<stdin>", line 1
<title>print("Hello World")</title><link rel="shortcut icon" href="https://i.imgur.com/yRk5mqb.png" /><pre>print("Hello World")</pre>
^
SyntaxError: invalid syntax
How can I return only what's inside my <pre> tag if someone makes a cURL or wget to my link?
3 Respuestas
Responde la pregunta0
You could attempt to sniff the User-Agent header but it isn't a good way to determine what type of content to provide to a client.
A better approach (utilizing the features built into HTTP that are designed for handling different representations of the same content) might be to use the Accept header.
In Python, you could use the accept-types module for this.
return_type = get_best_match(request.META.get('HTTP_ACCEPT'), ['text/html', 'application/python'])
if return_type == 'application/python':
return render_python()
else:
return render_html()
See this question for handling it in PHP.
Then the client could ask for the Python code if they wanted it:
curl -H "Accept: application/python" http://example.com/foo | python
0
similar to Quentin, i would check if the Accept-header contains the string "html", and serve the html if it does. but if it does not explicitly mention html, serve the python directly. because all web-browsers say some version of Accept: ...html... (like Chrome says Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 )
while wget/curl/libcurl just says Accept: */*
0
For PHP
I ended up do this
$userAgent = $_SERVER['HTTP_USER_AGENT']; if (stripos($userAgent, 'curl') !== false || stripos($userAgent, 'wget') !== false ){ return $paste->raw; }
public function raw($uuid)
{
$paste = Paste::where('uuid', base64_decode($uuid))->first();
$userAgent = $_SERVER['HTTP_USER_AGENT'];
if (stripos($userAgent, 'curl') !== false || stripos($userAgent, 'wget') !== false ){
return $paste->raw;
}
if($paste->type == 'json'){
return response()->json($paste->data);
} else {
$result = htmlentities($paste->raw);
return '<title>'.$result.'</title><link rel="shortcut icon" href="https://i.imgur.com/WWWynu9.png" /><pre>'.$result.'</pre>';
}
}
Now can I remotely execute bash or python from cURL without an extra HTML tag. The best part is that I don't have to compromise the icon and title for the browser & mobile browser.