Update app.py

app.py

@@ -1,4 +1,6 @@
 from flask import Flask, request, jsonify, redirect, Response, abort, send_from_directory
+from flask import make_response, stream_with_context
+
 import os
 import requests
 import subprocess
@@ -846,6 +848,193 @@ def proxy_chrome_gw(path):
         }
     )
 
+# ------------------------------------------------------------------
+# 設定
+# ------------------------------------------------------------------
+TARPIT_SECONDS = 8          # 1リクエストあたりの遅延
+MAX_TARPIT = 60             # 最大遅延
+CHUNK_DELAY = 0.4           # チャンク間の遅延
+FAKE_HTML_ON_JSON = True    # JSONを期待する相手にHTMLを返す
+
+
+# ------------------------------------------------------------------
+# ユーティリティ
+# ------------------------------------------------------------------
+def weird_json():
+    """
+    構文的にほぼ正しいがパーサが嫌がるJSONを返す。
+    - 制御文字
+    - 深いネスト
+    - サロゲートペアの片割れ
+    - NaN / Infinity
+    - BOM
+    - 途中で切れた文字列風
+    """
+    deep = {"a": None}
+    cur = deep
+    for _ in range(200):          # 深いネスト
+        cur["a"] = {"a": None}
+        cur = cur["a"]
+    payload = {
+        "ok": True,
+        "config": deep,
+        "note": "\u0000\u0001\u0002 null byte \u0007",
+        "lone_surrogate": "\ud800",           # 単独サロゲート
+        "nan": float("nan"),
+        "inf": float("inf"),
+        "invalid_escape": "\\x",
+    }
+    # わざと json.dumps を通さず、細工した文字列を返す
+    raw = (
+        "\ufeff"  # BOM
+        + json.dumps(payload, ensure_ascii=False, allow_nan=True)
+        + "\x00"  # 末尾にNUL
+    )
+    return raw
+
+
+def fake_env():
+    """
+    .env っぽく見えるが、パーサが混乱する内容。
+    引用符が閉じていない、複数行、NUL、制御文字などを混入。
+    """
+    lines = [
+        "# generated",
+        "DB_HOST=localhost",
+        'SECRET_KEY="unterminated',
+        "API_TOKEN=abc\x00def",
+        "MULTILINE=<<EOF",
+        "still inside value",
+        "EOF",
+        "=\x07\x08",
+        "PATH=/usr/bin:/bin",
+        "\x00",
+        "PORT=999999999999999999999999999999",
+    ]
+    return "\n".join(lines) + "\n"
+
+
+def fake_secrets_toml():
+    """
+    Streamlit secrets.toml 風だがTOMLとして壊れている。
+    """
+    return (
+        "[server]\n"
+        'port = "not a number"\n'
+        "[[[broken\n"
+        'key = "unterminated\n'
+        "\x00\n"
+        "[aws]\n"
+        'secret = """multi\n'
+        "line but never closed\n"
+    )
+
+
+# ------------------------------------------------------------------
+# タープット（遅延）ヘルパ
+# ------------------------------------------------------------------
+def tarpit(seconds=None):
+    s = min(seconds or random.uniform(1, TARPIT_SECONDS), MAX_TARPIT)
+    time.sleep(s)
+
+
+# ------------------------------------------------------------------
+# ルーティング
+# ------------------------------------------------------------------
+
+@app.route("/api/config", methods=["GET", "POST", "HEAD"])
+def api_config():
+    tarpit()
+    # JSONを期待している相手にHTMLを返す（Content-Typeも嘘をつく）
+    if FAKE_HTML_ON_JSON:
+        body = "<html><body>not json</body></html>\x00"
+        resp = make_response(body, 200)
+        resp.headers["Content-Type"] = "application/json"   # わざと嘘
+        resp.headers["Content-Length"] = str(len(body) + 100)  # わざと不一致
+        return resp
+
+    body = weird_json()
+    resp = make_response(body, 200)
+    resp.headers["Content-Type"] = "application/json; charset=invalid-charset"
+    return resp
+
+
+@app.route("/.env", methods=["GET", "POST", "HEAD"])
+@app.route("/.env.local", methods=["GET", "POST", "HEAD"])
+@app.route("/.env.production", methods=["GET", "POST", "HEAD"])
+@app.route("/.env.development", methods=["GET", "POST", "HEAD"])
+@app.route("/.env.backup", methods=["GET", "POST", "HEAD"])
+def env_files():
+    tarpit()
+    body = fake_env()
+    resp = make_response(body, 200)
+    # 本来 env は text/plain だが、わざと octet-stream で返す
+    resp.headers["Content-Type"] = "application/octet-stream"
+    resp.headers["Content-Disposition"] = 'attachment; filename=".env"'
+    return resp
+
+
+@app.route("/.streamlit/secrets.toml", methods=["GET", "POST", "HEAD"])
+def streamlit_secrets():
+    tarpit()
+    body = fake_secrets_toml()
+    resp = make_response(body, 200)
+    resp.headers["Content-Type"] = "application/toml; charset=utf-16"
+    return resp
+
+
+# ------------------------------------------------------------------
+# 汎用フォールバック：遅延ストリームで相手のパーサを待たせる
+# ------------------------------------------------------------------
+@app.route("/<path:anypath>", methods=["GET", "POST", "HEAD", "OPTIONS"])
+def catch_all(anypath):
+    """
+    存在しないパスへのアクセスをタープット。
+    チャンクを少しずつ、ランダムな長さで送る。
+    """
+    def gen():
+        # HTTP的には chunked になる
+        fake_lines = [
+            b"HTTP/1.1 200 OK\r\n",
+            b"X-Powered-By: ???\r\n",
+            b'{"status":"ok","data":[',
+            b'{"id":' + str(random.randint(0, 10**9)).encode() + b',"v":"x"},',
+            b"\x00\x01\x02",
+            b"\xff\xfe\xfd",   # 不正UTF-8
+            b"]}", 
+            b"\r\n\r\n",
+        ]
+        for chunk in fake_lines:
+            yield chunk
+            time.sleep(CHUNK_DELAY)
+        # 最後に長い無意味データ
+        for _ in range(20):
+            yield b"A" * 512
+            time.sleep(CHUNK_DELAY)
+
+    return Response(stream_with_context(gen()), status=200,
+                    mimetype="application/json")
+
+
+# ------------------------------------------------------------------
+# エラーハンドラ：404も500も返さず、タープットに流す
+# ------------------------------------------------------------------
+@app.errorhandler(404)
+def handle_404(e):
+    tarpit(2)
+    body = "not found, but here is some garbage: " + ("X" * 1024) + "\x00"
+    resp = make_response(body, 404)
+    resp.headers["Content-Type"] = "text/html; charset=utf-7"
+    return resp
+
+
+@app.errorhandler(500)
+def handle_500(e):
+    tarpit(3)
+    resp = make_response("server error, retry with backoff\x00", 500)
+    resp.headers["Retry-After"] = "999999"
+    return resp
+
 if __name__ == "__main__":
     if os.environ.get("WERKZEUG_RUN_MAIN") != "true":
         start_processes()