added warmup chall

services/warmup/src/main.go

@@ -0,0 +1,54 @@
+package main
+
+import (
+"fmt"
+"io/ioutil"
+"log"
+"net/http"
+"path/filepath"
+)
+
+// Vulnerable file viewing handler - LFI vulnerability
+func viewHandler(w http.ResponseWriter, r *http.Request) {
+// Get the file parameter
+filename := r.URL.Query().Get("file")
+
+// Default file if none specified
+if filename == "" {
+filename = "welcome.txt"
+}
+
+// Vulnerable: directly concatenating user input without proper validation
+// This allows path traversal attacks
+filePath := filepath.Join("/opt/files/", filename)
+
+// Read the file
+content, err := ioutil.ReadFile(filePath)
+if err != nil {
+http.Error(w, "File not found or cannot be read", http.StatusNotFound)
+return
+}
+
+w.Header().Set("Content-Type", "text/plain")
+w.Write(content)
+}
+
+func homeHandler(w http.ResponseWriter, r *http.Request) {
+// Serve the HTML template
+htmlContent, err := ioutil.ReadFile("/opt/index.html")
+if err != nil {
+http.Error(w, "Template not found", http.StatusNotFound)
+return
+}
+
+w.Header().Set("Content-Type", "text/html")
+w.Write(htmlContent)
+}
+
+func main() {
+http.HandleFunc("/", homeHandler)
+http.HandleFunc("/view", viewHandler)
+
+fmt.Println("Starting server on :8081")
+log.Fatal(http.ListenAndServe(":8081", nil))
+}