[HarekazeCTF2019]encode_and_encode

<?php

error_reporting(0);

if (isset($_GET['source'])) {

  show_source(__FILE__);

  exit();

}

function is_valid($str) {

  $banword = [

    // no path traversal

    '\.\.',

    // no stream wrapper

    '(php|file|glob|data|tp|zip|zlib|phar):',

    // no data exfiltration

    'flag'

  ];

  $regexp = '/' . implode('|', $banword) . '/i';

  if (preg_match($regexp, $str)) {

    return false;

  }

  return true;

}

$body = file_get_contents('php://input');

$json = json_decode($body, true);

if (is_valid($body) && isset($json) && isset($json['page'])) {

  $page = $json['page'];

  $content = file_get_contents($page);

  if (!$content || !is_valid($content)) {

    $content = "<p>not found</p>\n";

  }

} else {

  $content = '<p>invalid request</p>';

}

// no data exfiltration!!!

$content = preg_replace('/HarekazeCTF\{.+\}/i', 'HarekazeCTF{<censored>}', $content);

echo json_encode(['content' => $content]);