#!/bin/sh
set -e # Have script exit in the event of a failed command.

{{- if .Values.configPathmc }}
MC_CONFIG_DIR="{{ .Values.configPathmc }}"
MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
{{- else }}
MC="/usr/bin/mc --insecure"
{{- end }}

# connectToMinio
# Use a check-sleep-check loop to wait for MinIO service to be available
connectToMinio() {
	SCHEME=$1
	ATTEMPTS=0
	LIMIT=29 # Allow 30 attempts

```
https://evilhackers.example.com
```

And that malicious website sends requests using `fetch()` with a `Blob` body to the local API at

```
http://localhost:8000/v1/agents/multivac
```

Even though the host of the malicious website and the local app is different, the browser won't trigger a CORS preflight request because:

* It's running without any authentication, it doesn't have to send any credentials.

## Exemplo de Ataque { #example-attack }

Imagine que você desenvolve uma forma de executar um agente de IA local.

Ele fornece uma API em

```
http://localhost:8000/v1/agents/multivac
```

Há também um frontend em

```
http://localhost:8000
```

/// tip | Dica

Observe que ambos têm o mesmo host.

///

fonksiyon çağrıları entegre ederken `RuntimeError: Task attached to a different loop` hatasıyla karşılaşırsanız (ör. [MongoDB'nin MotorClient](https://stackoverflow.com/questions/41584243/runtimeerror-task-attached-to-a-different-loop) kullanımı), event loop gerektiren nesneleri yalnızca async fonksiyonların içinde oluşturmanız gerektiğini unutmayın; örneğin bir `@app.on_event("startup")` callback'i içinde.

///...

// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package event

import (
	"reflect"
	"testing"
)

## Exemple d’attaque { #example-attack }

Imaginez que vous mettiez au point un moyen d’exécuter un agent IA local.

Il expose une API à l’adresse

```
http://localhost:8000/v1/agents/multivac
```

Il y a aussi un frontend à l’adresse

```
http://localhost:8000
```

/// tip | Astuce

Notez qu’ils ont le même hôte.

///

## Ejemplo de ataque { #example-attack }

Imagina que construyes una forma de ejecutar un agente de IA local.

Provee un API en

```
http://localhost:8000/v1/agents/multivac
```

También hay un frontend en

```
http://localhost:8000
```

/// tip | Consejo

Ten en cuenta que ambos tienen el mismo host.

///

- 且不发送任何认证凭据。

这种攻击主要在以下情况下相关：

- 应用在本地（如 `localhost`）或内网中运行
- 且应用没有任何认证，假定来自同一网络的请求都可信。

## 攻击示例 { #example-attack }

假设你构建了一个本地运行的 AI 代理。

它提供了一个 API，地址为

```
http://localhost:8000/v1/agents/multivac
```

另有一个前端，地址为

```
http://localhost:8000
```

/// tip | 提示

注意它们的主机相同。

///

之后，你可以通过前端让该 AI 代理替你执行操作。

由于它在本地运行、而非暴露在开放的互联网，你决定不配置任何认证，只信任对本地网络的访问。

"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

    nextRequest: Request?,
  ) {
    logWithTime("followUpDecision")
  }

  private fun logWithTime(message: String) {
    val startNs = startNs
    val timeMs =
      if (startNs == null) {
        // Event occurred before start, for an example an early cancel.
        0L
      } else {
        TimeUnit.NANOSECONDS.toMillis(System.nanoTime() - startNs)
      }

    logger.invoke("[$timeMs ms] $message")
  }