---

##### GLOBAL METADATA

- meta:
    cluster: elasticsearch-ci

##### JOB DEFAULTS

- job:
    vault:
      url: https://secrets.elastic.co:8200
      role_id: 1ba1ac3e-aee4-d040-d9a3-6ae23bd2b3db
    node: "general-purpose"
    concurrent: true
    logrotate:
      daysToKeep: 30
      numToKeep: 500
      artifactDaysToKeep: 7
    parameters:
      - string:
          name: branch_specifier

### Interface Web

- Interface de recherche : http://localhost:8080/

![Search UI](https://fess.codelibs.org/_images/fess_search_result1.png)

- Interface d'administration : http://localhost:8080/admin/ (nom d'utilisateur/mot de passe par défaut : admin/admin)

![Admin UI](https://fess.codelibs.org/_images/fess_admin_dashboard.png)

### Interface do Navegador

- Interface de Busca: http://localhost:8080/

![Interface de Busca](https://fess.codelibs.org/_images/fess_search_result1.png)

- Interface de Administração: http://localhost:8080/admin/ (o nome de usuário/senha padrão é admin/admin)

![Interface de Administração](https://fess.codelibs.org/_images/fess_admin_dashboard.png)

```

</div>

então a variável interna `__name__` no seu arquivo, criada automaticamente pelo Python, terá como valor a string `"__main__"`.

Então, a seção:

```Python
    uvicorn.run(app, host="0.0.0.0", port=8000)
```

vai executar.

---

Isso não acontecerá se você importar esse módulo (arquivo).

Então, se você tiver outro arquivo `importer.py` com:

```Python
from myapp import app

- 應用在本機（例如 `localhost`）或內部網路中執行
- 並且應用沒有任何身分驗證，假設同一個網路中的任何請求都可被信任

## 攻擊範例 { #example-attack }

假設你打造了一個在本機執行 AI 代理（AI agent）的方法。

它提供一個 API：

```
http://localhost:8000/v1/agents/multivac
```

同時也有一個前端：

```
http://localhost:8000
```

/// tip | 提示

請注意兩者的主機（host）相同。

///

接著你可以透過前端讓 AI 代理代你執行動作。

由於它在本機執行、而非公開的網際網路上，你決定不設定任何身分驗證，只信任對本機網路的存取。

然後你的某位使用者可能安裝並在本機執行它。

```

</div>

then the internal variable `__name__` in your file, created automatically by Python, will have as value the string `"__main__"`.

So, the section:

```Python
    uvicorn.run(app, host="0.0.0.0", port=8000)
```

will run.

---

This won't happen if you import that module (file).

So, if you have another file `importer.py` with:

```Python
from myapp import app

# Some more code
```

</div>

alors la variable interne `__name__` de votre fichier, créée automatiquement par Python, aura pour valeur la chaîne de caractères `"__main__"`.

Ainsi, la section :

```Python
    uvicorn.run(app, host="0.0.0.0", port=8000)
```

va s'exécuter.

---

Cela ne se produira pas si vous importez ce module (fichier).

Par exemple, si vous avez un autre fichier `importer.py` qui contient :

```Python
from myapp import app

    }

    // Test with different origin formats
    @Test
    public void test_doFilter_differentOrigins() throws Exception {
        String[] origins = { "http://localhost:8080", "https://example.com", "http://subdomain.example.com", "https://example.com:3000" };

        for (String origin : origins) {
            resetMocks(); // Reset for each test

## 공격 예시 { #example-attack }

로컬 AI 에이전트를 실행하는 방법을 만들었다고 가정해 봅시다.

이 에이전트는 다음 위치에 API를 제공합니다:

```
http://localhost:8000/v1/agents/multivac
```

또한 다음 위치에 프론트엔드가 있습니다:

```
http://localhost:8000
```

/// tip | 팁

두 주소 모두 같은 호스트를 사용합니다.

///

그런 다음 프론트엔드를 통해 AI 에이전트가 여러분을 대신해 작업을 수행하도록 할 수 있습니다.

### ブラウザUI

- 検索UI: http://localhost:8080/

![Search UI](https://fess.codelibs.org/_images/fess_search_result1.png)

- 管理者UI: http://localhost:8080/admin/ （デフォルトのユーザー名/パスワードはadmin/adminです）

![Admin UI](https://fess.codelibs.org/_images/fess_admin_dashboard.png)