## Example Attack { #example-attack }

Imagine you build a way to run a local AI agent.

It provides an API at

```
http://localhost:8000/v1/agents/multivac
```

There's also a frontend at

```
http://localhost:8000
```

/// tip

Note that both have the same host.

///

Then using the frontend you can make the AI agent do things on your behalf.

## Exemplo de Ataque { #example-attack }

Imagine que você desenvolve uma forma de executar um agente de IA local.

Ele fornece uma API em

```
http://localhost:8000/v1/agents/multivac
```

Há também um frontend em

```
http://localhost:8000
```

/// tip | Dica

Observe que ambos têm o mesmo host.

///

Usando o frontend, você pode fazer o agente de IA executar ações em seu nome.

```

</div>

então a variável interna `__name__` no seu arquivo, criada automaticamente pelo Python, terá como valor a string `"__main__"`.

Então, a seção:

```Python
    uvicorn.run(app, host="0.0.0.0", port=8000)
```

vai executar.

---

Isso não acontecerá se você importar esse módulo (arquivo).

Então, se você tiver outro arquivo `importer.py` com:

```Python
from myapp import app

    void testEncode() {
        byte[] testBytes = new byte[] { 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, (byte) 0x88, (byte) 0x99, (byte) 0xAA, (byte) 0xBB,
                (byte) 0xCC, (byte) 0xDD, (byte) 0xEE, (byte) 0xFF, 0x00 };

        Smb2LeaseKey key = new Smb2LeaseKey(testBytes);
        byte[] buffer = new byte[20];

        key.encode(buffer, 2);

        for (int i = 0; i < 16; i++) {

Imaginez que vous mettiez au point un moyen d’exécuter un agent IA local.

Il expose une API à l’adresse

```
http://localhost:8000/v1/agents/multivac
```

Il y a aussi un frontend à l’adresse

```
http://localhost:8000
```

/// tip | Astuce

Notez qu’ils ont le même hôte.

///

Vous pouvez alors, via le frontend, amener l’agent IA à effectuer des actions en votre nom.

        isBroadcast = false;
    }

    @Override
    int writeBodyWireFormat(final byte[] dst, final int dstIndex) {
        final int tmp = questionName.hexCode;
        questionName.hexCode = 0x00; // type has to be 0x00 for node status
        final int result = writeQuestionSectionWireFormat(dst, dstIndex);
        questionName.hexCode = tmp;
        return result;
    }

    @Override

    static final int FLAGS_REQUEST_OPLOCK = 0x02;
    static final int FLAGS_REQUEST_BATCH_OPLOCK = 0x04;

    // Access Mode Encoding for desiredAccess
    static final int SHARING_COMPATIBILITY = 0x00;
    static final int SHARING_DENY_READ_WRITE_EXECUTE = 0x10;
    static final int SHARING_DENY_WRITE = 0x20;
    static final int SHARING_DENY_READ_EXECUTE = 0x30;
    static final int SHARING_DENY_NONE = 0x40;

所以，下面这部分代码才会运行：

```Python
    uvicorn.run(app, host="0.0.0.0", port=8000)
```

---

如果你是导入这个模块（文件）就不会这样。

因此，如果你的另一个文件 `importer.py` 像这样：

```Python
from myapp import app

# 其他一些代码
```

在这种情况下，`myapp.py` 内部的自动变量不会有值为 `"__main__"` 的变量 `__name__`。

所以，下面这一行不会被执行：

```Python
    uvicorn.run(app, host="0.0.0.0", port=8000)
```

/// info | 信息

        assertEquals(0x37, SMBUtil.readInt2(buffer, 0));

        // Verify max items
        assertEquals(100, SMBUtil.readInt2(buffer, 2));

        // Verify flags (should be 0x00)
        assertEquals(0x00, SMBUtil.readInt2(buffer, 4));

        // Verify information level (SMB_FILE_BOTH_DIRECTORY_INFO)
        assertEquals(Trans2FindFirst2.SMB_FILE_BOTH_DIRECTORY_INFO, SMBUtil.readInt2(buffer, 6));

	b.Run(" 0000|0000 ", func(b *testing.B) { benchmarkErasureDecode(4, 4, 0, 0, size, b) })
	b.Run(" 0000|X000 ", func(b *testing.B) { benchmarkErasureDecode(4, 4, 0, 1, size, b) })
	b.Run(" X000|0000 ", func(b *testing.B) { benchmarkErasureDecode(4, 4, 1, 0, size, b) })
	b.Run(" X000|X000 ", func(b *testing.B) { benchmarkErasureDecode(4, 4, 1, 1, size, b) })
	b.Run(" 0000|XXXX ", func(b *testing.B) { benchmarkErasureDecode(4, 4, 0, 4, size, b) })