#!/usr/bin/env bash
# Oracle solution for sec-005-xss-vulnerability-scan
set -euo pipefail

WORKSPACE="${1:-workspace}"

python3 -c "
import json

report = [
    {
        'file': 'profile.html',
        'line': 7,
        'type': 'unescaped_output',
        'description': 'Triple braces {{{ user.bio }}} renders raw HTML without escaping, allowing XSS via bio field',
        'severity': 'high'
    },
    {
        'file': 'search.html',
        'line': 9,
        'type': 'inline_js',
        'description': 'Template variable search_query is embedded directly in JavaScript string, allowing script injection',
        'severity': 'high'
    },
    {
        'file': 'comment.html',
        'line': 10,
        'type': 'unescaped_output',
        'description': 'The |safe filter disables auto-escaping on comment.text, allowing stored XSS',
        'severity': 'high'
    },
    {
        'file': 'dashboard.html',
        'line': 7,
        'type': 'attribute_injection',
        'description': 'Unvalidated URL in href attribute allows javascript: protocol injection via next_url',
        'severity': 'high'
    },
    {
        'file': 'settings.html',
        'line': 16,
        'type': 'inline_js',
        'description': 'Template variable user.display_name used in innerHTML assignment inside script tag allows DOM-based XSS',
        'severity': 'high'
    },
    {
        'file': 'search.html',
        'line': 10,
        'type': 'dom_injection',
        'description': 'innerHTML is used to insert query value into the DOM without sanitization',
        'severity': 'medium'
    }
]

with open('$WORKSPACE/xss_report.json', 'w') as f:
    json.dump(report, f, indent=2)
"

echo "Solution written to $WORKSPACE/xss_report.json"
