/** * Malicious provider-content corpus (proposal §4.5 acceptance). Exported so * `packages/testing` and the Playwright suites can replay the same payloads * through connector mocks. */ export const ATTACKER_ORIGIN = "evil.example"; export const MALICIOUS_HTML: readonly string[] = [ // Script injection "", "", "ipt>", "</script>", "

hi", // Event handlers / attributes "", "", " $\"pic\"$ ", "", "

click

", "ok", "

css

", "

", "", "

", "x", // Dangerous schemes "x", "x", "x", "x", "x", "x", "x", "x", "x", "x", "x", "x", "x", "creds", "at-trick", // Container elements "", "", "

", "

", "", "", "", "", "", "

<img src=x onerror=alert(1)>",
  "<noscript><p title=\"</noscript><img src=x onerror=alert(1)>\">",
  "<textarea><img src=x onerror=alert(1)></textarea>",
  "<template><img src=x onerror=alert(1)></template>",
  "<svg><foreignObject><iframe src=javascript:alert(1)></iframe></foreignObject></svg>",
  // Encoding / comment / malformed evasions
  "<script>alert(1)</script>",
  "<!--<script>alert(1)</script>-->",
  "<!--><img src=x onerror=alert(1)>-->",
  "<![CDATA[<script>alert(1)</script>]]>",
  "<?xml-stylesheet href=\"https://evil.example/x.xsl\"?>",
  "<a href=\"https://ok.example/\"<script>alert(1)</script>",
  "<a href=\"https://ok.example/",
  "<a href='https://ok.example/' title='\"><script>alert(1)</script>'>quotes</a>",
  "<a href=https://ok.example/ ><img src=x onerror=alert(1)></a>",
  "</p></a></div></span><img src=x onerror=alert(1)>",
  "<a href=\"https://ok.example/\"><a href=\"javascript:alert(1)\">nested</a></a>",
  "<span class=\"invisible\"><script>alert(1)</script></span>",
  // Spoofing
  "<a href=\"https://evil.example/login\">https://bank.example/login</a>",
  "<a href=\"https://pаypal.com/\">paypal.com</a>",
  "<p>file‮gnp.exe and zero​width⁦isolate⁩</p>",
];

export const MALICIOUS_PLAIN: readonly string[] = [
  "<script>alert(1)</script>",
  "<img src=x onerror=alert(1)>",
  "javascript:alert(1)",
  "click javascript://%0aalert(1) now",
  "data:text/html,<script>alert(1)</script>",
  "https://evil.example/\"><script>alert(1)</script>",
  "see https://user:pass@evil.example/ and //evil.example",
  "@alice@evil.example #tag <b>bold</b>",
  "‮txt.exe ​‍﻿",
  "<script>",
];

export const MALICIOUS_LINK_PREVIEWS: readonly unknown[] = [
  { url: "javascript:alert(1)", title: "x" },
  { url: "data:text/html,<script>alert(1)</script>", title: "x" },
  { url: "//evil.example/", title: "protocol-relative" },
  { url: "https://ok.example/", title: "<script>alert(1)</script>", description: "<img src=x onerror=alert(1)>", image: "https://evil.example/og.png" },
  { url: "https://ok.example/", image: "javascript:alert(1)" },
  { url: "https://ok.example/", image: "data:image/svg+xml,<svg onload=alert(1)>" },
  { url: "https://ok.example/", image: "//evil.example/og.png" },
  { url: "https://ok.example/", siteName: "‮lapyap", title: "x".repeat(100_000) },
  { type: "linkPreview", href: "javascript:alert(1)", host: "ok.example" },
  { type: "linkPreview", href: "https://ok.example/", host: "ok.example", image: "https://evil.example/direct.png" },
  { url: { toString: () => "javascript:alert(1)" } },
  null,
  "https://ok.example/",
];

/** Hand-forged ASTs, as if from a tampered DB row or websocket frame. */
export const FORGED_DOCUMENTS: readonly unknown[] = [
  {
    type: "doc",
    version: 1,
    truncated: false,
    children: [
      {
        type: "paragraph",
        children: [
          { type: "link", href: "javascript:alert(1)", host: "ok.example", children: [{ type: "text", text: "x" }] },
          { type: "link", href: "https://ok.example/", host: "ok.example", children: [{ type: "html", html: "<script>alert(1)</script>" }] },
          { type: "emoji", shortcode: "x", src: "https://evil.example/e.png" },
          { type: "emoji", shortcode: "x", src: "/api/media-proxy?url=javascript%3Aalert(1)" },
          { type: "emoji", shortcode: "x\"onerror=alert(1)", src: "/api/media-proxy?url=https%3A%2F%2Fok.example%2Fe.png" },
          { type: "html", html: "<img src=x onerror=alert(1)>" },
          { type: "text", text: "<img src=x onerror=alert(1)>" },
          { type: "mention", handle: "x\"><script>", href: "javascript:alert(1)" },
          { type: "hashtag", tag: "ok", href: "data:text/html,x" },
          { type: "text", text: { toString: () => "<script>" } },
        ],
      },
      { type: "script", children: [] },
      "<script>alert(1)</script>",
    ],
  },
  { type: "doc", children: "nope" },
  "<script>alert(1)</script>",
  null,
  [],
];