module Xssmaze::Catalog

Overview

Catalog packages every "static" response served from the maze index: the HTML landing page, /map/* views, /sitemap.xml, /version, /stats, etc. Each entry stores the body, a pre-gzipped copy, and a short ETag, all computed once at boot so the request path is just a hash lookup.

Defined in:

catalog.cr

Constant Summary

PAYLOADS_BODY = {description: "Reference XSS payloads for lab use only.", payloads: [{label: "basic alert", value: "<script>alert(1)</script>"}, {label: "img onerror", value: "<img src=x onerror=alert(1)>"}, {label: "svg onload", value: "<svg onload=alert(1)>"}, {label: "javascript: scheme", value: "javascript:alert(1)"}, {label: "data: html", value: "data:text/html,<script>alert(1)</script>"}, {label: "iframe srcdoc", value: "<iframe srcdoc='<script>alert(1)</script>'>"}, {label: "details ontoggle", value: "<details open ontoggle=alert(1)>"}, {label: "input autofocus", value: "<input autofocus onfocus=alert(1)>"}, {label: "form action javascript", value: "<form action=javascript:alert(1)><button>x</button></form>"}, {label: "polyglot", value: "jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert()//>\\x3e"}]}.to_json

ROBOTS_BODY = "User-agent: *\nDisallow: /\n"

Class Method Summary

• .build_all : Hash(String, Entry)

  Build every cached static asset in one shot.

• .build_categories_json(groups : Hash(String, Array(Maze)), total : Int32) : String
• .build_index_html(groups : Hash(String, Array(Maze)), total : Int32) : String
• .build_map_markdown(mazes : Array(Maze)) : String
• .build_map_text(mazes : Array(Maze)) : String
• .build_openapi(mazes : Array(Maze)) : String

  Minimal OpenAPI 3.0 document so external tooling (Swagger UI, code generators, scanner runners) can ingest the catalog directly.

• .build_sitemap(mazes : Array(Maze)) : String
• .build_stats(mazes : Array(Maze), groups : Hash(String, Array(Maze))) : String

Class Method Detail