module Xssmaze::Catalog

Overview

Catalog packages every "static" response served from the maze index: the HTML landing page, /map/* views, /sitemap.xml, /version, /stats, etc. Each entry stores the body, a pre-gzipped copy, and a short ETag, all computed once at boot so the request path is just a hash lookup.

Defined in:

catalog.cr

Constant Summary

MAP_LINKS = ["/map/text", "/map/json", "/map/categories", "/map/markdown", "/map/openapi", "/stats", "/payloads", "/random", "/health", "/version"] of ::String

Endpoints the catalog publishes for tooling. Rendered in the page footer.

PAYLOADS_BODY = {description: "Reference XSS payloads for lab use only.", payloads: [{label: "basic alert", value: "<script>alert(1)</script>"}, {label: "img onerror", value: "<img src=x onerror=alert(1)>"}, {label: "svg onload", value: "<svg onload=alert(1)>"}, {label: "javascript: scheme", value: "javascript:alert(1)"}, {label: "data: html", value: "data:text/html,<script>alert(1)</script>"}, {label: "iframe srcdoc", value: "<iframe srcdoc='<script>alert(1)</script>'>"}, {label: "details ontoggle", value: "<details open ontoggle=alert(1)>"}, {label: "input autofocus", value: "<input autofocus onfocus=alert(1)>"}, {label: "form action javascript", value: "<form action=javascript:alert(1)><button>x</button></form>"}, {label: "polyglot", value: "jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcliCk=alert() )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\\x3csVg/<sVg/oNloAd=alert()//>\\x3e"}]}.to_json
ROBOTS_BODY = "User-agent: *\nDisallow: /\n"

Class Method Summary

Class Method Detail

def self.build_all : Hash(String, Entry) #

Build every cached static asset in one shot. The key naming maps 1:1 to the route table in server.cr so adding a new catalog view is a matter of: add a builder above, add an Entry here, add a route in the server table.


[View source]
def self.build_categories_json(groups : Hash(String, Array(Maze)), total : Int32) : String #

Per-category rollup. Beyond the raw count, this breaks each category down by vulnerability class and reachability so a benchmark can pick its target set (and exclude controls) without walking every endpoint in /map/json.


[View source]
def self.build_index_html(groups : Hash(String, Array(Maze)), total : Int32) : String #

[View source]
def self.build_map_markdown(mazes : Array(Maze)) : String #

[View source]
def self.build_map_text(mazes : Array(Maze)) : String #

[View source]
def self.build_openapi(mazes : Array(Maze)) : String #

Minimal OpenAPI 3.0 document so external tooling (Swagger UI, code generators, scanner runners) can ingest the catalog directly.


[View source]
def self.build_sitemap(mazes : Array(Maze)) : String #

[View source]
def self.build_stats(mazes : Array(Maze), groups : Hash(String, Array(Maze))) : String #

[View source]
def self.render_404(path : String) : String #

The 404 body is the one page that varies per request (it echoes the missed path), so it is rendered rather than cached like the entries above. The path is escaped — this page is chrome, not a maze. It shares the index stylesheet instead of carrying its own, so the two pages can never drift apart.


[View source]