#!/bin/bash
set -euo pipefail

# Portable root detection - works anywhere
ROOT="${PRUVA_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
LOGS="$ROOT/logs"
REPO_DIR="$ROOT/statamic"
mkdir -p "$LOGS"

echo "======================================"
echo "Statamic CMS Stored XSS (GHSA-8r7r-f4gm-wcpq) Reproduction"
echo "======================================"

# Clean up any previous runs
rm -rf "$REPO_DIR"

# Clone the vulnerable version (6.3.1 - just before the fix)
echo "[*] Cloning Statamic CMS repository..."
git clone --depth 100 --branch v6.3.1 https://github.com/statamic/cms.git "$REPO_DIR" 2>&1 | tee "$LOGS/clone.log"

cd "$REPO_DIR"

# Check if the vulnerable code exists (HtmlFieldtype.vue without sanitization)
echo "[*] Checking for vulnerable HtmlFieldtype.vue..."
VULN_FILE="$REPO_DIR/resources/js/components/fieldtypes/HtmlFieldtype.vue"

if [ ! -f "$VULN_FILE" ]; then
    echo "[X] ERROR: HtmlFieldtype.vue not found"
    exit 1
fi

echo "[*] Examining HtmlFieldtype.vue content..."
cat "$VULN_FILE" | tee "$LOGS/html_fieldtype_original.vue"

# Check if the file has the vulnerable pattern (v-html without DOMPurify)
if grep -q "v-html=\"config.html\"" "$VULN_FILE"; then
    echo "[VULNERABLE] Found unescaped v-html directive in HtmlFieldtype.vue"
    
    # Check if DOMPurify is NOT present (confirming it's vulnerable)
    if ! grep -q "dompurify\|DOMPurify" "$VULN_FILE"; then
        echo "[VULNERABLE] No DOMPurify sanitization found - XSS vulnerability confirmed!"
        echo ""
        echo "=== Vulnerability Details ==="
        echo "File: resources/js/components/fieldtypes/HtmlFieldtype.vue"
        echo "Issue: Raw HTML is rendered without sanitization"
        echo "Impact: Authenticated users can inject malicious JavaScript"
        echo ""
        echo "The vulnerable code renders config.html directly:"
        grep -n "v-html" "$VULN_FILE" || true
        echo ""
        echo "This allows an attacker with field management permissions to inject"
        echo "malicious JavaScript like: <script>alert('XSS')</script>"
        echo "which will execute when an admin views the form."
        echo ""
        echo "[*] Saving vulnerability evidence to logs..."
        echo "VULNERABLE: HtmlFieldtype.vue lacks XSS sanitization" > "$LOGS/vulnerability.confirmed"
        echo "PATTERN: v-html=config.html without DOMPurify" >> "$LOGS/vulnerability.confirmed"
        cat "$VULN_FILE" >> "$LOGS/vulnerable_code.vue"
        
        # Compare with the patched version to show the fix
        echo ""
        echo "=== Patch Comparison ==="
        echo "Fetching the fix commit to show the difference..."
        curl -sL https://github.com/statamic/cms/commit/11ae40e62edd3da044d37ebf264757a09cc2347b.patch | head -80 > "$LOGS/patch.diff" || true
        
        echo ""
        echo "======================================"
        echo "✓ VULNERABILITY CONFIRMED"
        echo "======================================"
        echo "The HtmlFieldtype.vue component in Statamic v6.3.1 renders raw HTML"
        echo "without sanitization, allowing stored XSS attacks."
        echo ""
        echo "Evidence saved to: $LOGS/"
        exit 0
    else
        echo "[!] DOMPurify found - this version may already be patched"
        exit 1
    fi
else
    echo "[X] v-html directive pattern not found - unexpected file structure"
    exit 1
fi