#!/usr/bin/env bash
# Vector 11: Cross-Site Request Forgery
# Desc: Missing CSRF tokens in state-changing forms
# Detect: Forms without CSRF tokens, SameSite=None cookies
# Severity: MEDIUM
# Tools: curl

vector_csrf() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing CSRF vectors..."
  
  local page=$(curl -s --connect-timeout 5 --max-time 10 "$target" 2>/dev/null)
  
  # Find forms
  local forms=$(echo "$page" | perl -nle 'print \$& if /<form[^>]*>/g' 2>/dev/null)
  
  if [ -z "$forms" ]; then
    print_skip "No forms found to test"
    return 0
  fi
  
  print_info "Found $(echo "$forms" | wc -l | tr -d ' ') form(s), checking CSRF protection..."
  
  local form_count=0
  while IFS= read -r form; do
    form_count=$((form_count + 1))
    local form_method=$(echo "$form" | sed -n 's/.*method="\([^"]*\)".*/\1/p' | sed 's/method="//;s/"//' | tr '[:upper:]' '[:lower:]')
    local form_action=$(echo "$form" | sed -n 's/.*action="\([^"]*\)".*/\1/p' | sed 's/action="//;s/"//')
    
    # Check for CSRF token in form
    if ! echo "\$form" | grep -qiE 'csrf|_token|nonce|authenticity_token|xsrf|__RequestVerificationToken'; then
      # Check page for hidden CSRF fields
      local hidden_fields=$(echo "$page" | perl -nle 'print \$& if /<input[^>]*hidden[^>]*>/g' 2>/dev/null)
      local has_csrf=false
      
      while IFS= read -r hidden; do
        if echo "\$hidden" | grep -qiE 'csrf|_token|nonce|authenticity'; then
          has_csrf=true
          break
        fi
      done <<< "$hidden_fields"
      
      if [ "$has_csrf" = false ] && [ "$form_method" = "post" ]; then
        print_find "CSRF vulnerability!" "Form #$form_count missing CSRF protection"
        echo "SEVERITY: MEDIUM
VECTOR: Cross-Site Request Forgery (CSRF)
DETAIL: CSRF - No CSRF token in state-changing form on $target
EVIDENCE: Form action=$form_action, method=$form_method lacks CSRF protection
EXPLOIT: Generate malicious HTML form that auto-submits to this endpoint" > "$REPORTS_DIR/.finding_$(date +%s)_csrf.txt"
        findings=$((findings + 1))
      fi
    fi
  done <<< "$forms"
  
  if [ "$findings" -eq 0 ]; then
    print_ok "All forms appear to have CSRF protection"
  fi
  
  return $findings
}