/**
 * XXE Detection Test Fixtures
 * Tests for detecting XML External Entity injection vulnerabilities
 */

import type { TestGroup } from '../../types'

export const xxeDetectionTests: TestGroup = {
  name: 'XXE Detection',
  tier: 'A',
  layer: 2,
  description: 'Detection of XML parsers used without external entity protection',

  truePositives: [
    {
      name: 'XXE - Python ElementTree (unprotected)',
      expectFindings: true,
      expectedCategories: ['xxe'],
      description: 'Python xml.etree without defusedxml must be detected',
      file: {
        path: 'src/parser.py',
        content: `
import xml.etree.ElementTree as ET

def parse_user_xml(xml_data):
    # Vulnerable: no defusedxml imported
    tree = ET.parse(xml_data)
    root = tree.getroot()
    return root.find('name').text
`,
        language: 'python',
        size: 200,
      },
    },
    {
      name: 'XXE - Java DocumentBuilderFactory (unprotected)',
      expectFindings: true,
      expectedCategories: ['xxe'],
      description: 'Java DocumentBuilderFactory without setFeature must be detected',
      file: {
        path: 'src/XmlService.java',
        content: `
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.DocumentBuilder;
import org.w3c.dom.Document;

public class XmlService {
    public Document parseXml(String xml) throws Exception {
        // Vulnerable: no feature disabling
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        DocumentBuilder builder = factory.newDocumentBuilder();
        return builder.parse(new InputSource(new StringReader(xml)));
    }
}
`,
        language: 'java',
        size: 300,
      },
    },
    {
      name: 'XXE - Node.js xml2js (unprotected)',
      expectFindings: true,
      expectedCategories: ['xxe'],
      description: 'Node.js xml2js without safe options must be detected',
      file: {
        path: 'src/xml-handler.ts',
        content: `
import xml2js from 'xml2js'

export function parseXmlPayload(xmlData: string) {
  // xml2js without explicit safe configuration
  xml2js.parseString(xmlData, (err, result) => {
    if (err) throw err
    return result
  })
}
`,
        language: 'typescript',
        size: 200,
      },
    },
    {
      name: 'XXE - PHP simplexml (unprotected)',
      expectFindings: true,
      expectedCategories: ['xxe'],
      description: 'PHP simplexml_load_string without entity disable must be detected',
      file: {
        path: 'src/parser.php',
        content: `
<?php

function parseUserXml($xmlString) {
    // Vulnerable: no entity loader disabled
    $xml = simplexml_load_string($xmlString);
    return $xml->name;
}
`,
        language: 'php',
        size: 150,
      },
    },
  ],

  falseNegatives: [
    {
      name: 'XXE - Python with defusedxml (safe)',
      expectFindings: false,
      description: 'Python file using defusedxml is safe',
      file: {
        path: 'src/safe_parser.py',
        content: `
import defusedxml.ElementTree as ET

def parse_user_xml(xml_data):
    # Safe: using defusedxml
    tree = ET.parse(xml_data)
    root = tree.getroot()
    return root.find('name').text
`,
        language: 'python',
        size: 200,
      },
    },
    {
      name: 'XXE - Java with DTD Disabled (safe)',
      expectFindings: false,
      description: 'Java DocumentBuilderFactory with disallow-doctype-decl is safe',
      file: {
        path: 'src/SafeXmlService.java',
        content: `
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.DocumentBuilder;

public class SafeXmlService {
    public Document parseXml(String xml) throws Exception {
        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        // Safe: DTD disabled
        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        DocumentBuilder builder = factory.newDocumentBuilder();
        return builder.parse(new InputSource(new StringReader(xml)));
    }
}
`,
        language: 'java',
        size: 300,
      },
    },
    {
      name: 'XXE - Python with defusedxml import (safe)',
      expectFindings: false,
      description: 'Python file importing defusedxml even if using ET alias',
      file: {
        path: 'src/xml_utils.py',
        content: `
from defusedxml.ElementTree import parse, fromstring

def load_config(path):
    tree = parse(path)
    return tree.getroot()

def parse_string(xml_str):
    return fromstring(xml_str)
`,
        language: 'python',
        size: 200,
      },
    },
    {
      name: 'XXE - Browser DOMParser in TSX (safe)',
      expectFindings: false,
      description: 'Browser DOMParser in client-side TSX is inherently safe',
      file: {
        path: 'src/components/XmlViewer.tsx',
        content: `
'use client'

export function XmlViewer({ xml }: { xml: string }) {
  const parser = new DOMParser()
  const doc = parser.parseFromString(xml, 'text/xml')
  return <pre>{doc.documentElement.textContent}</pre>
}
`,
        language: 'typescript',
        size: 200,
      },
      allowedInfoFindings: [
        {
          category: 'xxe',
          maxCount: 1,
          reason: 'DOMParser in TSX may produce info-level finding',
        },
      ],
    },
  ],
}
