class

Maze

Inherits Reference / Object

Constants

SERVER_CHANNELS = ["query", "path", "body", "header", "cookie", "referer"] of ::String

Delivery channels a plain HTTP client can drive on its own. Anything else needs a real browser (or a driver) to place the payload.

VULN_CLASSES = ["unclassified", "reflected-html", "reflected-attr", "reflected-js", "dom", "stored", "prototype-pollution", "csti", "non-xss-control"] of ::String

Classification rule: classify by the injection context — where the bytes actually land — not by what the receiving API does with a well-formed argument. A value the server reflects raw into a JS string literal is reflected-js however inert the function it is passed to, because the breakout happens before that function is ever called. dom is for flows whose taint reaches a sink through client-side code (either from a client-side source, or from a server-reflected literal that a live DOM sink then executes without needing a breakout).

Closed set of vuln values. "unclassified" is the default for endpoints that have not been triaged yet — deliberately distinct from "non-xss-control" so unreviewed and reviewed-as-safe never get conflated.

Constructors

new(name : String, url : String, desc : String, method : String = "GET", params : Array(String) = ["query"], vuln : String = "unclassified", sources : Array(String) = [] of String, sinks : Array(String) = [] of String, delivery : Array(String) = [] of String, exploitable : Bool = true, note : Nil | String = nil)
Source

Instance methods

delivery

Where the payload enters, e.g. "query", "fragment", "postmessage".

Source
desc
Source
exploitable?

False when the endpoint is a control / true negative.

Source
method
Source
name
Source
note

Free-form caveat: why it is a control, what interaction it needs, etc.

Source
params
Source
reach

"server" - the payload fits in the HTTP request (query/path/body/ header/cookie/referer), so a non-browser scanner can reach it. "client" - the payload only exists browser-side (fragment, postMessage, clipboard, drag-and-drop, window.name, ...); a request-only scanner cannot deliver it at all. "unknown" - not triaged.

Source
sinks

DOM taint sinks, e.g. "innerHTML", "eval", "location-nav", "srcdoc".

Source
sources

DOM taint sources, e.g. "location.hash", "postMessage", "localStorage".

Source
to_json_object
Source
type

Category, derived from the name prefix ("basic-level1" -> "basic"). Computed once: grouping, /map/json, /map/openapi and /stats each walk every maze, and the old split("-").first? allocated an array per call.

Source
vuln

Vulnerability class; one of VULN_CLASSES.

Source