diff --git a/.gitignore b/.gitignore index a08b53e..57387c6 100644 --- a/.gitignore +++ b/.gitignore @@ -10,6 +10,8 @@ obj/ .env.local .vs/ +README.md +README.txt ## Rider / VS Code / JetBrains .idea/ .vscode/ @@ -33,6 +35,9 @@ Migrations/ *.pidb *.pdb +# dependencies +/node_modules + ## OS Files .DS_Store Thumbs.db \ No newline at end of file diff --git a/README.md b/README.md index 7424e27..16e304a 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,16 @@ -# Sec_Coding_Lab -Training Files for Secure Coding Course +# Secure Coding Training Projects and Files +This repository contains a collection of hands-on projects and training modules focused on secure coding practices using modern .NET technologies. It is designed to support learning and teaching of common security vulnerabilities, their mitigations, and best practices for building secure web applications. +--- +## 🔐 Purpose + +The goal of this repository is to provide a structured and practical resource for software developers and security engineers to: + +- Understand common web security issues (e.g., injection, authentication flaws, insecure deserialization). +- Analyze insecure .NET codebases and fix vulnerabilities. +- Learn to use Identity Framework and ASP.NET Core securely. +- Practice secure design and implementation patterns using C# and .NET Core APIs. + +--- diff --git a/appsettings.json b/appsettings.json deleted file mode 100644 index f6852ef..0000000 --- a/appsettings.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "ConnectionStrings": { - "DefaultConnection": "Server=localhost;Database=UserProfileDb;User Id=sa;Password=123456789;MultipleActiveResultSets=true" - }, - "Logging": { - "LogLevel": { - "Default": "Information", - "Microsoft.AspNetCore": "Warning" - } - }, - "AllowedHosts": "*" -} \ No newline at end of file diff --git a/sec11/Controllers/SerializationController.cs b/sec11/Controllers/SerializationController.cs deleted file mode 100644 index 3caf1a4..0000000 --- a/sec11/Controllers/SerializationController.cs +++ /dev/null @@ -1,60 +0,0 @@ - -using Google.Protobuf; -using Microsoft.AspNetCore.Mvc; -using Newtonsoft.Json; -using System.IO; -using System.Xml.Serialization; -using System.Runtime.Serialization.Formatters.Binary; - -namespace SerializationSecurity.Controllers -{ - [ApiController] - [Route("api/[controller]")] - public class SerializationController : ControllerBase - { - [HttpPost("upload-binary")] - [Consumes("application/octet-stream")] - public IActionResult UploadBinary() - { - var formatter = new BinaryFormatter(); - using var stream = Request.Body; - var userProfile = (UserProfile)formatter.Deserialize(stream); - if (userProfile.Name.Length > 50) - return BadRequest("Invalid name"); - return Ok($"Hello {userProfile.Name}, {userProfile.Bio}"); - } - - [HttpPost("upload-json")] - [Consumes("application/json")] - public IActionResult UploadJson([FromBody] string jsonPayload) - { - var profile = JsonConvert.DeserializeObject(jsonPayload); - if (profile.Name.Length > 50) - return BadRequest("Invalid name"); - return Ok($"Hello {profile.Name}, {profile.Bio}"); - } - - [HttpPost("upload-xml")] - [Consumes("application/xml")] - public IActionResult UploadXml() - { - var serializer = new XmlSerializer(typeof(UserProfile)); - using var stream = Request.Body; - var profile = (UserProfile)serializer.Deserialize(stream); - if (profile.Name.Length > 50) - return BadRequest("Invalid name"); - return Ok($"Hello {profile.Name}, {profile.Bio}"); - } - - [HttpPost("upload-protobuf")] - [Consumes("application/x-protobuf")] - public IActionResult UploadProtobuf() - { - using var stream = Request.Body; - var profile = UserProfile.Parser.ParseFrom(stream); - if (profile.Name.Length > 50) - return BadRequest("Invalid name"); - return Ok($"Hello {profile.Name}, {profile.Bio}"); - } - } -} diff --git a/sec11/UserProfile.cs b/sec11/UserProfile.cs deleted file mode 100644 index a59838c..0000000 --- a/sec11/UserProfile.cs +++ /dev/null @@ -1,17 +0,0 @@ - -namespace SerializationSecurity -{ - public class UserProfile - { - public string Name { get; set; } - public string Bio { get; set; } - public Address UserAddress { get; set; } - } - - public class Address - { - public string Street { get; set; } - public string City { get; set; } - public string ZipCode { get; set; } - } -} diff --git a/Controllers/AccountController.cs b/sec17/Controllers/AccountController.cs similarity index 91% rename from Controllers/AccountController.cs rename to sec17/Controllers/AccountController.cs index e83afd4..82b081c 100644 --- a/Controllers/AccountController.cs +++ b/sec17/Controllers/AccountController.cs @@ -20,7 +20,7 @@ public AccountController(UserManager userManager, SignInManager [HttpPost("register")] public async Task Register([FromBody] RegisterDto model) { - var user = new ApplicationUser { UserName = model.Email, Email = model.Email }; + var user = new ApplicationUser { UserName = model.Email, Email = model.Email, Bio = model.Bio ?? "Default bio here", FullName = model.FullName ?? "Default full name" }; var result = await _userManager.CreateAsync(user, model.Password); return result.Succeeded ? Ok() : BadRequest(result.Errors); } @@ -56,7 +56,7 @@ public async Task Reset([FromBody] PasswordResetDto model) return result.Succeeded ? Ok() : BadRequest(result.Errors); } - public class RegisterDto { public string Email { get; set; } public string Password { get; set; } } + public class RegisterDto { public string Email { get; set; } public string Password { get; set; } public string? Bio { get; set; } public string? FullName { get; set; } } public class LoginDto { public string Email { get; set; } public string Password { get; set; } } public class PasswordResetRequestDto { public string Email { get; set; } } public class PasswordResetDto { public string Email { get; set; } public string Token { get; set; } public string NewPassword { get; set; } } diff --git a/Controllers/ProfileController.cs b/sec17/Controllers/ProfileController.cs similarity index 100% rename from Controllers/ProfileController.cs rename to sec17/Controllers/ProfileController.cs diff --git a/LICENSE b/sec17/LICENSE similarity index 100% rename from LICENSE rename to sec17/LICENSE diff --git a/Models/ApplicationUser.cs b/sec17/Models/ApplicationUser.cs similarity index 100% rename from Models/ApplicationUser.cs rename to sec17/Models/ApplicationUser.cs diff --git a/Models/ProfileDto.cs b/sec17/Models/ProfileDto.cs similarity index 100% rename from Models/ProfileDto.cs rename to sec17/Models/ProfileDto.cs diff --git a/Program.cs b/sec17/Program.cs similarity index 100% rename from Program.cs rename to sec17/Program.cs diff --git a/Properties/launchSettings.json b/sec17/Properties/launchSettings.json similarity index 100% rename from Properties/launchSettings.json rename to sec17/Properties/launchSettings.json diff --git a/Readme.txt b/sec17/README.md similarity index 62% rename from Readme.txt rename to sec17/README.md index 190f845..e858554 100644 --- a/Readme.txt +++ b/sec17/README.md @@ -1,7 +1,6 @@ # UserProfileApi -An ASP.NET Core Web API project that implements user registration, authentication, session-based login, password reset, and profile management using **ASP.NET Core Identity**. -Ideal for use behind an API Gateway (e.g., Kong). +An ASP.NET Core Web API project that implements user registration, authentication, session-based login, password reset, and profile management using **ASP.NET Core Identity**. Ideal for use behind an API Gateway (e.g., Kong). --- @@ -30,25 +29,21 @@ Ideal for use behind an API Gateway (e.g., Kong). ## 🚀 Getting Started ### 1. Clone the Repository - -```bash -git clone https://github.com/code5ecure/Sec_coding_lab/UserProfileApi.git -cd UserProfileApi - - -2. Configure Database: - -Update your appsettings.json: - -"ConnectionStrings": { - "DefaultConnection": "Server=localhost;Database=UserProfileDb;User Id=sa;Password=YourPasswordHere;MultipleActiveResultSets=true" -} - +

+ +git clone [https://github.com/yourusername/UserProfileApi.git](https://github.com/code5ecure/Sec_coding_lab.git) +cd UserProfileApi
+2. Configure Database
+Update your appsettings.json:
+"ConnectionStrings": {
+ "DefaultConnection": "Server=localhost;Database=UserProfileDb;User Id= ;Password=<>;MultipleActiveResultSets=true"
+}
3. Run EF Core Migrations +
+dotnet tool install --global dotnet-ef # if not already installed br> +dotnet ef migrations add Init
+dotnet ef database update
+4. Run the API
-dotnet tool install --global dotnet-ef -dotnet ef migrations add Init -dotnet ef database update - -4. Run dotnet run +
diff --git a/UserProfileApi.csproj b/sec17/UserProfileApi.csproj similarity index 100% rename from UserProfileApi.csproj rename to sec17/UserProfileApi.csproj diff --git a/UserProfileApi.http b/sec17/UserProfileApi.http similarity index 100% rename from UserProfileApi.http rename to sec17/UserProfileApi.http diff --git a/appsettings.Development.json b/sec17/appsettings.Development.json similarity index 100% rename from appsettings.Development.json rename to sec17/appsettings.Development.json diff --git a/sec17/appsettings.json b/sec17/appsettings.json new file mode 100644 index 0000000..9aee7af --- /dev/null +++ b/sec17/appsettings.json @@ -0,0 +1,12 @@ +{ + "ConnectionStrings": { + "DefaultConnection": "Server=localhost;Database=UserProfileDb;User Id=sa;Password=123456789;MultipleActiveResultSets=true;TrustServerCertificate=True;Encrypt=False" + }, + "Logging": { + "LogLevel": { + "Default": "Information", + "Microsoft.AspNetCore": "Warning" + } + }, + "AllowedHosts": "*" +} \ No newline at end of file diff --git a/data/ApplicationDbContext.cs b/sec17/data/ApplicationDbContext.cs similarity index 100% rename from data/ApplicationDbContext.cs rename to sec17/data/ApplicationDbContext.cs diff --git a/sec20/EnvVarDemo.Api/EnvVarDemo.Api.csproj b/sec20/EnvVarDemo.Api/EnvVarDemo.Api.csproj new file mode 100644 index 0000000..7c0bcd6 --- /dev/null +++ b/sec20/EnvVarDemo.Api/EnvVarDemo.Api.csproj @@ -0,0 +1,13 @@ + + + + net9.0 + enable + enable + + + + + + + \ No newline at end of file diff --git a/sec20/EnvVarDemo.Api/Program.cs b/sec20/EnvVarDemo.Api/Program.cs new file mode 100644 index 0000000..a4d48a1 --- /dev/null +++ b/sec20/EnvVarDemo.Api/Program.cs @@ -0,0 +1,51 @@ +var builder = WebApplication.CreateBuilder(args); + +// Load configuration from appsettings.json +builder.Configuration.AddJsonFile("appsettings.json", optional: false, reloadOnChange: true); + +// Setup Kestrel +builder.WebHost.ConfigureKestrel(options => +{ + options.Configure(builder.Configuration.GetSection("Kestrel")); +}); + +// 🔐 Allow CORS +builder.Services.AddCors(options => +{ + options.AddDefaultPolicy(policy => + { + policy + .WithOrigins("http://localhost:5000") + .AllowAnyHeader() + .AllowAnyMethod(); + }); +}); + +builder.Services.AddEndpointsApiExplorer(); +builder.Services.AddSwaggerGen(); + +var app = builder.Build(); + +// Apply middleware +app.UseSwagger(); +app.UseSwaggerUI(); +app.UseCors(); // 🔥 THIS is critical +app.UseHttpsRedirection(); + +app.MapPost("/api/SecureData", (HttpRequest request) => +{ + var keyFromHeader = request.Headers["X-API-KEY"].ToString(); + var expectedKey = Environment.GetEnvironmentVariable("MY_API_KEY"); + + if (keyFromHeader != expectedKey) + { + return Results.BadRequest("❌ Invalid API Key"); + } + + return Results.Ok("✅ Authorized. Your API key is valid."); +}); + + + + +app.Run(); diff --git a/sec20/EnvVarDemo.Api/appsettings.json b/sec20/EnvVarDemo.Api/appsettings.json new file mode 100644 index 0000000..c506cae --- /dev/null +++ b/sec20/EnvVarDemo.Api/appsettings.json @@ -0,0 +1,9 @@ +{ + "Kestrel": { + "Endpoints": { + "Http": { + "Url": "http://localhost:5050" + } + } + } +} \ No newline at end of file diff --git a/sec20/EnvVarDemo.Web/EnvVarDemo.Web.csproj b/sec20/EnvVarDemo.Web/EnvVarDemo.Web.csproj new file mode 100644 index 0000000..6f27d5c --- /dev/null +++ b/sec20/EnvVarDemo.Web/EnvVarDemo.Web.csproj @@ -0,0 +1,9 @@ + + + + net9.0 + enable + enable + + + \ No newline at end of file diff --git a/sec20/EnvVarDemo.Web/Pages/Index.cshtml b/sec20/EnvVarDemo.Web/Pages/Index.cshtml new file mode 100644 index 0000000..814fb24 --- /dev/null +++ b/sec20/EnvVarDemo.Web/Pages/Index.cshtml @@ -0,0 +1,27 @@ +@page +@model IndexModel +@{ + ViewData["Title"] = "Home page"; +} + +

API Key Authentication Test

+ + + + +

+ + diff --git a/sec20/EnvVarDemo.Web/Pages/Index.cshtml.cs b/sec20/EnvVarDemo.Web/Pages/Index.cshtml.cs new file mode 100644 index 0000000..c78cfc4 --- /dev/null +++ b/sec20/EnvVarDemo.Web/Pages/Index.cshtml.cs @@ -0,0 +1,16 @@ +using Microsoft.AspNetCore.Mvc.RazorPages; +using Microsoft.Extensions.Configuration; + +public class IndexModel : PageModel +{ + public string ApiUrl { get; private set; } + + public IndexModel(IConfiguration config) + { + ApiUrl = $"{config["ApiBaseUrl"]}/api/SecureData"; + } + + public void OnGet() + { + } +} diff --git a/sec20/EnvVarDemo.Web/Program.cs b/sec20/EnvVarDemo.Web/Program.cs new file mode 100644 index 0000000..67bc86c --- /dev/null +++ b/sec20/EnvVarDemo.Web/Program.cs @@ -0,0 +1,11 @@ +var builder = WebApplication.CreateBuilder(args); + +builder.Configuration.AddJsonFile("appsettings.json", optional: false, reloadOnChange: true); +builder.Services.AddRazorPages(); + +var app = builder.Build(); + +app.UseStaticFiles(); +app.UseRouting(); +app.MapRazorPages(); +app.Run(); \ No newline at end of file diff --git a/sec20/EnvVarDemo.Web/appsettings.json b/sec20/EnvVarDemo.Web/appsettings.json new file mode 100644 index 0000000..4b00a8a --- /dev/null +++ b/sec20/EnvVarDemo.Web/appsettings.json @@ -0,0 +1,3 @@ +{ + "ApiBaseUrl": "http://localhost:5050" +} \ No newline at end of file diff --git a/sec20/README.md b/sec20/README.md new file mode 100644 index 0000000..494d01b --- /dev/null +++ b/sec20/README.md @@ -0,0 +1,121 @@ +# EnvVarDemo - Secure API Key Demo (.NET 9) + +This solution demonstrates a secure setup for passing an API key from a web frontend to a backend API in ASP.NET Core 9. + +## 🔒 Key Security Points + +### 1. Sending Parameters via POST is More Secure +- The frontend sends the API key using the `X-API-KEY` header via **POST**. +- **Why POST is safer**: GET requests expose data in URLs (browser history, server logs), while POST keeps headers and body hidden from such logging. + +### 2. Avoid `AllowAnyOrigin()` in CORS +- Using `AllowAnyOrigin()` allows *any* website to call your API, which is insecure. +- Instead, explicitly define allowed origins in the backend: + ```.csharp + builder.Services.AddCors(options => + { + options.AddDefaultPolicy(policy => + { + policy.WithOrigins("http://localhost:5000") + .AllowAnyHeader() + .AllowAnyMethod(); + }); + }); + ``` + +### 3. How to Set API Key in Environment Variables + +#### 🪟 On Windows (PowerShell or CMD) +```powershell +$env:MY_API_KEY = "your-api-key-here" +``` +Or persist it for the session: +```powershell +[System.Environment]::SetEnvironmentVariable("MY_API_KEY", "your-api-key-here", "User") +``` +To view: +```powershell +[System.Environment]::GetEnvironmentVariable("MY_API_KEY", "User") +``` + +#### 🐧 On Linux/macOS (bash) +```bash +export MY_API_KEY="your-api-key-here" +``` +To make it permanent, add the above line to your `~/.bashrc`, `~/.zshrc`, or `~/.profile`. + +--- + +## ⚙️ appsettings.json Configuration + +Both Web and API projects can use `appsettings.json` to configure the default port. + +### 🔧 Example for `EnvVarDemo.Api/appsettings.json`: +```json +{ + "Kestrel": { + "Endpoints": { + "Http": { + "Url": "http://localhost:5001" + } + } + }, + "Logging": { + "LogLevel": { + "Default": "Information", + "Microsoft.AspNetCore": "Warning" + } + } +} +``` + +### 🔧 Example for `EnvVarDemo.Web/appsettings.json`: +```json +{ + "Kestrel": { + "Endpoints": { + "Http": { + "Url": "http://localhost:5000" + } + } + }, + "Logging": { + "LogLevel": { + "Default": "Information", + "Microsoft.AspNetCore": "Warning" + } + } +} +``` + +Ensure each project includes this file and is configured to use it in `Program.cs`. + +--- + +## 🚀 Running the Projects + +### 1. API Project +```bash +cd EnvVarDemo.Api +dotnet run +``` +The API runs on port 5001 by default (as set in `appsettings.json`). + +### 2. Web (Frontend) Project +```bash +cd EnvVarDemo.Web +dotnet run +``` +The frontend UI runs on port 5000. + +Ensure both projects are running, and that CORS and ports are aligned correctly. + +## ✅ Test Scenario +1. Run the backend (`EnvVarDemo.Api`) on port 5001. +2. Run the frontend (`EnvVarDemo.Web`) on port 5000. +3. Visit `http://localhost:5000`, enter your API key, and click send. +4. If valid, you'll see a success message. If not, you'll receive a 400 error. + +--- + +© 2025 - Secure Coding Demo diff --git a/sec4/FileUploadVulnerable3/Controllers/FileUploadController.cs b/sec4/FileUploadVulnerable3/Controllers/FileUploadController.cs new file mode 100644 index 0000000..36d42c5 --- /dev/null +++ b/sec4/FileUploadVulnerable3/Controllers/FileUploadController.cs @@ -0,0 +1,30 @@ +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Http; +using System.IO; +using System.Threading.Tasks; + +namespace FileUploadVulnerable.Controllers +{ + public class FileUploadController : Controller + { + [HttpGet] + public IActionResult Index() => View(); + + [HttpPost] + public async Task Upload(IFormFile file) + { + if (file == null || file.Length == 0) + return Content("File not selected"); + + if (file.ContentType != "image/jpeg") + return Content("Only JPEG files are allowed"); + + var uploads = Path.Combine(Directory.GetCurrentDirectory(), "wwwroot/uploads"); + Directory.CreateDirectory(uploads); + var filePath = Path.Combine(uploads, Path.GetFileName(file.FileName)); + using var stream = new FileStream(filePath, FileMode.Create); + await file.CopyToAsync(stream); + return Content($"[Header Check] File uploaded to {filePath}"); + } + } +} diff --git a/sec4/FileUploadVulnerable3/Controllers/HomeController.cs b/sec4/FileUploadVulnerable3/Controllers/HomeController.cs new file mode 100644 index 0000000..e413d8f --- /dev/null +++ b/sec4/FileUploadVulnerable3/Controllers/HomeController.cs @@ -0,0 +1,10 @@ +using Microsoft.AspNetCore.Mvc; + +namespace FileUploadVulnerable.Controllers +{ + public class HomeController : Controller + { + [HttpGet] + public IActionResult Index() => View(); + } +} diff --git a/sec4/FileUploadVulnerable3/Controllers/Uploader2Controller.cs b/sec4/FileUploadVulnerable3/Controllers/Uploader2Controller.cs new file mode 100644 index 0000000..cd3d24d --- /dev/null +++ b/sec4/FileUploadVulnerable3/Controllers/Uploader2Controller.cs @@ -0,0 +1,30 @@ +using Microsoft.AspNetCore.Mvc; +using Microsoft.AspNetCore.Http; +using System; +using System.IO; +using System.Threading.Tasks; + +namespace FileUploadVulnerable.Controllers +{ + public class Uploader2Controller : Controller + { + [HttpPost] + public async Task Upload(IFormFile file) + { + if (file == null || file.Length == 0) + return Content("File not selected"); + + var ext = Path.GetExtension(file.FileName)?.ToLowerInvariant(); + if (ext != ".jpg") + return Content("Only JPEG files are allowed"); + + var fileName = $"{Guid.NewGuid()}{ext}"; + var uploads = Path.Combine(Directory.GetCurrentDirectory(), "wwwroot/uploads"); + Directory.CreateDirectory(uploads); + var filePath = Path.Combine(uploads, fileName); + using var stream = new FileStream(filePath, FileMode.Create); + await file.CopyToAsync(stream); + return Content($"[Extension Check GUID] File uploaded to {filePath}"); + } + } +} diff --git a/sec4/FileUploadVulnerable3/FileUploadVulnerableNet9.csproj b/sec4/FileUploadVulnerable3/FileUploadVulnerableNet9.csproj new file mode 100644 index 0000000..902ca32 --- /dev/null +++ b/sec4/FileUploadVulnerable3/FileUploadVulnerableNet9.csproj @@ -0,0 +1,11 @@ + + + net9.0 + enable + enable + + + + + + diff --git a/sec4/FileUploadVulnerable3/FileUploadVulnerableNet9.sln b/sec4/FileUploadVulnerable3/FileUploadVulnerableNet9.sln new file mode 100644 index 0000000..df931f6 --- /dev/null +++ b/sec4/FileUploadVulnerable3/FileUploadVulnerableNet9.sln @@ -0,0 +1,22 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.12.35527.113 d17.12 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FileUploadVulnerableNet9", "FileUploadVulnerableNet9.csproj", "{753600A1-0F46-44BE-9D66-1730ECAF72FB}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Release|Any CPU = Release|Any CPU + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {753600A1-0F46-44BE-9D66-1730ECAF72FB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {753600A1-0F46-44BE-9D66-1730ECAF72FB}.Debug|Any CPU.Build.0 = Debug|Any CPU + {753600A1-0F46-44BE-9D66-1730ECAF72FB}.Release|Any CPU.ActiveCfg = Release|Any CPU + {753600A1-0F46-44BE-9D66-1730ECAF72FB}.Release|Any CPU.Build.0 = Release|Any CPU + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/sec4/FileUploadVulnerable3/Program.cs b/sec4/FileUploadVulnerable3/Program.cs new file mode 100644 index 0000000..fa22105 --- /dev/null +++ b/sec4/FileUploadVulnerable3/Program.cs @@ -0,0 +1,107 @@ +using Microsoft.AspNetCore.Builder; +using Microsoft.Extensions.DependencyInjection; +using Microsoft.Extensions.Hosting; +using tusdotnet; +using tusdotnet.Models.Configuration; +using tusdotnet.Stores; +using System.Text; +using MimeDetective; +using MimeDetective.Engine; +using System.IO; +using System.Linq; +using System; +using tusdotnet.Models; + +var builder = WebApplication.CreateBuilder(args); +builder.Services.AddControllersWithViews(); + +var app = builder.Build(); + +// Ensure the uploads folder exists +var uploadsRoot = Path.Combine(Directory.GetCurrentDirectory(), "wwwroot", "uploads"); +Directory.CreateDirectory(uploadsRoot); + +app.UseStaticFiles(); +app.UseRouting(); + +app.UseTus(_ => new DefaultTusConfiguration +{ + Store = new TusDiskStore(uploadsRoot), + UrlPath = "/tusfiles", + Events = new Events + { + OnBeforeCreateAsync = ctx => + { + // Pre‑flight: only allow image/png or image/jpeg + var md = ctx.Metadata; + var ft = md.ContainsKey("filetype") + ? md["filetype"].GetString(Encoding.UTF8) + : ""; + if (ft != "image/png" && ft != "image/jpeg") + { + ctx.FailRequest("Only PNG or JPEG allowed."); + } + return Task.CompletedTask; + }, + + OnFileCompleteAsync = async ctx => + { + try + { + // 1) Grab the completed upload as a stream + var tusFile = await ctx.GetFileAsync(); + var ct = ctx.CancellationToken; + + // 2) Read out the original filename from metadata + var meta = await tusFile.GetMetadataAsync(ct); + meta.TryGetValue("filename", out var fnMeta); + var rawName = fnMeta?.GetString(Encoding.UTF8) ?? ""; + Console.WriteLine($"[Tus] metadata filename = '{rawName}'"); + + // 3) Determine extension: use metadata first + var ext = Path.GetExtension(rawName); + // 4) If metadata gave no extension, detect by content + if (string.IsNullOrEmpty(ext)) + { + await using var contentStream = await tusFile.GetContentAsync(ct); + contentStream.Seek(0, SeekOrigin.Begin); + var insp = new ContentInspectorBuilder().Build(); + var match = insp.Inspect(contentStream).ByMimeType().FirstOrDefault(); + if (match != null) + { + ext = match.MimeType switch + { + "image/png" => ".png", + "image/jpeg" => ".jpg", + _ => "" + }; + Console.WriteLine($"[Tus] detected MIME = {match.MimeType}, using ext = '{ext}'"); + } + } + + if (string.IsNullOrEmpty(ext)) + { + Console.WriteLine("[Tus] no extension could be determined; skipping save."); + return; + } + + // 5) Write out the final file with GUID + extension + var finalName = $"{ctx.FileId}{ext}"; + var finalPath = Path.Combine(uploadsRoot, finalName); + await using var inStream = await tusFile.GetContentAsync(ct); + await using var outStream = new FileStream(finalPath, FileMode.Create, FileAccess.Write); + inStream.Seek(0, SeekOrigin.Begin); + await inStream.CopyToAsync(outStream, ct); + + Console.WriteLine($"[Tus] saved: {finalName}"); + } + catch (Exception ex) + { + Console.WriteLine($"[Tus] OnFileCompleteAsync error: {ex}"); + } + } + } +}); + +app.MapDefaultControllerRoute(); +app.Run(); diff --git a/sec4/FileUploadVulnerable3/Properties/launchSettings.json b/sec4/FileUploadVulnerable3/Properties/launchSettings.json new file mode 100644 index 0000000..0ec2e05 --- /dev/null +++ b/sec4/FileUploadVulnerable3/Properties/launchSettings.json @@ -0,0 +1,12 @@ +{ + "profiles": { + "FileUploadVulnerableNet9": { + "commandName": "Project", + "launchBrowser": true, + "environmentVariables": { + "ASPNETCORE_ENVIRONMENT": "Development" + }, + "applicationUrl": "https://localhost:48084;http://localhost:48085" + } + } +} \ No newline at end of file diff --git a/sec4/FileUploadVulnerable3/README.md b/sec4/FileUploadVulnerable3/README.md new file mode 100644 index 0000000..9e3bced --- /dev/null +++ b/sec4/FileUploadVulnerable3/README.md @@ -0,0 +1,63 @@ +

📁 Secure File Upload Examples in ASP.NET Core



+This repository demonstrates three file upload implementations in ASP.NET Core, +progressing from insecure to secure, for educational purposes. +
+

🔍 Project Structure

+
+/FileUploadVulnerable1/ --> Basic upload with header check only
+/FileUploadVulnerable2/ --> Vulnerable to %00 null byte exploit
+/FileUploadSecureTus/ --> Secure resumable uploads via tusdotnet with validation
+

🚨 Version 1 – Insecure Header-Only Check

+Path: FileUploadVulnerable1 +
+

✅ Features:


+Accepts uploaded files via form. +
+Checks MIME type using the Content-Type HTTP header. + +

❌ Vulnerabilities:

+
Trusting User Input: Relies solely on Content-Type header, which can be faked.
+ +Content Mismatch: Allows non-image files with .jpg extension (e.g., uploading PHP or executable files disguised as images). +
+Example Exploit: +
+ +

❌ Vulnerabilities:

+Null Byte Injection: Accepts filenames like shell.aspx%00.jpg
+ +

✅ Version 3 – Secure Upload with tusdotnet


+Path: FileUploadSecureTus +
+ +

🔐 Security Measures:


+Does not trust the filename or extension. +
+Validates actual file content type using byte inspection. +
+Automatically renames files with a safe GUID + extension format. +
+Serves files from a secure location (wwwroot/uploads) after validation. +
+ +The tusdotnet implementation provides both security and resumability, making it the most reliable and robust upload method for modern web apps. +
+

⚙️ Requirements


+.NET 7 or later +
+tusdotnet NuGet package +
+MimeDetective NuGet package +
+

🚀 Usage

+Clone the repo. +
+Run the desired project:
+ + +dotnet run --project FileUploadSecureTus
+Visit https://localhost:48084 and upload an image.
+ +![Capture](https://github.com/user-attachments/assets/4c11a8b1-ffc9-4077-ae2a-0fa3260ae47c) + +
diff --git a/sec4/FileUploadVulnerable3/Views/FileUpload/Index.cshtml b/sec4/FileUploadVulnerable3/Views/FileUpload/Index.cshtml new file mode 100644 index 0000000..415885c --- /dev/null +++ b/sec4/FileUploadVulnerable3/Views/FileUpload/Index.cshtml @@ -0,0 +1,8 @@ +@{ + ViewData["Title"] = "File Upload"; +} +

Upload a JPEG File

+
+ + +
diff --git a/sec4/FileUploadVulnerable3/Views/Home/Index.cshtml b/sec4/FileUploadVulnerable3/Views/Home/Index.cshtml new file mode 100644 index 0000000..07367ea --- /dev/null +++ b/sec4/FileUploadVulnerable3/Views/Home/Index.cshtml @@ -0,0 +1,83 @@ + + + + File Upload Example + + + +@{ + ViewData["Title"] = "Home"; +} +

File Upload Demo

+ +
+

Uploader #1: Header Check

+
+ + +
+
+ +
+

Uploader #2: Extension GUID (%00 bypass)

+
+ + +
+
+ +
+

Secure Image Upload with tusdotnet

+ + + + + + +
diff --git a/sec4/FileUploadVulnerable3/Views/_ViewImports.cshtml b/sec4/FileUploadVulnerable3/Views/_ViewImports.cshtml new file mode 100644 index 0000000..a757b41 --- /dev/null +++ b/sec4/FileUploadVulnerable3/Views/_ViewImports.cshtml @@ -0,0 +1 @@ +@addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers diff --git a/sec4/FileUploadVulnerable3/appsettings.json b/sec4/FileUploadVulnerable3/appsettings.json new file mode 100644 index 0000000..26acf8d --- /dev/null +++ b/sec4/FileUploadVulnerable3/appsettings.json @@ -0,0 +1,12 @@ +{ + "profiles": { + "FileUploadVulnerableNet9": { + "commandName": "Project", + "launchBrowser": true, + "environmentVariables": { + "ASPNETCORE_ENVIRONMENT": "Development" + }, + "applicationUrl": "https://localhost:48084;http://localhost:48085" + } + } +} \ No newline at end of file diff --git a/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03 b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03 new file mode 100644 index 0000000..834ba55 Binary files /dev/null and b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03 differ diff --git a/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.chunkcomplete b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.chunkcomplete new file mode 100644 index 0000000..56a6051 --- /dev/null +++ b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.chunkcomplete @@ -0,0 +1 @@ +1 \ No newline at end of file diff --git a/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.chunkstart b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.chunkstart new file mode 100644 index 0000000..c227083 --- /dev/null +++ b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.chunkstart @@ -0,0 +1 @@ +0 \ No newline at end of file diff --git a/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.jpg b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.jpg new file mode 100644 index 0000000..834ba55 Binary files /dev/null and b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.jpg differ diff --git a/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.metadata b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.metadata new file mode 100644 index 0000000..48e3401 --- /dev/null +++ b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.metadata @@ -0,0 +1 @@ +filename cmVzdF9hcGkgLSBDb3B5LmpwZw==,filetype aW1hZ2UvanBlZw== \ No newline at end of file diff --git a/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.uploadlength b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.uploadlength new file mode 100644 index 0000000..285474e --- /dev/null +++ b/sec4/FileUploadVulnerable3/wwwroot/uploads/bc7b2d1580724898b03a49f7a3ac9b03.uploadlength @@ -0,0 +1 @@ +641795 \ No newline at end of file diff --git a/sec5/react-xss-lab-master/.dockerignore b/sec5/react-xss-lab-master/.dockerignore new file mode 100644 index 0000000..0c52673 --- /dev/null +++ b/sec5/react-xss-lab-master/.dockerignore @@ -0,0 +1,4 @@ +node_modules +npm-debug.log +build +*.md diff --git a/sec5/react-xss-lab-master/Dockerfile.dev b/sec5/react-xss-lab-master/Dockerfile.dev new file mode 100644 index 0000000..8be5822 --- /dev/null +++ b/sec5/react-xss-lab-master/Dockerfile.dev @@ -0,0 +1,18 @@ + +FROM node:alpine AS development + + +ENV NODE_ENV development + + +WORKDIR /react-app + + +COPY ./package.json /react-app +RUN npm install + + +COPY . . + + +CMD npm start \ No newline at end of file diff --git a/sec5/react-xss-lab-master/README.md b/sec5/react-xss-lab-master/README.md new file mode 100644 index 0000000..bf9bec8 --- /dev/null +++ b/sec5/react-xss-lab-master/README.md @@ -0,0 +1,24 @@ +# react-xss-lab +Dont upload this in your development envirnoment. +This is just educational labratoar to XSS vulnerabilities in react. + +It has simple sign up and sign in with mysql database and node js backend. +Then there are 3 types of xss (stored, dom , reflected ) has been inserted in code. + +1. Install node version 18.6.0 +2. Install and start mysql (you can simply use xampp in test envirnement) +3. create 2 database named.. lab and lab2 +4. change database user and password if neccessary. +5. download code and type : npm build +6. to start frontend in project directory type: npm start +7. to start backend go to back dir and then type : node Mitigated_server.js +then type: node Vuln_server.js + +![alt text](https://github.com/php-lover-boy/react-xss-lab/blob/main/www.JPG) +

+![alt text](https://github.com/php-lover-boy/react-xss-lab/blob/main/www2.JPG) +

+![alt text](https://github.com/php-lover-boy/react-xss-lab/blob/main/www3.JPG) +

+![alt text](https://github.com/php-lover-boy/react-xss-lab/blob/main/www4.JPG) +

diff --git a/sec5/react-xss-lab-master/back/Mitigated_server.js b/sec5/react-xss-lab-master/back/Mitigated_server.js new file mode 100644 index 0000000..82a8f56 --- /dev/null +++ b/sec5/react-xss-lab-master/back/Mitigated_server.js @@ -0,0 +1,64 @@ +const express = require("express"); +const bodyParser = require("body-parser"); +const cors = require("cors"); +var mysql = require("mysql"); + +const { body } = require("express-validator"); + +const app = express(); + +app.use(cors()); +app.use(cors(), function (req, res, next) { + res.header("Access-Control-Allow-Origin", "http://localhost:3000"); + res.header( + "Access-Control-Allow-Headers", + "Origin, X-Requested-With, Content-Type, Accept" + ); + next(); +}); + +app.use(bodyParser.json()); + +const conn = mysql.createConnection({ + host: "localhost", + user: "root", + password: "", + database: "lab2", +}); + +//connect to database +conn.connect((err) => { + if (err) throw err; + console.log("Mysql Connected..."); +}); + +//add new user +app.post( + "/store-data", + //////////////////////////////// input sanitization in backend + body("username").escape(), + body("email").escape(), + + (req, res) => { + let data = { username: req.body.username, email: req.body.email }; + + let sql = "INSERT INTO users SET ?"; + let query = conn.query(sql, data, (err, results) => { + if (err) throw err; + + res.send(JSON.stringify({ status: 200, error: null, response: results })); + }); + } +); + +app.get("/users", (req, res) => { + let sql = "SELECT * From users "; + let query = conn.query(sql, (err, results) => { + if (err) throw err; + res.send(results); + }); +}); + +app.listen(3002, () => { + console.log("Server running successfully on 3002"); +}); diff --git a/sec5/react-xss-lab-master/back/Vuln_server.js b/sec5/react-xss-lab-master/back/Vuln_server.js new file mode 100644 index 0000000..b03b97c --- /dev/null +++ b/sec5/react-xss-lab-master/back/Vuln_server.js @@ -0,0 +1,55 @@ +const express = require("express"); +const bodyParser = require("body-parser"); +const cors = require("cors"); +var mysql = require("mysql"); + +const app = express(); + +app.use(cors()); +app.use(cors(), function (req, res, next) { + res.header("Access-Control-Allow-Origin", "http://localhost:3000"); + res.header( + "Access-Control-Allow-Headers", + "Origin, X-Requested-With, Content-Type, Accept" + ); + next(); +}); + +app.use(bodyParser.json()); + +const conn = mysql.createConnection({ + host: "localhost", + user: "root", + password: "", + database: "lab", +}); + +conn.connect((err) => { + if (err) throw err; + console.log("Mysql Connected..."); +}); + +app.post("/store-data", (req, res) => { + let data = { + username: req.body.username, + email: req.body.email, + }; + + let sql = "INSERT INTO users SET ?"; + let query = conn.query(sql, data, (err, results) => { + if (err) throw err; + res.send(JSON.stringify({ status: 200, error: null, response: results })); + }); +}); + +app.get("/users", (req, res) => { + let sql = "SELECT * From users "; + let query = conn.query(sql, (err, results) => { + if (err) throw err; + res.send(results); + }); +}); + +app.listen(3001, () => { + console.log("Server running successfully on 3001"); +}); diff --git a/sec5/react-xss-lab-master/build/asset-manifest.json b/sec5/react-xss-lab-master/build/asset-manifest.json new file mode 100644 index 0000000..930bcf7 --- /dev/null +++ b/sec5/react-xss-lab-master/build/asset-manifest.json @@ -0,0 +1,16 @@ +{ + "files": { + "main.css": "/static/css/main.11871228.css", + "main.js": "/static/js/main.8c45f8df.js", + "static/js/512.16ce7241.chunk.js": "/static/js/512.16ce7241.chunk.js", + "static/media/logo.png": "/static/media/logo.017d701ca8c28a18892e.png", + "index.html": "/index.html", + "main.11871228.css.map": "/static/css/main.11871228.css.map", + "main.8c45f8df.js.map": "/static/js/main.8c45f8df.js.map", + "512.16ce7241.chunk.js.map": "/static/js/512.16ce7241.chunk.js.map" + }, + "entrypoints": [ + "static/css/main.11871228.css", + "static/js/main.8c45f8df.js" + ] +} \ No newline at end of file diff --git a/sec5/react-xss-lab-master/build/index.html b/sec5/react-xss-lab-master/build/index.html new file mode 100644 index 0000000..e242877 --- /dev/null +++ b/sec5/react-xss-lab-master/build/index.html @@ -0,0 +1 @@ +ReactJs xss lab
\ No newline at end of file diff --git a/sec5/react-xss-lab-master/build/manifest.json b/sec5/react-xss-lab-master/build/manifest.json new file mode 100644 index 0000000..080d6c7 --- /dev/null +++ b/sec5/react-xss-lab-master/build/manifest.json @@ -0,0 +1,25 @@ +{ + "short_name": "React App", + "name": "Create React App Sample", + "icons": [ + { + "src": "favicon.ico", + "sizes": "64x64 32x32 24x24 16x16", + "type": "image/x-icon" + }, + { + "src": "logo192.png", + "type": "image/png", + "sizes": "192x192" + }, + { + "src": "logo512.png", + "type": "image/png", + "sizes": "512x512" + } + ], + "start_url": ".", + "display": "standalone", + "theme_color": "#000000", + "background_color": "#ffffff" +} diff --git a/sec5/react-xss-lab-master/build/static/css/main.11871228.css b/sec5/react-xss-lab-master/build/static/css/main.11871228.css new file mode 100644 index 0000000..5e5745d --- /dev/null +++ b/sec5/react-xss-lab-master/build/static/css/main.11871228.css @@ -0,0 +1,2 @@ +body{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;margin:0}code{font-family:source-code-pro,Menlo,Monaco,Consolas,Courier New,monospace}:root{--main-bg-color:#3385ff}a,a:active,a:focus,a:hover{text-decoration:none}*{box-sizing:border-box;margin:0;padding:0}body{font-family:sans-serif}header{box-shadow:0 1px 3px 0 rgba(0,0,0,.07),0 1px 2px 0 rgba(0,0,0,.05);color:#212529}.nav-area{align-items:center;display:flex;margin:0 auto;max-width:1200px;padding:10px 20px}.logo{color:inherit;font-size:25px;margin-right:20px;text-decoration:none}.menus{align-items:center;display:flex;flex-wrap:wrap;list-style:none}.menu-items{font-size:14px;position:relative}.menu-items a{color:inherit;display:block;font-size:inherit;text-decoration:none}.menu-items button{align-items:center;background-color:transparent;border:none;color:inherit;cursor:pointer;display:flex;font-size:inherit;width:100%}button span{margin-left:3px}.menu-items button,.menu-items>a{padding:.7rem 1rem;text-align:left}.menu-items a:hover,.menu-items button:hover{background-color:#f2f2f2}.arrow:after{border-left:.32em solid transparent;border-right:.32em solid transparent;border-top:.42em solid;content:"";display:inline-block;margin-left:.28em;vertical-align:.09em}.dropdown{background-color:#fff;border-radius:.5rem;box-shadow:0 10px 15px -3px rgba(46,41,51,.08),0 4px 6px -2px rgba(71,63,79,.16);display:none;font-size:.875rem;left:auto;list-style:none;min-width:10rem;padding:.5rem 0;position:absolute;right:0;z-index:9999}.dropdown.show{display:block}.dropdown .dropdown-submenu{left:100%;position:absolute;top:-7px}.content{margin:0 auto;max-width:1200px;padding:3rem 20px}.content h2{margin-bottom:1rem}.content a{color:#cc3852;margin-right:10px}.demo1{margin-left:476px}.demo2{margin-left:602px}.profile{margin-left:1px;margin-top:26px}.profile2{margin-left:725px;margin-top:-355px}.content3{background-color:#eff3f7;float:left;height:auto;margin-left:222px;margin-top:-90px;width:auto}.textareacontent{background-color:#e7e9eb;float:left;height:auto;margin-left:30px;margin-top:50px}.content2{background-color:#eff3f7;float:left;height:auto;margin-left:222px;margin-top:-305px;width:auto}.button_submit{margin-top:40px}.test{background:url(/static/media/logo.017d701ca8c28a18892e.png);background-repeat:no-repeat;background-size:auto;font-size:50px;height:60vh;margin-left:332px;margin-top:93px} +/*# sourceMappingURL=main.11871228.css.map*/ \ No newline at end of file diff --git a/sec5/react-xss-lab-master/build/static/css/main.11871228.css.map b/sec5/react-xss-lab-master/build/static/css/main.11871228.css.map new file mode 100644 index 0000000..5c718c6 --- /dev/null +++ b/sec5/react-xss-lab-master/build/static/css/main.11871228.css.map @@ -0,0 +1 @@ +{"version":3,"file":"static/css/main.11871228.css","mappings":"AAAA,KAKE,kCAAmC,CACnC,iCAAkC,CAJlC,mIAEY,CAHZ,QAMF,CAEA,KACE,uEAEF,CAEA,MACE,uBACF,CAEA,2BACE,oBACF,CCpBA,EAGE,qBAAsB,CAFtB,QAAS,CACT,SAEF,CAEA,KACE,sBACF,CAEA,OACE,kEAA4E,CAC5E,aACF,CAEA,UAEE,kBAAmB,CADnB,YAAa,CAGb,aAAc,CADd,gBAAiB,CAEjB,iBACF,CAEA,MAGE,aAAc,CADd,cAAe,CAEf,iBAAkB,CAHlB,oBAIF,CAEA,OAEE,kBAAmB,CADnB,YAAa,CAEb,cAAe,CACf,eACF,CAEA,YAEE,cAAe,CADf,iBAEF,CAEA,cAGE,aAAc,CAFd,aAAc,CACd,iBAAkB,CAElB,oBACF,CAEA,mBAEE,kBAAmB,CAInB,4BAA6B,CAD7B,WAAY,CAFZ,aAAc,CAId,cAAe,CANf,YAAa,CAGb,iBAAkB,CAIlB,UACF,CAEA,YACE,eACF,CAEA,iCAEE,kBAAoB,CADpB,eAEF,CAEA,6CAEE,wBACF,CAEA,aAOE,mCAAqC,CADrC,oCAAsC,CADtC,sBAAwB,CAJxB,UAAW,CACX,oBAAqB,CACrB,iBAAmB,CACnB,oBAIF,CAEA,UAWE,qBAAsB,CACtB,mBAAqB,CARrB,gFACuC,CAQvC,YAAa,CAPb,iBAAmB,CAHnB,SAAU,CAOV,eAAgB,CAFhB,eAAgB,CAChB,eAAiB,CARjB,iBAAkB,CAClB,OAAQ,CAKR,YAOF,CAEA,eACE,aACF,CAEA,4BAEE,SAAU,CADV,iBAAkB,CAElB,QACF,CAIA,SAEE,aAAc,CADd,gBAAiB,CAEjB,iBACF,CAEA,YACE,kBACF,CAEA,WACE,aAAc,CACd,iBACF,CAEA,OAEA,iBACA,CACA,OAEA,iBAEA,CACA,SAGA,eAAe,CADf,eAEA,CACA,UAGA,iBAAiB,CADjB,iBAEA,CAEA,UAIE,wBAAwB,CAExB,UAAU,CACV,WAAY,CALZ,iBAAiB,CAGjB,gBAAgB,CAGhB,UACF,CACA,iBAIA,wBAAyB,CAEzB,UAAU,CACV,WAAY,CALZ,gBAAgB,CAGhB,eAIA,CACA,UAIA,wBAAwB,CAExB,UAAU,CACV,WAAY,CALZ,iBAAiB,CAGjB,iBAAiB,CAGjB,UAGA,CACA,eAEE,eACF,CAEA,MAEE,2DAA2B,CAK3B,2BAA2B,CAJ3B,oBAAqB,CAGrB,cAAc,CAFd,WAAY,CAIZ,iBAAkB,CAHlB,eAIF","sources":["index.css","components/App.css"],"sourcesContent":["body {\n margin: 0;\n font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen',\n 'Ubuntu', 'Cantarell', 'Fira Sans', 'Droid Sans', 'Helvetica Neue',\n sans-serif;\n -webkit-font-smoothing: antialiased;\n -moz-osx-font-smoothing: grayscale;\n}\n\ncode {\n font-family: source-code-pro, Menlo, Monaco, Consolas, 'Courier New',\n monospace;\n}\n\n:root {\n --main-bg-color: #3385ff;\n}\n\na, a:hover, a:focus, a:active {\n text-decoration: none;\n}","* {\n margin: 0;\n padding: 0;\n box-sizing: border-box;\n}\n\nbody {\n font-family: sans-serif;\n}\n\nheader {\n box-shadow: 0 1px 3px 0 rgba(0, 0, 0, 0.07), 0 1px 2px 0 rgba(0, 0, 0, 0.05);\n color: #212529;\n}\n\n.nav-area {\n display: flex;\n align-items: center;\n max-width: 1200px;\n margin: 0 auto;\n padding: 10px 20px;\n}\n\n.logo {\n text-decoration: none;\n font-size: 25px;\n color: inherit;\n margin-right: 20px;\n}\n\n.menus {\n display: flex;\n align-items: center;\n flex-wrap: wrap;\n list-style: none;\n}\n\n.menu-items {\n position: relative;\n font-size: 14px;\n}\n\n.menu-items a {\n display: block;\n font-size: inherit;\n color: inherit;\n text-decoration: none;\n}\n\n.menu-items button {\n display: flex;\n align-items: center;\n color: inherit;\n font-size: inherit;\n border: none;\n background-color: transparent;\n cursor: pointer;\n width: 100%;\n}\n\nbutton span {\n margin-left: 3px;\n}\n\n.menu-items > a, .menu-items button {\n text-align: left;\n padding: 0.7rem 1rem;\n}\n\n.menu-items a:hover,\n.menu-items button:hover {\n background-color: #f2f2f2;\n}\n\n.arrow::after {\n content: \"\";\n display: inline-block;\n margin-left: 0.28em;\n vertical-align: 0.09em;\n border-top: 0.42em solid;\n border-right: 0.32em solid transparent;\n border-left: 0.32em solid transparent;\n}\n\n.dropdown {\n position: absolute;\n right: 0;\n left: auto;\n box-shadow: 0 10px 15px -3px rgba(46, 41, 51, 0.08),\n 0 4px 6px -2px rgba(71, 63, 79, 0.16);\n font-size: 0.875rem;\n z-index: 9999;\n min-width: 10rem;\n padding: 0.5rem 0;\n list-style: none;\n background-color: #fff;\n border-radius: 0.5rem;\n display: none;\n}\n\n.dropdown.show {\n display: block;\n}\n\n.dropdown .dropdown-submenu {\n position: absolute;\n left: 100%;\n top: -7px;\n}\n\n/* content */\n\n.content {\n max-width: 1200px;\n margin: 0 auto;\n padding: 3rem 20px;\n}\n\n.content h2 {\n margin-bottom: 1rem;\n}\n\n.content a {\n color: #cc3852;\n margin-right: 10px;\n}\n\n.demo1\n{\nmargin-left:476px;\n}\n.demo2\n{\nmargin-left:602px;\n\n}\n.profile\n{\nmargin-top:26px;\nmargin-left:1px;\n}\n.profile2\n{\nmargin-top:-355px;\nmargin-left:725px;\n}\n\n.content3\n{\n margin-left:222px;\n \n background-color:#eff3f7;\n margin-top:-90px;\n float:left;\n height: auto;\n width: auto;\n}\n.textareacontent\n{\nmargin-left:30px;\nmargin-top:-99px;\nbackground-color: #E7E9EB;\nmargin-top:50px;\nfloat:left;\nheight: auto;\n\n}\n.content2\n{\nmargin-left:222px;\n\nbackground-color:#eff3f7;\nmargin-top:-305px;\nfloat:left;\nheight: auto;\nwidth: auto;\n\n\n}\n.button_submit\n{\n margin-top: 40px;\n}\n\n.test {\n \n background: url(\"logo.png\");\n background-size: auto;\n height: 60vh;\n margin-top: 93px;\n font-size:50px;\n background-repeat:no-repeat; \n margin-left: 332px;\n}"],"names":[],"sourceRoot":""} \ No newline at end of file diff --git a/sec5/react-xss-lab-master/build/static/js/512.16ce7241.chunk.js b/sec5/react-xss-lab-master/build/static/js/512.16ce7241.chunk.js new file mode 100644 index 0000000..9be0a2b --- /dev/null +++ b/sec5/react-xss-lab-master/build/static/js/512.16ce7241.chunk.js @@ -0,0 +1,2 @@ +"use strict";(self.webpackChunkMofid_sec_lab=self.webpackChunkMofid_sec_lab||[]).push([[512],{512:function(e,t,n){n.r(t),n.d(t,{getCLS:function(){return y},getFCP:function(){return g},getFID:function(){return C},getLCP:function(){return P},getTTFB:function(){return D}});var i,r,a,o,u=function(e,t){return{name:e,value:void 0===t?-1:t,delta:0,entries:[],id:"v2-".concat(Date.now(),"-").concat(Math.floor(8999999999999*Math.random())+1e12)}},c=function(e,t){try{if(PerformanceObserver.supportedEntryTypes.includes(e)){if("first-input"===e&&!("PerformanceEventTiming"in self))return;var n=new PerformanceObserver((function(e){return e.getEntries().map(t)}));return n.observe({type:e,buffered:!0}),n}}catch(e){}},f=function(e,t){var n=function n(i){"pagehide"!==i.type&&"hidden"!==document.visibilityState||(e(i),t&&(removeEventListener("visibilitychange",n,!0),removeEventListener("pagehide",n,!0)))};addEventListener("visibilitychange",n,!0),addEventListener("pagehide",n,!0)},s=function(e){addEventListener("pageshow",(function(t){t.persisted&&e(t)}),!0)},m=function(e,t,n){var i;return function(r){t.value>=0&&(r||n)&&(t.delta=t.value-(i||0),(t.delta||void 0===i)&&(i=t.value,e(t)))}},v=-1,d=function(){return"hidden"===document.visibilityState?0:1/0},p=function(){f((function(e){var t=e.timeStamp;v=t}),!0)},l=function(){return v<0&&(v=d(),p(),s((function(){setTimeout((function(){v=d(),p()}),0)}))),{get firstHiddenTime(){return v}}},g=function(e,t){var n,i=l(),r=u("FCP"),a=function(e){"first-contentful-paint"===e.name&&(f&&f.disconnect(),e.startTime-1&&e(t)},r=u("CLS",0),a=0,o=[],v=function(e){if(!e.hadRecentInput){var t=o[0],i=o[o.length-1];a&&e.startTime-i.startTime<1e3&&e.startTime-t.startTime<5e3?(a+=e.value,o.push(e)):(a=e.value,o=[e]),a>r.value&&(r.value=a,r.entries=o,n())}},d=c("layout-shift",v);d&&(n=m(i,r,t),f((function(){d.takeRecords().map(v),n(!0)})),s((function(){a=0,T=-1,r=u("CLS",0),n=m(i,r,t)})))},E={passive:!0,capture:!0},w=new Date,L=function(e,t){i||(i=t,r=e,a=new Date,F(removeEventListener),S())},S=function(){if(r>=0&&r1e12?new Date:performance.now())-e.timeStamp;"pointerdown"==e.type?function(e,t){var n=function(){L(e,t),r()},i=function(){r()},r=function(){removeEventListener("pointerup",n,E),removeEventListener("pointercancel",i,E)};addEventListener("pointerup",n,E),addEventListener("pointercancel",i,E)}(t,e):L(t,e)}},F=function(e){["mousedown","keydown","touchstart","pointerdown"].forEach((function(t){return e(t,b,E)}))},C=function(e,t){var n,a=l(),v=u("FID"),d=function(e){e.startTimeperformance.now())return;n.entries=[t],e(n)}catch(e){}},"complete"===document.readyState?setTimeout(t,0):addEventListener("load",(function(){return setTimeout(t,0)}))}}}]); +//# sourceMappingURL=512.16ce7241.chunk.js.map \ No newline at end of file diff --git a/sec5/react-xss-lab-master/build/static/js/512.16ce7241.chunk.js.map b/sec5/react-xss-lab-master/build/static/js/512.16ce7241.chunk.js.map new file mode 100644 index 0000000..f30a55e --- /dev/null +++ b/sec5/react-xss-lab-master/build/static/js/512.16ce7241.chunk.js.map @@ -0,0 +1 @@ +{"version":3,"file":"static/js/512.16ce7241.chunk.js","mappings":"+QAAA,IAAIA,EAAEC,EAAEC,EAAEC,EAAEC,EAAE,SAASJ,EAAEC,GAAG,MAAM,CAACI,KAAKL,EAAEM,WAAM,IAASL,GAAG,EAAEA,EAAEM,MAAM,EAAEC,QAAQ,GAAGC,GAAG,MAAMC,OAAOC,KAAKC,MAAM,KAAKF,OAAOG,KAAKC,MAAM,cAAcD,KAAKE,UAAU,MAAM,EAAEC,EAAE,SAAShB,EAAEC,GAAG,IAAI,GAAGgB,oBAAoBC,oBAAoBC,SAASnB,GAAG,CAAC,GAAG,gBAAgBA,KAAK,2BAA2BoB,MAAM,OAAO,IAAIlB,EAAE,IAAIe,qBAAqB,SAASjB,GAAG,OAAOA,EAAEqB,aAAaC,IAAIrB,EAAE,IAAI,OAAOC,EAAEqB,QAAQ,CAACC,KAAKxB,EAAEyB,UAAS,IAAKvB,CAAC,CAAC,CAAC,MAAMF,GAAG,CAAC,EAAE0B,EAAE,SAAS1B,EAAEC,GAAG,IAAIC,EAAE,SAASA,EAAEC,GAAG,aAAaA,EAAEqB,MAAM,WAAWG,SAASC,kBAAkB5B,EAAEG,GAAGF,IAAI4B,oBAAoB,mBAAmB3B,GAAE,GAAI2B,oBAAoB,WAAW3B,GAAE,IAAK,EAAE4B,iBAAiB,mBAAmB5B,GAAE,GAAI4B,iBAAiB,WAAW5B,GAAE,EAAG,EAAE6B,EAAE,SAAS/B,GAAG8B,iBAAiB,YAAY,SAAS7B,GAAGA,EAAE+B,WAAWhC,EAAEC,EAAE,IAAG,EAAG,EAAEgC,EAAE,SAASjC,EAAEC,EAAEC,GAAG,IAAIC,EAAE,OAAO,SAASC,GAAGH,EAAEK,OAAO,IAAIF,GAAGF,KAAKD,EAAEM,MAAMN,EAAEK,OAAOH,GAAG,IAAIF,EAAEM,YAAO,IAASJ,KAAKA,EAAEF,EAAEK,MAAMN,EAAEC,IAAI,CAAC,EAAEiC,GAAG,EAAEC,EAAE,WAAW,MAAM,WAAWR,SAASC,gBAAgB,EAAE,GAAG,EAAEQ,EAAE,WAAWV,GAAG,SAAS1B,GAAG,IAAIC,EAAED,EAAEqC,UAAUH,EAAEjC,CAAC,IAAG,EAAG,EAAEqC,EAAE,WAAW,OAAOJ,EAAE,IAAIA,EAAEC,IAAIC,IAAIL,GAAG,WAAWQ,YAAY,WAAWL,EAAEC,IAAIC,GAAG,GAAG,EAAE,KAAK,CAAKI,sBAAkB,OAAON,CAAC,EAAE,EAAEO,EAAE,SAASzC,EAAEC,GAAG,IAAIC,EAAEC,EAAEmC,IAAIZ,EAAEtB,EAAE,OAAO8B,EAAE,SAASlC,GAAG,2BAA2BA,EAAEK,OAAO+B,GAAGA,EAAEM,aAAa1C,EAAE2C,UAAUxC,EAAEqC,kBAAkBd,EAAEpB,MAAMN,EAAE2C,UAAUjB,EAAElB,QAAQoC,KAAK5C,GAAGE,GAAE,IAAK,EAAEiC,EAAEU,OAAOC,aAAaA,YAAYC,kBAAkBD,YAAYC,iBAAiB,0BAA0B,GAAGX,EAAED,EAAE,KAAKnB,EAAE,QAAQkB,IAAIC,GAAGC,KAAKlC,EAAE+B,EAAEjC,EAAE0B,EAAEzB,GAAGkC,GAAGD,EAAEC,GAAGJ,GAAG,SAAS5B,GAAGuB,EAAEtB,EAAE,OAAOF,EAAE+B,EAAEjC,EAAE0B,EAAEzB,GAAG+C,uBAAuB,WAAWA,uBAAuB,WAAWtB,EAAEpB,MAAMwC,YAAYlC,MAAMT,EAAEkC,UAAUnC,GAAE,EAAG,GAAG,GAAG,IAAI,EAAE+C,GAAE,EAAGC,GAAG,EAAEC,EAAE,SAASnD,EAAEC,GAAGgD,IAAIR,GAAG,SAASzC,GAAGkD,EAAElD,EAAEM,KAAK,IAAI2C,GAAE,GAAI,IAAI/C,EAAEC,EAAE,SAASF,GAAGiD,GAAG,GAAGlD,EAAEC,EAAE,EAAEiC,EAAE9B,EAAE,MAAM,GAAG+B,EAAE,EAAEC,EAAE,GAAGE,EAAE,SAAStC,GAAG,IAAIA,EAAEoD,eAAe,CAAC,IAAInD,EAAEmC,EAAE,GAAGjC,EAAEiC,EAAEA,EAAEiB,OAAO,GAAGlB,GAAGnC,EAAE2C,UAAUxC,EAAEwC,UAAU,KAAK3C,EAAE2C,UAAU1C,EAAE0C,UAAU,KAAKR,GAAGnC,EAAEM,MAAM8B,EAAEQ,KAAK5C,KAAKmC,EAAEnC,EAAEM,MAAM8B,EAAE,CAACpC,IAAImC,EAAED,EAAE5B,QAAQ4B,EAAE5B,MAAM6B,EAAED,EAAE1B,QAAQ4B,EAAElC,IAAI,CAAC,EAAEiD,EAAEnC,EAAE,eAAesB,GAAGa,IAAIjD,EAAE+B,EAAE9B,EAAE+B,EAAEjC,GAAGyB,GAAG,WAAWyB,EAAEG,cAAchC,IAAIgB,GAAGpC,GAAE,EAAG,IAAI6B,GAAG,WAAWI,EAAE,EAAEe,GAAG,EAAEhB,EAAE9B,EAAE,MAAM,GAAGF,EAAE+B,EAAE9B,EAAE+B,EAAEjC,EAAE,IAAI,EAAEsD,EAAE,CAACC,SAAQ,EAAGC,SAAQ,GAAIC,EAAE,IAAI/C,KAAKgD,EAAE,SAASxD,EAAEC,GAAGJ,IAAIA,EAAEI,EAAEH,EAAEE,EAAED,EAAE,IAAIS,KAAKiD,EAAE/B,qBAAqBgC,IAAI,EAAEA,EAAE,WAAW,GAAG5D,GAAG,GAAGA,EAAEC,EAAEwD,EAAE,CAAC,IAAItD,EAAE,CAAC0D,UAAU,cAAczD,KAAKL,EAAEwB,KAAKuC,OAAO/D,EAAE+D,OAAOC,WAAWhE,EAAEgE,WAAWrB,UAAU3C,EAAEqC,UAAU4B,gBAAgBjE,EAAEqC,UAAUpC,GAAGE,EAAE+D,SAAS,SAASlE,GAAGA,EAAEI,EAAE,IAAID,EAAE,EAAE,CAAC,EAAEgE,EAAE,SAASnE,GAAG,GAAGA,EAAEgE,WAAW,CAAC,IAAI/D,GAAGD,EAAEqC,UAAU,KAAK,IAAI1B,KAAKmC,YAAYlC,OAAOZ,EAAEqC,UAAU,eAAerC,EAAEwB,KAAK,SAASxB,EAAEC,GAAG,IAAIC,EAAE,WAAWyD,EAAE3D,EAAEC,GAAGG,GAAG,EAAED,EAAE,WAAWC,GAAG,EAAEA,EAAE,WAAWyB,oBAAoB,YAAY3B,EAAEqD,GAAG1B,oBAAoB,gBAAgB1B,EAAEoD,EAAE,EAAEzB,iBAAiB,YAAY5B,EAAEqD,GAAGzB,iBAAiB,gBAAgB3B,EAAEoD,EAAE,CAAhO,CAAkOtD,EAAED,GAAG2D,EAAE1D,EAAED,EAAE,CAAC,EAAE4D,EAAE,SAAS5D,GAAG,CAAC,YAAY,UAAU,aAAa,eAAekE,SAAS,SAASjE,GAAG,OAAOD,EAAEC,EAAEkE,EAAEZ,EAAE,GAAG,EAAEa,EAAE,SAASlE,EAAEgC,GAAG,IAAIC,EAAEC,EAAEE,IAAIG,EAAErC,EAAE,OAAO6C,EAAE,SAASjD,GAAGA,EAAE2C,UAAUP,EAAEI,kBAAkBC,EAAEnC,MAAMN,EAAEiE,gBAAgBjE,EAAE2C,UAAUF,EAAEjC,QAAQoC,KAAK5C,GAAGmC,GAAE,GAAI,EAAEe,EAAElC,EAAE,cAAciC,GAAGd,EAAEF,EAAE/B,EAAEuC,EAAEP,GAAGgB,GAAGxB,GAAG,WAAWwB,EAAEI,cAAchC,IAAI2B,GAAGC,EAAER,YAAY,IAAG,GAAIQ,GAAGnB,GAAG,WAAW,IAAIf,EAAEyB,EAAErC,EAAE,OAAO+B,EAAEF,EAAE/B,EAAEuC,EAAEP,GAAG/B,EAAE,GAAGF,GAAG,EAAED,EAAE,KAAK4D,EAAE9B,kBAAkBd,EAAEiC,EAAE9C,EAAEyC,KAAK5B,GAAG6C,GAAG,GAAG,EAAEQ,EAAE,CAAC,EAAEC,EAAE,SAAStE,EAAEC,GAAG,IAAIC,EAAEC,EAAEmC,IAAIJ,EAAE9B,EAAE,OAAO+B,EAAE,SAASnC,GAAG,IAAIC,EAAED,EAAE2C,UAAU1C,EAAEE,EAAEqC,kBAAkBN,EAAE5B,MAAML,EAAEiC,EAAE1B,QAAQoC,KAAK5C,GAAGE,IAAI,EAAEkC,EAAEpB,EAAE,2BAA2BmB,GAAG,GAAGC,EAAE,CAAClC,EAAE+B,EAAEjC,EAAEkC,EAAEjC,GAAG,IAAIwC,EAAE,WAAW4B,EAAEnC,EAAEzB,MAAM2B,EAAEkB,cAAchC,IAAIa,GAAGC,EAAEM,aAAa2B,EAAEnC,EAAEzB,KAAI,EAAGP,GAAE,GAAI,EAAE,CAAC,UAAU,SAASgE,SAAS,SAASlE,GAAG8B,iBAAiB9B,EAAEyC,EAAE,CAAC8B,MAAK,EAAGd,SAAQ,GAAI,IAAI/B,EAAEe,GAAE,GAAIV,GAAG,SAAS5B,GAAG+B,EAAE9B,EAAE,OAAOF,EAAE+B,EAAEjC,EAAEkC,EAAEjC,GAAG+C,uBAAuB,WAAWA,uBAAuB,WAAWd,EAAE5B,MAAMwC,YAAYlC,MAAMT,EAAEkC,UAAUgC,EAAEnC,EAAEzB,KAAI,EAAGP,GAAE,EAAG,GAAG,GAAG,GAAG,CAAC,EAAEsE,EAAE,SAASxE,GAAG,IAAIC,EAAEC,EAAEE,EAAE,QAAQH,EAAE,WAAW,IAAI,IAAIA,EAAE6C,YAAY2B,iBAAiB,cAAc,IAAI,WAAW,IAAIzE,EAAE8C,YAAY4B,OAAOzE,EAAE,CAAC6D,UAAU,aAAanB,UAAU,GAAG,IAAI,IAAIzC,KAAKF,EAAE,oBAAoBE,GAAG,WAAWA,IAAID,EAAEC,GAAGW,KAAK8D,IAAI3E,EAAEE,GAAGF,EAAE4E,gBAAgB,IAAI,OAAO3E,CAAC,CAAjL,GAAqL,GAAGC,EAAEI,MAAMJ,EAAEK,MAAMN,EAAE4E,cAAc3E,EAAEI,MAAM,GAAGJ,EAAEI,MAAMwC,YAAYlC,MAAM,OAAOV,EAAEM,QAAQ,CAACP,GAAGD,EAAEE,EAAE,CAAC,MAAMF,GAAG,CAAC,EAAE,aAAa2B,SAASmD,WAAWvC,WAAWtC,EAAE,GAAG6B,iBAAiB,QAAQ,WAAW,OAAOS,WAAWtC,EAAE,EAAE,GAAG,C","sources":["../../node_modules/web-vitals/dist/web-vitals.js"],"sourcesContent":["var e,t,n,i,r=function(e,t){return{name:e,value:void 0===t?-1:t,delta:0,entries:[],id:\"v2-\".concat(Date.now(),\"-\").concat(Math.floor(8999999999999*Math.random())+1e12)}},a=function(e,t){try{if(PerformanceObserver.supportedEntryTypes.includes(e)){if(\"first-input\"===e&&!(\"PerformanceEventTiming\"in self))return;var n=new PerformanceObserver((function(e){return e.getEntries().map(t)}));return n.observe({type:e,buffered:!0}),n}}catch(e){}},o=function(e,t){var n=function n(i){\"pagehide\"!==i.type&&\"hidden\"!==document.visibilityState||(e(i),t&&(removeEventListener(\"visibilitychange\",n,!0),removeEventListener(\"pagehide\",n,!0)))};addEventListener(\"visibilitychange\",n,!0),addEventListener(\"pagehide\",n,!0)},u=function(e){addEventListener(\"pageshow\",(function(t){t.persisted&&e(t)}),!0)},c=function(e,t,n){var i;return function(r){t.value>=0&&(r||n)&&(t.delta=t.value-(i||0),(t.delta||void 0===i)&&(i=t.value,e(t)))}},f=-1,s=function(){return\"hidden\"===document.visibilityState?0:1/0},m=function(){o((function(e){var t=e.timeStamp;f=t}),!0)},v=function(){return f<0&&(f=s(),m(),u((function(){setTimeout((function(){f=s(),m()}),0)}))),{get firstHiddenTime(){return f}}},d=function(e,t){var n,i=v(),o=r(\"FCP\"),f=function(e){\"first-contentful-paint\"===e.name&&(m&&m.disconnect(),e.startTime-1&&e(t)},f=r(\"CLS\",0),s=0,m=[],v=function(e){if(!e.hadRecentInput){var t=m[0],i=m[m.length-1];s&&e.startTime-i.startTime<1e3&&e.startTime-t.startTime<5e3?(s+=e.value,m.push(e)):(s=e.value,m=[e]),s>f.value&&(f.value=s,f.entries=m,n())}},h=a(\"layout-shift\",v);h&&(n=c(i,f,t),o((function(){h.takeRecords().map(v),n(!0)})),u((function(){s=0,l=-1,f=r(\"CLS\",0),n=c(i,f,t)})))},T={passive:!0,capture:!0},y=new Date,g=function(i,r){e||(e=r,t=i,n=new Date,w(removeEventListener),E())},E=function(){if(t>=0&&t1e12?new Date:performance.now())-e.timeStamp;\"pointerdown\"==e.type?function(e,t){var n=function(){g(e,t),r()},i=function(){r()},r=function(){removeEventListener(\"pointerup\",n,T),removeEventListener(\"pointercancel\",i,T)};addEventListener(\"pointerup\",n,T),addEventListener(\"pointercancel\",i,T)}(t,e):g(t,e)}},w=function(e){[\"mousedown\",\"keydown\",\"touchstart\",\"pointerdown\"].forEach((function(t){return e(t,S,T)}))},L=function(n,f){var s,m=v(),d=r(\"FID\"),p=function(e){e.startTimeperformance.now())return;n.entries=[t],e(n)}catch(e){}},\"complete\"===document.readyState?setTimeout(t,0):addEventListener(\"load\",(function(){return setTimeout(t,0)}))};export{h as getCLS,d as getFCP,L as getFID,F as getLCP,P as getTTFB};\n"],"names":["e","t","n","i","r","name","value","delta","entries","id","concat","Date","now","Math","floor","random","a","PerformanceObserver","supportedEntryTypes","includes","self","getEntries","map","observe","type","buffered","o","document","visibilityState","removeEventListener","addEventListener","u","persisted","c","f","s","m","timeStamp","v","setTimeout","firstHiddenTime","d","disconnect","startTime","push","window","performance","getEntriesByName","requestAnimationFrame","p","l","h","hadRecentInput","length","takeRecords","T","passive","capture","y","g","w","E","entryType","target","cancelable","processingStart","forEach","S","L","b","F","once","P","getEntriesByType","timing","max","navigationStart","responseStart","readyState"],"sourceRoot":""} \ No newline at end of file diff --git a/sec5/react-xss-lab-master/build/static/js/main.8c45f8df.js b/sec5/react-xss-lab-master/build/static/js/main.8c45f8df.js new file mode 100644 index 0000000..37380e7 --- /dev/null +++ b/sec5/react-xss-lab-master/build/static/js/main.8c45f8df.js @@ -0,0 +1,3 @@ +/*! For license information please see main.8c45f8df.js.LICENSE.txt */ +!function(){var e={9281:function(e,t,n){"use strict";n.d(t,{Z:function(){return ae}});var r=function(){function e(e){var t=this;this._insertTag=function(e){var n;n=0===t.tags.length?t.insertionPoint?t.insertionPoint.nextSibling:t.prepend?t.container.firstChild:t.before:t.tags[t.tags.length-1].nextSibling,t.container.insertBefore(e,n),t.tags.push(e)},this.isSpeedy=void 0===e.speedy||e.speedy,this.tags=[],this.ctr=0,this.nonce=e.nonce,this.key=e.key,this.container=e.container,this.prepend=e.prepend,this.insertionPoint=e.insertionPoint,this.before=null}var t=e.prototype;return t.hydrate=function(e){e.forEach(this._insertTag)},t.insert=function(e){this.ctr%(this.isSpeedy?65e3:1)===0&&this._insertTag(function(e){var t=document.createElement("style");return t.setAttribute("data-emotion",e.key),void 0!==e.nonce&&t.setAttribute("nonce",e.nonce),t.appendChild(document.createTextNode("")),t.setAttribute("data-s",""),t}(this));var t=this.tags[this.tags.length-1];if(this.isSpeedy){var n=function(e){if(e.sheet)return e.sheet;for(var t=0;t0?c(x,--g):0,m--,10===b&&(m=1,v--),b}function E(){return b=g2||Z(b)>3?"":" "}function T(e,t){for(;--t&&E()&&!(b<48||b>102||b>57&&b<65||b>70&&b<97););return C(e,A()+(t<6&&32==_()&&32==E()))}function N(e){for(;E();)switch(b){case e:return g;case 34:case 39:34!==e&&39!==e&&N(b);break;case 40:41===e&&N(e);break;case 92:E()}return g}function j(e,t){for(;E()&&e+b!==57&&(e+b!==84||47!==_()););return"/*"+C(t,g-1)+"*"+a(47===e?e:E())}function L(e){for(;!Z(_());)E();return C(e,g)}var I="-ms-",F="-moz-",D="-webkit-",$="comm",B="rule",z="decl",U="@import",W="@keyframes";function H(e,t){for(var n="",r=p(e),o=0;o0&&f(F)-y&&h(b>32?X(F+";",r,n,y-1):X(l(F," ","")+";",r,n,y-2),p);break;case 59:F+=";";default:if(h(I=Y(F,t,n,v,m,o,d,O,R=[],N=[],y),i),123===Z)if(0===m)K(F,t,I,I,R,i,y,d,N);else switch(99===g&&110===c(F,3)?100:g){case 100:case 109:case 115:K(e,I,I,r&&h(Y(e,I,I,0,0,o,d,O,o,R=[],y),N),o,N,y,d,r?R:N);break;default:K(F,I,I,I,[""],N,0,d,N)}}v=m=b=0,w=C=1,O=F="",y=u;break;case 58:y=1+f(F),b=x;default:if(w<1)if(123==Z)--w;else if(125==Z&&0==w++&&125==k())continue;switch(F+=a(Z),Z*w){case 38:C=m>0?1:(F+="\f",-1);break;case 44:d[v++]=(f(F)-1)*C,C=1;break;case 64:45===_()&&(F+=P(E())),g=_(),m=y=f(O=F+=L(A())),Z++;break;case 45:45===x&&2==f(F)&&(w=0)}}return i}function Y(e,t,n,r,a,i,s,c,f,h,v){for(var m=a-1,y=0===a?i:[""],g=p(y),b=0,x=0,S=0;b0?y[k]+" "+E:l(E,/&\f/g,y[k])))&&(f[S++]=_);return w(e,t,n,0===a?B:c,f,h,v)}function q(e,t,n){return w(e,t,n,$,a(b),d(e,2,-2),0)}function X(e,t,n,r){return w(e,t,n,z,d(e,0,r),d(e,r+1,-1),r)}var J=function(e,t,n){for(var r=0,o=0;r=o,o=_(),38===r&&12===o&&(t[n]=1),!Z(o);)E();return C(e,g)},Q=function(e,t){return R(function(e,t){var n=-1,r=44;do{switch(Z(r)){case 0:38===r&&12===_()&&(t[n]=1),e[n]+=J(g-1,t,n);break;case 2:e[n]+=P(r);break;case 4:if(44===r){e[++n]=58===_()?"&\f":"",t[n]=e[n].length;break}default:e[n]+=a(r)}}while(r=E());return e}(O(e),t))},ee=new WeakMap,te=function(e){if("rule"===e.type&&e.parent&&!(e.length<1)){for(var t=e.value,n=e.parent,r=e.column===n.column&&e.line===n.line;"rule"!==n.type;)if(!(n=n.parent))return;if((1!==e.props.length||58===t.charCodeAt(0)||ee.get(n))&&!r){ee.set(e,!0);for(var o=[],a=Q(t,o),i=n.props,u=0,l=0;u6)switch(c(e,t+1)){case 109:if(45!==c(e,t+4))break;case 102:return l(e,/(.+:)(.+)-([^]+)/,"$1"+D+"$2-$3$1"+F+(108==c(e,t+3)?"$3":"$2-$3"))+e;case 115:return~s(e,"stretch")?re(l(e,"stretch","fill-available"),t)+e:e}break;case 4949:if(115!==c(e,t+1))break;case 6444:switch(c(e,f(e)-3-(~s(e,"!important")&&10))){case 107:return l(e,":",":"+D)+e;case 101:return l(e,/(.+:)([^;!]+)(;|!.+)?/,"$1"+D+(45===c(e,14)?"inline-":"")+"box$3$1"+D+"$2$3$1"+I+"$2box$3")+e}break;case 5936:switch(c(e,t+11)){case 114:return D+e+I+l(e,/[svh]\w+-[tblr]{2}/,"tb")+e;case 108:return D+e+I+l(e,/[svh]\w+-[tblr]{2}/,"tb-rl")+e;case 45:return D+e+I+l(e,/[svh]\w+-[tblr]{2}/,"lr")+e}return D+e+I+e+e}return e}var oe=[function(e,t,n,r){if(e.length>-1&&!e.return)switch(e.type){case z:e.return=re(e.value,e.length);break;case W:return H([S(e,{value:l(e.value,"@","@"+D)})],r);case B:if(e.length)return function(e,t){return e.map(t).join("")}(e.props,(function(t){switch(function(e,t){return(e=t.exec(e))?e[0]:e}(t,/(::plac\w+|:read-\w+)/)){case":read-only":case":read-write":return H([S(e,{props:[l(t,/:(read-\w+)/,":"+F+"$1")]})],r);case"::placeholder":return H([S(e,{props:[l(t,/:(plac\w+)/,":"+D+"input-$1")]}),S(e,{props:[l(t,/:(plac\w+)/,":"+F+"$1")]}),S(e,{props:[l(t,/:(plac\w+)/,I+"input-$1")]})],r)}return""}))}}],ae=function(e){var t=e.key;if("css"===t){var n=document.querySelectorAll("style[data-emotion]:not([data-s])");Array.prototype.forEach.call(n,(function(e){-1!==e.getAttribute("data-emotion").indexOf(" ")&&(document.head.appendChild(e),e.setAttribute("data-s",""))}))}var o=e.stylisPlugins||oe;var a,i,u={},l=[];a=e.container||document.head,Array.prototype.forEach.call(document.querySelectorAll('style[data-emotion^="'+t+' "]'),(function(e){for(var t=e.getAttribute("data-emotion").split(" "),n=1;n=4;++r,o-=4)t=1540483477*(65535&(t=255&e.charCodeAt(r)|(255&e.charCodeAt(++r))<<8|(255&e.charCodeAt(++r))<<16|(255&e.charCodeAt(++r))<<24))+(59797*(t>>>16)<<16),n=1540483477*(65535&(t^=t>>>24))+(59797*(t>>>16)<<16)^1540483477*(65535&n)+(59797*(n>>>16)<<16);switch(o){case 3:n^=(255&e.charCodeAt(r+2))<<16;case 2:n^=(255&e.charCodeAt(r+1))<<8;case 1:n=1540483477*(65535&(n^=255&e.charCodeAt(r)))+(59797*(n>>>16)<<16)}return(((n=1540483477*(65535&(n^=n>>>13))+(59797*(n>>>16)<<16))^n>>>15)>>>0).toString(36)},o={animationIterationCount:1,borderImageOutset:1,borderImageSlice:1,borderImageWidth:1,boxFlex:1,boxFlexGroup:1,boxOrdinalGroup:1,columnCount:1,columns:1,flex:1,flexGrow:1,flexPositive:1,flexShrink:1,flexNegative:1,flexOrder:1,gridRow:1,gridRowEnd:1,gridRowSpan:1,gridRowStart:1,gridColumn:1,gridColumnEnd:1,gridColumnSpan:1,gridColumnStart:1,msGridRow:1,msGridRowSpan:1,msGridColumn:1,msGridColumnSpan:1,fontWeight:1,lineHeight:1,opacity:1,order:1,orphans:1,tabSize:1,widows:1,zIndex:1,zoom:1,WebkitLineClamp:1,fillOpacity:1,floodOpacity:1,stopOpacity:1,strokeDasharray:1,strokeDashoffset:1,strokeMiterlimit:1,strokeOpacity:1,strokeWidth:1},a=n(5618),i=/[A-Z]|^ms/g,u=/_EMO_([^_]+?)_([^]*?)_EMO_/g,l=function(e){return 45===e.charCodeAt(1)},s=function(e){return null!=e&&"boolean"!==typeof e},c=(0,a.Z)((function(e){return l(e)?e:e.replace(i,"-$&").toLowerCase()})),d=function(e,t){switch(e){case"animation":case"animationName":if("string"===typeof t)return t.replace(u,(function(e,t,n){return p={name:t,styles:n,next:p},t}))}return 1===o[e]||l(e)||"number"!==typeof t||0===t?t:t+"px"};function f(e,t,n){if(null==n)return"";if(void 0!==n.__emotion_styles)return n;switch(typeof n){case"boolean":return"";case"object":if(1===n.anim)return p={name:n.name,styles:n.styles,next:p},n.name;if(void 0!==n.styles){var r=n.next;if(void 0!==r)for(;void 0!==r;)p={name:r.name,styles:r.styles,next:p},r=r.next;return n.styles+";"}return function(e,t,n){var r="";if(Array.isArray(n))for(var o=0;o0&&void 0!==arguments[0]?arguments[0]:"light")?{main:g[200],light:g[50],dark:g[400]}:{main:g[700],light:g[400],dark:g[800]}}(n),A=e.secondary||function(){return"dark"===(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"light")?{main:v[200],light:v[50],dark:v[400]}:{main:v[500],light:v[300],dark:v[700]}}(n),C=e.error||function(){return"dark"===(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"light")?{main:m[500],light:m[300],dark:m[700]}:{main:m[700],light:m[400],dark:m[800]}}(n),Z=e.info||function(){return"dark"===(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"light")?{main:b[400],light:b[300],dark:b[700]}:{main:b[700],light:b[500],dark:b[900]}}(n),O=e.success||function(){return"dark"===(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"light")?{main:x[400],light:x[300],dark:x[700]}:{main:x[800],light:x[500],dark:x[900]}}(n),R=e.warning||function(){return"dark"===(arguments.length>0&&void 0!==arguments[0]?arguments[0]:"light")?{main:y[400],light:y[300],dark:y[700]}:{main:"#ed6c02",light:y[500],dark:y[900]}}(n);function P(e){return(0,f.mi)(e,k.text.primary)>=l?k.text.primary:S.text.primary}var M=function(e){var t=e.color,n=e.name,o=e.mainShade,i=void 0===o?500:o,u=e.lightShade,l=void 0===u?300:u,s=e.darkShade,d=void 0===s?700:s;if(!(t=(0,r.Z)({},t)).main&&t[i]&&(t.main=t[i]),!t.hasOwnProperty("main"))throw new Error((0,a.Z)(11,n?" (".concat(n,")"):"",i));if("string"!==typeof t.main)throw new Error((0,a.Z)(12,n?" (".concat(n,")"):"",JSON.stringify(t.main)));return E(t,"light",l,c),E(t,"dark",d,c),t.contrastText||(t.contrastText=P(t.main)),t},T={dark:k,light:S};return(0,i.Z)((0,r.Z)({common:(0,r.Z)({},p),mode:n,primary:M({color:_,name:"primary"}),secondary:M({color:A,name:"secondary",mainShade:"A400",lightShade:"A200",darkShade:"A700"}),error:M({color:C,name:"error"}),warning:M({color:R,name:"warning"}),info:M({color:Z,name:"info"}),success:M({color:O,name:"success"}),grey:h,contrastThreshold:l,getContrastText:P,augmentColor:M,tonalOffset:c},T[n]),d)}var A=["fontFamily","fontSize","fontWeightLight","fontWeightRegular","fontWeightMedium","fontWeightBold","htmlFontSize","allVariants","pxToRem"];var C={textTransform:"uppercase"},Z='"Roboto", "Helvetica", "Arial", sans-serif';function O(e,t){var n="function"===typeof t?t(e):t,a=n.fontFamily,u=void 0===a?Z:a,l=n.fontSize,s=void 0===l?14:l,c=n.fontWeightLight,d=void 0===c?300:c,f=n.fontWeightRegular,p=void 0===f?400:f,h=n.fontWeightMedium,v=void 0===h?500:h,m=n.fontWeightBold,y=void 0===m?700:m,g=n.htmlFontSize,b=void 0===g?16:g,x=n.allVariants,w=n.pxToRem,S=(0,o.Z)(n,A);var k=s/14,E=w||function(e){return"".concat(e/b*k,"rem")},_=function(e,t,n,o,a){return(0,r.Z)({fontFamily:u,fontWeight:e,fontSize:E(t),lineHeight:n},u===Z?{letterSpacing:"".concat((i=o/t,Math.round(1e5*i)/1e5),"em")}:{},a,x);var i},O={h1:_(d,96,1.167,-1.5),h2:_(d,60,1.2,-.5),h3:_(p,48,1.167,0),h4:_(p,34,1.235,.25),h5:_(p,24,1.334,0),h6:_(v,20,1.6,.15),subtitle1:_(p,16,1.75,.15),subtitle2:_(v,14,1.57,.1),body1:_(p,16,1.5,.15),body2:_(p,14,1.43,.15),button:_(v,14,1.75,.4,C),caption:_(p,12,1.66,.4),overline:_(p,12,2.66,1,C)};return(0,i.Z)((0,r.Z)({htmlFontSize:b,pxToRem:E,fontFamily:u,fontSize:s,fontWeightLight:d,fontWeightRegular:p,fontWeightMedium:v,fontWeightBold:y},O),S,{clone:!1})}var R=.2,P=.14,M=.12;function T(){return["".concat(arguments.length<=0?void 0:arguments[0],"px ").concat(arguments.length<=1?void 0:arguments[1],"px ").concat(arguments.length<=2?void 0:arguments[2],"px ").concat(arguments.length<=3?void 0:arguments[3],"px rgba(0,0,0,").concat(R,")"),"".concat(arguments.length<=4?void 0:arguments[4],"px ").concat(arguments.length<=5?void 0:arguments[5],"px ").concat(arguments.length<=6?void 0:arguments[6],"px ").concat(arguments.length<=7?void 0:arguments[7],"px rgba(0,0,0,").concat(P,")"),"".concat(arguments.length<=8?void 0:arguments[8],"px ").concat(arguments.length<=9?void 0:arguments[9],"px ").concat(arguments.length<=10?void 0:arguments[10],"px ").concat(arguments.length<=11?void 0:arguments[11],"px rgba(0,0,0,").concat(M,")")].join(",")}var N=["none",T(0,2,1,-1,0,1,1,0,0,1,3,0),T(0,3,1,-2,0,2,2,0,0,1,5,0),T(0,3,3,-2,0,3,4,0,0,1,8,0),T(0,2,4,-1,0,4,5,0,0,1,10,0),T(0,3,5,-1,0,5,8,0,0,1,14,0),T(0,3,5,-1,0,6,10,0,0,1,18,0),T(0,4,5,-2,0,7,10,1,0,2,16,1),T(0,5,5,-3,0,8,10,1,0,3,14,2),T(0,5,6,-3,0,9,12,1,0,3,16,2),T(0,6,6,-3,0,10,14,1,0,4,18,3),T(0,6,7,-4,0,11,15,1,0,4,20,3),T(0,7,8,-4,0,12,17,2,0,5,22,4),T(0,7,8,-4,0,13,19,2,0,5,24,4),T(0,7,9,-4,0,14,21,2,0,5,26,4),T(0,8,9,-5,0,15,22,2,0,6,28,5),T(0,8,10,-5,0,16,24,2,0,6,30,5),T(0,8,11,-5,0,17,26,2,0,6,32,5),T(0,9,11,-5,0,18,28,2,0,7,34,6),T(0,9,12,-6,0,19,29,2,0,7,36,6),T(0,10,13,-6,0,20,31,3,0,8,38,7),T(0,10,13,-6,0,21,33,3,0,8,40,7),T(0,10,14,-6,0,22,35,3,0,8,42,7),T(0,11,14,-7,0,23,36,3,0,9,44,8),T(0,11,15,-7,0,24,38,3,0,9,46,8)],j=n(7851),L={mobileStepper:1e3,fab:1050,speedDial:1050,appBar:1100,drawer:1200,modal:1300,snackbar:1400,tooltip:1500},I=["breakpoints","mixins","spacing","palette","transitions","typography","shape"];function F(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=e.mixins,n=void 0===t?{}:t,c=e.palette,f=void 0===c?{}:c,p=e.transitions,h=void 0===p?{}:p,v=e.typography,m=void 0===v?{}:v,y=(0,o.Z)(e,I);if(e.vars)throw new Error((0,a.Z)(18));var g=_(f),b=(0,u.Z)(e),x=(0,i.Z)(b,{mixins:d(b.breakpoints,n),palette:g,shadows:N.slice(),typography:O(g,m),transitions:(0,j.ZP)(h),zIndex:(0,r.Z)({},L)});x=(0,i.Z)(x,y);for(var w=arguments.length,S=new Array(w>1?w-1:0),k=1;k0&&void 0!==arguments[0]?arguments[0]:["all"],o=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},i=o.duration,u=void 0===i?n.standard:i,s=o.easing,c=void 0===s?t.easeInOut:s,d=o.delay,f=void 0===d?0:d;(0,r.Z)(o,a);return(Array.isArray(e)?e:[e]).map((function(e){return"".concat(e," ").concat("string"===typeof u?u:l(u)," ").concat(c," ").concat("string"===typeof f?f:l(f))})).join(",")}},e,{easing:t,duration:n})}},9123:function(e,t,n){"use strict";var r=(0,n(3700).Z)();t.Z=r},6420:function(e,t,n){"use strict";n.d(t,{Dz:function(){return i},FO:function(){return a}});var r=n(5864),o=n(9123),a=function(e){return(0,r.x9)(e)&&"classes"!==e},i=r.x9,u=(0,r.ZP)({defaultTheme:o.Z,rootShouldForwardProp:a});t.ZP=u},8867:function(e,t,n){"use strict";n.d(t,{Z:function(){return a}});var r=n(6837),o=n(9123);function a(e){var t=e.props,n=e.name;return(0,r.Z)({props:t,name:n,defaultTheme:o.Z})}},5570:function(e,t,n){"use strict";var r=n(3384);t.Z=r.Z},9428:function(e,t,n){"use strict";n.d(t,{Z:function(){return b}});var r=n(5773),o=n(6167),a=n(808),i=n(4337),u=n(102),l=n(5570),s=n(8867),c=n(6420),d=n(3327),f=n(814);function p(e){return(0,f.Z)("MuiSvgIcon",e)}(0,d.Z)("MuiSvgIcon",["root","colorPrimary","colorSecondary","colorAction","colorError","colorDisabled","fontSizeInherit","fontSizeSmall","fontSizeMedium","fontSizeLarge"]);var h=n(7878),v=["children","className","color","component","fontSize","htmlColor","inheritViewBox","titleAccess","viewBox"],m=(0,c.ZP)("svg",{name:"MuiSvgIcon",slot:"Root",overridesResolver:function(e,t){var n=e.ownerState;return[t.root,"inherit"!==n.color&&t["color".concat((0,l.Z)(n.color))],t["fontSize".concat((0,l.Z)(n.fontSize))]]}})((function(e){var t,n,r,o,a,i,u,l,s,c,d,f,p,h,v,m,y,g=e.theme,b=e.ownerState;return{userSelect:"none",width:"1em",height:"1em",display:"inline-block",fill:"currentColor",flexShrink:0,transition:null==(t=g.transitions)||null==(n=t.create)?void 0:n.call(t,"fill",{duration:null==(r=g.transitions)||null==(o=r.duration)?void 0:o.shorter}),fontSize:{inherit:"inherit",small:(null==(a=g.typography)||null==(i=a.pxToRem)?void 0:i.call(a,20))||"1.25rem",medium:(null==(u=g.typography)||null==(l=u.pxToRem)?void 0:l.call(u,24))||"1.5rem",large:(null==(s=g.typography)||null==(c=s.pxToRem)?void 0:c.call(s,35))||"2.1875rem"}[b.fontSize],color:null!=(d=null==(f=(g.vars||g).palette)||null==(p=f[b.color])?void 0:p.main)?d:{action:null==(h=(g.vars||g).palette)||null==(v=h.action)?void 0:v.active,disabled:null==(m=(g.vars||g).palette)||null==(y=m.action)?void 0:y.disabled,inherit:void 0}[b.color]}})),y=o.forwardRef((function(e,t){var n=(0,s.Z)({props:e,name:"MuiSvgIcon"}),o=n.children,c=n.className,d=n.color,f=void 0===d?"inherit":d,y=n.component,g=void 0===y?"svg":y,b=n.fontSize,x=void 0===b?"medium":b,w=n.htmlColor,S=n.inheritViewBox,k=void 0!==S&&S,E=n.titleAccess,_=n.viewBox,A=void 0===_?"0 0 24 24":_,C=(0,a.Z)(n,v),Z=(0,r.Z)({},n,{color:f,component:g,fontSize:x,instanceFontSize:e.fontSize,inheritViewBox:k,viewBox:A}),O={};k||(O.viewBox=A);var R=function(e){var t=e.color,n=e.fontSize,r=e.classes,o={root:["root","inherit"!==t&&"color".concat((0,l.Z)(t)),"fontSize".concat((0,l.Z)(n))]};return(0,u.Z)(o,p,r)}(Z);return(0,h.jsxs)(m,(0,r.Z)({as:g,className:(0,i.Z)(R.root,c),focusable:"false",color:w,"aria-hidden":!E||void 0,role:E?"img":void 0,ref:t},O,C,{ownerState:Z,children:[o,E?(0,h.jsx)("title",{children:E}):null]}))}));y.muiName="SvgIcon";var g=y;function b(e,t){function n(n,o){return(0,h.jsx)(g,(0,r.Z)({"data-testid":"".concat(t,"Icon"),ref:o},n,{children:e}))}return n.muiName=g.muiName,o.memo(o.forwardRef(n))}},8287:function(e,t,n){"use strict";var r=n(2333);t.Z=r.Z},3382:function(e,t,n){"use strict";n.r(t),n.d(t,{capitalize:function(){return o.Z},createChainedFunction:function(){return a},createSvgIcon:function(){return i.Z},debounce:function(){return u.Z},deprecatedPropType:function(){return l},isMuiElement:function(){return s.Z},ownerDocument:function(){return c.Z},ownerWindow:function(){return d.Z},requirePropFactory:function(){return f},setRef:function(){return p},unstable_ClassNameGenerator:function(){return w},unstable_useEnhancedEffect:function(){return h.Z},unstable_useId:function(){return v},unsupportedProp:function(){return m},useControlled:function(){return y.Z},useEventCallback:function(){return g.Z},useForkRef:function(){return b.Z},useIsFocusVisible:function(){return x.Z}});var r=n(9372),o=n(5570),a=n(4904).Z,i=n(9428),u=n(8287);var l=function(e,t){return function(){return null}},s=n(8051),c=n(6042),d=n(7402);n(5773);var f=function(e,t){return function(){return null}},p=n(2589).Z,h=n(4249),v=n(618).Z;var m=function(e,t,n,r,o){return null},y=n(454),g=n(9589),b=n(3484),x=n(8304),w={configure:function(e){r.Z.configure(e)}}},8051:function(e,t,n){"use strict";n.d(t,{Z:function(){return o}});var r=n(6167);var o=function(e,t){return r.isValidElement(e)&&-1!==t.indexOf(e.type.muiName)}},6042:function(e,t,n){"use strict";var r=n(5128);t.Z=r.Z},7402:function(e,t,n){"use strict";var r=n(8456);t.Z=r.Z},454:function(e,t,n){"use strict";n.d(t,{Z:function(){return a}});var r=n(1026),o=n(6167);var a=function(e){var t=e.controlled,n=e.default,a=(e.name,e.state,o.useRef(void 0!==t).current),i=o.useState(n),u=(0,r.Z)(i,2),l=u[0],s=u[1];return[a?t:l,o.useCallback((function(e){a||s(e)}),[])]}},4249:function(e,t,n){"use strict";var r=n(1396);t.Z=r.Z},9589:function(e,t,n){"use strict";var r=n(9098);t.Z=r.Z},3484:function(e,t,n){"use strict";var r=n(7886);t.Z=r.Z},8304:function(e,t,n){"use strict";n.d(t,{Z:function(){return f}});var r,o=n(6167),a=!0,i=!1,u={text:!0,search:!0,url:!0,tel:!0,email:!0,password:!0,number:!0,date:!0,month:!0,week:!0,time:!0,datetime:!0,"datetime-local":!0};function l(e){e.metaKey||e.altKey||e.ctrlKey||(a=!0)}function s(){a=!1}function c(){"hidden"===this.visibilityState&&i&&(a=!0)}function d(e){var t=e.target;try{return t.matches(":focus-visible")}catch(n){}return a||function(e){var t=e.type,n=e.tagName;return!("INPUT"!==n||!u[t]||e.readOnly)||"TEXTAREA"===n&&!e.readOnly||!!e.isContentEditable}(t)}var f=function(){var e=o.useCallback((function(e){var t;null!=e&&((t=e.ownerDocument).addEventListener("keydown",l,!0),t.addEventListener("mousedown",s,!0),t.addEventListener("pointerdown",s,!0),t.addEventListener("touchstart",s,!0),t.addEventListener("visibilitychange",c,!0))}),[]),t=o.useRef(!1);return{isFocusVisibleRef:t,onFocus:function(e){return!!d(e)&&(t.current=!0,!0)},onBlur:function(){return!!t.current&&(i=!0,window.clearTimeout(r),r=window.setTimeout((function(){i=!1}),100),t.current=!1,!0)},ref:e}}},6359:function(e,t,n){"use strict";var r=n(6167).createContext(null);t.Z=r},5360:function(e,t,n){"use strict";n.d(t,{Z:function(){return a}});var r=n(6167),o=n(6359);function a(){return r.useContext(o.Z)}},9161:function(e,t,n){"use strict";n.d(t,{ZP:function(){return x},Co:function(){return w}});var r=n(6167),o=n(5773),a=n(5618),i=/^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|abbr|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|cellPadding|cellSpacing|challenge|charSet|checked|cite|classID|className|cols|colSpan|content|contentEditable|contextMenu|controls|controlsList|coords|crossOrigin|data|dateTime|decoding|default|defer|dir|disabled|disablePictureInPicture|download|draggable|encType|enterKeyHint|form|formAction|formEncType|formMethod|formNoValidate|formTarget|frameBorder|headers|height|hidden|high|href|hrefLang|htmlFor|httpEquiv|id|inputMode|integrity|is|keyParams|keyType|kind|label|lang|list|loading|loop|low|marginHeight|marginWidth|max|maxLength|media|mediaGroup|method|min|minLength|multiple|muted|name|nonce|noValidate|open|optimum|pattern|placeholder|playsInline|poster|preload|profile|radioGroup|readOnly|referrerPolicy|rel|required|reversed|role|rows|rowSpan|sandbox|scope|scoped|scrolling|seamless|selected|shape|size|sizes|slot|span|spellCheck|src|srcDoc|srcLang|srcSet|start|step|style|summary|tabIndex|target|title|translate|type|useMap|value|width|wmode|wrap|about|datatype|inlist|prefix|property|resource|typeof|vocab|autoCapitalize|autoCorrect|autoSave|color|incremental|fallback|inert|itemProp|itemScope|itemType|itemID|itemRef|on|option|results|security|unselectable|accentHeight|accumulate|additive|alignmentBaseline|allowReorder|alphabetic|amplitude|arabicForm|ascent|attributeName|attributeType|autoReverse|azimuth|baseFrequency|baselineShift|baseProfile|bbox|begin|bias|by|calcMode|capHeight|clip|clipPathUnits|clipPath|clipRule|colorInterpolation|colorInterpolationFilters|colorProfile|colorRendering|contentScriptType|contentStyleType|cursor|cx|cy|d|decelerate|descent|diffuseConstant|direction|display|divisor|dominantBaseline|dur|dx|dy|edgeMode|elevation|enableBackground|end|exponent|externalResourcesRequired|fill|fillOpacity|fillRule|filter|filterRes|filterUnits|floodColor|floodOpacity|focusable|fontFamily|fontSize|fontSizeAdjust|fontStretch|fontStyle|fontVariant|fontWeight|format|from|fr|fx|fy|g1|g2|glyphName|glyphOrientationHorizontal|glyphOrientationVertical|glyphRef|gradientTransform|gradientUnits|hanging|horizAdvX|horizOriginX|ideographic|imageRendering|in|in2|intercept|k|k1|k2|k3|k4|kernelMatrix|kernelUnitLength|kerning|keyPoints|keySplines|keyTimes|lengthAdjust|letterSpacing|lightingColor|limitingConeAngle|local|markerEnd|markerMid|markerStart|markerHeight|markerUnits|markerWidth|mask|maskContentUnits|maskUnits|mathematical|mode|numOctaves|offset|opacity|operator|order|orient|orientation|origin|overflow|overlinePosition|overlineThickness|panose1|paintOrder|pathLength|patternContentUnits|patternTransform|patternUnits|pointerEvents|points|pointsAtX|pointsAtY|pointsAtZ|preserveAlpha|preserveAspectRatio|primitiveUnits|r|radius|refX|refY|renderingIntent|repeatCount|repeatDur|requiredExtensions|requiredFeatures|restart|result|rotate|rx|ry|scale|seed|shapeRendering|slope|spacing|specularConstant|specularExponent|speed|spreadMethod|startOffset|stdDeviation|stemh|stemv|stitchTiles|stopColor|stopOpacity|strikethroughPosition|strikethroughThickness|string|stroke|strokeDasharray|strokeDashoffset|strokeLinecap|strokeLinejoin|strokeMiterlimit|strokeOpacity|strokeWidth|surfaceScale|systemLanguage|tableValues|targetX|targetY|textAnchor|textDecoration|textRendering|textLength|to|transform|u1|u2|underlinePosition|underlineThickness|unicode|unicodeBidi|unicodeRange|unitsPerEm|vAlphabetic|vHanging|vIdeographic|vMathematical|values|vectorEffect|version|vertAdvY|vertOriginX|vertOriginY|viewBox|viewTarget|visibility|widths|wordSpacing|writingMode|x|xHeight|x1|x2|xChannelSelector|xlinkActuate|xlinkArcrole|xlinkHref|xlinkRole|xlinkShow|xlinkTitle|xlinkType|xmlBase|xmlns|xmlnsXlink|xmlLang|xmlSpace|y|y1|y2|yChannelSelector|z|zoomAndPan|for|class|autofocus)|(([Dd][Aa][Tt][Aa]|[Aa][Rr][Ii][Aa]|x)-.*))$/,u=(0,a.Z)((function(e){return i.test(e)||111===e.charCodeAt(0)&&110===e.charCodeAt(1)&&e.charCodeAt(2)<91})),l=n(429),s=n(9099),c=n(7997),d=n(8694),f=u,p=function(e){return"theme"!==e},h=function(e){return"string"===typeof e&&e.charCodeAt(0)>96?f:p},v=function(e,t,n){var r;if(t){var o=t.shouldForwardProp;r=e.__emotion_forwardProp&&o?function(t){return e.__emotion_forwardProp(t)&&o(t)}:o}return"function"!==typeof r&&n&&(r=e.__emotion_forwardProp),r},m=function(e){var t=e.cache,n=e.serialized,r=e.isStringTag;(0,s.hC)(t,n,r);(0,d.L)((function(){return(0,s.My)(t,n,r)}));return null},y=function e(t,n){var a,i,u=t.__emotion_real===t,d=u&&t.__emotion_base||t;void 0!==n&&(a=n.label,i=n.target);var f=v(t,n,u),p=f||h(d),y=!p("as");return function(){var g=arguments,b=u&&void 0!==t.__emotion_styles?t.__emotion_styles.slice(0):[];if(void 0!==a&&b.push("label:"+a+";"),null==g[0]||void 0===g[0].raw)b.push.apply(b,g);else{0,b.push(g[0][0]);for(var x=g.length,w=1;w0&&void 0!==arguments[0]?arguments[0]:{};return(null==(e=t.keys)?void 0:e.reduce((function(e,n){return e[t.up(n)]={},e}),{}))||{}}function u(e,t){return e.reduce((function(e,t){var n=e[t];return(!n||0===Object.keys(n).length)&&delete e[t],e}),t)}},3623:function(e,t,n){"use strict";n.d(t,{$n:function(){return d},Fq:function(){return s},_j:function(){return c},mi:function(){return l}});var r=n(4140);function o(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:0,n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:1;return Math.min(Math.max(t,e),n)}function a(e){if(e.type)return e;if("#"===e.charAt(0))return a(function(e){e=e.slice(1);var t=new RegExp(".{1,".concat(e.length>=6?2:1,"}"),"g"),n=e.match(t);return n&&1===n[0].length&&(n=n.map((function(e){return e+e}))),n?"rgb".concat(4===n.length?"a":"","(").concat(n.map((function(e,t){return t<3?parseInt(e,16):Math.round(parseInt(e,16)/255*1e3)/1e3})).join(", "),")"):""}(e));var t=e.indexOf("("),n=e.substring(0,t);if(-1===["rgb","rgba","hsl","hsla","color"].indexOf(n))throw new Error((0,r.Z)(9,e));var o,i=e.substring(t+1,e.length-1);if("color"===n){if(o=(i=i.split(" ")).shift(),4===i.length&&"/"===i[3].charAt(0)&&(i[3]=i[3].slice(1)),-1===["srgb","display-p3","a98-rgb","prophoto-rgb","rec-2020"].indexOf(o))throw new Error((0,r.Z)(10,o))}else i=i.split(",");return{type:n,values:i=i.map((function(e){return parseFloat(e)})),colorSpace:o}}function i(e){var t=e.type,n=e.colorSpace,r=e.values;return-1!==t.indexOf("rgb")?r=r.map((function(e,t){return t<3?parseInt(e,10):e})):-1!==t.indexOf("hsl")&&(r[1]="".concat(r[1],"%"),r[2]="".concat(r[2],"%")),r=-1!==t.indexOf("color")?"".concat(n," ").concat(r.join(" ")):"".concat(r.join(", ")),"".concat(t,"(").concat(r,")")}function u(e){var t="hsl"===(e=a(e)).type||"hsla"===e.type?a(function(e){var t=(e=a(e)).values,n=t[0],r=t[1]/100,o=t[2]/100,u=r*Math.min(o,1-o),l=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:(e+n/30)%12;return o-u*Math.max(Math.min(t-3,9-t,1),-1)},s="rgb",c=[Math.round(255*l(0)),Math.round(255*l(8)),Math.round(255*l(4))];return"hsla"===e.type&&(s+="a",c.push(t[3])),i({type:s,values:c})}(e)).values:e.values;return t=t.map((function(t){return"color"!==e.type&&(t/=255),t<=.03928?t/12.92:Math.pow((t+.055)/1.055,2.4)})),Number((.2126*t[0]+.7152*t[1]+.0722*t[2]).toFixed(3))}function l(e,t){var n=u(e),r=u(t);return(Math.max(n,r)+.05)/(Math.min(n,r)+.05)}function s(e,t){return e=a(e),t=o(t),"rgb"!==e.type&&"hsl"!==e.type||(e.type+="a"),"color"===e.type?e.values[3]="/".concat(t):e.values[3]=t,i(e)}function c(e,t){if(e=a(e),t=o(t),-1!==e.type.indexOf("hsl"))e.values[2]*=1-t;else if(-1!==e.type.indexOf("rgb")||-1!==e.type.indexOf("color"))for(var n=0;n<3;n+=1)e.values[n]*=1-t;return i(e)}function d(e,t){if(e=a(e),t=o(t),-1!==e.type.indexOf("hsl"))e.values[2]+=(100-e.values[2])*t;else if(-1!==e.type.indexOf("rgb"))for(var n=0;n<3;n+=1)e.values[n]+=(255-e.values[n])*t;else if(-1!==e.type.indexOf("color"))for(var r=0;r<3;r+=1)e.values[r]+=(1-e.values[r])*t;return i(e)}},5864:function(e,t,n){"use strict";n.d(t,{ZP:function(){return k},x9:function(){return w}});var r=n(649),o=n(1026),a=n(808),i=n(5773),u=n(9161),l=n(7205),s=n(3384),c=["variant"];function d(e){return 0===e.length}function f(e){var t=e.variant,n=(0,a.Z)(e,c),r=t||"";return Object.keys(n).sort().forEach((function(t){r+="color"===t?d(r)?e[t]:(0,s.Z)(e[t]):"".concat(d(r)?t:(0,s.Z)(t)).concat((0,s.Z)(e[t].toString()))})),r}var p=n(4837),h=["name","slot","skipVariantsResolver","skipSx","overridesResolver"],v=["theme"],m=["theme"];function y(e){return 0===Object.keys(e).length}var g=function(e,t){return t.components&&t.components[e]&&t.components[e].styleOverrides?t.components[e].styleOverrides:null},b=function(e,t){var n=[];t&&t.components&&t.components[e]&&t.components[e].variants&&(n=t.components[e].variants);var r={};return n.forEach((function(e){var t=f(e.props);r[t]=e.style})),r},x=function(e,t,n,r){var o,a,i=e.ownerState,u=void 0===i?{}:i,l=[],s=null==n||null==(o=n.components)||null==(a=o[r])?void 0:a.variants;return s&&s.forEach((function(n){var r=!0;Object.keys(n.props).forEach((function(t){u[t]!==n.props[t]&&e[t]!==n.props[t]&&(r=!1)})),r&&l.push(t[f(n.props)])})),l};function w(e){return"ownerState"!==e&&"theme"!==e&&"sx"!==e&&"as"!==e}var S=(0,l.Z)();function k(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=e.defaultTheme,n=void 0===t?S:t,l=e.rootShouldForwardProp,s=void 0===l?w:l,c=e.slotShouldForwardProp,d=void 0===c?w:c,f=function(e){var t=y(e.theme)?n:e.theme;return(0,p.Z)((0,i.Z)({},e,{theme:t}))};return f.__mui_systemSx=!0,function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};(0,u.Co)(e,(function(e){return e.filter((function(e){return!(null!=e&&e.__mui_systemSx)}))}));var l=t.name,c=t.slot,p=t.skipVariantsResolver,S=t.skipSx,k=t.overridesResolver,E=(0,a.Z)(t,h),_=void 0!==p?p:c&&"Root"!==c||!1,A=S||!1;var C=w;"Root"===c?C=s:c?C=d:function(e){return"string"===typeof e&&e.charCodeAt(0)>96}(e)&&(C=void 0);var Z=(0,u.ZP)(e,(0,i.Z)({shouldForwardProp:C,label:undefined},E)),O=function(e){for(var t=arguments.length,u=new Array(t>1?t-1:0),s=1;s0){var h=new Array(p).fill("");(d=[].concat((0,r.Z)(e),(0,r.Z)(h))).raw=[].concat((0,r.Z)(e.raw),(0,r.Z)(h))}else"function"===typeof e&&e.__emotion_real!==e&&(d=function(t){var r=t.theme,o=(0,a.Z)(t,m);return e((0,i.Z)({theme:y(r)?n:r},o))});return Z.apply(void 0,[d].concat((0,r.Z)(c)))};return Z.withConfig&&(O.withConfig=Z.withConfig),O}}},7205:function(e,t,n){"use strict";n.d(t,{Z:function(){return h}});var r=n(5773),o=n(808),a=n(8170),i=n(4649),u=["values","unit","step"],l=function(e){var t=Object.keys(e).map((function(t){return{key:t,val:e[t]}}))||[];return t.sort((function(e,t){return e.val-t.val})),t.reduce((function(e,t){return(0,r.Z)({},e,(0,i.Z)({},t.key,t.val))}),{})};var s={borderRadius:4},c=n(258);var d=n(4837),f=n(9855),p=["breakpoints","palette","spacing","shape"];var h=function(){for(var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},t=e.breakpoints,n=void 0===t?{}:t,i=e.palette,h=void 0===i?{}:i,v=e.spacing,m=e.shape,y=void 0===m?{}:m,g=(0,o.Z)(e,p),b=function(e){var t=e.values,n=void 0===t?{xs:0,sm:600,md:900,lg:1200,xl:1536}:t,a=e.unit,i=void 0===a?"px":a,s=e.step,c=void 0===s?5:s,d=(0,o.Z)(e,u),f=l(n),p=Object.keys(f);function h(e){var t="number"===typeof n[e]?n[e]:e;return"@media (min-width:".concat(t).concat(i,")")}function v(e){var t="number"===typeof n[e]?n[e]:e;return"@media (max-width:".concat(t-c/100).concat(i,")")}function m(e,t){var r=p.indexOf(t);return"@media (min-width:".concat("number"===typeof n[e]?n[e]:e).concat(i,") and ")+"(max-width:".concat((-1!==r&&"number"===typeof n[p[r]]?n[p[r]]:t)-c/100).concat(i,")")}return(0,r.Z)({keys:p,values:f,up:h,down:v,between:m,only:function(e){return p.indexOf(e)+10&&void 0!==arguments[0]?arguments[0]:8;if(e.mui)return e;var t=(0,c.hB)({spacing:e}),n=function(){for(var e=arguments.length,n=new Array(e),r=0;r1?S-1:0),E=1;E2){if(!s[e])return[e];e=s[e]}var t=e.split(""),n=(0,r.Z)(t,2),o=n[0],a=n[1],i=u[o],c=l[a]||"";return Array.isArray(c)?c.map((function(e){return i+e})):[i+c]})),d=["m","mt","mr","mb","ml","mx","my","margin","marginTop","marginRight","marginBottom","marginLeft","marginX","marginY","marginInline","marginInlineStart","marginInlineEnd","marginBlock","marginBlockStart","marginBlockEnd"],f=["p","pt","pr","pb","pl","px","py","padding","paddingTop","paddingRight","paddingBottom","paddingLeft","paddingX","paddingY","paddingInline","paddingInlineStart","paddingInlineEnd","paddingBlock","paddingBlockStart","paddingBlockEnd"],p=[].concat(d,f);function h(e,t,n,r){var o,i=null!=(o=(0,a.DW)(e,t,!1))?o:n;return"number"===typeof i?function(e){return"string"===typeof e?e:i*e}:Array.isArray(i)?function(e){return"string"===typeof e?e:i[e]}:"function"===typeof i?i:function(){}}function v(e){return h(e,"spacing",8)}function m(e,t){if("string"===typeof t||null==t)return t;var n=e(Math.abs(t));return t>=0?n:"number"===typeof n?-n:"-".concat(n)}function y(e,t,n,r){if(-1===t.indexOf(n))return null;var a=function(e,t){return function(n){return e.reduce((function(e,r){return e[r]=m(t,n),e}),{})}}(c(n),r),i=e[n];return(0,o.k9)(e,i,a)}function g(e,t){var n=v(e.theme);return Object.keys(e).map((function(r){return y(e,t,r,n)})).reduce(i.Z,{})}function b(e){return g(e,d)}function x(e){return g(e,f)}function w(e){return g(e,p)}b.propTypes={},b.filterProps=d,x.propTypes={},x.filterProps=f,w.propTypes={},w.filterProps=p},9747:function(e,t,n){"use strict";n.d(t,{DW:function(){return i},Jq:function(){return u}});var r=n(4649),o=n(3384),a=n(1596);function i(e,t){var n=!(arguments.length>2&&void 0!==arguments[2])||arguments[2];if(!t||"string"!==typeof t)return null;if(e&&e.vars&&n){var r="vars.".concat(t).split(".").reduce((function(e,t){return e&&e[t]?e[t]:null}),e);if(null!=r)return r}return t.split(".").reduce((function(e,t){return e&&null!=e[t]?e[t]:null}),e)}function u(e,t,n){var r,o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:n;return r="function"===typeof e?e(n):Array.isArray(e)?e[n]||o:i(e,n)||o,t&&(r=t(r,o,e)),r}t.ZP=function(e){var t=e.prop,n=e.cssProperty,l=void 0===n?e.prop:n,s=e.themeKey,c=e.transform,d=function(e){if(null==e[t])return null;var n=e[t],d=i(e.theme,s)||{};return(0,a.k9)(e,n,(function(e){var n=u(d,c,e);return e===n&&"string"===typeof e&&(n=u(d,c,"".concat(t).concat("default"===e?"":(0,o.Z)(e)),e)),!1===l?n:(0,r.Z)({},l,n)}))};return d.propTypes={},d.filterProps=[t],d}},9855:function(e,t,n){"use strict";n.d(t,{Z:function(){return P}});var r=n(258),o=n(9747),a=n(6612);var i=function(){for(var e=arguments.length,t=new Array(e),n=0;n0&&void 0!==arguments[0]?arguments[0]:null,n=(0,o.Z)();return n&&(e=n,0!==Object.keys(e).length)?n:t},i=(0,r.Z)();var u=function(){return a(arguments.length>0&&void 0!==arguments[0]?arguments[0]:i)}},6837:function(e,t,n){"use strict";n.d(t,{Z:function(){return a}});var r=n(6830);var o=n(275);function a(e){var t=e.props,n=e.name,a=e.defaultTheme,i=function(e){var t=e.theme,n=e.name,o=e.props;return t&&t.components&&t.components[n]&&t.components[n].defaultProps?(0,r.Z)(t.components[n].defaultProps,o):o}({theme:(0,o.Z)(a),name:n,props:t});return i}},9372:function(e,t){"use strict";var n=function(e){return e},r=function(){var e=n;return{configure:function(t){e=t},generate:function(t){return e(t)},reset:function(){e=n}}}();t.Z=r},3384:function(e,t,n){"use strict";n.d(t,{Z:function(){return o}});var r=n(4140);function o(e){if("string"!==typeof e)throw new Error((0,r.Z)(7));return e.charAt(0).toUpperCase()+e.slice(1)}},102:function(e,t,n){"use strict";function r(e,t,n){var r={};return Object.keys(e).forEach((function(o){r[o]=e[o].reduce((function(e,r){return r&&(e.push(t(r)),n&&n[r]&&e.push(n[r])),e}),[]).join(" ")})),r}n.d(t,{Z:function(){return r}})},4904:function(e,t,n){"use strict";function r(){for(var e=arguments.length,t=new Array(e),n=0;n1&&void 0!==arguments[1]?arguments[1]:166;function r(){for(var r=this,o=arguments.length,a=new Array(o),i=0;i2&&void 0!==arguments[2]?arguments[2]:{clone:!0},u=n.clone?(0,r.Z)({},e):e;return o(e)&&o(t)&&Object.keys(t).forEach((function(r){"__proto__"!==r&&(o(t[r])&&r in e&&o(e[r])?u[r]=i(e[r],t[r],n):n.clone?u[r]=o(t[r])?a(t[r]):t[r]:u[r]=t[r])})),u}},4140:function(e,t,n){"use strict";function r(e){for(var t="https://mui.com/production-error/?code="+e,n=1;n2&&void 0!==arguments[2]?arguments[2]:"Mui",a=o[t];return a?"".concat(n,"-").concat(a):"".concat(r.Z.generate(e),"-").concat(t)}},3327:function(e,t,n){"use strict";n.d(t,{Z:function(){return o}});var r=n(814);function o(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"Mui",o={};return t.forEach((function(t){o[t]=(0,r.Z)(e,t,n)})),o}},5128:function(e,t,n){"use strict";function r(e){return e&&e.ownerDocument||document}n.d(t,{Z:function(){return r}})},8456:function(e,t,n){"use strict";n.d(t,{Z:function(){return o}});var r=n(5128);function o(e){return(0,r.Z)(e).defaultView||window}},6830:function(e,t,n){"use strict";n.d(t,{Z:function(){return o}});var r=n(5773);function o(e,t){var n=(0,r.Z)({},t);return Object.keys(e).forEach((function(a){if(a.toString().match(/^(components|slots)$/))n[a]=(0,r.Z)({},e[a],n[a]);else if(a.toString().match(/^(componentsProps|slotProps)$/)){var i=e[a]||{},u=t[a];n[a]={},u&&Object.keys(u)?i&&Object.keys(i)?(n[a]=(0,r.Z)({},u),Object.keys(i).forEach((function(e){n[a][e]=o(i[e],u[e])}))):n[a]=u:n[a]=i}else void 0===n[a]&&(n[a]=e[a])})),n}},2589:function(e,t,n){"use strict";function r(e,t){"function"===typeof e?e(t):e&&(e.current=t)}n.d(t,{Z:function(){return r}})},1396:function(e,t,n){"use strict";var r=n(6167),o="undefined"!==typeof window?r.useLayoutEffect:r.useEffect;t.Z=o},9098:function(e,t,n){"use strict";n.d(t,{Z:function(){return a}});var r=n(6167),o=n(1396);function a(e){var t=r.useRef(e);return(0,o.Z)((function(){t.current=e})),r.useCallback((function(){return t.current.apply(void 0,arguments)}),[])}},7886:function(e,t,n){"use strict";n.d(t,{Z:function(){return a}});var r=n(6167),o=n(2589);function a(){for(var e=arguments.length,t=new Array(e),n=0;n1?n-1:0),o=1;o/gm),W=c(/\${[\w\W]*}/gm),H=c(/^data-[\-\w.\u00B7-\uFFFF]/),V=c(/^aria-[\-\w]+$/),G=c(/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i),K=c(/^(?:\w+script|data):/i),Y=c(/[\u0000-\u0020\u00A0\u1680\u180E\u2000-\u2029\u205F\u3000]/g),q=c(/^html$/i),X=Object.freeze({__proto__:null,MUSTACHE_EXPR:z,ERB_EXPR:U,TMPLIT_EXPR:W,DATA_ATTR:H,ARIA_ATTR:V,IS_ALLOWED_URI:G,IS_SCRIPT_OR_DATA:K,ATTR_WHITESPACE:Y,DOCTYPE_NAME:q}),J=function(){return"undefined"===typeof window?null:window},Q=function(e,t){if("object"!==typeof e||"function"!==typeof e.createPolicy)return null;var n=null,r="data-tt-policy-suffix";t&&t.hasAttribute(r)&&(n=t.getAttribute(r));var o="dompurify"+(n?"#"+n:"");try{return e.createPolicy(o,{createHTML:function(e){return e},createScriptURL:function(e){return e}})}catch(a){return console.warn("TrustedTypes policy "+o+" could not be created."),null}};function ee(){var t=arguments.length>0&&void 0!==arguments[0]?arguments[0]:J(),n=function(e){return ee(e)};if(n.version="3.0.3",n.removed=[],!t||!t.document||9!==t.document.nodeType)return n.isSupported=!1,n;var r,o=t.document,a=o.currentScript,u=t.document,l=t.DocumentFragment,c=t.HTMLTemplateElement,d=t.Node,f=t.Element,p=t.NodeFilter,h=t.NamedNodeMap,A=void 0===h?t.NamedNodeMap||t.MozNamedAttrMap:h,C=t.HTMLFormElement,z=t.DOMParser,U=t.trustedTypes,W=f.prototype,H=R(W,"cloneNode"),V=R(W,"nextSibling"),K=R(W,"childNodes"),Y=R(W,"parentNode");if("function"===typeof c){var te=u.createElement("template");te.content&&te.content.ownerDocument&&(u=te.content.ownerDocument)}var ne="",re=u,oe=re.implementation,ae=re.createNodeIterator,ie=re.createDocumentFragment,ue=re.getElementsByTagName,le=o.importNode,se={};n.isSupported="function"===typeof e&&"function"===typeof Y&&oe&&void 0!==oe.createHTMLDocument;var ce,de,fe=X.MUSTACHE_EXPR,pe=X.ERB_EXPR,he=X.TMPLIT_EXPR,ve=X.DATA_ATTR,me=X.ARIA_ATTR,ye=X.IS_SCRIPT_OR_DATA,ge=X.ATTR_WHITESPACE,be=X.IS_ALLOWED_URI,xe=null,we=Z({},[].concat(i(P),i(M),i(T),i(j),i(I))),Se=null,ke=Z({},[].concat(i(F),i(D),i($),i(B))),Ee=Object.seal(Object.create(null,{tagNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},attributeNameCheck:{writable:!0,configurable:!1,enumerable:!0,value:null},allowCustomizedBuiltInElements:{writable:!0,configurable:!1,enumerable:!0,value:!1}})),_e=null,Ae=null,Ce=!0,Ze=!0,Oe=!1,Re=!0,Pe=!1,Me=!1,Te=!1,Ne=!1,je=!1,Le=!1,Ie=!1,Fe=!0,De=!1,$e="user-content-",Be=!0,ze=!1,Ue={},We=null,He=Z({},["annotation-xml","audio","colgroup","desc","foreignobject","head","iframe","math","mi","mn","mo","ms","mtext","noembed","noframes","noscript","plaintext","script","style","svg","template","thead","title","video","xmp"]),Ve=null,Ge=Z({},["audio","video","img","source","image","track"]),Ke=null,Ye=Z({},["alt","class","for","id","label","name","pattern","placeholder","role","summary","title","value","style","xmlns"]),qe="http://www.w3.org/1998/Math/MathML",Xe="http://www.w3.org/2000/svg",Je="http://www.w3.org/1999/xhtml",Qe=Je,et=!1,tt=null,nt=Z({},[qe,Xe,Je],b),rt=["application/xhtml+xml","text/html"],ot="text/html",at=null,it=u.createElement("form"),ut=function(e){return e instanceof RegExp||e instanceof Function},lt=function(e){if(!at||at!==e){if(e&&"object"===typeof e||(e={}),e=O(e),ce=ce=-1===rt.indexOf(e.PARSER_MEDIA_TYPE)?ot:e.PARSER_MEDIA_TYPE,de="application/xhtml+xml"===ce?b:g,xe="ALLOWED_TAGS"in e?Z({},e.ALLOWED_TAGS,de):we,Se="ALLOWED_ATTR"in e?Z({},e.ALLOWED_ATTR,de):ke,tt="ALLOWED_NAMESPACES"in e?Z({},e.ALLOWED_NAMESPACES,b):nt,Ke="ADD_URI_SAFE_ATTR"in e?Z(O(Ye),e.ADD_URI_SAFE_ATTR,de):Ye,Ve="ADD_DATA_URI_TAGS"in e?Z(O(Ge),e.ADD_DATA_URI_TAGS,de):Ge,We="FORBID_CONTENTS"in e?Z({},e.FORBID_CONTENTS,de):He,_e="FORBID_TAGS"in e?Z({},e.FORBID_TAGS,de):{},Ae="FORBID_ATTR"in e?Z({},e.FORBID_ATTR,de):{},Ue="USE_PROFILES"in e&&e.USE_PROFILES,Ce=!1!==e.ALLOW_ARIA_ATTR,Ze=!1!==e.ALLOW_DATA_ATTR,Oe=e.ALLOW_UNKNOWN_PROTOCOLS||!1,Re=!1!==e.ALLOW_SELF_CLOSE_IN_ATTR,Pe=e.SAFE_FOR_TEMPLATES||!1,Me=e.WHOLE_DOCUMENT||!1,je=e.RETURN_DOM||!1,Le=e.RETURN_DOM_FRAGMENT||!1,Ie=e.RETURN_TRUSTED_TYPE||!1,Ne=e.FORCE_BODY||!1,Fe=!1!==e.SANITIZE_DOM,De=e.SANITIZE_NAMED_PROPS||!1,Be=!1!==e.KEEP_CONTENT,ze=e.IN_PLACE||!1,be=e.ALLOWED_URI_REGEXP||G,Qe=e.NAMESPACE||Je,Ee=e.CUSTOM_ELEMENT_HANDLING||{},e.CUSTOM_ELEMENT_HANDLING&&ut(e.CUSTOM_ELEMENT_HANDLING.tagNameCheck)&&(Ee.tagNameCheck=e.CUSTOM_ELEMENT_HANDLING.tagNameCheck),e.CUSTOM_ELEMENT_HANDLING&&ut(e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck)&&(Ee.attributeNameCheck=e.CUSTOM_ELEMENT_HANDLING.attributeNameCheck),e.CUSTOM_ELEMENT_HANDLING&&"boolean"===typeof e.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements&&(Ee.allowCustomizedBuiltInElements=e.CUSTOM_ELEMENT_HANDLING.allowCustomizedBuiltInElements),Pe&&(Ze=!1),Le&&(je=!0),Ue&&(xe=Z({},i(I)),Se=[],!0===Ue.html&&(Z(xe,P),Z(Se,F)),!0===Ue.svg&&(Z(xe,M),Z(Se,D),Z(Se,B)),!0===Ue.svgFilters&&(Z(xe,T),Z(Se,D),Z(Se,B)),!0===Ue.mathMl&&(Z(xe,j),Z(Se,$),Z(Se,B))),e.ADD_TAGS&&(xe===we&&(xe=O(xe)),Z(xe,e.ADD_TAGS,de)),e.ADD_ATTR&&(Se===ke&&(Se=O(Se)),Z(Se,e.ADD_ATTR,de)),e.ADD_URI_SAFE_ATTR&&Z(Ke,e.ADD_URI_SAFE_ATTR,de),e.FORBID_CONTENTS&&(We===He&&(We=O(We)),Z(We,e.FORBID_CONTENTS,de)),Be&&(xe["#text"]=!0),Me&&Z(xe,["html","head","body"]),xe.table&&(Z(xe,["tbody"]),delete _e.tbody),e.TRUSTED_TYPES_POLICY){if("function"!==typeof e.TRUSTED_TYPES_POLICY.createHTML)throw _('TRUSTED_TYPES_POLICY configuration option must provide a "createHTML" hook.');if("function"!==typeof e.TRUSTED_TYPES_POLICY.createScriptURL)throw _('TRUSTED_TYPES_POLICY configuration option must provide a "createScriptURL" hook.');r=e.TRUSTED_TYPES_POLICY,ne=r.createHTML("")}else void 0===r&&(r=Q(U,a)),null!==r&&"string"===typeof ne&&(ne=r.createHTML(""));s&&s(e),at=e}},st=Z({},["mi","mo","mn","ms","mtext"]),ct=Z({},["foreignobject","desc","title","annotation-xml"]),dt=Z({},["title","style","font","a","script"]),ft=Z({},M);Z(ft,T),Z(ft,N);var pt=Z({},j);Z(pt,L);var ht=function(e){var t=Y(e);t&&t.tagName||(t={namespaceURI:Qe,tagName:"template"});var n=g(e.tagName),r=g(t.tagName);return!!tt[e.namespaceURI]&&(e.namespaceURI===Xe?t.namespaceURI===Je?"svg"===n:t.namespaceURI===qe?"svg"===n&&("annotation-xml"===r||st[r]):Boolean(ft[n]):e.namespaceURI===qe?t.namespaceURI===Je?"math"===n:t.namespaceURI===Xe?"math"===n&&ct[r]:Boolean(pt[n]):e.namespaceURI===Je?!(t.namespaceURI===Xe&&!ct[r])&&!(t.namespaceURI===qe&&!st[r])&&!pt[n]&&(dt[n]||!ft[n]):!("application/xhtml+xml"!==ce||!tt[e.namespaceURI]))},vt=function(e){y(n.removed,{element:e});try{e.parentNode.removeChild(e)}catch(t){e.remove()}},mt=function(e,t){try{y(n.removed,{attribute:t.getAttributeNode(e),from:t})}catch(r){y(n.removed,{attribute:null,from:t})}if(t.removeAttribute(e),"is"===e&&!Se[e])if(je||Le)try{vt(t)}catch(r){}else try{t.setAttribute(e,"")}catch(r){}},yt=function(e){var t,n;if(Ne)e=""+e;else{var o=x(e,/^[\r\n\t ]+/);n=o&&o[0]}"application/xhtml+xml"===ce&&Qe===Je&&(e=''+e+"");var a=r?r.createHTML(e):e;if(Qe===Je)try{t=(new z).parseFromString(a,ce)}catch(l){}if(!t||!t.documentElement){t=oe.createDocument(Qe,"template",null);try{t.documentElement.innerHTML=et?ne:a}catch(l){}}var i=t.body||t.documentElement;return e&&n&&i.insertBefore(u.createTextNode(n),i.childNodes[0]||null),Qe===Je?ue.call(t,Me?"html":"body")[0]:Me?t.documentElement:i},gt=function(e){return ae.call(e.ownerDocument||e,e,p.SHOW_ELEMENT|p.SHOW_COMMENT|p.SHOW_TEXT,null,!1)},bt=function(e){return e instanceof C&&("string"!==typeof e.nodeName||"string"!==typeof e.textContent||"function"!==typeof e.removeChild||!(e.attributes instanceof A)||"function"!==typeof e.removeAttribute||"function"!==typeof e.setAttribute||"string"!==typeof e.namespaceURI||"function"!==typeof e.insertBefore||"function"!==typeof e.hasChildNodes)},xt=function(e){return"object"===typeof d?e instanceof d:e&&"object"===typeof e&&"number"===typeof e.nodeType&&"string"===typeof e.nodeName},wt=function(e,t,r){se[e]&&v(se[e],(function(e){e.call(n,t,r,at)}))},St=function(e){var t;if(wt("beforeSanitizeElements",e,null),bt(e))return vt(e),!0;var r=de(e.nodeName);if(wt("uponSanitizeElement",e,{tagName:r,allowedTags:xe}),e.hasChildNodes()&&!xt(e.firstElementChild)&&(!xt(e.content)||!xt(e.content.firstElementChild))&&E(/<[/\w]/g,e.innerHTML)&&E(/<[/\w]/g,e.textContent))return vt(e),!0;if(!xe[r]||_e[r]){if(!_e[r]&&Et(r)){if(Ee.tagNameCheck instanceof RegExp&&E(Ee.tagNameCheck,r))return!1;if(Ee.tagNameCheck instanceof Function&&Ee.tagNameCheck(r))return!1}if(Be&&!We[r]){var o=Y(e)||e.parentNode,a=K(e)||e.childNodes;if(a&&o)for(var i=a.length-1;i>=0;--i)o.insertBefore(H(a[i],!0),V(e))}return vt(e),!0}return e instanceof f&&!ht(e)?(vt(e),!0):"noscript"!==r&&"noembed"!==r||!E(/<\/no(script|embed)/i,e.innerHTML)?(Pe&&3===e.nodeType&&(t=e.textContent,t=w(t,fe," "),t=w(t,pe," "),t=w(t,he," "),e.textContent!==t&&(y(n.removed,{element:e.cloneNode()}),e.textContent=t)),wt("afterSanitizeElements",e,null),!1):(vt(e),!0)},kt=function(e,t,n){if(Fe&&("id"===t||"name"===t)&&(n in u||n in it))return!1;if(Ze&&!Ae[t]&&E(ve,t));else if(Ce&&E(me,t));else if(!Se[t]||Ae[t]){if(!(Et(e)&&(Ee.tagNameCheck instanceof RegExp&&E(Ee.tagNameCheck,e)||Ee.tagNameCheck instanceof Function&&Ee.tagNameCheck(e))&&(Ee.attributeNameCheck instanceof RegExp&&E(Ee.attributeNameCheck,t)||Ee.attributeNameCheck instanceof Function&&Ee.attributeNameCheck(t))||"is"===t&&Ee.allowCustomizedBuiltInElements&&(Ee.tagNameCheck instanceof RegExp&&E(Ee.tagNameCheck,n)||Ee.tagNameCheck instanceof Function&&Ee.tagNameCheck(n))))return!1}else if(Ke[t]);else if(E(be,w(n,ge,"")));else if("src"!==t&&"xlink:href"!==t&&"href"!==t||"script"===e||0!==S(n,"data:")||!Ve[e])if(Oe&&!E(ye,w(n,ge,"")));else if(n)return!1;return!0},Et=function(e){return e.indexOf("-")>0},_t=function(e){var t,o,a,i;wt("beforeSanitizeAttributes",e,null);var u=e.attributes;if(u){var l={attrName:"",attrValue:"",keepAttr:!0,allowedAttributes:Se};for(i=u.length;i--;){var s=t=u[i],c=s.name,d=s.namespaceURI;if(o="value"===c?t.value:k(t.value),a=de(c),l.attrName=a,l.attrValue=o,l.keepAttr=!0,l.forceKeepAttr=void 0,wt("uponSanitizeAttribute",e,l),o=l.attrValue,!l.forceKeepAttr&&(mt(c,e),l.keepAttr))if(Re||!E(/\/>/i,o)){Pe&&(o=w(o,fe," "),o=w(o,pe," "),o=w(o,he," "));var f=de(e.nodeName);if(kt(f,a,o)){if(!De||"id"!==a&&"name"!==a||(mt(c,e),o=$e+o),r&&"object"===typeof U&&"function"===typeof U.getAttributeType)if(d);else switch(U.getAttributeType(f,a)){case"TrustedHTML":o=r.createHTML(o);break;case"TrustedScriptURL":o=r.createScriptURL(o)}try{d?e.setAttributeNS(d,c,o):e.setAttribute(c,o),m(n.removed)}catch(p){}}}else mt(c,e)}wt("afterSanitizeAttributes",e,null)}},At=function e(t){var n,r=gt(t);for(wt("beforeSanitizeShadowDOM",t,null);n=r.nextNode();)wt("uponSanitizeShadowNode",n,null),St(n)||(n.content instanceof l&&e(n.content),_t(n));wt("afterSanitizeShadowDOM",t,null)};return n.sanitize=function(e){var t,a,i,u,s=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};if((et=!e)&&(e="\x3c!--\x3e"),"string"!==typeof e&&!xt(e)){if("function"!==typeof e.toString)throw _("toString is not a function");if("string"!==typeof(e=e.toString()))throw _("dirty is not a string, aborting")}if(!n.isSupported)return e;if(Te||lt(s),n.removed=[],"string"===typeof e&&(ze=!1),ze){if(e.nodeName){var c=de(e.nodeName);if(!xe[c]||_e[c])throw _("root node is forbidden and cannot be sanitized in-place")}}else if(e instanceof d)1===(a=(t=yt("\x3c!----\x3e")).ownerDocument.importNode(e,!0)).nodeType&&"BODY"===a.nodeName||"HTML"===a.nodeName?t=a:t.appendChild(a);else{if(!je&&!Pe&&!Me&&-1===e.indexOf("<"))return r&&Ie?r.createHTML(e):e;if(!(t=yt(e)))return je?null:Ie?ne:""}t&&Ne&&vt(t.firstChild);for(var f=gt(ze?e:t);i=f.nextNode();)St(i)||(i.content instanceof l&&At(i.content),_t(i));if(ze)return e;if(je){if(Le)for(u=ie.call(t.ownerDocument);t.firstChild;)u.appendChild(t.firstChild);else u=t;return(Se.shadowroot||Se.shadowrootmod)&&(u=le.call(o,u,!0)),u}var p=Me?t.outerHTML:t.innerHTML;return Me&&xe["!doctype"]&&t.ownerDocument&&t.ownerDocument.doctype&&t.ownerDocument.doctype.name&&E(q,t.ownerDocument.doctype.name)&&(p="\n"+p),Pe&&(p=w(p,fe," "),p=w(p,pe," "),p=w(p,he," ")),r&&Ie?r.createHTML(p):p},n.setConfig=function(e){lt(e),Te=!0},n.clearConfig=function(){at=null,Te=!1},n.isValidAttribute=function(e,t,n){at||lt({});var r=de(e),o=de(t);return kt(r,o,n)},n.addHook=function(e,t){"function"===typeof t&&(se[e]=se[e]||[],y(se[e],t))},n.removeHook=function(e){if(se[e])return m(se[e])},n.removeHooks=function(e){se[e]&&(se[e]=[])},n.removeAllHooks=function(){se={}},n}return ee()}()},5628:function(e,t,n){"use strict";var r=n(3012),o={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},a={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},i={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},u={};function l(e){return r.isMemo(e)?i:u[e.$$typeof]||o}u[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},u[r.Memo]=i;var s=Object.defineProperty,c=Object.getOwnPropertyNames,d=Object.getOwnPropertySymbols,f=Object.getOwnPropertyDescriptor,p=Object.getPrototypeOf,h=Object.prototype;e.exports=function e(t,n,r){if("string"!==typeof n){if(h){var o=p(n);o&&o!==h&&e(t,o,r)}var i=c(n);d&&(i=i.concat(d(n)));for(var u=l(t),v=l(n),m=0;m=this._maxSize&&this.clear(),e in this._values||this._size++,this._values[e]=t};var n=/[^.^\]^[]+|(?=\[\]|\.\.)/g,r=/^\d+$/,o=/^\d/,a=/[~`!#$%\^&*+=\-\[\]\\';,/{}|\\":<>\?]/g,i=/^\s*(['"]?)(.*?)(\1)\s*$/,u=new t(512),l=new t(512),s=new t(512);function c(e){return u.get(e)||u.set(e,d(e).map((function(e){return e.replace(i,"$2")})))}function d(e){return e.match(n)||[""]}function f(e){return"string"===typeof e&&e&&-1!==["'",'"'].indexOf(e.charAt(0))}function p(e){return!f(e)&&(function(e){return e.match(o)&&!e.match(r)}(e)||function(e){return a.test(e)}(e))}e.exports={Cache:t,split:d,normalizePath:c,setter:function(e){var t=c(e);return l.get(e)||l.set(e,(function(e,n){for(var r=0,o=t.length,a=e;r