[Fact]
    public async Task Post_BrokencrystalsApiMetadata_ShouldHaveXxe()
    {
        var config = new Configuration("hotel.playground.brightsec.com", logLevel: LogLevel.Trace);
        var runner = SecRunner.Create(config);
        await runner.Init();

        var content = new StringContent(@"<?xml version=""1.0"" encoding=""UTF-8""?><!DOCTYPE replace [<!ENTITY xxe SYSTEM ""file:///etc//passwd""> ]><xxe_trigger>&xxe;</xxe_trigger><child></child>", Encoding.Default, "text/xml");
        var headers = new Dictionary<string, IEnumerable<string>>
        {
            { "Accept", new[] { "application/json", "text/plain", "*/*" } },
            { "Accept-Encoding", new[] { "identity" } },
        };
        var target = new Target("https://qa.brokencrystals.com/api/metadata")
            .WithMethod(HttpMethod.Post)
            .WithBody(content)
            .WithHeaders(headers);
        var builder = new ScanSettingsBuilder()
            .WithTests(new List<TestType> { TestType.Xxe });

        await runner
            .CreateScan(builder)
            .Threshold(Severity.Medium)
            .Run(target);
        
        await runner.DisposeAsync();
    }