typosquatting 0.1.0

data/lib/typosquatting/ecosystems/composer.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Composer < Base
+      def initialize
+        super
+        @purl_type = "composer"
+      end
+
+      def name_pattern
+        /\A[a-z0-9]([a-z0-9_.-]*[a-z0-9])?\/[a-z0-9]([a-z0-9_.-]*[a-z0-9])?\z/
+      end
+
+      def allowed_characters
+        /[a-z0-9_.\/-]/
+      end
+
+      def allowed_delimiters
+        %w[- _ .]
+      end
+
+      def case_sensitive?
+        false
+      end
+
+      def supports_namespaces?
+        true
+      end
+
+      def normalise(name)
+        name.downcase
+      end
+
+      def parse_namespace(name)
+        parts = name.split("/", 2)
+        if parts.length == 2
+          [parts[0], parts[1]]
+        else
+          [nil, name]
+        end
+      end
+
+      def valid_name?(name)
+        return false if name.nil? || name.empty?
+
+        vendor, package = parse_namespace(name)
+        return false if vendor.nil? || package.nil?
+        return false if vendor.empty? || package.empty?
+
+        vendor_valid = vendor =~ /\A[a-z0-9]([a-z0-9_.-]*[a-z0-9])?\z/i
+        package_valid = package =~ /\A[a-z0-9]([a-z0-9_.-]*[a-z0-9])?\z/i
+
+        vendor_valid && package_valid
+      end
+
+      def format_name(vendor, package)
+        "#{vendor}/#{package}"
+      end
+    end
+
+    Base.register(Composer.new)
+  end
+end

data/lib/typosquatting/ecosystems/golang.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Golang < Base
+      def initialize
+        super
+        @name = "golang"
+        @purl_type = "golang"
+      end
+
+      def name_pattern
+        /\A[a-zA-Z0-9][a-zA-Z0-9._\/-]*\z/
+      end
+
+      def allowed_characters
+        /[a-zA-Z0-9._\/-]/
+      end
+
+      def allowed_delimiters
+        %w[- _ . /]
+      end
+
+      def case_sensitive?
+        true
+      end
+
+      def supports_namespaces?
+        true
+      end
+
+      def normalise(name)
+        name.sub(/\/v\d+$/, "")
+      end
+
+      def parse_namespace(name)
+        parts = name.split("/")
+        if parts.length > 1
+          [parts[0..-2].join("/"), parts.last]
+        else
+          [nil, name]
+        end
+      end
+
+      def valid_name?(name)
+        return false if name.nil? || name.empty?
+        return false if name.start_with?("/") || name.end_with?("/")
+        return false if name.include?("//")
+
+        !!(name =~ name_pattern)
+      end
+    end
+
+    Base.register(Golang.new)
+  end
+end

data/lib/typosquatting/ecosystems/hex.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Hex < Base
+      def initialize
+        super
+        @purl_type = "hex"
+      end
+
+      def name_pattern
+        /\A[a-z][a-z0-9_]*\z/
+      end
+
+      def allowed_characters
+        /[a-z0-9_]/
+      end
+
+      def allowed_delimiters
+        %w[_]
+      end
+
+      def case_sensitive?
+        false
+      end
+
+      def normalise(name)
+        name.downcase
+      end
+
+      def valid_name?(name)
+        return false if name.nil? || name.empty?
+        return false if name.include?("-")
+        return false if name.include?(".")
+
+        !!(name =~ name_pattern)
+      end
+    end
+
+    Base.register(Hex.new)
+  end
+end

data/lib/typosquatting/ecosystems/maven.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Maven < Base
+      def initialize
+        super
+        @purl_type = "maven"
+      end
+
+      def name_pattern
+        /\A[a-zA-Z0-9._-]+:[a-zA-Z0-9._-]+\z/
+      end
+
+      def allowed_characters
+        /[a-zA-Z0-9._:-]/
+      end
+
+      def allowed_delimiters
+        %w[- _ .]
+      end
+
+      def case_sensitive?
+        true
+      end
+
+      def supports_namespaces?
+        true
+      end
+
+      def normalise(name)
+        name
+      end
+
+      def parse_namespace(name)
+        parts = name.split(":", 2)
+        if parts.length == 2
+          [parts[0], parts[1]]
+        else
+          [nil, name]
+        end
+      end
+
+      def valid_name?(name)
+        return false if name.nil? || name.empty?
+
+        group_id, artifact_id = parse_namespace(name)
+        return false if group_id.nil? || artifact_id.nil?
+        return false if group_id.empty? || artifact_id.empty?
+
+        group_valid = group_id =~ /\A[a-zA-Z0-9._-]+\z/
+        artifact_valid = artifact_id =~ /\A[a-zA-Z0-9._-]+\z/
+
+        group_valid && artifact_valid
+      end
+
+      def format_name(group_id, artifact_id)
+        "#{group_id}:#{artifact_id}"
+      end
+    end
+
+    Base.register(Maven.new)
+  end
+end

data/lib/typosquatting/ecosystems/npm.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Npm < Base
+      def initialize
+        super
+        @purl_type = "npm"
+      end
+
+      def name_pattern
+        /\A(@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*\z/
+      end
+
+      def allowed_characters
+        /[a-z0-9._~-]/
+      end
+
+      def allowed_delimiters
+        %w[- _ .]
+      end
+
+      def case_sensitive?
+        false
+      end
+
+      def supports_namespaces?
+        true
+      end
+
+      def normalise(name)
+        name.downcase
+      end
+
+      def parse_namespace(name)
+        if name.start_with?("@")
+          parts = name.split("/", 2)
+          [parts[0], parts[1]]
+        else
+          [nil, name]
+        end
+      end
+
+      def valid_name?(name)
+        return false if name.nil? || name.empty?
+        return false if name.length > 214
+
+        namespace, pkg_name = parse_namespace(name)
+
+        if namespace
+          return false unless namespace =~ /\A@[a-z0-9~-][a-z0-9._~-]*\z/
+          return false if pkg_name.nil? || pkg_name.empty?
+        end
+
+        pkg_name = name unless namespace
+        return false unless pkg_name =~ /\A[a-z0-9~-][a-z0-9._~-]*\z/
+        return false if pkg_name.start_with?(".")
+        return false if pkg_name.start_with?("_")
+
+        true
+      end
+    end
+
+    Base.register(Npm.new)
+  end
+end

data/lib/typosquatting/ecosystems/nuget.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Nuget < Base
+      def initialize
+        super
+        @purl_type = "nuget"
+      end
+
+      def name_pattern
+        /\A[a-zA-Z0-9][a-zA-Z0-9._-]*\z/
+      end
+
+      def allowed_characters
+        /[a-zA-Z0-9._-]/
+      end
+
+      def allowed_delimiters
+        %w[- _ .]
+      end
+
+      def case_sensitive?
+        false
+      end
+
+      def normalise(name)
+        name.downcase
+      end
+
+      def valid_name?(name)
+        return false if name.nil? || name.empty?
+        return false if name.length > 100
+
+        !!(name =~ name_pattern)
+      end
+    end
+
+    Base.register(Nuget.new)
+  end
+end

data/lib/typosquatting/ecosystems/pub.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Pub < Base
+      def initialize
+        super
+        @purl_type = "pub"
+      end
+
+      def name_pattern
+        /\A[a-z][a-z0-9_]*\z/
+      end
+
+      def allowed_characters
+        /[a-z0-9_]/
+      end
+
+      def allowed_delimiters
+        %w[_]
+      end
+
+      def case_sensitive?
+        false
+      end
+
+      def normalise(name)
+        name.downcase
+      end
+
+      def valid_name?(name)
+        return false if name.nil? || name.empty?
+        return false if name.include?("-")
+        return false if name.include?(".")
+        return false if name.length < 2 || name.length > 64
+
+        !!(name =~ name_pattern)
+      end
+    end
+
+    Base.register(Pub.new)
+  end
+end

data/lib/typosquatting/ecosystems/pypi.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Pypi < Base
+      def initialize
+        super
+        @purl_type = "pypi"
+      end
+
+      def name_pattern
+        /\A[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?\z/
+      end
+
+      def allowed_characters
+        /[a-zA-Z0-9._-]/
+      end
+
+      def allowed_delimiters
+        %w[- _ .]
+      end
+
+      def case_sensitive?
+        false
+      end
+
+      def normalise(name)
+        name.downcase.gsub(/[-_.]+/, "-")
+      end
+
+      def equivalent?(name1, name2)
+        normalise(name1) == normalise(name2)
+      end
+    end
+
+    Base.register(Pypi.new)
+  end
+end

data/lib/typosquatting/ecosystems/rubygems.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  module Ecosystems
+    class Rubygems < Base
+      def initialize
+        super
+        @name = "rubygems"
+        @purl_type = "gem"
+      end
+
+      def name_pattern
+        /\A[a-zA-Z0-9][a-zA-Z0-9_-]*\z/
+      end
+
+      def allowed_characters
+        /[a-zA-Z0-9_-]/
+      end
+
+      def allowed_delimiters
+        %w[- _]
+      end
+
+      def case_sensitive?
+        true
+      end
+
+      def normalise(name)
+        name
+      end
+
+      def valid_name?(name)
+        return false if name.nil? || name.empty?
+        return false if name.include?(".")
+
+        !!(name =~ name_pattern)
+      end
+    end
+
+    Base.register(Rubygems.new)
+  end
+end

data/lib/typosquatting/generator.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Typosquatting
+  class Generator
+    attr_reader :ecosystem, :algorithms
+
+    def initialize(ecosystem:, algorithms: nil)
+      @ecosystem = ecosystem.is_a?(String) ? Ecosystems::Base.get(ecosystem) : ecosystem
+      @algorithms = algorithms || Algorithms::Base.all
+    end
+
+    def generate(package_name)
+      results = []
+
+      algorithms.each do |algorithm|
+        variants = algorithm.generate(package_name)
+        variants.each do |variant|
+          next if variant == package_name
+          next unless ecosystem.valid_name?(variant)
+          next if same_after_normalisation?(package_name, variant)
+
+          results << Variant.new(
+            name: variant,
+            algorithm: algorithm.name,
+            original: package_name
+          )
+        end
+      end
+
+      dedupe_by_normalised_name(results)
+    end
+
+    Variant = Struct.new(:name, :algorithm, :original, keyword_init: true) do
+      def to_h
+        { name: name, algorithm: algorithm, original: original }
+      end
+
+      def to_s
+        name
+      end
+    end
+
+    def same_after_normalisation?(original, variant)
+      ecosystem.normalise(original) == ecosystem.normalise(variant)
+    end
+
+    def dedupe_by_normalised_name(variants)
+      seen = {}
+      variants.each_with_object([]) do |variant, result|
+        normalised = ecosystem.normalise(variant.name)
+        unless seen[normalised]
+          seen[normalised] = true
+          result << variant
+        end
+      end
+    end
+  end
+end

data/lib/typosquatting/lookup.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "json"
+require "uri"
+require "purl"
+
+module Typosquatting
+  class Lookup
+    API_BASE = "https://packages.ecosyste.ms/api/v1"
+    USER_AGENT = "typosquatting-ruby/#{VERSION} (https://github.com/andrew/typosquatting)"
+
+    attr_reader :ecosystem
+
+    def initialize(ecosystem:)
+      @ecosystem = ecosystem.is_a?(String) ? Ecosystems::Base.get(ecosystem) : ecosystem
+    end
+
+    def check(package_name)
+      purl = build_purl(package_name)
+      response = fetch("/packages/lookup?purl=#{URI.encode_www_form_component(purl.to_s)}")
+
+      Result.new(
+        name: package_name,
+        purl: purl.to_s,
+        packages: response || [],
+        ecosystem: ecosystem.purl_type
+      )
+    end
+
+    def check_many(package_names, concurrency: 10)
+      results = []
+      mutex = Mutex.new
+      queue = package_names.dup
+
+      threads = concurrency.times.map do
+        Thread.new do
+          while (name = mutex.synchronize { queue.shift })
+            result = check(name)
+            mutex.synchronize { results << [name, result] }
+          end
+        end
+      end
+
+      threads.each(&:join)
+      package_names.map { |name| results.find { |n, _| n == name }&.last }
+    end
+
+    def registries
+      response = fetch("/registries?ecosystem=#{URI.encode_www_form_component(ecosystem.purl_type)}")
+      response&.map { |r| Registry.new(r) } || []
+    end
+
+    Result = Struct.new(:name, :purl, :packages, :ecosystem, keyword_init: true) do
+      def exists?
+        !packages.empty?
+      end
+
+      def registries
+        packages.map { |p| p.dig("registry", "name") }.compact.uniq
+      end
+
+      def to_h
+        {
+          name: name,
+          purl: purl,
+          exists: exists?,
+          registries: registries,
+          packages: packages
+        }
+      end
+    end
+
+    Registry = Struct.new(:data) do
+      def name
+        data["name"]
+      end
+
+      def url
+        data["url"]
+      end
+
+      def ecosystem
+        data["ecosystem"]
+      end
+
+      def packages_count
+        data["packages_count"]
+      end
+
+      def to_h
+        data
+      end
+    end
+
+    def build_purl(package_name)
+      if ecosystem.supports_namespaces?
+        namespace, name = ecosystem.parse_namespace(package_name)
+        Purl::PackageURL.new(
+          type: ecosystem.purl_type,
+          namespace: namespace,
+          name: name
+        )
+      else
+        Purl::PackageURL.new(
+          type: ecosystem.purl_type,
+          name: package_name
+        )
+      end
+    end
+
+    def fetch(path)
+      uri = URI("#{API_BASE}#{path}")
+      request = Net::HTTP::Get.new(uri)
+      request["User-Agent"] = USER_AGENT
+      request["Accept"] = "application/json"
+
+      response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
+        http.request(request)
+      end
+
+      case response
+      when Net::HTTPSuccess
+        JSON.parse(response.body)
+      when Net::HTTPNotFound
+        []
+      else
+        raise APIError, "API request failed: #{response.code} #{response.message}"
+      end
+    rescue StandardError => e
+      raise APIError, "API request failed: #{e.message}" unless e.is_a?(APIError)
+
+      raise
+    end
+  end
+
+  class APIError < StandardError; end
+end