@anonympins/fingerprint 0.5.0 → 0.5.2

package/src/js/fingerprint.js

@@ -8,7 +8,20 @@ import {DynamicWasmGenerator} from "./dynamic-wasm.js";
 import {readFileSync, existsSync} from "node:fs";
 import {fileURLToPath} from "node:url";
 import {dirname, join, resolve} from "node:path";
-import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "./fingerprint.utils.js";
+import {
+    verifyZkpProof,
+    sanitizeRedirectPath,
+    decodePolymorphicFingerprint,
+    deepMerge,
+    getHeaderSignature,
+    parseJa3,
+    modPow,
+    hashNetwork,
+    normalizeReferer,
+    isPrivateIp,
+    parseUserAgent,
+    safeJsonStringify
+} from "./fingerprint.utils.js";
 
 
 const __filename = fileURLToPath(import.meta.url);
@@ -22,6 +35,42 @@ let lastMappingTime = 0;
 let isCompilingMapping = false;
 const MAPPING_ROTATION_INTERVAL = 60000; // 60 seconds
 
+const configDir = resolve(__dirname, '../../config');
+
+const loadBotWhitelist = (filename, fallbackEntries) => {
+  const filePath = join(configDir, filename);
+  if (existsSync(filePath)) {
+    try {
+      return JSON.parse(readFileSync(filePath, 'utf-8'));
+    } catch (e) {
+      console.error(`[Fingerprint] Error loading whitelist file ${filename}:`, e.message);
+    }
+  }
+  return fallbackEntries;
+};
+
+const googlebotEntries = loadBotWhitelist('googlebot.json', [
+  "2001:4860:4801:10::/64",
+  "2001:4860:4801:11::/64",
+  "2001:4860:4801:12::/64",
+  // ... [Keep fallback inline values for safety]
+  "66.249.79.64"
+]);
+
+const bingbotEntries = loadBotWhitelist('bingbot.json', [
+  "157.55.39.0/24",
+  "207.46.13.0/24",
+  // ... [Keep fallback inline values for safety]
+  "40.77.178.0/23"
+]);
+
+const yandexEntries = loadBotWhitelist('yandex.json', [
+  "2a02:6b8::/29",
+  "5.45.192.0/18",
+  // ... [Keep fallback inline values for safety]
+  "213.180.192.0/19"
+]);
+
 function generateSessionMapping() {
     const randomStr = (len = 6) => crypto.randomBytes(len).toString('hex').replace(/[0-9]/g, 'g').substring(0, len);
     const randomHeader = () => `X-Sess-${crypto.randomBytes(4).toString('hex')}`;
@@ -189,7 +238,82 @@ export function generateStatelessTicket(payload) {
   const signature = crypto.createHmac('sha256', key).update(Buffer.concat([iv, encrypted])).digest();
   return `${base64UrlEncode(iv)}.${base64UrlEncode(encrypted)}.${base64UrlEncode(signature)}`;
 }
+/**
+ * Détecte les anomalies de flux QUIC/HTTP3 par rapport au User-Agent.
+ * @private
+ * @param {object} context - Le contexte de la requête.
+ * @returns {{quicAnomalyScore: number}}
+ */
+function getQuicAnomalyScore(context) {
+    const quicFp = context.headers?.['x-quic-fp'] || context.quicFingerprint || null;
+    if (!quicFp || typeof quicFp !== 'string') {
+        return { quicAnomalyScore: 0.0 };
+    }
+
+    const parts = quicFp.split(';');
+    if (parts.length < 2) return { quicAnomalyScore: 0.0 };
+
+    const params = {};
+    parts[1].split(',').forEach(p => {
+        const kv = p.split('=');
+        if (kv.length === 2) params[kv[0]] = kv[1];
+    });
+    const priorityOrder = parts[2] || '';
+
+    const ua = context.headers?.['user-agent'] || '';
+    const uaParts = parseUserAgent(ua);
+    const browser = uaParts.browser;
 
+    if (!browser) return { quicAnomalyScore: 0.0 };
+
+    let anomaly = 0.0;
+    if (browser.startsWith('Chrome') || browser.startsWith('Edge')) {
+        const maxData = parseInt(params['1'] || '0', 10);
+        const maxStreams = parseInt(params['4'] || '0', 10);
+        if (maxData > 0 && maxData < 1048576) anomaly += 40.0;
+        if (maxStreams > 0 && maxStreams !== 100) anomaly += 30.0;
+        if (priorityOrder && !priorityOrder.includes('u=')) anomaly += 30.0;
+    } else if (browser.startsWith('Firefox')) {
+        const maxData = parseInt(params['1'] || '0', 10);
+        if (maxData > 0 && maxData > 5000000) anomaly += 40.0;
+    }
+
+    return { quicAnomalyScore: Math.max(0.0, Math.min(100.0, anomaly)) };
+}
+/**
+ * Détecte les anomalies de rendu (V-Sync, FPS, gigue) à partir des métriques d'affichage.
+ * @private
+ * @param {object} context - Le contexte de la requête.
+ * @returns {{renderingAnomalyScore: number}}
+ */
+function getRenderingAnomalyScore(context) {
+  const behaviorHeader = context.headers?.['x-behavior-metrics'];
+  if (!behaviorHeader) {
+    return { renderingAnomalyScore: 0.0 };
+  }
+  try {
+    const metrics = JSON.parse(behaviorHeader);
+    if (!metrics || !metrics.rendering) {
+      return { renderingAnomalyScore: 0.0 };
+    }
+    const rendering = metrics.rendering;
+    let score = 0.0;
+    if (rendering.offscreenAnom) {
+      score += 100.0;
+    }
+    const fps = parseFloat(rendering.fps || 0.0);
+    const jitter = parseFloat(rendering.jitter || 0.0);
+    if (fps > 250.0 || (fps > 0.0 && fps < 15.0)) {
+      score += 50.0;
+    }
+    if (jitter > 6.0) {
+      score += Math.min(80.0, (jitter - 6.0) * 10.0);
+    }
+    return { renderingAnomalyScore: Math.min(100.0, score) };
+  } catch (e) {
+    return { renderingAnomalyScore: 0.0 };
+  }
+}
 export function parseStatelessTicket(ticket) {
   try {
     if (ticket.startsWith('ed25519.')) {
@@ -304,7 +428,10 @@ const securityProfiles = {
             tlsSpoofingScore: 0.8, // NOUVEAU: Poids pour la détection de spoofing TLS
             subnetScore: 0.4, // NOUVEAU: Poids pour la réputation du sous-réseau
             ipReputationScore: 0.5, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.6 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.6, // NOUVEAU: Poids pour le clustering botnet
+            tcpAnomalyScore: 0.8, // NEW: Anomalie de pile TCP/IP
+            quicAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie QUIC
+            renderingAnomalyScore: 0.8 // NOUVEAU: Poids pour l'anomalie de rendu
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
         patterns: {
@@ -340,7 +467,8 @@ const securityProfiles = {
             tlsSpoofingScore: 1.0, // Plus agressif pour le spoofing TLS
             subnetScore: 0.5,
             ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.8 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.8, // NOUVEAU: Poids pour le clustering botnet
+            renderingAnomalyScore: 1.0 // NOUVEAU: Poids pour l'anomalie de rendu
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
         patterns: {
@@ -377,7 +505,9 @@ const securityProfiles = {
             tlsSpoofingScore: 0.7, // Important pour les API
             subnetScore: 0.4,
             ipReputationScore: 0.5, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.7 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.7, // NOUVEAU: Poids pour le clustering botnet
+            tcpAnomalyScore: 0.8, // NEW: Anomalie de pile TCP/IP
+            quicAnomalyScore: 0.8 // NOUVEAU: Poids pour l'anomalie QUIC
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
         patterns: {
@@ -415,7 +545,10 @@ const securityProfiles = {
             tlsSpoofingScore: 0.6, // Moins critique pour les blogs
             subnetScore: 0.2,
             ipReputationScore: 0.3, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.5 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.5, // NOUVEAU: Poids pour le clustering botnet
+            tcpAnomalyScore: 0.5, // NEW: Anomalie de pile TCP/IP
+            quicAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie QUIC
+            renderingAnomalyScore: 0.5 // NOUVEAU: Poids pour l'anomalie de rendu
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -452,7 +585,10 @@ const securityProfiles = {
             tlsSpoofingScore: 0.9, // Très important pour l'e-commerce
             subnetScore: 0.5,
             ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.9 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.9, // NOUVEAU: Poids pour le clustering botnet
+            tcpAnomalyScore: 0.9, // NEW: Anomalie de pile TCP/IP
+            quicAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie QUIC
+            renderingAnomalyScore: 0.9 // NOUVEAU: Poids pour l'anomalie de rendu
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -497,15 +633,17 @@ const getPowSecret = () => {
   return secret || "fallback-dev-secret-32-chars-minimum";
 };
 
+let cachedPowSolverCode = null;
 /**
  * Loads the pow.solver.js content for inlining in HTML pages.
  * @returns {string} The solver JavaScript code.
  */
 const getPowSolverCode = () => {
-  // On supprime le try/catch. Si le fichier n'est pas trouvé, le processus plantera,
-  // ce qui est préférable à servir un code de secours potentiellement désynchronisé.
-  const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
-  return readFileSync(solverPath, 'utf-8');
+  if (!cachedPowSolverCode) {
+    const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
+    cachedPowSolverCode = readFileSync(solverPath, 'utf-8');
+  }
+  return cachedPowSolverCode;
 };
 /**
  * Extracts the "stable" part of a fingerprint string.
@@ -771,6 +909,7 @@ const generateTspChallenge = (
 ) => {
   const citiesJson = JSON.stringify(cities);
   const solverCode = getPowSolverCode();
+    const safePath = sanitizeRedirectPath(path);
   return `
       <html>
         <head><title>Advanced Security Check (Level 3)</title></head>
@@ -781,14 +920,14 @@ const generateTspChallenge = (
           <script>${solverCode}</script>
           <script>
             const cities = ${citiesJson}; // Safe, as it's JSON
-            const nonce = ${JSON.stringify(nonce)}; // Safe
+            const nonce = ${safeJsonStringify(nonce)}; // Safe
             const targetMaxDistance = ${targetMaxDistance};
 
             async function solve() {
               const result = await window.solveTspChallenge(cities, targetMaxDistance);
               
               if (result.distance <= targetMaxDistance) {
-                window.location.href = ${JSON.stringify(path)} + "?pow_type=tsp&pow_nonce=" + nonce + "&pow_solution=" + JSON.stringify(result.path);
+                window.location.href = ${safeJsonStringify(safePath)} + "?pow_type=tsp&pow_nonce=" + nonce + "&pow_solution=" + JSON.stringify(result.path);
               } else {
                 document.getElementById('loader').innerText = "Error: Could not find a sufficient solution. Please try again.";
               }
@@ -885,6 +1024,7 @@ const generateMemoryPoWChallenge = (
   difficulty = 16,
   path = "",
 ) => {
+    const safePath = sanitizeRedirectPath(path);
   // difficulty here is the buffer size in MB.
   return `
       <html>
@@ -895,8 +1035,8 @@ const generateMemoryPoWChallenge = (
           <div id="loader" style="margin:20px;">⚙️ Performing memory allocation and calculation... (${difficulty} MB)</div>
           <script>
             async function solve() {
-              const nonce = "${nonce}";
-              const size = ${difficulty} * 1024 * 1024; // en octets
+              const nonce = ${safeJsonStringify(nonce)};
+                   const size = ${difficulty} * 1024 * 1024; // en octets
               const iterations = size / 16;
               
               try {
@@ -913,8 +1053,8 @@ const generateMemoryPoWChallenge = (
                 }
                 window.location.href = "${path}" + "?pow_type=mem&pow_nonce=" + nonce + "&pow_solution=" + finalHash;
               } catch(e) {
-                document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
-              }
+                window.location.href = ${safeJsonStringify(safePath)} + "?pow_type=mem&pow_nonce=" + nonce + "&pow_solution=" + finalHash;
+                 }
             }
             solve();
           </script>
@@ -969,40 +1109,123 @@ export const verifyPoWAndGenerateTicket = async (
  * For higher difficulties (production workloads), we skip the massive memory allocation on the server,
  * avoiding server-side memory DoS vectors completely.
  */
+function getChallengedIndices(seed, solution, numBlocks, k = 4) {
+    const indices = [];
+    let h = cyrb53(seed + ":" + solution);
+    for (let i = 0; i < k; i++) {
+        h = Math.imul(h ^ i, 1597334677);
+        indices.push(Math.abs(h) % numBlocks);
+    }
+    return indices;
+}
+
+function verifyMerkleProof(leafHash, index, proof, root) {
+    let currentHash = leafHash;
+    let idx = index;
+    for (let i = 0; i < proof.length; i++) {
+        const sibling = proof[i];
+        const combined = idx % 2 === 0 ? currentHash + sibling : sibling + currentHash;
+        currentHash = crypto.createHash('sha256').update(Buffer.from(combined, 'hex')).digest('hex');
+        idx = Math.floor(idx / 2);
+    }
+    return currentHash === root;
+}
+
+function verifyMemoryPoWLegacy(nonce, solution, difficulty, clientSecret) {
+    const size = difficulty * 1024 * 1024;
+    const iterations = size / 16;
+    const buffer = new Uint32Array(size / 4);
+    const seed = `:${nonce}:${clientSecret}`;
+    let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
+
+    for (let i = 0; i < buffer.length; i++) {
+        buffer[i] = h = Math.imul(h ^ i, 1597334677);
+    }
+
+    let finalHash = 0;
+    let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
+    for (let i = 0; i < iterations; i++) {
+        addr = buffer[addr] % buffer.length;
+        finalHash ^= addr;
+    }
+    return finalHash === solution;
+}
+
 export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
   const MAX_ALLOWED_MEM_DIFFICULTY = 128; // 128MB
   if (difficulty > MAX_ALLOWED_MEM_DIFFICULTY) {
     console.warn(`[Security] Memory PoW verification attempt with excessive difficulty: ${difficulty}MB. Denied.`);
     return false;
   }
+  if (Number(difficulty) === 0) {
+    return true;
+  }
   if (!solution) {
     return false;
   }
 
-  // If difficulty is high (production workloads), we treat memory PoW purely as a client-side cost.
-  // Cryptographic integrity is already fully enforced by the chained CPU PoW verification.
-  if (difficulty > 4) {
-    return true;
+  let data;
+  try {
+      data = typeof solution === 'string' ? JSON.parse(solution) : solution;
+  } catch (e) {
+      data = null;
   }
 
-  // Fallback: Cryptographic verification path for low-difficulty challenges / unit tests
-  const size = difficulty * 1024 * 1024;
-  const iterations = size / 16;
-  const buffer = new Uint32Array(size / 4);
+  if (!data || typeof data !== 'object' || data.solution === undefined || !data.merkleRoot || !data.proofs) {
+      if (difficulty <= 4 && /^\d+$/.test(String(solution))) {
+          return verifyMemoryPoWLegacy(nonce, parseInt(solution, 10), difficulty, clientSecret);
+      }
+      return false;
+  }
+
+  const { solution: sol, merkleRoot, proofs } = data;
+  const numBlocks = difficulty * 256;
   const seed = `:${nonce}:${clientSecret}`;
-  let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
 
-  for (let i = 0; i < buffer.length; i++) {
-    buffer[i] = h = Math.imul(h ^ i, 1597334677);
+  const challengedIndices = getChallengedIndices(seed, sol, numBlocks, 4);
+
+  for (const b of challengedIndices) {
+      const proof = proofs[b] || proofs[String(b)];
+      if (!proof) return false;
+
+      const block = new Uint32Array(1024);
+      let h = cyrb53(seed + ":" + b);
+      for (let i = 0; i < 1024; i++) {
+          block[i] = (h = Math.imul(h ^ i, 1597334677));
+      }
+
+      const expectedLeaf = crypto.createHash('sha256').update(Buffer.from(block.buffer)).digest('hex');
+
+      if (!verifyMerkleProof(expectedLeaf, b, proof, merkleRoot)) {
+          return false;
+      }
+  }
+
+  const blockCache = new Map();
+  function getBlockElement(blockIdx, elementIdx) {
+      if (!blockCache.has(blockIdx)) {
+          const block = new Uint32Array(1024);
+          let h = cyrb53(seed + ":" + blockIdx);
+          for (let i = 0; i < 1024; i++) {
+              block[i] = (h = Math.imul(h ^ i, 1597334677));
+          }
+          blockCache.set(blockIdx, block);
+      }
+      return blockCache.get(blockIdx)[elementIdx];
   }
 
-  let finalHash = 0;
-  let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
+  const totalElements = numBlocks * 1024;
+  let addr = totalElements > 0 ? getBlockElement(0, 0) % totalElements : 0;
+  let expectedSolution = 0;
+  const iterations = 1024;
   for (let i = 0; i < iterations; i++) {
-    addr = buffer[addr] % buffer.length;
-    finalHash ^= addr;
+      const blockIdx = Math.floor(addr / 1024);
+      const elementIdx = addr % 1024;
+      addr = getBlockElement(blockIdx, elementIdx) % totalElements;
+      expectedSolution ^= addr;
   }
-  return finalHash === parseInt(solution, 10);
+
+  return expectedSolution === parseInt(sol, 10);
 };
 
 export async function verifySpacePoW(nonce, solution, queries, seed, clientSecret) {
@@ -1234,12 +1457,13 @@ export async function generateSpaceChallenge(clientIp, nonce, suspicionFactor, o
 function generateSpaceChallengePage(challengeDetails, clientSecret, securityConfig) {
   const { nonce, sizeMb, queries, path } = challengeDetails;
   const solverCode = getPowSolverCode();
-  
-  const challengeScript = `
+    const safePath = sanitizeRedirectPath(path);
+
+    const challengeScript = `
     async function solve() {
-      const nonce = ${JSON.stringify(nonce)};
-      const path = ${JSON.stringify(path)};
-      const clientSecret = ${JSON.stringify(clientSecret)};
+      const nonce = ${safeJsonStringify(nonce)};
+       const path = ${safeJsonStringify(safePath)};
+       const clientSecret = ${safeJsonStringify(clientSecret)};
       const queries = ${JSON.stringify(queries)};
       const sizeMb = ${sizeMb};
       
@@ -1600,6 +1824,41 @@ function getBehaviorScore(context) {
     if (metrics.keystrokeLatency > 0 && metrics.keystrokeLatency < 40) score += 25; // Frappe trop rapide pour un humain.
     if (metrics.keystrokeLatency > 1000) score += 15; // Latence très élevée, peut être un script lent.
 
+    // NOUVEAU: Analyse de digraphie/trigraphie (dwell & flight times)
+    const dwellTimes = metrics.keystrokeDwellTimes || [];
+    const flightTimes = metrics.keystrokeFlightTimes || [];
+
+    if (dwellTimes.length >= 5) {
+        const meanDwell = dwellTimes.reduce((a, b) => a + b, 0) / dwellTimes.length;
+        const varDwell = dwellTimes.reduce((a, b) => a + Math.pow(b - meanDwell, 2), 0) / dwellTimes.length;
+        const stdDevDwell = Math.sqrt(varDwell);
+
+        if (stdDevDwell < 2.0) {
+            score += 35; // Suspicion d'automatisation (pas de variation humaine de pression)
+        }
+        if (meanDwell < 15.0) {
+            score += 25; // Dwell time irréaliste
+        }
+    }
+
+    if (flightTimes.length >= 5) {
+        const times = flightTimes.map(f => f.time);
+        const meanFlight = times.reduce((a, b) => a + b, 0) / times.length;
+        const varFlight = times.reduce((a, b) => a + Math.pow(b - meanFlight, 2), 0) / times.length;
+        const stdDevFlight = Math.sqrt(varFlight);
+
+        if (stdDevFlight < 3.0) {
+            score += 35; // Pas de variation de transition (flight time robotique)
+        }
+        if (meanFlight < 25.0) {
+            score += 25; // Transitions trop rapides
+        }
+        const benfordDev = Optimization.Operators.benfordTest(times);
+        if (benfordDev > 0.18) {
+            score += 30; // Les intervalles ne suivent pas la loi de Benford
+        }
+    }
+
     // 4. Analyse de la distribution avec la loi de Benford (si les valeurs sont non nulles).
     if (segments.length > 10) {
         const benfordDeviation = Optimization.Operators.benfordTest(segments);
@@ -2766,8 +3025,9 @@ export const getSuspicionVector = async (context, securityConfig) => {
   const stableFp = extractStablePart(currentDeviceHash);
   const stableFpHash = cyrb53(stableFp).toString();
   const { botnetClusterScore } = await getBotnetClusterScore(context, stableFpHash);
-
-    const { tcpAnomalyScore } = getTcpAnomalyScore(context);
+  const { tcpAnomalyScore } = getTcpAnomalyScore(context);
+  const { quicAnomalyScore } = getQuicAnomalyScore(context);
+  const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
 
   // Save the updated device state to the store
   // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
@@ -2779,7 +3039,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, quicAnomalyScore, renderingAnomalyScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -2848,8 +3108,8 @@ function calculateTarget(suspicionFactor, securityConfig = {}) {
   // MAX_DIFFICULTY: Slow enough to heavily penalize a bot, but feasible for a patient human (5-30s).
   // NOUVEAU: La difficulté est maintenant configurable.
   const { cpu: cpuConfig = {} } = securityConfig;
-  const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
-  const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 16;
+                      const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
+                      const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 22;
 
   // Use linear interpolation between min and max difficulty.
   const totalDifficultyBits =
@@ -2903,6 +3163,8 @@ export function generateCpuTargetChallenge(
   };
 }
 
+const htmlTemplateCache = new Map();
+
 /**
  * Generates the HTML page for the CPU target challenge.
  * @param {object} challengeDetails - The details from generateCpuTargetChallenge.
@@ -2911,6 +3173,7 @@ export function generateCpuTargetChallenge(
  */
 function generateCpuTargetChallengePage(challengeDetails, clientIp) {
     const { nonce, target, path } = challengeDetails;
+    const safePath = sanitizeRedirectPath(path);
     const solverCode = getPowSolverCode();
     return `
       <html><head><title>Security Check</title></head>
@@ -2922,14 +3185,14 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
         <script>
           async function solve() {
             const clientIp = ${JSON.stringify(clientIp)};
-            const nonce = ${JSON.stringify(nonce)};
+            const nonce = ${safeJsonStringify(nonce)};
             const cpuTarget = BigInt("0x" + "${target}");
             // La nouvelle version de solveCpuChallengeInline n'a plus besoin de l'IP ou du secret,
             // car tout est dans le baseBlock. Pour la compatibilité de ce challenge simple, on passe null.
             const baseBlockBytes = new TextEncoder().encode(nonce + ":");
             const solution = await window.solveCpuChallengeInline(baseBlockBytes, cpuTarget, (progress) => {});
             window.location.href = ${JSON.stringify(path)} + "?pow_type=cpu_target&pow_nonce=" + nonce + "&pow_solution=" + solution;
-          }
+           }
           solve();
         </script>
       </body></html>`;
@@ -2944,6 +3207,7 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  */
 function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapUrls, originalFingerprint) { // eslint-disable-line max-len
     const { nonce, target, path } = cpuChallengeDetails;
+    const safePath = sanitizeRedirectPath(path);
     const solverCode = getPowSolverCode();
     // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
     // Le fingerprint est maintenant passé directement en paramètre.
@@ -2960,10 +3224,10 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
 
     const challengeScript = `
       async function solve() {
-        const nonce = ${JSON.stringify(nonce)};
-        const path = ${JSON.stringify(path)};
-        const clientSecret = ${JSON.stringify(clientSecret)};
-        const clientIp = ${JSON.stringify(clientIp)};
+        const nonce = ${safeJsonStringify(nonce)};
+           const path = ${JSON.stringify(path)};
+           const clientSecret = ${safeJsonStringify(clientSecret)};
+           const clientIp = ${JSON.stringify(clientIp)};
         const cpuTarget = BigInt("0x" + "${target}");
         const memDifficulty = ${memoryDifficulty};
         // Le client reçoit directement le 'baseBlock' sous forme de tableau d'octets.
@@ -3002,10 +3266,15 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const customTemplatePath = securityConfig?.challengePagePath;
 
     if (customTemplatePath) {
-        try {
-            htmlTemplate = readFileSync(customTemplatePath, 'utf-8');
-        } catch (error) {
-            console.warn(`[Fingerprint] Could not load custom challenge page at '${customTemplatePath}'. Falling back to default. Error: ${error.message}`);
+        if (htmlTemplateCache.has(customTemplatePath)) {
+            htmlTemplate = htmlTemplateCache.get(customTemplatePath);
+        } else {
+            try {
+                htmlTemplate = readFileSync(customTemplatePath, 'utf-8');
+                htmlTemplateCache.set(customTemplatePath, htmlTemplate);
+            } catch (error) {
+                console.warn(`[Fingerprint] Could not load custom challenge page at '${customTemplatePath}'. Falling back to default. Error: ${error.message}`);
+            }
         }
     }
 
@@ -3144,6 +3413,18 @@ export class FingerprintEngine {
     this.dryRun = finalConfig.dryRun || false;
   }
 
+  /**
+   * Applique à chaud une nouvelle configuration de sécurité (poids, seuils, etc.)
+   * sans nécessiter de redémarrage.
+   * @param {object} newConfig - La nouvelle configuration partielle ou complète.
+   */
+  updateConfig(newConfig) {
+    this._validateConfig(newConfig);
+    this.securityConfig = deepMerge(this.securityConfig, newConfig);
+    this.dryRun = this.securityConfig.dryRun || false;
+    this._log('Configuration mise à jour à chaud (Hot-Reloaded)', this.securityConfig);
+  }
+
   /**
    * Validates the security configuration object to detect potential typos or missing essential keys.
    * @private
@@ -3208,7 +3489,9 @@ export class FingerprintEngine {
             (suspicionVector.clientHintsInconsistencyScore || 0) * (weights.clientHintsInconsistencyScore || 0) +
             (suspicionVector.subnetScore || 0) * (weights.subnetScore || 0) +
             (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0) +
-            (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0);
+            (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0) +
+            (suspicionVector.quicAnomalyScore || 0) * (weights.quicAnomalyScore || 0) + // NOUVEAU: QUIC Anomaly
+            (suspicionVector.renderingAnomalyScore || 0) * (weights.renderingAnomalyScore || 0); // NOUVEAU: Rendering Anomaly
 
         return Math.min(100, score);
     }
@@ -3652,8 +3935,9 @@ export class FingerprintEngine {
             // lors de l'émission du challenge.
             // --- FIX: Use submitted fingerprint, but fallback to current request's fingerprint ---
             // This handles API clients that might not use the full client-side library but still solve the challenge.
-            const solverFingerprint = pow_fp || getCompositeDeviceHash(requestContext);
-    const originalFingerprint = challengeContext.fingerprint; // This is the fingerprint of the request that *triggered* the challenge
+                const safe_pow_fp = typeof pow_fp === 'string' ? pow_fp : (Array.isArray(pow_fp) ? String(pow_fp[0]) : '');
+                const solverFingerprint = safe_pow_fp || getCompositeDeviceHash(requestContext);
+                const originalFingerprint = typeof challengeContext.fingerprint === 'string' ? challengeContext.fingerprint : '';
 
             let similarity;
             const similarityThreshold = this.securityConfig.similarityThreshold ?? 0.95;
@@ -4115,9 +4399,8 @@ export class FingerprintEngine {
             // On passe la configuration pour que la difficulté soit calculée correctement.
             const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
 
-            // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
-            // Par exemple, elle ne commence à augmenter qu'à partir de 25% du chemin entre 'low' et 'high'.
-            const memActivationFactor = Math.max(0, (suspicionFactor - 0.25) / 0.75);
+            // La difficulté mémoire augmente désormais en parfaite synergie avec le facteur de suspicion (ratio constant)
+            const memActivationFactor = suspicionFactor;
 
             const minMemDifficulty = 0;   // Peut être 0 Mo !
             const maxMemDifficulty = 48;  // 48Mo pour les plus suspects
@@ -4846,6 +5129,9 @@ export const modsecurity_analyzer = (rulesPath) => {
  * @returns {Array<{userAgent: string, hostnameSuffix: string}>}
  */
 export const default_whitelist = () => [
+    googlebot_whitelist(),
+    bingbot_whitelist(),
+    yandex_whitelist(),
     // === Moteurs de recherche majeurs ===
     { userAgent: 'Googlebot', hostnameSuffix: '.googlebot.com' },
     { userAgent: 'Google-Extended', hostnameSuffix: '.google.com' },
@@ -4943,6 +5229,26 @@ export const default_whitelist = () => [
     { userAgent: 'KeyCDN', hostnameSuffix: '.keycdn.com' },
 ];
 
+/**
+ * Retourne la liste officielle des préfixes IP/CIDR (IPv4 et IPv6) utilisés par Googlebot
+ * enveloppée dans un objet de type 'allowlist' prêt à être injecté.
+ * @returns {{type: string, entries: string[]}} Règle d'allowlist de sécurité.
+ */
+export const googlebot_whitelist = () => ({
+    type: 'allowlist',
+    entries: googlebotEntries
+});
+
+export const yandex_whitelist = () => ({
+    type: 'allowlist',
+    entries: yandexEntries
+});
+
+export const bingbot_whitelist = () => ({
+    type: 'allowlist',
+    entries: bingbotEntries
+});
+
 
 /**
  * Extracts the TLS Session ID or ticket hash from the request context.
@@ -4972,6 +5278,8 @@ function getTlsSessionId(context) {
 }
 
 // --- Proof-of-Work Middleware (The Tollbooth) ---
+const staticFileCache = new Map();
+
 export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
 
@@ -5052,7 +5360,11 @@ export const powMiddleware = (securityConfig) => {
                     }
                 }
                 if (jsFile && existsSync(jsFile)) {
-                    const fileContent = readFileSync(jsFile);
+                    let fileContent = staticFileCache.get(jsFile);
+                    if (!fileContent) {
+                        fileContent = readFileSync(jsFile);
+                        staticFileCache.set(jsFile, fileContent);
+                    }
                     res.setHeader('Content-Type', 'application/javascript');
                     return res.send(fileContent);
                 }
@@ -5069,7 +5381,11 @@ export const powMiddleware = (securityConfig) => {
                     }
                 }
                 if (wasmFile && existsSync(wasmFile)) {
-                    const fileContent = readFileSync(wasmFile);
+                    let fileContent = staticFileCache.get(wasmFile);
+                    if (!fileContent) {
+                        fileContent = readFileSync(wasmFile);
+                        staticFileCache.set(wasmFile, fileContent);
+                    }
                     res.setHeader('Content-Type', 'application/wasm');
                     return res.send(fileContent);
                 }
@@ -5079,7 +5395,7 @@ export const powMiddleware = (securityConfig) => {
 
     const requestContext = {
       clientIp: req.ip || req.socket?.remoteAddress || "unknown",
-      path: req.path,
+        path: sanitizeRedirectPath(req.path),
       cookies: req.cookies,
       query: req.query,
       body: req.body,
@@ -5132,7 +5448,7 @@ export const powMiddleware = (securityConfig) => {
         if (decision.cookie) {
           res.cookie(decision.cookie.name, decision.cookie.value, decision.cookie.options);
         }
-        return res.redirect(decision.path);
+        return res.redirect(sanitizeRedirectPath(decision.path));
 
       case 'next':
       default:
@@ -5141,6 +5457,7 @@ export const powMiddleware = (securityConfig) => {
   };
 };
 
+
 /**
  * @internal
  * Exporting an object containing the functions to make them mockable in tests.
@@ -5186,6 +5503,8 @@ export const __internal = {
     parseTcpSyn, // Expose for testing
     classifyTcpOs, // Expose for testing
     getTcpAnomalyScore, // Expose for testing,
+    getQuicAnomalyScore, // NOUVEAU: Expose pour les tests
+    getRenderingAnomalyScore, // NOUVEAU: Expose pour les tests
     registerCooperativeNode,
     findPeerInSubnet,
     handleCooperativeRequest
@@ -5584,7 +5903,7 @@ export async function handleMetricsRequest(req, res, securityConfig) {
     if (typeof authorizationCallback === 'function') {
         const context = new RequestContext(
             req.ip,
-            req.path,
+            sanitizeRedirectPath(req.path),
             req.headers,
             req.query,
             req.body,