npm - @anonympins/fingerprint - Versions diffs - 0.5.1 → 0.5.2 - Mend

@anonympins/fingerprint 0.5.1 → 0.5.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/CHANGELOG.md +9 -0
package/README.md +118 -115
package/package.json +1 -1
package/src/js/dynamic-wasm.js +52 -13
package/src/js/fingerprint.builder.js +169 -168
package/src/js/fingerprint.client.js +3 -1
package/src/js/fingerprint.client.obfuscated.js +1 -1
package/src/js/fingerprint.js +234 -54
package/src/js/fingerprint.utils.js +213 -183
package/src/js/gpu_pow.solver.js +96 -1
package/src/js/library.js +16 -13
package/src/js/pow.solver.inline.js +138 -27
package/src/js/pow.solver.js +141 -28
package/src/js/tests/fingerprint.engine.test.js +370 -370
package/src/js/tests/fingerprint.test.js +87 -3
package/src/js/tests/gpu_pow.test.js +81 -0
package/src/js/tests/pow.solver.test.js +4 -4
package/src/php/Challenge/ChallengeUtils.php +116 -27
package/src/php/FingerprintEngine.php +103 -2

package/src/js/fingerprint.js CHANGED Viewed

@@ -8,7 +8,20 @@ import {DynamicWasmGenerator} from "./dynamic-wasm.js";
 import {readFileSync, existsSync} from "node:fs";
 import {fileURLToPath} from "node:url";
 import {dirname, join, resolve} from "node:path";
-import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "./fingerprint.utils.js";
+import {
+    verifyZkpProof,
+    sanitizeRedirectPath,
+    decodePolymorphicFingerprint,
+    deepMerge,
+    getHeaderSignature,
+    parseJa3,
+    modPow,
+    hashNetwork,
+    normalizeReferer,
+    isPrivateIp,
+    parseUserAgent,
+    safeJsonStringify
+} from "./fingerprint.utils.js";
 const __filename = fileURLToPath(import.meta.url);
@@ -22,6 +35,42 @@ let lastMappingTime = 0;
 let isCompilingMapping = false;
 const MAPPING_ROTATION_INTERVAL = 60000; // 60 seconds
+const configDir = resolve(__dirname, '../../config');
+const loadBotWhitelist = (filename, fallbackEntries) => {
+  const filePath = join(configDir, filename);
+  if (existsSync(filePath)) {
+    try {
+      return JSON.parse(readFileSync(filePath, 'utf-8'));
+    } catch (e) {
+      console.error(`[Fingerprint] Error loading whitelist file ${filename}:`, e.message);
+    }
+  }
+  return fallbackEntries;
+};
+const googlebotEntries = loadBotWhitelist('googlebot.json', [
+  "2001:4860:4801:10::/64",
+  "2001:4860:4801:11::/64",
+  "2001:4860:4801:12::/64",
+  // ... [Keep fallback inline values for safety]
+  "66.249.79.64"
+]);
+const bingbotEntries = loadBotWhitelist('bingbot.json', [
+  "157.55.39.0/24",
+  "207.46.13.0/24",
+  // ... [Keep fallback inline values for safety]
+  "40.77.178.0/23"
+]);
+const yandexEntries = loadBotWhitelist('yandex.json', [
+  "2a02:6b8::/29",
+  "5.45.192.0/18",
+  // ... [Keep fallback inline values for safety]
+  "213.180.192.0/19"
+]);
 function generateSessionMapping() {
     const randomStr = (len = 6) => crypto.randomBytes(len).toString('hex').replace(/[0-9]/g, 'g').substring(0, len);
     const randomHeader = () => `X-Sess-${crypto.randomBytes(4).toString('hex')}`;
@@ -584,15 +633,17 @@ const getPowSecret = () => {
   return secret || "fallback-dev-secret-32-chars-minimum";
 };
+let cachedPowSolverCode = null;
 /**
  * Loads the pow.solver.js content for inlining in HTML pages.
  * @returns {string} The solver JavaScript code.
  */
 const getPowSolverCode = () => {
-  // On supprime le try/catch. Si le fichier n'est pas trouvé, le processus plantera,
-  // ce qui est préférable à servir un code de secours potentiellement désynchronisé.
-  const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
-  return readFileSync(solverPath, 'utf-8');
+  if (!cachedPowSolverCode) {
+    const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
+    cachedPowSolverCode = readFileSync(solverPath, 'utf-8');
+  }
+  return cachedPowSolverCode;
 };
 /**
  * Extracts the "stable" part of a fingerprint string.
@@ -858,6 +909,7 @@ const generateTspChallenge = (
 ) => {
   const citiesJson = JSON.stringify(cities);
   const solverCode = getPowSolverCode();
+    const safePath = sanitizeRedirectPath(path);
   return `
       <html>
         <head><title>Advanced Security Check (Level 3)</title></head>
@@ -868,14 +920,14 @@ const generateTspChallenge = (
           <script>${solverCode}</script>
           <script>
             const cities = ${citiesJson}; // Safe, as it's JSON
-            const nonce = ${JSON.stringify(nonce)}; // Safe
+            const nonce = ${safeJsonStringify(nonce)}; // Safe
             const targetMaxDistance = ${targetMaxDistance};
             async function solve() {
               const result = await window.solveTspChallenge(cities, targetMaxDistance);
               if (result.distance <= targetMaxDistance) {
-                window.location.href = ${JSON.stringify(path)} + "?pow_type=tsp&pow_nonce=" + nonce + "&pow_solution=" + JSON.stringify(result.path);
+                window.location.href = ${safeJsonStringify(safePath)} + "?pow_type=tsp&pow_nonce=" + nonce + "&pow_solution=" + JSON.stringify(result.path);
               } else {
                 document.getElementById('loader').innerText = "Error: Could not find a sufficient solution. Please try again.";
               }
@@ -972,6 +1024,7 @@ const generateMemoryPoWChallenge = (
   difficulty = 16,
   path = "",
 ) => {
+    const safePath = sanitizeRedirectPath(path);
   // difficulty here is the buffer size in MB.
   return `
       <html>
@@ -982,8 +1035,8 @@ const generateMemoryPoWChallenge = (
           <div id="loader" style="margin:20px;">⚙️ Performing memory allocation and calculation... (${difficulty} MB)</div>
           <script>
             async function solve() {
-              const nonce = "${nonce}";
-              const size = ${difficulty} * 1024 * 1024; // en octets
+              const nonce = ${safeJsonStringify(nonce)};
+                   const size = ${difficulty} * 1024 * 1024; // en octets
               const iterations = size / 16;
               try {
@@ -1000,8 +1053,8 @@ const generateMemoryPoWChallenge = (
                 }
                 window.location.href = "${path}" + "?pow_type=mem&pow_nonce=" + nonce + "&pow_solution=" + finalHash;
               } catch(e) {
-                document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
-              }
+                window.location.href = ${safeJsonStringify(safePath)} + "?pow_type=mem&pow_nonce=" + nonce + "&pow_solution=" + finalHash;
+                 }
             }
             solve();
           </script>
@@ -1056,40 +1109,123 @@ export const verifyPoWAndGenerateTicket = async (
  * For higher difficulties (production workloads), we skip the massive memory allocation on the server,
  * avoiding server-side memory DoS vectors completely.
  */
+function getChallengedIndices(seed, solution, numBlocks, k = 4) {
+    const indices = [];
+    let h = cyrb53(seed + ":" + solution);
+    for (let i = 0; i < k; i++) {
+        h = Math.imul(h ^ i, 1597334677);
+        indices.push(Math.abs(h) % numBlocks);
+    }
+    return indices;
+}
+function verifyMerkleProof(leafHash, index, proof, root) {
+    let currentHash = leafHash;
+    let idx = index;
+    for (let i = 0; i < proof.length; i++) {
+        const sibling = proof[i];
+        const combined = idx % 2 === 0 ? currentHash + sibling : sibling + currentHash;
+        currentHash = crypto.createHash('sha256').update(Buffer.from(combined, 'hex')).digest('hex');
+        idx = Math.floor(idx / 2);
+    }
+    return currentHash === root;
+}
+function verifyMemoryPoWLegacy(nonce, solution, difficulty, clientSecret) {
+    const size = difficulty * 1024 * 1024;
+    const iterations = size / 16;
+    const buffer = new Uint32Array(size / 4);
+    const seed = `:${nonce}:${clientSecret}`;
+    let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
+    for (let i = 0; i < buffer.length; i++) {
+        buffer[i] = h = Math.imul(h ^ i, 1597334677);
+    }
+    let finalHash = 0;
+    let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
+    for (let i = 0; i < iterations; i++) {
+        addr = buffer[addr] % buffer.length;
+        finalHash ^= addr;
+    }
+    return finalHash === solution;
+}
 export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
   const MAX_ALLOWED_MEM_DIFFICULTY = 128; // 128MB
   if (difficulty > MAX_ALLOWED_MEM_DIFFICULTY) {
     console.warn(`[Security] Memory PoW verification attempt with excessive difficulty: ${difficulty}MB. Denied.`);
     return false;
   }
+  if (Number(difficulty) === 0) {
+    return true;
+  }
   if (!solution) {
     return false;
   }
-  // If difficulty is high (production workloads), we treat memory PoW purely as a client-side cost.
-  // Cryptographic integrity is already fully enforced by the chained CPU PoW verification.
-  if (difficulty > 4) {
-    return true;
+  let data;
+  try {
+      data = typeof solution === 'string' ? JSON.parse(solution) : solution;
+  } catch (e) {
+      data = null;
+  }
+  if (!data || typeof data !== 'object' || data.solution === undefined || !data.merkleRoot || !data.proofs) {
+      if (difficulty <= 4 && /^\d+$/.test(String(solution))) {
+          return verifyMemoryPoWLegacy(nonce, parseInt(solution, 10), difficulty, clientSecret);
+      }
+      return false;
   }
-  // Fallback: Cryptographic verification path for low-difficulty challenges / unit tests
-  const size = difficulty * 1024 * 1024;
-  const iterations = size / 16;
-  const buffer = new Uint32Array(size / 4);
+  const { solution: sol, merkleRoot, proofs } = data;
+  const numBlocks = difficulty * 256;
   const seed = `:${nonce}:${clientSecret}`;
-  let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
-  for (let i = 0; i < buffer.length; i++) {
-    buffer[i] = h = Math.imul(h ^ i, 1597334677);
+  const challengedIndices = getChallengedIndices(seed, sol, numBlocks, 4);
+  for (const b of challengedIndices) {
+      const proof = proofs[b] || proofs[String(b)];
+      if (!proof) return false;
+      const block = new Uint32Array(1024);
+      let h = cyrb53(seed + ":" + b);
+      for (let i = 0; i < 1024; i++) {
+          block[i] = (h = Math.imul(h ^ i, 1597334677));
+      }
+      const expectedLeaf = crypto.createHash('sha256').update(Buffer.from(block.buffer)).digest('hex');
+      if (!verifyMerkleProof(expectedLeaf, b, proof, merkleRoot)) {
+          return false;
+      }
   }
-  let finalHash = 0;
-  let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
+  const blockCache = new Map();
+  function getBlockElement(blockIdx, elementIdx) {
+      if (!blockCache.has(blockIdx)) {
+          const block = new Uint32Array(1024);
+          let h = cyrb53(seed + ":" + blockIdx);
+          for (let i = 0; i < 1024; i++) {
+              block[i] = (h = Math.imul(h ^ i, 1597334677));
+          }
+          blockCache.set(blockIdx, block);
+      }
+      return blockCache.get(blockIdx)[elementIdx];
+  }
+  const totalElements = numBlocks * 1024;
+  let addr = totalElements > 0 ? getBlockElement(0, 0) % totalElements : 0;
+  let expectedSolution = 0;
+  const iterations = 1024;
   for (let i = 0; i < iterations; i++) {
-    addr = buffer[addr] % buffer.length;
-    finalHash ^= addr;
+      const blockIdx = Math.floor(addr / 1024);
+      const elementIdx = addr % 1024;
+      addr = getBlockElement(blockIdx, elementIdx) % totalElements;
+      expectedSolution ^= addr;
   }
-  return finalHash === parseInt(solution, 10);
+  return expectedSolution === parseInt(sol, 10);
 };
 export async function verifySpacePoW(nonce, solution, queries, seed, clientSecret) {
@@ -1321,12 +1457,13 @@ export async function generateSpaceChallenge(clientIp, nonce, suspicionFactor, o
 function generateSpaceChallengePage(challengeDetails, clientSecret, securityConfig) {
   const { nonce, sizeMb, queries, path } = challengeDetails;
   const solverCode = getPowSolverCode();
-  const challengeScript = `
+    const safePath = sanitizeRedirectPath(path);
+    const challengeScript = `
     async function solve() {
-      const nonce = ${JSON.stringify(nonce)};
-      const path = ${JSON.stringify(path)};
-      const clientSecret = ${JSON.stringify(clientSecret)};
+      const nonce = ${safeJsonStringify(nonce)};
+       const path = ${safeJsonStringify(safePath)};
+       const clientSecret = ${safeJsonStringify(clientSecret)};
       const queries = ${JSON.stringify(queries)};
       const sizeMb = ${sizeMb};
@@ -2971,8 +3108,8 @@ function calculateTarget(suspicionFactor, securityConfig = {}) {
   // MAX_DIFFICULTY: Slow enough to heavily penalize a bot, but feasible for a patient human (5-30s).
   // NOUVEAU: La difficulté est maintenant configurable.
   const { cpu: cpuConfig = {} } = securityConfig;
-  const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
-  const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 16;
+                      const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
+                      const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 22;
   // Use linear interpolation between min and max difficulty.
   const totalDifficultyBits =
@@ -3026,6 +3163,8 @@ export function generateCpuTargetChallenge(
   };
 }
+const htmlTemplateCache = new Map();
 /**
  * Generates the HTML page for the CPU target challenge.
  * @param {object} challengeDetails - The details from generateCpuTargetChallenge.
@@ -3034,6 +3173,7 @@ export function generateCpuTargetChallenge(
  */
 function generateCpuTargetChallengePage(challengeDetails, clientIp) {
     const { nonce, target, path } = challengeDetails;
+    const safePath = sanitizeRedirectPath(path);
     const solverCode = getPowSolverCode();
     return `
       <html><head><title>Security Check</title></head>
@@ -3045,14 +3185,14 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
         <script>
           async function solve() {
             const clientIp = ${JSON.stringify(clientIp)};
-            const nonce = ${JSON.stringify(nonce)};
+            const nonce = ${safeJsonStringify(nonce)};
             const cpuTarget = BigInt("0x" + "${target}");
             // La nouvelle version de solveCpuChallengeInline n'a plus besoin de l'IP ou du secret,
             // car tout est dans le baseBlock. Pour la compatibilité de ce challenge simple, on passe null.
             const baseBlockBytes = new TextEncoder().encode(nonce + ":");
             const solution = await window.solveCpuChallengeInline(baseBlockBytes, cpuTarget, (progress) => {});
             window.location.href = ${JSON.stringify(path)} + "?pow_type=cpu_target&pow_nonce=" + nonce + "&pow_solution=" + solution;
-          }
+           }
           solve();
         </script>
       </body></html>`;
@@ -3067,6 +3207,7 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  */
 function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapUrls, originalFingerprint) { // eslint-disable-line max-len
     const { nonce, target, path } = cpuChallengeDetails;
+    const safePath = sanitizeRedirectPath(path);
     const solverCode = getPowSolverCode();
     // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
     // Le fingerprint est maintenant passé directement en paramètre.
@@ -3083,10 +3224,10 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const challengeScript = `
       async function solve() {
-        const nonce = ${JSON.stringify(nonce)};
-        const path = ${JSON.stringify(path)};
-        const clientSecret = ${JSON.stringify(clientSecret)};
-        const clientIp = ${JSON.stringify(clientIp)};
+        const nonce = ${safeJsonStringify(nonce)};
+           const path = ${JSON.stringify(path)};
+           const clientSecret = ${safeJsonStringify(clientSecret)};
+           const clientIp = ${JSON.stringify(clientIp)};
         const cpuTarget = BigInt("0x" + "${target}");
         const memDifficulty = ${memoryDifficulty};
         // Le client reçoit directement le 'baseBlock' sous forme de tableau d'octets.
@@ -3125,10 +3266,15 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const customTemplatePath = securityConfig?.challengePagePath;
     if (customTemplatePath) {
-        try {
-            htmlTemplate = readFileSync(customTemplatePath, 'utf-8');
-        } catch (error) {
-            console.warn(`[Fingerprint] Could not load custom challenge page at '${customTemplatePath}'. Falling back to default. Error: ${error.message}`);
+        if (htmlTemplateCache.has(customTemplatePath)) {
+            htmlTemplate = htmlTemplateCache.get(customTemplatePath);
+        } else {
+            try {
+                htmlTemplate = readFileSync(customTemplatePath, 'utf-8');
+                htmlTemplateCache.set(customTemplatePath, htmlTemplate);
+            } catch (error) {
+                console.warn(`[Fingerprint] Could not load custom challenge page at '${customTemplatePath}'. Falling back to default. Error: ${error.message}`);
+            }
         }
     }
@@ -3789,8 +3935,9 @@ export class FingerprintEngine {
             // lors de l'émission du challenge.
             // --- FIX: Use submitted fingerprint, but fallback to current request's fingerprint ---
             // This handles API clients that might not use the full client-side library but still solve the challenge.
-            const solverFingerprint = pow_fp || getCompositeDeviceHash(requestContext);
-    const originalFingerprint = challengeContext.fingerprint; // This is the fingerprint of the request that *triggered* the challenge
+                const safe_pow_fp = typeof pow_fp === 'string' ? pow_fp : (Array.isArray(pow_fp) ? String(pow_fp[0]) : '');
+                const solverFingerprint = safe_pow_fp || getCompositeDeviceHash(requestContext);
+                const originalFingerprint = typeof challengeContext.fingerprint === 'string' ? challengeContext.fingerprint : '';
             let similarity;
             const similarityThreshold = this.securityConfig.similarityThreshold ?? 0.95;
@@ -4252,9 +4399,8 @@ export class FingerprintEngine {
             // On passe la configuration pour que la difficulté soit calculée correctement.
             const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
-            // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
-            // Par exemple, elle ne commence à augmenter qu'à partir de 25% du chemin entre 'low' et 'high'.
-            const memActivationFactor = Math.max(0, (suspicionFactor - 0.25) / 0.75);
+            // La difficulté mémoire augmente désormais en parfaite synergie avec le facteur de suspicion (ratio constant)
+            const memActivationFactor = suspicionFactor;
             const minMemDifficulty = 0;   // Peut être 0 Mo !
             const maxMemDifficulty = 48;  // 48Mo pour les plus suspects
@@ -4983,6 +5129,9 @@ export const modsecurity_analyzer = (rulesPath) => {
  * @returns {Array<{userAgent: string, hostnameSuffix: string}>}
  */
 export const default_whitelist = () => [
+    googlebot_whitelist(),
+    bingbot_whitelist(),
+    yandex_whitelist(),
     // === Moteurs de recherche majeurs ===
     { userAgent: 'Googlebot', hostnameSuffix: '.googlebot.com' },
     { userAgent: 'Google-Extended', hostnameSuffix: '.google.com' },
@@ -5080,6 +5229,26 @@ export const default_whitelist = () => [
     { userAgent: 'KeyCDN', hostnameSuffix: '.keycdn.com' },
 ];
+/**
+ * Retourne la liste officielle des préfixes IP/CIDR (IPv4 et IPv6) utilisés par Googlebot
+ * enveloppée dans un objet de type 'allowlist' prêt à être injecté.
+ * @returns {{type: string, entries: string[]}} Règle d'allowlist de sécurité.
+ */
+export const googlebot_whitelist = () => ({
+    type: 'allowlist',
+    entries: googlebotEntries
+});
+export const yandex_whitelist = () => ({
+    type: 'allowlist',
+    entries: yandexEntries
+});
+export const bingbot_whitelist = () => ({
+    type: 'allowlist',
+    entries: bingbotEntries
+});
 /**
  * Extracts the TLS Session ID or ticket hash from the request context.
@@ -5109,6 +5278,8 @@ function getTlsSessionId(context) {
 }
 // --- Proof-of-Work Middleware (The Tollbooth) ---
+const staticFileCache = new Map();
 export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
@@ -5189,7 +5360,11 @@ export const powMiddleware = (securityConfig) => {
                     }
                 }
                 if (jsFile && existsSync(jsFile)) {
-                    const fileContent = readFileSync(jsFile);
+                    let fileContent = staticFileCache.get(jsFile);
+                    if (!fileContent) {
+                        fileContent = readFileSync(jsFile);
+                        staticFileCache.set(jsFile, fileContent);
+                    }
                     res.setHeader('Content-Type', 'application/javascript');
                     return res.send(fileContent);
                 }
@@ -5206,7 +5381,11 @@ export const powMiddleware = (securityConfig) => {
                     }
                 }
                 if (wasmFile && existsSync(wasmFile)) {
-                    const fileContent = readFileSync(wasmFile);
+                    let fileContent = staticFileCache.get(wasmFile);
+                    if (!fileContent) {
+                        fileContent = readFileSync(wasmFile);
+                        staticFileCache.set(wasmFile, fileContent);
+                    }
                     res.setHeader('Content-Type', 'application/wasm');
                     return res.send(fileContent);
                 }
@@ -5216,7 +5395,7 @@ export const powMiddleware = (securityConfig) => {
     const requestContext = {
       clientIp: req.ip || req.socket?.remoteAddress || "unknown",
-      path: req.path,
+        path: sanitizeRedirectPath(req.path),
       cookies: req.cookies,
       query: req.query,
       body: req.body,
@@ -5269,7 +5448,7 @@ export const powMiddleware = (securityConfig) => {
         if (decision.cookie) {
           res.cookie(decision.cookie.name, decision.cookie.value, decision.cookie.options);
         }
-        return res.redirect(decision.path);
+        return res.redirect(sanitizeRedirectPath(decision.path));
       case 'next':
       default:
@@ -5278,6 +5457,7 @@ export const powMiddleware = (securityConfig) => {
   };
 };
 /**
  * @internal
  * Exporting an object containing the functions to make them mockable in tests.
@@ -5723,7 +5903,7 @@ export async function handleMetricsRequest(req, res, securityConfig) {
     if (typeof authorizationCallback === 'function') {
         const context = new RequestContext(
             req.ip,
-            req.path,
+            sanitizeRedirectPath(req.path),
             req.headers,
             req.query,
             req.body,