@anonympins/fingerprint 0.5.1 → 0.5.2

package/src/js/tests/fingerprint.test.js

@@ -749,7 +749,7 @@ describe('Fingerprint & PoW Security Suite', () => {
                     pow_type: 'cpu_mem',
                     pow_nonce: nonce,
                     pow_solution_cpu: String(cpuSolution),
-                    pow_solution_mem: String(memSolution),
+                    pow_solution_mem: JSON.stringify(memSolution),
                     pow_fp: solverFingerprint
                 },
                 headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
@@ -843,7 +843,7 @@ describe('Fingerprint & PoW Security Suite', () => {
                     pow_type: 'cpu_mem',
                     pow_nonce: nonce,
                     pow_solution_cpu: String(cpuSolution),
-                    pow_solution_mem: String(memSolution),
+                    pow_solution_mem: JSON.stringify(memSolution),
                     pow_fp: solverFingerprint // The client submits its fingerprint.
                 },
                 headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint }, rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
@@ -2122,7 +2122,7 @@ describe('Challenge Page Generation Security (XSS)', () => {
     });
 
     it('should escape the path parameter in generateCombinedPoWChallengePage to prevent XSS', () => {
-        const maliciousPath = `test.com";\nconsole.log("pwned");//`;
+        const maliciousPath = `test.com";\nconsole.log("pwned");//`; // Original malicious path
         const challengeDetails = { nonce: 'test-nonce', target: '0000', path: maliciousPath };
 
         const html = generateCombinedPoWChallengePage(challengeDetails, 16, '127.0.0.1', 'secret', {}, '');
@@ -2721,3 +2721,87 @@ describe('Botnet Cluster Scoring (Node.js)', () => {
         const isDiffIpValid = await fingerprint.isTicketValid('192.168.1.1', ticket, 'device-123', 'hash-abc', false);
         expect(isDiffIpValid).toBe(false);
     });
+
+describe('IP Registration and Filtering', () => {
+    const localInMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        async has(key) { return this._map.has(key); },
+        async delete(key) { this._map.delete(key); },
+        clear() { this._map.clear(); }
+    };
+
+    beforeEach(() => {
+        localInMemoryStore.clear();
+        configureStore(localInMemoryStore);
+        vi.restoreAllMocks();
+        vi.spyOn(fingerprint.__internal, 'getTlsFingerprint').mockReturnValue({
+            ja3: 'mock-ja3', ja4: 'mock-ja4'
+        });
+    });
+
+    it('should immediately allow requests from IPs in the static allowlist', async () => {
+        const whitelistedIp = '198.51.100.42';
+        const config = {
+            weights: { historyScore: 1.0 },
+            thresholds: { low: 20, block: 95 },
+            whitelist: [
+                { type: 'allowlist', entries: [whitelistedIp] }
+            ]
+        };
+        const engine = new FingerprintEngine(config);
+
+        const req = {
+            clientIp: whitelistedIp,
+            path: '/',
+            cookies: {},
+            query: {},
+            headers: { 'user-agent': 'test-ua' },
+            rawHeaders: ['User-Agent', 'test-ua'],
+            httpVersion: '1.1'
+        };
+
+        const decision = await engine.processRequest(req);
+        expect(decision.action).toBe('next');
+        expect(decision.vector.whitelisted).toBe(100);
+        expect(decision.vector.type).toBe('allowlist');
+    });
+
+    it('should register distinct client IPs for a device in the data store', async () => {
+        const ip1 = '192.168.1.100';
+        const ip2 = '192.168.1.101';
+        const deviceId = 'test-ip-reg-device';
+
+        await localInMemoryStore.set(`device:${deviceId}`, {
+            initialDeviceHash: 'some-hash',
+            ips: new Set([ip1]),
+            lastUpdate: Date.now(),
+            lastFpHash: 'some-hash',
+            lastChangeTimestamp: 0,
+            rapidChangeCount: 0,
+        });
+
+        const req = {
+            clientIp: ip2,
+            path: '/',
+            cookies: { device_id: deviceId },
+            query: {},
+            headers: { 'user-agent': 'test-ua' },
+            rawHeaders: ['User-Agent', 'test-ua'],
+            httpVersion: '1.1'
+        };
+
+        const engine = new FingerprintEngine({
+            weights: { historyScore: 1.0 },
+            thresholds: { low: 20, block: 95 }
+        });
+
+        await engine.processRequest(req);
+
+        const storedData = await localInMemoryStore.get(`device:${deviceId}`);
+        expect(storedData.ips).toBeInstanceOf(Set);
+        expect(storedData.ips.has(ip1)).toBe(true);
+        expect(storedData.ips.has(ip2)).toBe(true);
+    });
+});

package/src/js/tests/gpu_pow.test.js

@@ -115,4 +115,85 @@ describe('GpuPowSolver - Chaotic Logistic Map PoW', () => {
         expect(result.solution.split(',').length).toBe(64);
         vi.restoreAllMocks();
     });
+
+    it('should fallback to WebGL1 if both WebGPU and WebGL2 are not supported', async () => {
+        // Mock WebGPU as undefined
+        Object.defineProperty(global.navigator, 'gpu', {
+            value: undefined,
+            writable: true,
+            configurable: true
+        });
+
+        // Mock WebGL1 (webgl) context with float extensions enabled
+        const mockGl1 = {
+            FRAMEBUFFER: 36160,
+            FRAMEBUFFER_COMPLETE: 36053,
+            COLOR_ATTACHMENT0: 36064,
+            TEXTURE_2D: 3553,
+            RGBA: 6408,
+            FLOAT: 5126,
+            TRIANGLES: 4,
+            CLAMP_TO_EDGE: 33071,
+            TEXTURE_MAG_FILTER: 10240,
+            TEXTURE_MIN_FILTER: 10241,
+            NEAREST: 9728,
+            TEXTURE_WRAP_S: 10242,
+            TEXTURE_WRAP_T: 10243,
+            useProgram: vi.fn(),
+            createBuffer: vi.fn(),
+            bindBuffer: vi.fn(),
+            bufferData: vi.fn(),
+            enableVertexAttribArray: vi.fn(),
+            vertexAttribPointer: vi.fn(),
+            uniform1f: vi.fn(),
+            uniform1i: vi.fn(),
+            getUniformLocation: vi.fn(),
+            getAttribLocation: vi.fn(),
+            drawArrays: vi.fn(),
+            getExtension: vi.fn().mockImplementation((ext) => {
+                if (ext === 'OES_texture_float' || ext === 'WEBGL_color_buffer_float') {
+                    return {};
+                }
+                return null;
+            }),
+            createTexture: vi.fn(),
+            bindTexture: vi.fn(),
+            texImage2D: vi.fn(),
+            texParameteri: vi.fn(),
+            createFramebuffer: vi.fn(),
+            bindFramebuffer: vi.fn(),
+            framebufferTexture2D: vi.fn(),
+            checkFramebufferStatus: vi.fn().mockReturnValue(36053), // gl.FRAMEBUFFER_COMPLETE
+            viewport: vi.fn(),
+            readPixels: vi.fn((x, y, w, h, format, type, pixels) => {
+                for (let i = 0; i < pixels.length; i++) {
+                    pixels[i] = 0.75;
+                }
+            })
+        };
+
+        const mockCanvas = {
+            width: 8,
+            height: 8,
+            getContext: vi.fn().mockImplementation((contextId) => {
+                if (contextId === 'webgl2') return null;
+                if (contextId === 'webgl' || contextId === 'experimental-webgl') return mockGl1;
+                return null;
+            })
+        };
+
+        vi.spyOn(document, 'createElement').mockImplementation((tagName) => {
+            if (tagName === 'canvas') return mockCanvas;
+            return {};
+        });
+
+        vi.spyOn(GpuPowSolver, '_createProgram').mockReturnValue({});
+
+        const result = await GpuPowSolver.solve(seed, 100);
+
+        expect(result.platform).toBe('webgl1');
+        expect(result.solution.split(',').length).toBe(64);
+        expect(result.solution.split(',')[0]).toBe('0.750000');
+        vi.restoreAllMocks();
+    });
 });

package/src/js/tests/pow.solver.test.js

@@ -63,8 +63,8 @@ describe('Proof-of-Work Solvers', () => {
             const solution1 = await solveMemory(seed, difficulty);
             const solution2 = await solveMemory(seed, difficulty);
 
-            expect(solution1).toBe(solution2);
-            expect(solution1).not.toBe(await solveMemory('different-seed', difficulty));
+            expect(solution1).toStrictEqual(solution2);
+            expect(solution1).not.toStrictEqual(await solveMemory('different-seed', difficulty));
         });
     });
 
@@ -106,7 +106,7 @@ describe('Proof-of-Work Solvers', () => {
 
             const solutions = await solveChallenge(challenge, ''); // Le fingerprint est passé en 2e arg
             expect(solutions.rawSolution).toHaveProperty('cpu', expect.any(Number));
-            expect(solutions.rawSolution).toHaveProperty('mem', expect.any(Number));
+            expect(solutions.rawSolution).toHaveProperty('mem', expect.any(Object));
         }, 20000);
 
         it('should solve a "cpu_mem_inline" challenge for a browser', async () => {
@@ -122,7 +122,7 @@ describe('Proof-of-Work Solvers', () => {
 
             const solutions = await solveChallenge(challenge, '');
             expect(solutions.rawSolution).toHaveProperty('cpu', expect.any(Number));
-            expect(solutions.rawSolution).toHaveProperty('mem', expect.any(Number));
+            expect(solutions.rawSolution).toHaveProperty('mem', expect.any(Object));
         }, 20000);
 
         it('should solve a "tsp" challenge', async () => {

package/src/php/Challenge/ChallengeUtils.php

@@ -638,6 +638,55 @@ class ChallengeUtils
     /**
      * Vérifie une solution de PoW mémoire.
      */
+    private static function getChallengedIndices(string $seed, int $solution, int $numBlocks, int $k = 4): array
+    {
+        $indices = [];
+        $h = (int)bcmod(\Anonympins\Fingerprint\FingerprintBuilder::cyrb53($seed . ":" . $solution), '4294967296');
+        for ($i = 0; $i < $k; $i++) {
+            $h = self::gmp_imul($h ^ $i, 1597334677);
+            $indices[] = abs($h) % $numBlocks;
+        }
+        return $indices;
+    }
+
+    private static function verifyMerkleProof(string $leafHash, int $index, array $proof, string $root): bool
+    {
+        $currentHash = $leafHash;
+        $idx = $index;
+        foreach ($proof as $sibling) {
+            $combined = ($idx % 2 === 0) ? $currentHash . $sibling : $sibling . $currentHash;
+            $currentHash = hash('sha256', hex2bin($combined));
+            $idx = (int)floor($idx / 2);
+        }
+        return $currentHash === $root;
+    }
+
+    private static function verifyMemoryPoWLegacy(string $nonce, int $solution, int $difficulty, string $clientSecret): bool
+    {
+        $size = $difficulty * 1024 * 1024;
+        $iterations = (int)floor($size / 16);
+        $buffer = new \SplFixedArray((int)floor($size / 4));
+
+        $seed = ":{$nonce}:{$clientSecret}";
+        $h = 0;
+        foreach (unpack('C*', $seed) as $byte) {
+            $h += $byte;
+        }
+
+        for ($i = 0; $i < count($buffer); $i++) {
+            $buffer[$i] = $h = self::gmp_imul($h ^ $i, 1597334677);
+        }
+
+        $finalHash = 0;
+        $addr = count($buffer) > 0 ? $buffer[0] % count($buffer) : 0;
+        for ($i = 0; $i < $iterations; $i++) {
+            $addr = $buffer[$addr] % count($buffer);
+            $finalHash ^= $addr;
+        }
+
+        return $finalHash === $solution;
+    }
+
     public static function verifyMemoryPoW(
         string $nonce,
         string $solution,
@@ -654,37 +703,69 @@ class ChallengeUtils
             return false;
         }
 
-        // If difficulty is high (production workloads), we treat memory PoW purely as a client-side cost.
-        // Cryptographic integrity is already fully enforced by the chained CPU PoW verification.
-        if ($difficulty > 4) {
-            return true;
+        $data = json_decode($solution, true);
+        if (json_last_error() !== JSON_ERROR_NONE || !isset($data['solution']) || !isset($data['merkleRoot']) || !isset($data['proofs'])) {
+            if ($difficulty <= 4 && preg_match('/^\d+$/', $solution)) {
+                return self::verifyMemoryPoWLegacy($nonce, (int)$solution, $difficulty, $clientSecret);
+            }
+            return false;
         }
 
-        $size = $difficulty * 1024 * 1024;
-        if ($size <= 0) {
-            return true; // Pas de challenge mémoire si la difficulté est nulle ou négative.
-        }
-        $iterations = (int)floor($size / 16);
-        $buffer = new \SplFixedArray((int)floor($size / 4));
+        $sol = $data['solution'];
+        $merkleRoot = $data['merkleRoot'];
+        $proofs = $data['proofs'];
 
+        $numBlocks = $difficulty * 256;
         $seed = ":{$nonce}:{$clientSecret}";
-        $h = 0;
-        foreach (unpack('C*', $seed) as $byte) {
-            $h += $byte;
-        }
 
-        for ($i = 0; $i < count($buffer); $i++) {
-            $buffer[$i] = $h = self::gmp_imul($h ^ $i, 1597334677);
+        $challengedIndices = self::getChallengedIndices($seed, (int)$sol, $numBlocks, 4);
+
+        foreach ($challengedIndices as $b) {
+            $proof = $proofs[$b] ?? $proofs[(string)$b] ?? null;
+            if ($proof === null) return false;
+
+            $blockBytes = '';
+            $h = (int)bcmod(\Anonympins\Fingerprint\FingerprintBuilder::cyrb53($seed . ":" . $b), '4294967296');
+            for ($i = 0; $i < 1024; $i++) {
+                $h = self::gmp_imul($h ^ $i, 1597334677);
+                $blockBytes .= pack('V', $h);
+            }
+
+            $expectedLeaf = hash('sha256', $blockBytes);
+
+            if (!self::verifyMerkleProof($expectedLeaf, $b, $proof, $merkleRoot)) {
+                return false;
+            }
         }
 
-        $finalHash = 0;
-        $addr = count($buffer) > 0 ? $buffer[0] % count($buffer) : 0;
+        $blockCache = [];
+        $getBlockElement = function (int $blockIdx, int $elementIdx) use (&$blockCache, $seed): int {
+            if (!isset($blockCache[$blockIdx])) {
+                $block = [];
+                $h = (int)bcmod(\Anonympins\Fingerprint\FingerprintBuilder::cyrb53($seed . ":" . $blockIdx), '4294967296');
+                for ($i = 0; $i < 1024; $i++) {
+                    $h = self::gmp_imul($h ^ $i, 1597334677);
+                    $block[$i] = $h;
+                }
+                $blockCache[$blockIdx] = $block;
+            }
+            return $blockCache[$blockIdx][$elementIdx];
+        };
+
+        $totalElements = $numBlocks * 1024;
+        $addr = $totalElements > 0 ? $getBlockElement(0, 0) % $totalElements : 0;
+        $addr = $addr & 0xffffffff;
+        $expectedSolution = 0;
+        $iterations = 1024;
         for ($i = 0; $i < $iterations; $i++) {
-            $addr = $buffer[$addr] % count($buffer);
-            $finalHash ^= $addr;
+            $blockIdx = (int)floor($addr / 1024);
+            $elementIdx = $addr % 1024;
+            $addr = $getBlockElement($blockIdx, $elementIdx) % $totalElements;
+            $addr = $addr & 0xffffffff;
+            $expectedSolution ^= $addr;
         }
 
-        return $finalHash === (int)$solution;
+        return $expectedSolution === (int)$sol;
     }
 
     /**
@@ -759,11 +840,15 @@ class ChallengeUtils
         $solverCode = self::getPowSolverCode();
         $queriesJson = json_encode($queries);
 
+        $safePath = json_encode($path, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+        $safeNonce = json_encode($nonce, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+        $safeClientSecret = json_encode($clientSecret, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+
         $challengeScript = <<<JS
           async function solve() {
-            const nonce = "{$nonce}";
-            const path = "{$path}";
-            const clientSecret = "{$clientSecret}";
+            const nonce = {$safeNonce};
+            const path = {$safePath};
+            const clientSecret = {$safeClientSecret};
             const queries = {$queriesJson};
             const sizeMb = {$sizeMb};
             const nodeId = "{$nodeId}";
@@ -866,11 +951,15 @@ JS;
         ));
         $trapContainerHtml = "<div style=\"position:absolute;left:-9999px;top:-9999px;transform:scale(0);pointer-events:none;\" aria-hidden=\"true\">{$trapLinksHtml}</div>";
 
+        $safePath = json_encode($path, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+        $safeNonce = json_encode($nonce, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+        $safeClientSecret = json_encode($clientSecret, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+
         $challengeScript = <<<JS
           async function solve() {
-            const nonce = "{$nonce}";
-            const path = "{$path}";
-            const clientSecret = "{$clientSecret}";
+            const nonce = {$safeNonce};
+            const path = {$safePath};
+            const clientSecret = {$safeClientSecret};
             const cpuTarget = BigInt("0x" + "{$target}");
             const memDifficulty = {$memoryDifficulty};
             const baseBlock = new Uint8Array({$baseBlockBytes});

package/src/php/FingerprintEngine.php

@@ -27,6 +27,10 @@
      private ?Logger $logger = null;
      private bool $dryRun;
 
+     private static ?array $googlebotEntries = null;
+     private static ?array $yandexEntries = null;
+     private static ?array $bingbotEntries = null;
+
      public function __construct(array $securityConfig)
      {
          $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
@@ -103,7 +107,103 @@
              }
          }
      }
+     private static function loadBotWhitelist(string $filename, array $fallbackEntries): array
+     {
+         $configDir = dirname(__DIR__, 2) . '/config';
+         $filePath = $configDir . '/' . $filename;
+         if (file_exists($filePath)) {
+             try {
+                 $content = file_get_contents($filePath);
+                 if ($content !== false) {
+                     $decoded = json_decode($content, true);
+                     if (json_last_error() === JSON_ERROR_NONE && is_array($decoded)) {
+                         return $decoded;
+                     }
+                 }
+             } catch (\Throwable $e) {
+                 error_log("[Fingerprint] Error loading whitelist file {$filename}: " . $e->getMessage());
+             }
+         }
+         return $fallbackEntries;
+     }
+
+     public static function googlebot_whitelist(): array
+     {
+         if (self::$googlebotEntries === null) {
+             self::$googlebotEntries = self::loadBotWhitelist('googlebot.json', [
+                 "2001:4860:4801:10::/64",
+                 "2001:4860:4801:11::/64",
+                 "2001:4860:4801:12::/64",
+                 "66.249.79.64"
+             ]);
+         }
+         return [
+             'type' => 'allowlist',
+             'entries' => self::$googlebotEntries
+         ];
+     }
+
+     public static function yandex_whitelist(): array
+     {
+         if (self::$yandexEntries === null) {
+             self::$yandexEntries = self::loadBotWhitelist('yandex.json', [
+                 "2a02:6b8::/29",
+                 "5.45.192.0/18",
+                 "213.180.192.0/19"
+             ]);
+         }
+         return [
+             'type' => 'allowlist',
+             'entries' => self::$yandexEntries
+         ];
+     }
 
+     public static function bingbot_whitelist(): array
+     {
+         if (self::$bingbotEntries === null) {
+             self::$bingbotEntries = self::loadBotWhitelist('bingbot.json', [
+                 "157.55.39.0/24",
+                 "207.46.13.0/24",
+                 "40.77.178.0/23"
+             ]);
+         }
+         return [
+             'type' => 'allowlist',
+             'entries' => self::$bingbotEntries
+         ];
+     }
+
+     public static function default_whitelist(): array
+     {
+         return [
+             self::googlebot_whitelist(),
+             self::bingbot_whitelist(),
+             self::yandex_whitelist(),
+             ['userAgent' => 'Googlebot', 'hostnameSuffix' => '.googlebot.com'],
+             ['userAgent' => 'Google-Extended', 'hostnameSuffix' => '.google.com'],
+             ['userAgent' => 'AdsBot-Google', 'hostnameSuffix' => '.googlebot.com'],
+             ['userAgent' => 'Mediapartners-Google', 'hostnameSuffix' => '.google.com'],
+             ['userAgent' => 'Google-InspectionTool', 'hostnameSuffix' => '.google.com'],
+             ['userAgent' => '(bingbot|adidxbot)', 'hostnameSuffix' => '.search.msn.com'],
+             ['userAgent' => 'DuckDuckBot', 'hostnameSuffix' => '.duckduckgo.com'],
+             ['userAgent' => 'YandexBot', 'hostnameSuffix' => '.yandex.com'],
+             ['userAgent' => 'YandexImages', 'hostnameSuffix' => '.yandex.com'],
+             ['userAgent' => 'Baiduspider', 'hostnameSuffix' => '.crawl.baidu.com'],
+             ['userAgent' => 'Slurp', 'hostnameSuffix' => '.crawl.yahoo.net'],
+             ['userAgent' => 'Sogou web spider', 'hostnameSuffix' => '.sogou.com'],
+             ['userAgent' => 'Exabot', 'hostnameSuffix' => '.exabot.com'],
+             ['userAgent' => 'ia_archiver', 'hostnameSuffix' => '.alexa.com'],
+             ['userAgent' => 'SeznamBot', 'hostnameSuffix' => '.seznam.cz'],
+             ['userAgent' => 'Mail.RU_Bot', 'hostnameSuffix' => '.mail.ru'],
+             ['userAgent' => 'Yeti', 'hostnameSuffix' => '.naver.com'],
+             ['userAgent' => 'AhrefsBot', 'hostnameSuffix' => '.ahrefs.com'],
+             ['userAgent' => 'SemrushBot', 'hostnameSuffix' => '.semrush.com'],
+             ['userAgent' => 'MJ12bot', 'hostnameSuffix' => '.mj12bot.com'],
+             ['userAgent' => 'rogerbot', 'hostnameSuffix' => '.moz.com'],
+             ['userAgent' => 'DotBot', 'hostnameSuffix' => '.moz.com'],
+             ['userAgent' => 'Screaming Frog SEO Spider', 'hostnameSuffix' => '.screamingfrog.co.uk'],
+         ];
+     }
      private function log(string $message, array $data = [], string $level = 'info'): void
      {
          if ($this->verbose) {
@@ -1039,8 +1139,9 @@
                      'target' => ChallengeUtils::calculateCpuTarget($suspicionFactor, $this->securityConfig),
                      'path' => $context->path,
                  ];
- 
-                 $memActivationFactor = max(0, ($suspicionFactor - 0.25) / 0.75);
+
+                 // Alignement linéaire parfait du ratio d'effort CPU/Mémoire
+                 $memActivationFactor = $suspicionFactor;
                  $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
  
                  $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);