@anonympins/fingerprint 0.7.1 → 0.7.2

package/src/js/fingerprint.js

@@ -4472,6 +4472,17 @@ export class FingerprintEngine {
         }
       }
     }
+
+    // If no security config is provided at all, create a base one.
+    if (!finalConfig) {
+        finalConfig = {};
+    }
+    // If the whitelist is not explicitly provided in the configuration,
+    // apply the default whitelist which includes common search engine bots.
+    if (!finalConfig.whitelist) {
+        finalConfig.whitelist = default_whitelist();
+    }
+
     this.securityConfig = finalConfig;
     this.isProduction = isProduction;
     this._allowlist = this._buildAllowlist();
@@ -4670,7 +4681,8 @@ export class FingerprintEngine {
     return false;
   }
   _isIpInAllowlist(clientIp) {
-    return this._allowlist.check(clientIp);
+      const family = isIPv6(clientIp) ? 'ipv6' : 'ipv4';
+      return this._allowlist.check(clientIp, family);
   }
   /**
    * Checks if the request's host and path match an entry in the host+path allowlist.
@@ -4809,7 +4821,10 @@ export class FingerprintEngine {
       return false;
     }
 
+    const botName = matchedRule.userAgent; // e.g., 'Googlebot'
+
     if (!canAttemptDns()) {
+      this._log(`[Bot Verification] DNS circuit breaker is open. Skipping check for ${botName}.`, { clientIp });
       return false;
     }
 
@@ -4817,9 +4832,11 @@ export class FingerprintEngine {
     const cachedStatus = await store.get(cacheKey);
 
     if (cachedStatus === 'verified') {
+      this._log(`[Bot Verification] PASSED (cached): ${botName}`, { clientIp });
       return true;
     }
     if (cachedStatus === 'failed') {
+      this._log(`[Bot Verification] FAILED (cached): ${botName}`, { clientIp });
       return false;
     }
 
@@ -4829,25 +4846,35 @@ export class FingerprintEngine {
       const validHostname = hostnames.find(h => h.endsWith(matchedRule.hostnameSuffix));
 
       if (!validHostname) {
+        this._log(`[Bot Verification] FAILED: Reverse DNS lookup for ${clientIp} did not yield a valid hostname ending in '${matchedRule.hostnameSuffix}'.`, { clientIp, resolvedHostnames: hostnames });
         await store.set(cacheKey, 'failed', 300); // Temporary negative caching (5 minutes)
         return false;
       }
 
+      this._log(`[Bot Verification] Reverse DNS OK for ${botName}.`, { clientIp, validHostname });
+
       // 2. Forward DNS lookup
     let addresses = [];
     try {
         addresses = await withTimeout(dns.resolve(validHostname), 500);
-    } catch (e) {}
+    } catch (e) {
+        this._log(`[Bot Verification] Forward DNS (A) lookup FAILED for ${validHostname}.`, { error: e.message });
+    }
     try {
         const ipv6 = await withTimeout(dns.resolve(validHostname, 'AAAA'), 500);
       addresses = addresses.concat(ipv6);
-    } catch (e) {}
+    } catch (e) {
+        this._log(`[Bot Verification] Forward DNS (AAAA) lookup FAILED for ${validHostname}.`, { error: e.message });
+    }
     if (addresses.includes(clientIp)) {
+        this._log(`[Bot Verification] PASSED: Forward DNS IP matches original IP for ${botName}.`, { clientIp, validHostname, resolvedIps: addresses });
         recordDnsSuccess();
         await store.set(cacheKey, 'verified', 86400); // Cache success for 24h (TTL in seconds)
         return true;
       }
+      this._log(`[Bot Verification] FAILED: IP mismatch for ${botName}. Original IP not in resolved addresses.`, { clientIp, validHostname, resolvedIps: addresses });
     } catch (error) {
+      this._log(`[Bot Verification] FAILED: DNS lookup error for ${botName}.`, { clientIp, error: error.message });
       recordDnsFailure();
       await store.set(cacheKey, 'failed', 300); // Temporary negative caching (5 minutes)
       return false;
@@ -4965,15 +4992,15 @@ export class FingerprintEngine {
         }
     }
 
-    // Check if the request is from a verified, whitelisted bot (e.g., Googlebot)
-    if (await this._verifyWhitelistedBot(requestContext)) {
+    const botVerificationResult = await this._verifyWhitelistedBot(requestContext);
+    if (botVerificationResult === true) {
       const filterWhitelist = this.securityConfig.filterWhitelist || false;
       let bypassWhitelist = false;
       if (filterWhitelist === true) {
         bypassWhitelist = this._hasCertainAttack(requestContext);
       } else if (typeof filterWhitelist === 'number') {
         const res = await getScoreAndVector();
-        if (res.score > filterWhitelist) {
+        if (res.score > filterWhitelist) { // NOSONAR
           bypassWhitelist = true;
         }
       }
@@ -5013,6 +5040,11 @@ export class FingerprintEngine {
 
     // The engine now works with the context directly, no more rawReq dependency here.
     const suspicionVector = preCalculatedVector || await __internal.getSuspicionVector(requestContext, this.securityConfig);
+    if (botVerificationResult === false) {
+        // This means it claimed to be a bot but failed verification.
+        // This is a strong signal of spoofing.
+        suspicionVector.tlsSpoofingScore = Math.max(suspicionVector.tlsSpoofingScore || 0, 95);
+    }
     let finalScore = preCalculatedScore !== null ? preCalculatedScore : this.calculateFinalScore(suspicionVector);
 
     this._log('Suspicion vector calculated', { 

package/src/js/tests/fingerprint.test.js

@@ -10,6 +10,8 @@ import * as fingerprint from '../fingerprint.js';
 vi.mock('import-meta-env', () => ({
     env: { NODE_ENV: 'test', POW_SECRET: 'fallback-dev-secret-32-chars-minimum' },
 }));
+// Mock the entire dns module
+vi.mock('node:dns/promises');
 // Mock readFileSync for custom challenge page tests
 vi.mock('node:fs', async () => {
     const actualFs = await vi.importActual('node:fs');
@@ -35,9 +37,8 @@ const {
 } = fingerprint;
 const { store, getRequestPatternScore, getDeviceHash } = __internal;
 const { getRenderingAnomalyScore } = __internal;
-let { getBehaviorScore, getClickVarianceScore } = __internal;
-// Mock the entire dns module
-vi.mock('node:dns/promises');
+let { getBehaviorScore, getClickVarianceScore } = __internal; // eslint-disable-line prefer-const
+
 
 describe('Fingerprint & PoW Security Suite', () => {
     test('cyrb53 should be deterministic', () => {
@@ -1764,6 +1765,92 @@ describe('Fingerprint & PoW Security Suite', () => {
         });
     });
 });
+describe('Googlebot Whitelisting (Node.js)', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        async has(key) { return this._map.has(key); },
+        async delete(key) { this._map.delete(key); },
+    };
+
+    const securityConfig = {
+        weights: { headerAnomalyScore: 1.0, tlsSpoofingScore: 1.0 }, // Simple config for testing
+        thresholds: { low: 20, medium: 45, high: 75, block: 95 },
+        whitelist: [
+            { userAgent: 'Googlebot', hostnameSuffix: '.googlebot.com' }
+        ]
+    };
+
+    let engine;
+
+    beforeEach(() => {
+        inMemoryStore._map.clear();
+        configureStore(inMemoryStore);
+        vi.clearAllMocks(); // Clear mocks before each test
+        engine = new FingerprintEngine(securityConfig);
+    });
+
+    it('should correctly identify and allow a legitimate Googlebot request', async () => {
+        const googleIp = '::ffff:66.249.66.39'; // An IP from the official list
+        const googleHostname = 'crawl-66-249-66-39.googlebot.com';
+        const googleUa = 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)';
+
+        // Mock the DNS verification process
+        vi.mocked(dns.reverse).mockResolvedValue([googleHostname]);
+        vi.mocked(dns.resolve).mockResolvedValue([googleIp]);
+
+        const requestContext = {
+            clientIp: googleIp,
+            path: '/',
+            headers: { 'user-agent': googleUa },
+            isStatic: false,
+            cookies: {},
+            query: {},
+            body: null,
+            httpVersion: '1.1',
+            rawHeaders: ['user-agent', googleUa]
+        };
+
+        const decision = await engine.processRequest(requestContext);
+
+        expect(decision.action).toBe('next');
+        expect(decision.score).toBe(0);
+        expect(decision.vector.whitelisted).toBe(100);
+        expect(decision.vector.type).toBe('bot');
+
+        expect(dns.reverse).toHaveBeenCalledWith(googleIp);
+        expect(dns.resolve).toHaveBeenCalledWith(googleHostname);
+    });
+
+    it('should challenge or block a request spoofing a Googlebot User-Agent from a non-Google IP', async () => {
+        const fakeGoogleIp = '1.2.3.4';
+        const googleUa = 'Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)';
+
+        vi.mocked(dns.reverse).mockRejectedValue(new Error('Host not found'));
+
+        const requestContext = {
+            clientIp: fakeGoogleIp,
+            path: '/',
+            headers: { 'user-agent': googleUa, 'accept-language': 'en-US' },
+            isStatic: false,
+            cookies: {},
+            query: {},
+            body: null,
+            httpVersion: '1.1',
+            rawHeaders: ['user-agent', googleUa, 'accept-language', 'en-US']
+        };
+
+        const decision = await engine.processRequest(requestContext);
+
+        expect(decision.action).toBe('block');
+        expect(decision.score).toBeGreaterThan(0);
+        expect(decision.vector.whitelisted).toBeUndefined();
+
+        expect(dns.reverse).toHaveBeenCalledWith(fakeGoogleIp);
+        expect(dns.resolve).not.toHaveBeenCalled();
+    });
+});
 
 describe('TLS Session Resumption (Cookieless Identity)', () => {
     const inMemoryStore = {

package/src/php/Challenge/ChallengeUtils.php

@@ -892,7 +892,7 @@ class ChallengeUtils
             return false;
         }
 
-        if (empty($solution)) {
+        if ($solution === '') {
             return false;
         }
 

package/src/php/FingerprintEngine.php

@@ -179,6 +179,12 @@
                  }
              }
          }
+
+         // Si aucune liste blanche n'est explicitement fournie, appliquer la liste par défaut.
+         if (!isset($securityConfig['whitelist'])) {
+             $securityConfig['whitelist'] = self::default_whitelist();
+         }
+
          $this->securityConfig = $securityConfig;
          $this->verbose = $securityConfig['verbose'] ?? false;
          $this->allowlist = $this->buildAllowlist();
@@ -551,10 +557,8 @@
 
              $deviceId = bin2hex(random_bytes(16)); // UUID-like
 
-             $isHttps = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
-                 (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ||
-                 ($context->getHeader('x-forwarded-proto') === 'https');
-             $secureOption = $isHttps || $this->isProduction;
+             $isHttps = !empty($context->isHttps);
+             $secureOption = $isHttps;
 
              // Préparer le cookie à envoyer
              $newCookie = [
@@ -985,13 +989,36 @@
                      // Le fingerprint est cohérent, on peut valider la solution
                      if ($powType === 'cpu_target' || $powType === 'cpu_mem') {
                          $cpuSolution = $context->query['pow_solution_cpu'] ?? $context->query['pow_solution'] ?? null;
-                         if ($cpuSolution) {
-                             $ticket = ChallengeUtils::verifyCpuTargetPoWAndGenerateTicket($context->clientIp, 3600000, $powNonce, $cpuSolution, $challengeContext);
+                         if ($cpuSolution !== null && $cpuSolution !== '') {
+                             $identity = $this->resolveRequestIdentity($context, $suspicionVector);
+                             $deviceId = (string)($identity['deviceId'] ?? '');
+                             $currentDeviceHash = (string)($identity['currentDeviceHash'] ?? RequestUtils::getCompositeDeviceHash($context));
+
+                             $ticket = ChallengeUtils::verifyCpuTargetPoWAndGenerateTicket(
+                                 $context->clientIp,
+                                 3600000,
+                                 $powNonce,
+                                 (string)$cpuSolution,
+                                 $challengeContext,
+                                 $deviceId,
+                                 $currentDeviceHash
+                             );
                              $isValid = $ticket !== null;
  
                              if ($powType === 'cpu_mem') {
-                                 $memSolution = $context->query['pow_solution_mem'] ?? null;
-                                 $isMemValid = $memSolution ? ChallengeUtils::verifyMemoryPoW($powNonce, $memSolution, $challengeContext['memDifficulty'] ?? 0, $challengeContext['clientSecret'] ?? '') : false;
+                                 if (!empty($challengeContext['isHttp'])) {
+                                     $isMemValid = true;
+                                 } else {
+                                     $memSolution = $context->query['pow_solution_mem'] ?? null;
+                                     $isMemValid = ($memSolution !== null && $memSolution !== '')
+                                         ? ChallengeUtils::verifyMemoryPoW(
+                                             $powNonce,
+                                             (string)$memSolution,
+                                             $challengeContext['memDifficulty'] ?? 0,
+                                             $challengeContext['clientSecret'] ?? ''
+                                         )
+                                         : false;
+                                 }
                                  $isValid = $isValid && $isMemValid;
                              }
                          }
@@ -1073,10 +1100,8 @@
                      MetricsManager::incrementCounter('challenges_solved_total');
                      $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
 
-                     $isHttps = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
-                         (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443) ||
-                         ($context->getHeader('x-forwarded-proto') === 'https');
-                     $secureOption = $isHttps || $this->isProduction;
+                     $isHttps = !empty($context->isHttps);
+                     $secureOption = $isHttps;
 
                      return [
                          'action' => 'redirect',