@anonympins/fingerprint 0.7.3 → 0.7.4

package/src/js/tests/fingerprint.test.js

@@ -906,8 +906,76 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(req.fingerprint.score).toBeGreaterThanOrEqual(blockThreshold);
         });
 
-        test('should redirect after a valid COMBINED (CPU+Mem) PoW solution is provided', async (context) => {
+        test('should redirect after a valid COMBINED (CPU+Mem) PoW solution is provided', async () => {
+            const ip = '127.0.0.1';
+            const originalPath = '/protected/combined';
+            const solverFingerprint = 'fp-combined-solution';
+            const userAgent = 'test-ua-combined';
+
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 35,
+            });
+
+            const securityConfigWithLowDiff = {
+                ...securityConfig,
+                cpu: { minDifficultyBits: 4, ...securityConfig.cpu },
+            };
+            const middleware = powMiddleware(securityConfigWithLowDiff);
+
+            // 1. Déclencher le challenge
+            const req1 = {
+                path: originalPath, ip, cookies: {}, query: {},
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let challengeBody;
+            const res1 = {
+                status: () => res1,
+                send: (body) => { challengeBody = body; },
+                cookie: vi.fn()
+            };
+            req1.fingerprint = {};
+            await middleware(req1, res1, vi.fn());
+
+            expect(challengeBody).toContain('Enhanced Verification');
 
+            // 2. Résoudre le challenge
+            const nonce = challengeBody.match(/const nonce = "([^"]+)"/)[1];
+            const clientSecret = challengeBody.match(/const clientSecret = "([^"]+)"/)[1];
+            const cpuTargetHex = challengeBody.match(/const cpuTarget = BigInt\("0x" \+ "([^"]+)"\);/)[1];
+            const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
+
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:${ip}::`);
+            const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
+            const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
+
+            // 3. Soumettre la solution
+            const req2 = {
+                path: originalPath, ip, cookies: {},
+                query: {
+                    pow_type: 'cpu_mem',
+                    pow_nonce: nonce,
+                    pow_solution_cpu: String(cpuSolution),
+                    pow_solution_mem: JSON.stringify(memSolution),
+                    pow_fp: solverFingerprint
+                },
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let capturedCookie;
+            const res2 = {
+                cookie: (name, value, options) => { capturedCookie = { name, value, options }; },
+                redirect: vi.fn(),
+                status: vi.fn(() => res2),
+                send: vi.fn(),
+            };
+
+            req2.fingerprint = {};
+            await middleware(req2, res2, vi.fn());
+
+            expect(res2.redirect).toHaveBeenCalledWith(originalPath);
+            expect(capturedCookie).toBeDefined();
+            expect(capturedCookie.name).toBe('pow_clearance');
         });
     });
 
@@ -1553,6 +1621,18 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(behaviorScore).toBe(0);
         });
 
+        it('should return a score of 0 when x-behavior-metrics is 1 (human verified client-side)', () => {
+            const context = { headers: { 'x-behavior-metrics': '1' } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(0);
+        });
+
+        it('should return a score of 100 when x-behavior-metrics is 0 (bot detected client-side)', () => {
+            const context = { headers: { 'x-behavior-metrics': '0' } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(100);
+        });
+
         it('should return a score of 100 for honeypot interaction', () => {
             const metrics = { honeypotInteraction: true, mouseEntropy: 50, keystrokeLatency: 120 };
             const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
@@ -1560,11 +1640,11 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(behaviorScore).toBe(100);
         });
 
-        it('should return a score of 40 for no mouse or keyboard activity', () => {
+        it('should return a score of 5 for no mouse or keyboard activity', () => {
             const metrics = { honeypotInteraction: false, mouseMovementsHistory: [], keystrokeLatency: 0 };
             const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
             const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(40);
+            expect(behaviorScore).toBe(5);
         });
 
         it('should return a score of 0 for normal user activity', () => {
@@ -2394,6 +2474,58 @@ describe('getClientHintsInconsistencyScore', () => {
     });
 });
 
+describe('getProtocolAnomalyScore (HTTP/2 Frame Analysis)', () => {
+    const { getProtocolAnomalyScore } = __internal;
+
+    test('should penalize spoofed Chromium with no PRIORITY frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:0,w:4,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(25.0);
+    });
+
+    test('should penalize spoofed Chromium with too few WINDOW_UPDATE frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:3,w:1,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(20.0);
+    });
+
+    test('should penalize spoofed Firefox with too many PRIORITY frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,s,p,a|p:3,w:2,c:0'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(20.0);
+    });
+
+    test('should not penalize a legitimate Chromium fingerprint', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:3,w:4,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(0.0);
+    });
+});
+
 describe('Subnet Scoring (Node.js)', () => {
     const inMemoryStore = {
         _map: new Map(),

package/src/php/Challenge/ChallengeUtils.php

@@ -789,39 +789,38 @@ class ChallengeUtils
     /**
      * Vérifie le limiteur de débit Token Bucket pour les demandes de challenge d'un sous-réseau.
      */
-    public static function checkChallengeRateLimit(string $clientIp): bool
+    public static function checkChallengeRateLimit(string $clientIp, float $capacity = 5.0, float $refillRate = 0.1): bool
     {
-        $subnet = RequestUtils::getIpSubnet($clientIp);
-        if ($subnet === null) {
-            return false;
-        }
+        $subnet = RequestUtils::getIpSubnet($clientIp) ?? $clientIp;
 
         $store = StoreManager::getStore();
         $key = "rate-limit:{$subnet}";
-        $rateLimitData = $store->get($key) ?? [
-            'tokens' => 5.0,
-            'lastRefill' => microtime(true)
-        ];
-
-        $capacity = 5.0;
-        $refillRate = 0.1; // 1 token toutes les 10 secondes
         $now = microtime(true);
 
-        $elapsed = $now - $rateLimitData['lastRefill'];
-        $tokens = min($capacity, $rateLimitData['tokens'] + $elapsed * $refillRate);
+        $rateLimitData = $store->get($key);
+        if (!is_array($rateLimitData) || !isset($rateLimitData['tokens'], $rateLimitData['lastRefill'])) {
+            $rateLimitData = [
+                'tokens' => $capacity,
+                'lastRefill' => $now
+            ];
+        }
+
+        $elapsed = max(0.0, $now - (float)$rateLimitData['lastRefill']);
+        $tokens = min($capacity, (float)$rateLimitData['tokens'] + $elapsed * $refillRate);
+        $ttl = (int)max(60, ceil($capacity / max(0.1, $refillRate)));
 
         if ($tokens < 1.0) {
             $store->set($key, [
                 'tokens' => $tokens,
                 'lastRefill' => $now
-            ], 60);
+            ], $ttl);
             return false;
         }
 
         $store->set($key, [
             'tokens' => $tokens - 1.0,
             'lastRefill' => $now
-        ], 60);
+        ], $ttl);
 
         return true;
     }