@anonympins/fingerprint 0.7.4 → 0.7.5

package/src/js/tests/dynamic-wasm.test.js

@@ -1,78 +1,78 @@
-import { describe, expect, it } from 'vitest';
-import { DynamicWasmGenerator } from '../dynamic-wasm.js';
-
-// Helper function to decode ULEB128 (for verification)
-function decodeULEB128(bytes) {
-    let result = 0;
-    let shift = 0;
-    for (const byte of bytes) {
-        result |= (byte & 0x7f) << shift;
-        if (!(byte & 0x80)) {
-            break;
-        }
-        shift += 7;
-    }
-    return result;
-}
-
-describe('DynamicWasmGenerator', () => {
-    it('should generate a valid WASM module buffer', () => {
-        const constants = { seed: 123, multiplier: 33, adder: 7 };
-        const wasmBuffer = DynamicWasmGenerator.generate(constants);
-
-        // Basic check: ensure it's a Buffer and starts with WASM magic number
-        expect(wasmBuffer).toBeInstanceOf(Buffer);
-        expect(wasmBuffer.slice(0, 4).toString('hex')).toBe('0061736d'); // \0asm
-        expect(wasmBuffer.slice(4, 8).toString('hex')).toBe('01000000'); // Version 1
-
-        // Attempt to compile and instantiate the module to ensure validity
-        let instance;
-        try {
-            const module = new WebAssembly.Module(wasmBuffer);
-            instance = new WebAssembly.Instance(module, {});
-        } catch (e) {
-            // If compilation/instantiation fails, it's an invalid WASM module
-            expect.fail(`Generated WASM module is invalid: ${e.message}`);
-        }
-
-        // Verify the exported hash function exists
-        expect(instance.exports.hash).toBeInstanceOf(Function);
-        expect(instance.exports.memory).toBeInstanceOf(WebAssembly.Memory);
-    });
-
-    it('should produce a consistent hash result with the JS fallback', () => {
-        const constants = { seed: 42, multiplier: 1597334677, adder: 12345 };
-        const testString = "hello world";
-
-        const wasmBuffer = DynamicWasmGenerator.generate(constants);
-        const module = new WebAssembly.Module(wasmBuffer);
-        const instance = new WebAssembly.Instance(module, {});
-        const exports = instance.exports;
-        const memory = exports.memory;
-
-        // Write string to WASM memory
-        const encoder = new TextEncoder();
-        const bytes = encoder.encode(testString);
-        const view = new Uint8Array(memory.buffer);
-        view.set(bytes, 0); // Assuming hash function expects string at address 0
-
-        // Calculate hash using WASM
-        const wasmHash = exports.hash(0, bytes.length);
-
-        // Calculate hash using JS fallback
-        const jsHash = DynamicWasmGenerator.hashJs(testString, constants);
-
-        // The WASM and JS implementations should yield the same result
-        expect(wasmHash).toBe(jsHash);
-    });
-
-    it('should generate different WASM modules for different constants', () => {
-        const constants1 = { seed: 1, multiplier: 2, adder: 3 };
-        const constants2 = { seed: 4, multiplier: 5, adder: 6 };
-
-        const wasmBuffer1 = DynamicWasmGenerator.generate(constants1);
-        const wasmBuffer2 = DynamicWasmGenerator.generate(constants2);
-
-        expect(wasmBuffer1.toString('hex')).not.toBe(wasmBuffer2.toString('hex'));
-    });
+import { describe, expect, it } from 'vitest';
+import { DynamicWasmGenerator } from '../dynamic-wasm.js';
+
+// Helper function to decode ULEB128 (for verification)
+function decodeULEB128(bytes) {
+    let result = 0;
+    let shift = 0;
+    for (const byte of bytes) {
+        result |= (byte & 0x7f) << shift;
+        if (!(byte & 0x80)) {
+            break;
+        }
+        shift += 7;
+    }
+    return result;
+}
+
+describe('DynamicWasmGenerator', () => {
+    it('should generate a valid WASM module buffer', () => {
+        const constants = { seed: 123, multiplier: 33, adder: 7 };
+        const wasmBuffer = DynamicWasmGenerator.generate(constants);
+
+        // Basic check: ensure it's a Buffer and starts with WASM magic number
+        expect(wasmBuffer).toBeInstanceOf(Buffer);
+        expect(wasmBuffer.slice(0, 4).toString('hex')).toBe('0061736d'); // \0asm
+        expect(wasmBuffer.slice(4, 8).toString('hex')).toBe('01000000'); // Version 1
+
+        // Attempt to compile and instantiate the module to ensure validity
+        let instance;
+        try {
+            const module = new WebAssembly.Module(wasmBuffer);
+            instance = new WebAssembly.Instance(module, {});
+        } catch (e) {
+            // If compilation/instantiation fails, it's an invalid WASM module
+            expect.fail(`Generated WASM module is invalid: ${e.message}`);
+        }
+
+        // Verify the exported hash function exists
+        expect(instance.exports.hash).toBeInstanceOf(Function);
+        expect(instance.exports.memory).toBeInstanceOf(WebAssembly.Memory);
+    });
+
+    it('should produce a consistent hash result with the JS fallback', () => {
+        const constants = { seed: 42, multiplier: 1597334677, adder: 12345 };
+        const testString = "hello world";
+
+        const wasmBuffer = DynamicWasmGenerator.generate(constants);
+        const module = new WebAssembly.Module(wasmBuffer);
+        const instance = new WebAssembly.Instance(module, {});
+        const exports = instance.exports;
+        const memory = exports.memory;
+
+        // Write string to WASM memory
+        const encoder = new TextEncoder();
+        const bytes = encoder.encode(testString);
+        const view = new Uint8Array(memory.buffer);
+        view.set(bytes, 0); // Assuming hash function expects string at address 0
+
+        // Calculate hash using WASM
+        const wasmHash = exports.hash(0, bytes.length);
+
+        // Calculate hash using JS fallback
+        const jsHash = DynamicWasmGenerator.hashJs(testString, constants);
+
+        // The WASM and JS implementations should yield the same result
+        expect(wasmHash).toBe(jsHash);
+    });
+
+    it('should generate different WASM modules for different constants', () => {
+        const constants1 = { seed: 1, multiplier: 2, adder: 3 };
+        const constants2 = { seed: 4, multiplier: 5, adder: 6 };
+
+        const wasmBuffer1 = DynamicWasmGenerator.generate(constants1);
+        const wasmBuffer2 = DynamicWasmGenerator.generate(constants2);
+
+        expect(wasmBuffer1.toString('hex')).not.toBe(wasmBuffer2.toString('hex'));
+    });
 });

package/src/js/tests/fingerprint.client.init.test.js

@@ -21,6 +21,7 @@ if (typeof globalThis.crypto !== 'undefined') {
     Object.defineProperty(dom.window, 'crypto', { value: globalThis.crypto, writable: true, configurable: true });
 }
 Object.defineProperty(global, 'CustomEvent', { value: dom.window.CustomEvent, writable: true, configurable: true });
+Object.defineProperty(global, 'Event', { value: dom.window.Event, writable: true, configurable: true });
 
 global.fetch = vi.fn(); // Mock global fetch
 window.fetch = (...args) => global.fetch(...args);
@@ -174,4 +175,81 @@ describe('ClientLibrary.initializeClient', () => {
         expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('Challenge retry limit reached (3)'));
     });
 
+    it('should inject phantom traps within closed shadow root and fire trigger on interaction', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        // Ensure document.body exists
+        document.body.innerHTML = '';
+
+        ClientLibrary.injectPhantomTraps();
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        // Under closed mode, host.shadowRoot is inaccessible (null) from external callers
+        expect(host.shadowRoot).toBeNull();
+        expect(capturedShadow).not.toBeNull();
+
+        // Dispatch events on attached phantom elements inside closed shadow root
+        const link = capturedShadow.querySelector('a');
+        expect(link).not.toBeNull();
+        link.dispatchEvent(new Event('focus'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
+
+    it('should inject trap links within closed shadow root and trigger on honeypot click', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        document.body.innerHTML = '';
+
+        ClientLibrary.injectTrapLinks(['/trap-url-1', '/trap-url-2']);
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        expect(host.shadowRoot).toBeNull(); // Closed Shadow DOM verification
+        expect(capturedShadow).not.toBeNull();
+
+        const link = capturedShadow.querySelector('a');
+        expect(link).not.toBeNull();
+        link.dispatchEvent(new Event('click'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
+
+    it('should initialize honeypot form inputs within closed shadow root', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        document.body.innerHTML = '';
+
+        ClientLibrary.initializeHoneypots(['bot_field_trap']);
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        expect(host.shadowRoot).toBeNull();
+        expect(capturedShadow).not.toBeNull();
+
+        const input = capturedShadow.querySelector('input');
+        expect(input).not.toBeNull();
+        input.dispatchEvent(new Event('input'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
 });

package/src/js/tests/fingerprint.test.js

@@ -3200,4 +3200,22 @@ describe('IP Registration and Filtering', () => {
             expect(process.env.ED25519_PUBLIC_KEY).toBe(dummyKeys.publicKey);
         });
     });
+
+    describe('Closed-Shadow DOM Honeypot Traps (Feature 19)', () => {
+        it('should generate closed declarative shadow DOM trap container for trap URLs', () => {
+            const trapUrls = ['/trap-1', '/trap-2'];
+            const markup = __internal.generateClosedShadowTraps(trapUrls);
+
+            expect(markup).toContain('aria-hidden="true"');
+            expect(markup).toContain('shadowrootmode="closed"');
+            expect(markup).toContain('shadowroot="closed"');
+            expect(markup).toContain('href="/trap-1"');
+            expect(markup).toContain('href="/trap-2"');
+        });
+
+        it('should return an empty string if trapUrls array is empty or invalid', () => {
+            expect(__internal.generateClosedShadowTraps([])).toBe('');
+            expect(__internal.generateClosedShadowTraps(null)).toBe('');
+        });
+    });
 });

package/src/js/tests/threatIntel.test.js

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it } from 'vitest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { __internal, configureStore } from '../fingerprint.js';
 
 describe('Threat Intelligence - Rationale-Driven Defensive Logic', () => {
@@ -73,4 +73,43 @@ describe('Threat Intelligence - Rationale-Driven Defensive Logic', () => {
         expect(vector.threatIntelScore).toBeGreaterThan(70.0);
         expect(vector.threatIntelScore).toBeLessThanOrEqual(95.0);
     });
+
+    it('should broadcast banned ZKP with differential privacy (perturbed timestamps and decoy injection)', async () => {
+        const calls = [];
+        const originalFetch = globalThis.fetch;
+        globalThis.fetch = vi.fn(async (url, init) => {
+            calls.push({ url, init });
+            return { ok: true, json: async () => ({ status: 'synchronized' }) };
+        });
+
+        const config = {
+            federatedPeers: ['https://peer1.example.com', 'https://peer2.example.com'],
+            federationSecret: 'test-secret-key-32-chars-long!!',
+            differentialPrivacy: {
+                enabled: true,
+                epsilon: 1.0,
+                dummyRate: 1.0 // Force decoy generation for deterministic testing
+            }
+        };
+
+        const realZkpY = 'deadbeef12345678';
+        await __internal.broadcastBannedZkp(realZkpY, config);
+
+        // Should broadcast to 2 peers with real key + 2 peers with decoy key
+        expect(calls.length).toBe(4);
+
+        const bodies = calls.map(c => JSON.parse(c.init.body));
+        const zkpYs = bodies.map(b => b.zkpY);
+
+        expect(zkpYs).toContain(realZkpY);
+        const decoyKey = zkpYs.find(k => k !== realZkpY);
+        expect(decoyKey).toBeDefined();
+        expect(decoyKey).not.toBe(realZkpY);
+
+        for (const call of calls) {
+            const timestamp = Number(call.init.headers['X-Federation-Timestamp']);
+            expect(timestamp).toBeGreaterThan(0);
+        }
+        globalThis.fetch = originalFetch;
+    });
 });

package/src/php/Challenge/ChallengeUtils.php

@@ -605,6 +605,11 @@ class ChallengeUtils
 
             if (!$expiry || (int)floor(microtime(true) * 1000) > (int)$expiry) {
                 return false;
+            }
+            if (!empty($ticketData['greenlist']) || str_starts_with((string)$storedDeviceHash, 'webauthn:greenlist:')) {
+                if (empty($deviceId) || $deviceId === $storedDeviceId) {
+                    return true;
+                }
             }
                 if ($storedDeviceHash && str_starts_with($storedDeviceHash, 'zkp:')) {
                     $expectedY = explode(':', $storedDeviceHash, 2)[1] ?? '';
@@ -644,6 +649,11 @@ class ChallengeUtils
             if (!$expiry || (int)floor(microtime(true) * 1000) > (int)$expiry) {
                 $store->delete("ticket:{$ticket}");
                 return false;
+            }
+            if (!empty($ticketData['greenlist']) || str_starts_with((string)$storedDeviceHash, 'webauthn:greenlist:')) {
+                if (empty($deviceId) || $deviceId === $storedDeviceId) {
+                    return true;
+                }
             }
                 if ($storedDeviceHash && str_starts_with($storedDeviceHash, 'zkp:')) {
                     $expectedY = explode(':', $storedDeviceHash, 2)[1] ?? '';

package/src/php/Config/SecurityProfiles.php

@@ -43,6 +43,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 0.8,
                 'protocolAnomalyScore' => 0.8, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
                 'renderingAnomalyScore' => 0.8, // NEW: Anomalie de rendu
+                'mtuAnomalyScore' => 0.9, // NOUVEAU: Poids pour l'anomalie MTU/fragmentation
                 'ipReputationScore' => 0.5, // NOUVEAU: Poids pour la réputation IP
                 'virtualizationScore' => 0.8,
             ],
@@ -97,6 +98,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 1.0, // NEW: Anomalie de pile TCP/IP
                 'protocolAnomalyScore' => 1.0, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
                 'renderingAnomalyScore' => 1.0, // NEW: Anomalie de rendu
+                'mtuAnomalyScore' => 0.9,
 
             ],
             'thresholds' => ['low' => 10, 'medium' => 35, 'high' => 65, 'block' => 90],
@@ -149,6 +151,7 @@ class SecurityProfiles
                 'botnetClusterScore' => 0.7, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
                 'protocolAnomalyScore' => 0.8, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
+                'mtuAnomalyScore' => 0.9,
 
             ],
             'thresholds' => ['low' => 25, 'medium' => 50, 'high' => 80, 'block' => 95],
@@ -205,6 +208,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 0.5, // NEW: Anomalie de pile TCP/IP
                 'protocolAnomalyScore' => 0.5, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
                 'renderingAnomalyScore' => 0.5, // NEW: Anomalie de rendu
+                'mtuAnomalyScore' => 0.9,
 
             ],
             'thresholds' => ['low' => 25, 'medium' => 55, 'high' => 80, 'block' => 95],
@@ -259,6 +263,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 0.9, // NEW: Anomalie de pile TCP/IP
                 'protocolAnomalyScore' => 0.9, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
                 'renderingAnomalyScore' => 0.9, // NEW: Anomalie de rendu
+                'mtuAnomalyScore' => 0.9,
 
             ],
             'thresholds' => ['low' => 15, 'medium' => 40, 'high' => 70, 'block' => 90],