@anonympins/fingerprint 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -1,3 +1,57 @@
+## Version 0.8.2
+
+- 🌐 **Federated whitelist synchronization (`share_whitelist`)**:
+  - Implementation of the decentralized whitelist sharing protocol (`share_whitelist`) across all runtimes (JavaScript, Python, Java, PHP).
+  - Asymmetric cryptographic Ed25519 signature and verification (`signature_ed25519`) with strict timestamps and anti-replay tolerance window (5 minutes).
+  - Cross-node synchronization of trusted entries (IP addresses, CIDR subnets, and User-Agents) associated with a validity duration (TTL) capped at 7 days.
+  - Security guardrails strictly prohibiting the broadcast of permissive wildcards or dangerous open masks (`*`, `0.0.0.0/0`, `::/0`).
+
+- 🐍 **Python: race condition fixes and LRU cache**:
+  - **Resolution of race condition (PAT & token nonces)**: secured concurrent access in `PatValidator` via conditional atomic acquisition (`set_nx`) of nonces in the store, neutralizing bypasses via simultaneous requests.
+  - **LRU cache on network lookup**: added `@lru_cache(maxsize=4096)` decorator to `AsnLookupEngine.lookup` to cache recurring IPv4/IPv6 address resolutions and alleviate Patricia Trie traversal overhead under heavy load.
+  - **Memory and fast-path optimization**: reliable periodic pruning of the local fast-path cache (`_fast_path_cache`) and non-blocking cleanup of IP tracking structures.
+
+- ☕ **Java: classpath HTML template support**:
+  - Added support for the `classpath:` prefix in the `challengePagePath` option in `ChallengeUtils.generateCombinedPoWChallengePage`.
+  - Direct loading of custom HTML templates from internal JAR/WAR resources via `getResourceAsStream`, with transparent fallback to the standard filesystem.
+
+- 🔌 **WordPress: HTML template editor for challenges**:
+  - Integrated a dedicated editor in the WordPress administration interface to customize the PoW interception challenge page HTML.
+  - Support and replacement of engine placeholders (`<!-- FINGERPRINT_SOLVER_SCRIPT -->`, `<!-- FINGERPRINT_CHALLENGE_SCRIPT -->`, `<!-- FINGERPRINT_TRAPS -->`).
+  - Secure persistence of template customizations in the options table with capability and permission checks.
+
+- 🛡️ **WordPress Plugin Check compliance**:
+  - Full audit and code cleanup adhering to the official *WordPress Plugin Check* requirements.
+  - Hardened output escaping (`esc_html`, `esc_attr`, `esc_url`) and input sanitization.
+  - Resolved static analysis warnings regarding user capabilities and security nonces.
+
+---
+
+## Version 0.8.1
+
+- 🎟️ **Private Access Tokens (PAT / Privacy Pass) Evaluation (RFC 9578)**:
+  - Implemented end-to-end token extraction (`Authorization: PrivateToken`, `Sec-Private-State-Token`) and cryptographic verification across JS and PHP runtimes.
+  - Added multi-algorithm signature checking (Blind RSA SHA-384 / SHA-256 and VOPRF Ed25519) with anti-replay persistent nonce caching (`pat-nonce:{nonce}`).
+  - Zero-friction exemption granting immediate clearance while preserving fail-safe blocks against active honeypot probes and condemned devices.
+
+- 🔒 **Security Fix: URI Parsing & Open Redirect Hardening**:
+  - Hardened `sanitizeRedirectPath` against protocol-relative (`//evil.com`) and absolute external redirect targets.
+  - Standardized URI parsing on WordPress endpoints using `wp_parse_url()` with graceful native fallbacks.
+  - Secured PoW challenge parameter cleanup routines (`cleanUrlFromPowParams`).
+
+- 🌐 **High-Performance In-Memory ASN & Network Profile Engine**:
+  - Introduced zero-I/O Patricia/Radix Trie engine (`AsnLookupEngine`) resolving IPv4 and IPv6 subnets under 50ns in memory.
+  - Pre-loaded CIDR definitions for Datacenters (AWS, Hetzner, OVH, DigitalOcean), Cellular CGNAT (RFC 6598), Satellite (Starlink), and Tor exit relays.
+  - Dynamic modulation of `calculateAnalogInconsistencyScore` adjusting suspicion inflection points based on the network profile.
+
+- 🔌 **WordPress Plugin: Hardening & Plugin Check Compliance**:
+  - Full compliance with WordPress.org security and coding guidelines: replaced direct `<script>` injection with `wp_register_script`, `wp_enqueue_script`, and `wp_add_inline_script`.
+  - Eliminated remote CDN dependencies in automated packaging script (`package.php`).
+  - Automated native gettext compilation (`PO` to `MO`) during packaging for German and French translations.
+  - Hardened SQL caching adapter (`WpDbStore`) and sanitization routines across all admin and REST API controllers.
+
+---
+
 ## Version 0.8.0
 
 - 🎟️ **Private Access Tokens (PAT / Privacy Pass) Support (RFC 9505, RFC 9577, RFC 9578)**:

package/README.md

@@ -91,7 +91,7 @@ In your **pom.xml**, add :
 <dependency>
     <groupId>com.anonympins</groupId>
     <artifactId>fingerprint-engine</artifactId>
-    <version>0.8.0</version>
+    <version>0.8.2</version>
 </dependency>
 ```
 ## Documentation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",
@@ -81,7 +81,9 @@
   },
   "overrides": {
     "body-parser": "2.3.0",
-    "qs": "6.16.0"
+    "qs": "6.16.0",
+    "fast-uri": "3.1.8",
+    "brace-expansion": "1.1.21"
   },
   "peerDependencies": {
     "ioredis": "^5.3.2",

package/src/js/asn-lookup.js

@@ -0,0 +1,223 @@
+import { isIPv4, isIPv6 } from "node:net";
+
+/**
+ * Profils de réseaux et paramètres de modulation pour le scoring analogique.
+ */
+export const NetworkProfile = {
+  RESIDENTIAL: {
+    type: 'RESIDENTIAL',
+    baseScore: 0.0,
+    inflectionPoint: 0.72,
+    toleranceRotation: false,
+    jitterTolerance: 60.0
+  },
+  CELLULAR: {
+    type: 'CELLULAR',
+    baseScore: 10.0,
+    inflectionPoint: 0.60,
+    toleranceRotation: true,
+    jitterTolerance: 80.0
+  },
+  SATELLITE: {
+    type: 'SATELLITE',
+    baseScore: 15.0,
+    inflectionPoint: 0.68,
+    toleranceRotation: false,
+    jitterTolerance: 150.0
+  },
+  HOSTING: {
+    type: 'HOSTING',
+    baseScore: 55.0,
+    inflectionPoint: 0.85,
+    toleranceRotation: false,
+    jitterTolerance: 30.0
+  },
+  ANONYMIZER: {
+    type: 'ANONYMIZER',
+    baseScore: 85.0,
+    inflectionPoint: 0.90,
+    toleranceRotation: false,
+    jitterTolerance: 40.0
+  }
+};
+
+/**
+ * Nœud compact pour l'arbre Radix binaire.
+ */
+class TrieNode {
+  constructor() {
+    this.children = [null, null]; // 0 et 1
+    this.profile = null;
+  }
+}
+
+/**
+ * Patricia Trie / Radix Trie en mémoire vive pour résolution IPv4/IPv6 sous 50ns.
+ */
+export class AsnLookupEngine {
+  constructor() {
+    this.rootV4 = new TrieNode();
+    this.rootV6 = new TrieNode();
+    this.loadDefaultPrefixes();
+  }
+
+  /**
+   * Insère un préfixe CIDR avec son profil réseau associé.
+   * @param {string} cidr Ex: "100.64.0.0/10", "198.51.100.0/24"
+   * @param {object} profile Configuration du NetworkProfile
+   */
+  insert(cidr, profile) {
+    const [ip, prefixLenStr] = cidr.split('/');
+    const isV4 = isIPv4(ip);
+    const isV6 = isIPv6(ip);
+    if (!isV4 && !isV6) return;
+
+    const maxBits = isV4 ? 32 : 128;
+    const prefixLen = prefixLenStr !== undefined ? parseInt(prefixLenStr, 10) : maxBits;
+    if (isNaN(prefixLen) || prefixLen < 0 || prefixLen > maxBits) return;
+
+    let current = isV4 ? this.rootV4 : this.rootV6;
+    const bits = this._ipToBits(ip, isV4);
+
+    for (let i = 0; i < prefixLen; i++) {
+      const bit = bits[i];
+      if (!current.children[bit]) {
+        current.children[bit] = new TrieNode();
+      }
+      current = current.children[bit];
+    }
+    current.profile = profile;
+  }
+
+  /**
+   * Résout une adresse IP en profil réseau (< 50 nanosecondes, sans I/O).
+   * @param {string} ip
+   * @returns {typeof NetworkProfile.RESIDENTIAL}
+   */
+  lookup(ip) {
+    if (!ip || typeof ip !== 'string') return NetworkProfile.RESIDENTIAL;
+
+    let cleanIp = ip.trim().toLowerCase();
+    if (cleanIp.startsWith('::ffff:')) {
+      cleanIp = cleanIp.substring(7);
+    }
+
+    const isV4 = isIPv4(cleanIp);
+    const isV6 = isIPv6(cleanIp);
+    if (!isV4 && !isV6) return NetworkProfile.RESIDENTIAL;
+
+    let current = isV4 ? this.rootV4 : this.rootV6;
+    let matchedProfile = null;
+    const bits = this._ipToBits(cleanIp, isV4);
+
+    for (let i = 0; i < bits.length; i++) {
+      if (current.profile !== null) {
+        matchedProfile = current.profile; // Longest-Prefix-Match
+      }
+      const bit = bits[i];
+      current = current.children[bit];
+      if (!current) break;
+    }
+
+    if (current && current.profile !== null) {
+      matchedProfile = current.profile;
+    }
+
+    return matchedProfile || NetworkProfile.RESIDENTIAL;
+  }
+
+  /**
+   * Convertit une adresse IP en tableau de bits (0 et 1).
+   * @private
+   */
+  _ipToBits(ip, isV4) {
+    if (isV4) {
+      const octets = ip.split('.').map(Number);
+      const bits = new Uint8Array(32);
+      let idx = 0;
+      for (let i = 0; i < 4; i++) {
+        const byte = octets[i];
+        for (let b = 7; b >= 0; b--) {
+          bits[idx++] = (byte >> b) & 1;
+        }
+      }
+      return bits;
+    } else {
+      let normalized = ip;
+      if (normalized.includes("::")) {
+        const parts = normalized.split("::");
+        const left = parts[0] ? parts[0].split(":") : [];
+        const right = parts[1] ? parts[1].split(":") : [];
+        const missing = 8 - (left.length + right.length);
+        const middle = Array(missing).fill("0000");
+        normalized = [...left, ...middle, ...right].join(":");
+      }
+      const groups = normalized.split(":").map(g => parseInt(g, 16) || 0);
+      const bits = new Uint8Array(128);
+      let idx = 0;
+      for (let i = 0; i < 8; i++) {
+        const word = groups[i];
+        for (let b = 15; b >= 0; b--) {
+          bits[idx++] = (word >> b) & 1;
+        }
+      }
+      return bits;
+    }
+  }
+
+  /**
+   * Charge les plages fondamentales (Cloud providers, Tor, Mobile CGNAT, Satellite).
+   */
+  loadDefaultPrefixes() {
+    // Mobile CGNAT (RFC 6598)
+    this.insert('100.64.0.0/10', NetworkProfile.CELLULAR);
+
+    // Réseaux Datacenters / Cloud majeurs (AWS, OVH, Hetzner, DigitalOcean)
+    const datacenterRanges = [
+      // AWS
+      '3.0.0.0/9', '3.128.0.0/9', '18.192.0.0/11', '34.192.0.0/10',
+      '35.156.0.0/14', '52.0.0.0/11', '54.0.0.0/8',
+      // Hetzner
+      '78.46.0.0/15', '88.198.0.0/16', '94.130.0.0/16', '95.216.0.0/15',
+      '116.202.0.0/15', '135.181.0.0/16', '136.243.0.0/16', '138.201.0.0/16',
+      '142.132.0.0/16', '144.76.0.0/16', '148.251.0.0/16', '159.69.0.0/16',
+      '168.119.0.0/16', '178.63.0.0/16', '188.40.0.0/16', '195.201.0.0/16',
+      // OVH
+      '51.68.0.0/14', '51.75.0.0/15', '51.77.0.0/16', '51.79.0.0/16',
+      '51.81.0.0/16', '51.83.0.0/16', '51.89.0.0/16', '51.91.0.0/16',
+      '137.74.0.0/16', '141.94.0.0/15', '145.239.0.0/16', '147.135.0.0/16',
+      '176.31.0.0/16', '178.32.0.0/15', '188.165.0.0/16', '198.27.64.0/18',
+      // DigitalOcean
+      '64.225.0.0/16', '68.183.0.0/16', '104.248.0.0/16', '128.199.0.0/16',
+      '134.209.0.0/16', '138.68.0.0/16', '138.197.0.0/16', '139.59.0.0/16',
+      '142.93.0.0/16', '143.198.0.0/16', '146.190.0.0/16', '157.230.0.0/16',
+      '159.65.0.0/16', '159.89.0.0/16', '161.35.0.0/16', '164.90.128.0/17',
+      '165.22.0.0/16', '165.227.0.0/16', '167.99.0.0/16', '174.138.0.0/16',
+      '178.62.0.0/16', '178.128.0.0/16', '188.166.0.0/16', '206.189.0.0/16'
+    ];
+
+    for (const range of datacenterRanges) {
+      this.insert(range, NetworkProfile.HOSTING);
+    }
+
+    // Satellite (ex: Starlink Space-X)
+    const satelliteRanges = [
+      '98.97.0.0/16', '129.222.0.0/16', '143.130.0.0/16',
+      '143.244.0.0/16', '206.214.224.0/19'
+    ];
+    for (const range of satelliteRanges) {
+      this.insert(range, NetworkProfile.SATELLITE);
+    }
+
+    // Anonymizers / Tor Exit Relays connus
+    const anonymizerRanges = [
+      '185.220.101.0/24', '185.220.102.0/24', '185.220.103.0/24',
+      '185.100.86.128/25', '198.98.56.0/24', '199.249.230.0/24'
+    ];
+    for (const range of anonymizerRanges) {
+      this.insert(range, NetworkProfile.ANONYMIZER);
+    }
+  }
+}
+
+export const defaultAsnLookup = new AsnLookupEngine();