@arcadialdev/arcality 2.4.24 → 2.4.26

package/tests/_helpers/ai-agent-helper.ts

@@ -1,5 +1,49 @@
 import { Page, TestInfo } from '@playwright/test';
 import { qaAdvancedTools } from './qa-tools';
+import {
+    test_xss_injection,
+    test_auth_bypass,
+    audit_http_headers,
+    scan_sensitive_data_exposure,
+    SecurityFinding
+} from './qa-security-tools';
+
+const qaSecurityTools = [
+    {
+        name: "test_xss_injection",
+        description: "Injects a standard XSS payload into an input field to test for reflected XSS vulnerabilities. Reports a vulnerability if an alert is triggered.",
+        parameters: {
+            type: "object",
+            properties: {
+                selector: { type: "string", description: "The CSS selector of the input field to test." }
+            },
+            required: ["selector"]
+        }
+    },
+    {
+        name: "test_auth_bypass",
+        description: "Attempts to directly navigate to a URL that should be protected to check for authentication bypass vulnerabilities.",
+        parameters: {
+            type: "object",
+            properties: {
+                url: { type: "string", description: "The protected URL to test." },
+                redirectUrl: { type: "string", description: "The expected URL to be redirected to if unauthorized (e.g., '/login')." }
+            },
+            required: ["url", "redirectUrl"]
+        }
+    },
+    {
+        name: "audit_http_headers",
+        description: "Audits the current page's HTTP response headers for common security headers like CSP, HSTS, etc.",
+        parameters: { type: "object", properties: {} }
+    },
+    {
+        name: "scan_sensitive_data_exposure",
+        description: "Scans localStorage and sessionStorage for keys that might contain sensitive data (e.g., 'token', 'password').",
+        parameters: { type: "object", properties: {} }
+    }
+];
+import { SecurityScanner } from '../../src/services/securityScanner';
 import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -478,8 +522,12 @@ ${best.steps.slice(0, 15).map((s: any) => `  - ${s}`).join('\n')}
                     const memStep = m.steps_data[historyLength];
                     if (!memStep) return false;
 
-                    const memUrl = (memStep.url || '').split('?')[0];
-                    const currUrl = currentUrl.split('?')[0];
+                    const normalizeUrl = (u: string) =>
+                        u.replace(/\/[a-z]{2}-[A-Z]{2}\//g, '/{locale}/')
+                         .replace(/\/[a-z]{2}\//g, '/{lang}/');
+
+                    const memUrl = normalizeUrl((memStep.url || '').split('?')[0]);
+                    const currUrl = normalizeUrl(currentUrl.split('?')[0]);
 
                     // URL Validation
                     if (memUrl !== currUrl) return false;
@@ -539,7 +587,7 @@ ${best.steps.slice(0, 15).map((s: any) => `  - ${s}`).join('\n')}
         return null;
     }
 
-    async askIA(prompt: string, history: string[] = []): Promise<AgentAction> {
+    async askIA(prompt: string, history: string[] = [], stepCount?: number): Promise<AgentAction> {
         // El modo proxy (ARCALITY_API_URL) está integrado en el bucle de fetch de abajo.
         // Si ARCALITY_API_URL está definido, se enruta automáticamente a /api/v1/ai/proxy.
         // Si no, requiere ANTHROPIC_API_KEY para llamada directa.
@@ -632,6 +680,11 @@ ${best.steps.slice(0, 15).map((s: any) => `  - ${s}`).join('\n')}
                 name: t.name,
                 description: t.description,
                 parameters: (t as any).input_schema || (t as any).parameters
+            })),
+            ...qaSecurityTools.map(t => ({
+                name: t.name,
+                description: t.description,
+                parameters: (t as any).input_schema || (t as any).parameters
             }))
         ];
 
@@ -828,8 +881,8 @@ ${history.slice(-25).join('\n') || 'None'}`
                     ? `${process.env.ARCALITY_API_URL}/api/v1/ai/proxy`
                     : "https://api.anthropic.com/v1/messages";
 
-                // Log the endpoint being called on every turn so we can debug connectivity
-                console.log(`>>ARCALITY_STATUS>> 📡 Llamando a: ${endpointUrl} (turno ${turn + 1})`);
+                const displayTurn = stepCount !== undefined ? stepCount : (turn + 1);
+                console.log(`>>ARCALITY_STATUS>> 📡 Llamando a: ${endpointUrl} (turno IA ${displayTurn}${turn > 0 ? `, reintento ${turn}` : ''})`);
 
                 const headers: Record<string, string> = {
                     "Content-Type": "application/json"
@@ -837,6 +890,8 @@ ${history.slice(-25).join('\n') || 'None'}`
 
                 if (isProxyMode) {
                     headers["x-api-key"] = process.env.ARCALITY_API_KEY || "";
+                    const missionId = process.env.ARCALITY_MISSION_ID || '';
+                    if (missionId) headers["x-mission-id"] = missionId;
                 } else {
                     headers["x-api-key"] = process.env.ANTHROPIC_API_KEY!;
                     headers["anthropic-version"] = "2023-06-01";
@@ -1162,7 +1217,68 @@ ${history.slice(-25).join('\n') || 'None'}`
                             toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error restoring checkpoint: ${e.message}` });
                         }
                     }
-
+                } else if (toolName === "test_xss_injection") {
+                    const { idx, payload_type } = toolInput;
+                    const el = state.components.find(c => c.idx === idx);
+                    if (!el) {
+                        toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Element idx ${idx} not found.` });
+                    } else {
+                        console.log(`>>ARCALITY_STATUS>> 🛡️ [Security] Probando inyección XSS en IDX ${idx}...`);
+                        let payload = "<script>alert(1)</script>";
+                        if (payload_type === 'image') payload = "<img src=x onerror=alert(1)>";
+                        if (payload_type === 'svg') payload = "<svg onload=alert(1)>";
+                        
+                        try {
+                            const locator = this.page.locator(`xpath=${el.selector}`).first();
+                            await locator.fill(payload);
+                            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Payload inyectado. Asegúrate de probar si el payload fue ejecutado revisando el DOM, o realiza el sumbit y observa si el input regresó renderizado tal cual o sanitizado.` });
+                            if (this.testInfo) this.testInfo.attach('security_tool_call', { body: JSON.stringify({ action: "test_xss_injection", target: idx, payload }), contentType: "application/json" });
+                        } catch (e: any) {
+                            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error injecting payload: ${e.message}` });
+                        }
+                    }
+                } else if (toolName === "test_auth_bypass") {
+                    const { target_url } = toolInput;
+                    console.log(`>>ARCALITY_STATUS>> 🛡️ [Security] Intentando Auth Bypass en ${target_url}...`);
+                    try {
+                        const baseUrl = new URL(this.page.url()).origin;
+                        const fullUrl = new URL(target_url, baseUrl).toString();
+                        await this.page.goto(fullUrl);
+                        await this.page.waitForLoadState('networkidle', { timeout: 3000 }).catch(() => {});
+                        const resultingUrl = this.page.url();
+                        let resultData = `Navegado a ${fullUrl}. \nURL resultante: ${resultingUrl}. \n`;
+                        if (resultingUrl !== fullUrl) resultData += `Posiblemente redirigido (el bypass falló o te enviaron a Login).`;
+                        else resultData += `URL se mantuvo igual. ¡Esto podría ser un IDOR o Auth Bypass si ves datos a los que no deberías acceder!`;
+                        toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: resultData });
+                    } catch (e: any) {
+                        toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error test_auth_bypass: ${e.message}` });
+                    }
+                } else if (toolName === "scan_sensitive_data_exposure") {
+                    console.log(`>>ARCALITY_STATUS>> 🛡️ [Security] Escaneando datos sensibles...`);
+                    try {
+                        const issues = await scan_sensitive_data_exposure(this.page);
+                        if (issues.length > 0) {
+                            const report = issues.map((i: any) => `- ${i.category}: ${i.description}\n  Evidence: ${JSON.stringify(i.evidence)}`).join('\n');
+                            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Vulnerabilidades detectadas:\n${report}` });
+                        } else {
+                            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: "No se detectaron datos sensibles en LocalStorage/SessionStorage en este chequeo." });
+                        }
+                    } catch (e: any) {
+                        toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error scan_sensitive_data_exposure: ${e.message}` });
+                    }
+                } else if (toolName === "audit_http_headers") {
+                    console.log(`>>ARCALITY_STATUS>> 🛡️ [Security] Auditando headers HTTP...`);
+                    try {
+                        const issues = await audit_http_headers(this.page);
+                        if (issues.length > 0) {
+                            const report = issues.map((i: any) => `- ${i.category}: ${i.description}`).join('\n');
+                            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Vulnerabilidades de Headers detectadas:\n${report}` });
+                        } else {
+                            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: "No se detectaron problemas en los headers de seguridad básicos." });
+                        }
+                    } catch (e: any) {
+                        toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error audit_http_headers: ${e.message}` });
+                    }
                 } else if (toolName === "create_test_evidence") {
                     const { evidence_type, annotations, save_as, description, finish_run = false } = toolInput;
                     console.log(`📸 [SKILL] Creating test evidence: "${save_as}"...`);
@@ -1385,6 +1501,8 @@ ${history.slice(-25).join('\n') || 'None'}`
                     } catch (e: any) {
                         toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error scrolling: ${e.message}` });
                     }
+                } else {
+                    toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error: Tool '${toolName}' not recognized by this version.` });
                 }
             }
 
@@ -1438,6 +1556,8 @@ ${history.slice(-25).join('\n') || 'None'}`
 
             if (isProxyMode) {
                 headers["x-api-key"] = process.env.ARCALITY_API_KEY || "";
+                const missionId = process.env.ARCALITY_MISSION_ID || '';
+                if (missionId) headers["x-mission-id"] = missionId;
             } else {
                 headers["x-api-key"] = process.env.ANTHROPIC_API_KEY!;
                 headers["anthropic-version"] = "2023-06-01";
@@ -1487,6 +1607,8 @@ ${history.slice(-25).join('\n') || 'None'}`
 
             if (isProxyMode) {
                 headers["x-api-key"] = process.env.ARCALITY_API_KEY || "";
+                const missionId = process.env.ARCALITY_MISSION_ID || '';
+                if (missionId) headers["x-mission-id"] = missionId;
             } else {
                 headers["x-api-key"] = process.env.ANTHROPIC_API_KEY!;
                 headers["anthropic-version"] = "2023-06-01";

package/tests/_helpers/qa-security-tools.ts

@@ -0,0 +1,265 @@
+/* eslint-disable no-console */
+import { Page, expect } from '@playwright/test';
+
+export type Severity = 'Critical' | 'High' | 'Medium' | 'Low' | 'Info';
+
+export type SecurityFindingType = 'confirmed_vulnerability' | 'security_misconfiguration' | 'potential_issue' | 'informational';
+export type Confidence = 'High' | 'Medium' | 'Low';
+export type Exploitability = 'confirmed' | 'likely' | 'unknown' | 'not_confirmed';
+
+export interface SecurityFinding {
+  type: SecurityFindingType;
+  category: string;
+  subcategory?: string;
+  severity: Severity;
+  confidence: Confidence;
+  exploitability: Exploitability;
+  status: 'detected';
+  description: string;
+  impact?: string;
+  evidence: {
+    [key: string]: any;
+  };
+  reproductionSteps?: string[];
+  remediation: string;
+  classification?: {
+    owaspTop10?: string;
+    cwe?: string;
+  };
+}
+
+/**
+ * Attempts to inject a simple XSS payload into a specified element and checks for an alert.
+ * @param page - The Playwright Page object.
+ * @param selector - The selector for the input field to test.
+ * @returns A vulnerability object if successful, null otherwise.
+ */
+export async function test_xss_injection(
+  page: Page,
+  selector: string,
+): Promise<SecurityFinding | null> {
+  const payload = `<script>alert('XSS-ARCALITY-TEST')</script>`;
+  console.log(`[QA-SEC] Testing XSS on selector: ${selector}`);
+
+  let alertTriggered = false;
+  page.once('dialog', async (dialog) => {
+    if (dialog.message().includes('XSS-ARCALITY-TEST')) {
+      alertTriggered = true;
+    }
+    await dialog.dismiss();
+  });
+
+  await page.fill(selector, payload);
+  // Submit the form or trigger the action that would process the input
+  // This part is crucial and might need to be adapted based on the application's behavior
+  await page.press(selector, 'Enter'); 
+
+  // Wait a moment for any potential script execution
+  await page.waitForTimeout(1000);
+
+  if (alertTriggered) {
+    console.log(`[QA-SEC] XSS Vulnerability DETECTED at ${selector}`);
+    return {
+      type: 'confirmed_vulnerability',
+      category: 'Injection',
+      subcategory: 'Reflected XSS',
+      severity: 'High',
+      confidence: 'High',
+      exploitability: 'confirmed',
+      status: 'detected',
+      description: `A reflected Cross-Site Scripting (XSS) vulnerability was detected in the element '${selector}'. The application executed a script injected into this input field.`,
+      impact: 'Allows execution of arbitrary JavaScript in the context of the user session, potentially leading to session hijacking, credential theft, or unauthorized actions.',
+      evidence: {
+        payload,
+        url: page.url(),
+        selector,
+      },
+      reproductionSteps: [
+        `Navigate to the page containing '${selector}'.`,
+        `Inject the payload: ${payload}`,
+        'Trigger the form submission or blur event.',
+        'Observe the script execution (alert dialog).'
+      ],
+      remediation: 'Sanitize all user-supplied input on the server-side before rendering it back to the page. Use libraries like DOMPurify on the client-side as an additional layer of defense.',
+      classification: {
+        owaspTop10: 'A03:2021 Injection',
+        cwe: 'CWE-79'
+      }
+    };
+  }
+
+  console.log(`[QA-SEC] No XSS detected for selector: ${selector}`);
+  return null;
+}
+
+/**
+ * Checks if a given URL, assumed to be protected, can be accessed without authentication.
+ * @param page - The Playwright Page object.
+ * @param url - The protected URL to test.
+ * @param redirectUrl - The URL the app should redirect to if unauthorized.
+ * @returns A vulnerability object if bypass is successful, null otherwise.
+ */
+export async function test_auth_bypass(
+  page: Page,
+  url: string,
+  redirectUrl: string | RegExp,
+): Promise<SecurityFinding | null> {
+  console.log(`[QA-SEC] Testing Auth Bypass on URL: ${url}`);
+  const response = await page.goto(url, { waitUntil: 'domcontentloaded' });
+
+  // If the page loads the protected content (doesn't redirect or redirects to a different page)
+  if (response?.ok() && !page.url().match(redirectUrl)) {
+    console.log(`[QA-SEC] Auth Bypass DETECTED for URL: ${url}`);
+    return {
+      type: 'confirmed_vulnerability',
+      category: 'Broken Access Control',
+      subcategory: 'Authentication Bypass',
+      severity: 'Critical',
+      confidence: 'High',
+      exploitability: 'confirmed',
+      status: 'detected',
+      description: `Unauthorized access to the protected route '${url}' was successful. The application failed to enforce authentication, allowing a direct bypass to sensitive content.`,
+      impact: 'An unauthenticated attacker can access protected resources, potentially reading or modifying sensitive user data.',
+      evidence: {
+        accessedUrl: url,
+        finalUrl: page.url(),
+      },
+      reproductionSteps: [
+        'Ensure no active session (cleared cookies/storage).',
+        `Navigate directly to: ${url}`,
+        'Observe that the protected page loads without redirection.'
+      ],
+      remediation: 'Implement server-side middleware to verify user authentication and authorization status before serving any protected routes.',
+      classification: {
+        owaspTop10: 'A01:2021 Broken Access Control',
+        cwe: 'CWE-285'
+      }
+    };
+  }
+
+  console.log(`[QA-SEC] No Auth Bypass detected for URL: ${url}`);
+  return null;
+}
+
+/**
+ * Audits the HTTP security headers of the current page.
+ * @param page - The Playwright Page object.
+ * @returns An array of vulnerability objects for missing headers.
+ */
+export async function audit_http_headers(page: Page): Promise<SecurityFinding[]> {
+  console.log(`[QA-SEC] Auditing HTTP Headers for: ${page.url()}`);
+  const response = await page.reload({ waitUntil: 'domcontentloaded' });
+  const headers = response?.headers();
+  const vulnerabilities: SecurityFinding[] = [];
+
+  const securityHeaders = {
+    'Content-Security-Policy': {
+      severity: 'Medium',
+      remediation: 'Implement a strict Content-Security-Policy (CSP) to mitigate XSS and other injection attacks. Start with a restrictive policy and gradually allow trusted sources.',
+      impact: 'If an injection issue exists elsewhere in the application, the lack of CSP may increase exploitability and impact.',
+      cwe: 'CWE-16'
+    },
+    'Strict-Transport-Security': {
+      severity: 'Medium',
+      remediation: 'Implement HTTP Strict Transport Security (HSTS) to force browsers to communicate over HTTPS, preventing downgrade attacks.',
+      impact: 'Man-in-the-middle attacks could downgrade the connection to HTTP, allowing traffic interception.',
+      cwe: 'CWE-319'
+    },
+    'X-Content-Type-Options': {
+      severity: 'Low',
+      remediation: 'Set `X-Content-Type-Options: nosniff` to prevent browsers from MIME-sniffing a response away from the declared content-type.',
+      impact: 'Browsers may interpret non-executable MIME types as executable, leading to potential XSS.',
+      cwe: 'CWE-430'
+    },
+    'X-Frame-Options': {
+      severity: 'Medium',
+      remediation: 'Set `X-Frame-Options: SAMEORIGIN` or `DENY` to protect against clickjacking attacks by preventing the page from being loaded in an iframe on other domains.',
+      impact: 'Attackers could trick users into clicking visually hidden elements, causing unintended actions (Clickjacking).',
+      cwe: 'CWE-1021'
+    }
+  };
+
+  for (const [header, info] of Object.entries(securityHeaders)) {
+    if (!headers || !Object.keys(headers).find(h => h.toLowerCase() === header.toLowerCase())) {
+        vulnerabilities.push({
+            type: 'security_misconfiguration',
+            category: 'Missing Security Header',
+            subcategory: header,
+            severity: info.severity as Severity,
+            confidence: 'High',
+            exploitability: 'not_confirmed',
+            status: 'detected',
+            description: `The '${header}' HTTP header is missing. This header is crucial for defending against various web attacks.`,
+            impact: info.impact,
+            evidence: {
+                url: page.url(),
+                missingHeader: header
+            },
+            reproductionSteps: [
+                `Navigate to ${page.url()}`,
+                `Inspect the response headers.`,
+                `Verify that ${header} is absent.`
+            ],
+            remediation: info.remediation,
+            classification: {
+                owaspTop10: 'A05:2021 Security Misconfiguration',
+                cwe: info.cwe
+            }
+        });
+    }
+  }
+  
+  console.log(`[QA-SEC] Found ${vulnerabilities.length} missing security headers.`);
+  return vulnerabilities;
+}
+
+/**
+ * Scans localStorage and sessionStorage for potentially sensitive data.
+ * @param page - The Playwright Page object.
+ * @returns An array of vulnerability objects for any sensitive data found.
+ */
+export async function scan_sensitive_data_exposure(page: Page): Promise<SecurityFinding[]> {
+  console.log(`[QA-SEC] Scanning localStorage and sessionStorage for sensitive data.`);
+  const vulnerabilities: SecurityFinding[] = [];
+  const sensitiveKeywords = ['token', 'password', 'secret', 'key', 'jwt', 'auth'];
+
+  const storages = {
+    localStorage: await page.evaluate(() => Object.entries(window.localStorage)),
+    sessionStorage: await page.evaluate(() => Object.entries(window.sessionStorage)),
+  };
+
+  for (const [storageType, items] of Object.entries(storages)) {
+    for (const [key, value] of items) {
+      if (sensitiveKeywords.some(keyword => key.toLowerCase().includes(keyword))) {
+        vulnerabilities.push({
+          type: 'potential_issue',
+          category: 'Sensitive Data Exposure',
+          subcategory: 'Browser Storage',
+          severity: 'Medium',
+          confidence: 'Medium',
+          exploitability: 'unknown',
+          status: 'detected',
+          description: `Potentially sensitive data was found in ${storageType}. Storing sensitive information like tokens or keys in browser storage is insecure.`,
+          impact: 'If an attacker discovers an XSS vulnerability, they can read localStorage/sessionStorage and exfiltrate secrets.',
+          evidence: {
+            storage: storageType,
+            key: key,
+            valuePreview: value ? `${value.substring(0, 10)}...` : '(empty)',
+          },
+          reproductionSteps: [
+            `Open Developer Tools on ${page.url()}`,
+            `Check ${storageType} for the key '${key}'.`
+          ],
+          remediation: 'Avoid storing sensitive data in browser storage. Use secure, HttpOnly cookies for session tokens. If you must store data, encrypt it first.',
+          classification: {
+            owaspTop10: 'A04:2021 Insecure Design',
+            cwe: 'CWE-312'
+          }
+        });
+      }
+    }
+  }
+
+  console.log(`[QA-SEC] Found ${vulnerabilities.length} instances of sensitive data in browser storage.`);
+  return vulnerabilities;
+}