@dailephd/my-dev-kit-lab 0.4.0 → 0.4.2

package/dist/src/mobile/android/advancedSecurity/networkSecurity/deriveEffectiveNetworkPolicy.js

@@ -0,0 +1,52 @@
+import { MAX_DOMAIN_CONFIG_DEPTH } from "./types.js";
+function walkDomainConfig(node, scopeId, depth, inheritedDomains, inheritedTrustAnchorsChain, baseCleartextTrafficPermitted, out) {
+    if (depth > MAX_DOMAIN_CONFIG_DEPTH)
+        return;
+    const domains = node.domains.length > 0 ? node.domains : inheritedDomains;
+    const domainsInherited = node.domains.length === 0 && inheritedDomains.length > 0;
+    const cleartextTrafficPermitted = node.cleartextTrafficPermitted ?? baseCleartextTrafficPermitted;
+    const cleartextTrafficSource = node.cleartextTrafficPermitted !== undefined ? "explicit" : baseCleartextTrafficPermitted !== undefined ? "inherited-from-base" : "unspecified";
+    const trustAnchorsChain = node.trustAnchors ? [node.trustAnchors, ...inheritedTrustAnchorsChain] : inheritedTrustAnchorsChain;
+    const trustAnchorsSource = node.trustAnchors ? "own" : trustAnchorsChain.length > 0 ? "inherited" : "unspecified";
+    out.push({
+        scopeId,
+        kind: "domain",
+        depth,
+        domains,
+        domainsInherited,
+        cleartextTrafficPermitted,
+        cleartextTrafficSource,
+        trustAnchorsChain,
+        trustAnchorsSource,
+        pinSet: node.pinSet,
+        location: node.location,
+    });
+    node.nested.forEach((child, index) => {
+        walkDomainConfig(child, `${scopeId}>domain-config[${index}]`, depth + 1, domains, trustAnchorsChain, baseCleartextTrafficPermitted, out);
+    });
+}
+// Derives deterministic effective policy from a "parsed" Network Security
+// Config result. Callers must narrow to the "parsed" state first — a
+// malformed/unsupported-root parse result has no policy to derive.
+export function deriveEffectiveNetworkPolicy(parsed) {
+    const baseScope = parsed.baseConfig
+        ? {
+            scopeId: "base-config",
+            kind: "base",
+            depth: 0,
+            domains: [],
+            domainsInherited: false,
+            cleartextTrafficPermitted: parsed.baseConfig.cleartextTrafficPermitted,
+            cleartextTrafficSource: parsed.baseConfig.cleartextTrafficPermitted !== undefined ? "explicit" : "unspecified",
+            trustAnchorsChain: parsed.baseConfig.trustAnchors ? [parsed.baseConfig.trustAnchors] : [],
+            trustAnchorsSource: parsed.baseConfig.trustAnchors ? "own" : "unspecified",
+            pinSet: parsed.baseConfig.pinSet,
+            location: parsed.baseConfig.location,
+        }
+        : undefined;
+    const domainScopes = [];
+    parsed.domainConfigs.forEach((node, index) => {
+        walkDomainConfig(node, `domain-config[${index}]`, 0, [], baseScope?.trustAnchorsChain ?? [], baseScope?.cleartextTrafficPermitted, domainScopes);
+    });
+    return { baseScope, domainScopes, debugTrustAnchors: parsed.debugOverrides?.trustAnchors };
+}

package/dist/src/mobile/android/advancedSecurity/networkSecurity/index.js

@@ -0,0 +1,14 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 2 — public exports for the standalone Android network-
+// security (cleartext traffic / Network Security Config) audit.
+//
+// Exports only what a later integration batch (or a test) needs: the parser,
+// the effective-policy deriver, the analyzer, and the standalone check-result
+// builder. Internal helpers (attribute parsing, bounded previews, per-scope
+// finding builders) stay unexported.
+// ---------------------------------------------------------------------------
+export { parseNetworkSecurityConfig } from "./parseNetworkSecurityConfig.js";
+export { deriveEffectiveNetworkPolicy } from "./deriveEffectiveNetworkPolicy.js";
+export { extractManifestNetworkSecurityEvidence } from "./manifestEvidence.js";
+export { analyzeManifestNetworkSecurity } from "./analyzeNetworkSecurity.js";
+export { auditAndroidNetworkSecurity, ANDROID_NETWORK_SECURITY_AUDIT_CHECK_ID } from "./checkResult.js";

package/dist/src/mobile/android/advancedSecurity/networkSecurity/manifestEvidence.js

@@ -0,0 +1,109 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { parseAndroidResourceReference } from "../resourceReference.js";
+import { resolveAndroidXmlResourceReference } from "../resourceResolution.js";
+import { parseNetworkSecurityConfig } from "./parseNetworkSecurityConfig.js";
+function classifyUsesCleartextTraffic(entry) {
+    const app = entry.manifest.application;
+    if (app.usesCleartextTraffic === true)
+        return { state: "explicit-true", raw: app.usesCleartextTrafficRaw ?? "true" };
+    if (app.usesCleartextTraffic === false)
+        return { state: "explicit-false", raw: app.usesCleartextTrafficRaw ?? "false" };
+    if (app.usesCleartextTrafficRaw !== undefined)
+        return { state: "malformed", raw: app.usesCleartextTrafficRaw };
+    return { state: "missing" };
+}
+function parseNetworkSecurityConfigFile(absolutePath) {
+    let xmlText;
+    try {
+        xmlText = readFileSync(absolutePath, "utf8");
+    }
+    catch (error) {
+        return { state: "malformed-xml", reason: error instanceof Error ? error.message : "Unable to read the resolved Network Security Config file" };
+    }
+    return parseNetworkSecurityConfig(xmlText);
+}
+function classifyResolution(raw, resolution, targetRoot) {
+    switch (resolution.state) {
+        case "resolved": {
+            const candidate = resolution.candidates[0];
+            return {
+                state: "resolved",
+                raw,
+                modulePath: resolution.modulePath,
+                candidate,
+                parseResult: parseNetworkSecurityConfigFile(path.join(targetRoot, candidate.relativePath)),
+            };
+        }
+        case "ambiguous":
+            return {
+                state: "ambiguous",
+                raw,
+                modulePath: resolution.modulePath,
+                candidates: resolution.candidates.map((candidate) => ({
+                    candidate,
+                    parseResult: parseNetworkSecurityConfigFile(path.join(targetRoot, candidate.relativePath)),
+                })),
+            };
+        case "missing":
+            return { state: "missing", raw, modulePath: resolution.modulePath, searchedSourceSets: resolution.searchedSourceSets };
+        case "malformed-reference":
+            return { state: "malformed", raw, reason: resolution.reason };
+        case "unsupported-reference":
+            // Unreachable in practice: this function only calls the resolver once
+            // parseAndroidResourceReference has already confirmed a "parsed"
+            // (xml-type) reference, so the resolver's own unsupported-reference
+            // branch (package-qualified/non-xml) cannot trigger from this path.
+            // Handled defensively rather than asserted unreachable.
+            return {
+                state: "unsupported-type",
+                raw,
+                resourceType: "type" in resolution.parsed ? resolution.parsed.type : "unknown",
+            };
+    }
+}
+// Extracts and classifies cleartext-traffic/Network Security Config evidence
+// for one already-parsed manifest. `targetRoot` must be the absolute Android
+// target root (the same root the manifest/resource resolver operate within).
+export function extractManifestNetworkSecurityEvidence(targetRoot, entry) {
+    const usesCleartextTraffic = classifyUsesCleartextTraffic(entry);
+    const raw = entry.manifest.application.networkSecurityConfigRef;
+    let networkSecurityConfig;
+    if (raw === undefined) {
+        networkSecurityConfig = { state: "absent" };
+    }
+    else {
+        const parsedRef = parseAndroidResourceReference(raw);
+        if (parsedRef.state === "placeholder") {
+            networkSecurityConfig = { state: "placeholder", raw };
+        }
+        else if (parsedRef.state === "malformed") {
+            networkSecurityConfig = { state: "malformed", raw, reason: parsedRef.reason };
+        }
+        else if (parsedRef.state === "empty") {
+            networkSecurityConfig = { state: "malformed", raw, reason: "Reference is empty" };
+        }
+        else if (parsedRef.state === "unsupported-type") {
+            networkSecurityConfig = { state: "unsupported-type", raw, resourceType: parsedRef.type };
+        }
+        else if (parsedRef.state === "package-qualified") {
+            networkSecurityConfig = { state: "package-qualified", raw, packageQualifier: parsedRef.packageQualifier };
+        }
+        else if (entry.modulePath === undefined) {
+            networkSecurityConfig = { state: "module-unknown", raw };
+        }
+        else {
+            const moduleAbsolutePath = path.join(targetRoot, entry.modulePath);
+            const resolution = resolveAndroidXmlResourceReference(targetRoot, moduleAbsolutePath, raw);
+            networkSecurityConfig = classifyResolution(raw, resolution, targetRoot);
+        }
+    }
+    return {
+        manifestPath: entry.manifestPath,
+        modulePath: entry.modulePath,
+        sourceSetKind: entry.sourceSetKind,
+        applicationLocation: entry.manifest.application.location,
+        usesCleartextTraffic,
+        networkSecurityConfig,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/networkSecurity/parseNetworkSecurityConfig.js

@@ -0,0 +1,186 @@
+import { findChildren, parseXmlDocument } from "../../manifest/xml/parseXml.js";
+import { MAX_DOMAIN_CONFIG_DEPTH, } from "./types.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 2 — dependency-free Network Security Config XML parser.
+//
+// Builds on the existing bounded XML tree parser
+// (src/mobile/android/manifest/xml/parseXml.ts) rather than creating a
+// second tokenizer — this file only adds NSC-specific semantic parsing on
+// top of the generic XmlElement tree, per agents.txt Batch 2 section 12.
+//
+// Parses exactly one already-resolved, target-contained file. Never merges
+// multiple files, never evaluates resource overlays, never invokes Gradle/
+// Android SDK/network. Malformed XML or an unsupported root never throws —
+// both map to a structured, non-"parsed" result state.
+// ---------------------------------------------------------------------------
+const MAX_PIN_VALUE_PREVIEW_LENGTH = 128;
+const SUPPORTED_PIN_DIGESTS = new Set(["SHA-256"]);
+function getUnprefixedAttribute(element, localName) {
+    return element.attributes.find((attr) => attr.prefix === undefined && attr.localName === localName)?.value;
+}
+function parseBooleanAttribute(element, localName) {
+    const raw = getUnprefixedAttribute(element, localName);
+    if (raw === undefined)
+        return {};
+    if (raw === "true")
+        return { value: true, raw };
+    if (raw === "false")
+        return { value: false, raw };
+    return { raw };
+}
+function boundedPreview(value, maxLength = MAX_PIN_VALUE_PREVIEW_LENGTH) {
+    const normalized = value.replace(/\s+/g, "").trim();
+    if (normalized.length <= maxLength)
+        return normalized;
+    return `${normalized.slice(0, maxLength)}... [truncated, ${normalized.length} chars total]`;
+}
+function classifyCertificateSource(srcRaw) {
+    if (srcRaw === "system")
+        return { sourceKind: "system" };
+    if (srcRaw === "user")
+        return { sourceKind: "user" };
+    if (srcRaw?.startsWith("@raw/"))
+        return { sourceKind: "raw-resource", rawResourceName: srcRaw.slice("@raw/".length) };
+    return { sourceKind: "unknown" };
+}
+function parseTrustAnchors(element) {
+    const certificates = findChildren(element, "certificates").map((certEl) => {
+        const srcRaw = getUnprefixedAttribute(certEl, "src");
+        const { sourceKind, rawResourceName } = classifyCertificateSource(srcRaw);
+        const overridePinsResult = parseBooleanAttribute(certEl, "overridePins");
+        return {
+            srcRaw,
+            sourceKind,
+            rawResourceName,
+            overridePins: overridePinsResult.value,
+            overridePinsRaw: overridePinsResult.raw,
+            location: certEl.location,
+        };
+    });
+    return { certificates, location: element.location };
+}
+function parsePinEntry(pinEl) {
+    const digestRaw = getUnprefixedAttribute(pinEl, "digest");
+    const digestSupported = digestRaw !== undefined && SUPPORTED_PIN_DIGESTS.has(digestRaw);
+    const rawText = pinEl.textContent.trim();
+    const malformed = rawText.length === 0 || digestRaw === undefined;
+    const malformedReason = rawText.length === 0 ? "Pin element has no text content" : digestRaw === undefined ? "Pin element is missing a digest attribute" : undefined;
+    return {
+        digestRaw,
+        digestSupported,
+        valuePreview: boundedPreview(rawText),
+        malformed,
+        malformedReason,
+        location: pinEl.location,
+    };
+}
+function parsePinSet(element) {
+    const expirationRaw = getUnprefixedAttribute(element, "expiration");
+    // A syntactically valid expiration is YYYY-MM-DD; anything else is
+    // preserved verbatim and flagged malformed rather than guessed at.
+    const expirationMalformed = expirationRaw !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(expirationRaw);
+    const pins = findChildren(element, "pin").map(parsePinEntry);
+    return { expirationRaw, expirationMalformed, pins, location: element.location };
+}
+function normalizeDomainText(raw) {
+    let normalized = raw.trim().toLowerCase();
+    if (normalized.endsWith(".") && normalized.length > 1) {
+        normalized = normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function parseDomainEntry(domainEl) {
+    const includeSubdomainsResult = parseBooleanAttribute(domainEl, "includeSubdomains");
+    const textRaw = domainEl.textContent;
+    const normalized = normalizeDomainText(textRaw);
+    return {
+        textRaw,
+        normalized,
+        includeSubdomains: includeSubdomainsResult.value,
+        includeSubdomainsRaw: includeSubdomainsResult.raw,
+        malformed: normalized.length === 0,
+        location: domainEl.location,
+    };
+}
+const DOMAIN_CONFIG_KNOWN_CHILDREN = new Set(["domain", "trust-anchors", "pin-set", "domain-config"]);
+function parseDomainConfig(element, depth, warnings) {
+    const cleartextResult = parseBooleanAttribute(element, "cleartextTrafficPermitted");
+    const domains = findChildren(element, "domain").map(parseDomainEntry);
+    const trustAnchorsEl = findChildren(element, "trust-anchors")[0];
+    const pinSetEl = findChildren(element, "pin-set")[0];
+    const unsupportedChildren = element.children.filter((child) => !DOMAIN_CONFIG_KNOWN_CHILDREN.has(child.localName)).map((child) => `<${child.tagName}> at line ${child.location.line}`);
+    const nestedElements = findChildren(element, "domain-config");
+    let nestingTruncated = false;
+    let nested = [];
+    if (nestedElements.length > 0) {
+        if (depth >= MAX_DOMAIN_CONFIG_DEPTH) {
+            nestingTruncated = true;
+            warnings.push(`<domain-config> nesting exceeds the bounded depth of ${MAX_DOMAIN_CONFIG_DEPTH} at line ${element.location.line}; deeper nodes were not parsed.`);
+        }
+        else {
+            nested = nestedElements.map((child) => parseDomainConfig(child, depth + 1, warnings));
+        }
+    }
+    return {
+        cleartextTrafficPermitted: cleartextResult.value,
+        cleartextTrafficPermittedRaw: cleartextResult.raw,
+        domains,
+        trustAnchors: trustAnchorsEl ? parseTrustAnchors(trustAnchorsEl) : undefined,
+        pinSet: pinSetEl ? parsePinSet(pinSetEl) : undefined,
+        nested,
+        location: element.location,
+        unsupportedChildren,
+        nestingTruncated,
+    };
+}
+function parseBaseConfig(element) {
+    const cleartextResult = parseBooleanAttribute(element, "cleartextTrafficPermitted");
+    const trustAnchorsEl = findChildren(element, "trust-anchors")[0];
+    const pinSetEl = findChildren(element, "pin-set")[0];
+    return {
+        cleartextTrafficPermitted: cleartextResult.value,
+        cleartextTrafficPermittedRaw: cleartextResult.raw,
+        trustAnchors: trustAnchorsEl ? parseTrustAnchors(trustAnchorsEl) : undefined,
+        pinSet: pinSetEl ? parsePinSet(pinSetEl) : undefined,
+        location: element.location,
+    };
+}
+function parseDebugOverrides(element) {
+    const trustAnchorsEl = findChildren(element, "trust-anchors")[0];
+    return { trustAnchors: trustAnchorsEl ? parseTrustAnchors(trustAnchorsEl) : undefined, location: element.location };
+}
+// Parses Network Security Config XML text. Never throws for ordinary
+// malformed external input — always returns a structured result.
+export function parseNetworkSecurityConfig(xmlText) {
+    const parsed = parseXmlDocument(xmlText);
+    if (!parsed.ok) {
+        return { state: "malformed-xml", reason: parsed.error.message, location: parsed.error.location };
+    }
+    const root = parsed.root;
+    if (root.localName !== "network-security-config") {
+        return { state: "unsupported-root", rootTagName: root.tagName };
+    }
+    const warnings = parsed.warnings.map((w) => `${w.message} (line ${w.location.line})`);
+    const baseConfigEl = findChildren(root, "base-config")[0];
+    if (findChildren(root, "base-config").length > 1) {
+        warnings.push(`Multiple <base-config> elements found; only the first was used.`);
+    }
+    const debugOverridesEl = findChildren(root, "debug-overrides")[0];
+    if (findChildren(root, "debug-overrides").length > 1) {
+        warnings.push(`Multiple <debug-overrides> elements found; only the first was used.`);
+    }
+    const domainConfigEls = findChildren(root, "domain-config");
+    const knownRootChildren = new Set(["base-config", "domain-config", "debug-overrides"]);
+    for (const child of root.children) {
+        if (!knownRootChildren.has(child.localName)) {
+            warnings.push(`Unsupported <${child.tagName}> element at line ${child.location.line} was not parsed.`);
+        }
+    }
+    return {
+        state: "parsed",
+        baseConfig: baseConfigEl ? parseBaseConfig(baseConfigEl) : undefined,
+        domainConfigs: domainConfigEls.map((el) => parseDomainConfig(el, 0, warnings)),
+        debugOverrides: debugOverridesEl ? parseDebugOverrides(debugOverridesEl) : undefined,
+        warnings,
+    };
+}

package/dist/src/mobile/android/advancedSecurity/networkSecurity/types.js

@@ -0,0 +1 @@
+export const MAX_DOMAIN_CONFIG_DEPTH = 10;

package/dist/src/mobile/android/advancedSecurity/ordering.js

@@ -0,0 +1,44 @@
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — deterministic ordering for candidate evidence produced by
+// later v0.4.1 detectors. Mirrors the existing localeCompare-by-id pattern
+// already used for finding/module ordering (e.g.
+// src/mobile/android/validate/validateAndroidTarget.ts's
+// `.sort((a, b) => a.id.localeCompare(b.id))`, detect/detectAndroidProject.ts)
+// rather than introducing a different comparator convention.
+//
+// Ordering key precedence: category, then rule id, then module path, then
+// source path, then line, then column, then fingerprint (final tiebreaker —
+// guarantees a total order even for two otherwise-identical locations).
+// Must never depend on filesystem enumeration order or object insertion
+// order.
+// ---------------------------------------------------------------------------
+function compareOptionalNumber(a, b) {
+    if (a === b)
+        return 0;
+    if (a === undefined)
+        return -1;
+    if (b === undefined)
+        return 1;
+    return a - b;
+}
+function compareOptionalString(a, b) {
+    if (a === b)
+        return 0;
+    if (a === undefined)
+        return -1;
+    if (b === undefined)
+        return 1;
+    return a.localeCompare(b);
+}
+export function compareCandidateEvidence(a, b) {
+    return (a.category.localeCompare(b.category) ||
+        a.ruleId.localeCompare(b.ruleId) ||
+        compareOptionalString(a.modulePath, b.modulePath) ||
+        a.location.path.localeCompare(b.location.path) ||
+        compareOptionalNumber(a.location.line, b.location.line) ||
+        compareOptionalNumber(a.location.column, b.location.column) ||
+        a.fingerprint.localeCompare(b.fingerprint));
+}
+export function sortCandidateEvidence(evidence) {
+    return [...evidence].sort(compareCandidateEvidence);
+}

package/dist/src/mobile/android/advancedSecurity/redaction.js

@@ -0,0 +1,54 @@
+import { createHash } from "node:crypto";
+import { stripUnsafeControlChars } from "../../../securityValidation/attackScenarios/exploitEvidence.js";
+// ---------------------------------------------------------------------------
+// v0.4.1 Batch 1 — redaction and fingerprint primitives for later Android
+// secret/signing/configuration candidate evidence.
+//
+// Reuses stripUnsafeControlChars from the existing exploit-evidence redaction
+// owner (src/securityValidation/attackScenarios/exploitEvidence.ts) rather
+// than re-implementing control-character stripping. That module's
+// redactPreview() fully masks any secret-*looking* substring behind a
+// "[REDACTED:Nchars]" marker with no prefix/suffix, which is the right
+// behavior for exploit-scenario evidence (never show any of a real exploit
+// payload). Android candidate evidence has a different, narrower need: a
+// human reviewing a static-candidate finding benefits from a short prefix/
+// suffix so they can recognize *which* secret in their own source it is
+// without the full value ever being reconstructable — so this module adds
+// that prefix/suffix-preserving preview and a non-reversible fingerprint on
+// top of the shared control-character stripping, instead of creating a
+// second, competing full-redaction implementation.
+// ---------------------------------------------------------------------------
+const DEFAULT_MAX_PREVIEW_LENGTH = 64;
+const DEFAULT_EDGE_LENGTH = 3;
+const MASK = "***";
+// Distinguishes "no input was available to redact" (e.g. a value could not
+// be read) from "the input was an empty string literal" — callers must not
+// conflate the two.
+export function redactedPreviewForCandidate(input, options = {}) {
+    if (input === undefined)
+        return "[unavailable]";
+    if (input.length === 0)
+        return "[empty]";
+    const maxLength = options.maxLength ?? DEFAULT_MAX_PREVIEW_LENGTH;
+    const edgeLength = options.edgeLength ?? DEFAULT_EDGE_LENGTH;
+    const normalized = stripUnsafeControlChars(input).replace(/\r\n|\r|\n/g, "\\n");
+    const bounded = normalized.length > maxLength ? `${normalized.slice(0, maxLength)}...` : normalized;
+    // Too short to safely show both a prefix and a suffix without
+    // reconstructing most or all of the value — mask it entirely instead.
+    if (bounded.length <= edgeLength * 2) {
+        return MASK;
+    }
+    const prefix = bounded.slice(0, edgeLength);
+    const suffix = bounded.slice(-edgeLength);
+    return `${prefix}${MASK}${suffix}`;
+}
+// Stable, non-reversible fingerprint for deduplication. Uses Node's built-in
+// sha256 (no new dependency). Distinct from redactedPreviewForCandidate: the
+// fingerprint is stored for dedup, the preview is stored for human review —
+// neither one can be used to recover the raw value.
+export function fingerprintCandidateValue(input) {
+    if (input === undefined)
+        return "unavailable";
+    const hash = createHash("sha256").update(input, "utf8").digest("hex");
+    return `sha256:${hash}`;
+}