@paywalls-net/filter 1.3.13 → 1.3.14

package/package.json

@@ -3,7 +3,7 @@
   "description": "Client SDK for integrating paywalls.net bot filtering and authorization services into your server or CDN.",
   "author": "paywalls.net",
   "license": "MIT",
-  "version": "1.3.13",
+  "version": "1.3.14",
   "publishConfig": {
     "access": "public"
   },

package/src/index.js

@@ -185,7 +185,18 @@ async function proxyVAIRequest(cfg, request) {
             cf.country ? `co=${cf.country}, re=${cf.region || ''}, ci=${cf.city || ''}, asn=${cf.asn || ''}` : null);
 
         // Tier 3: UA features + HMAC (§6.3)
-        setIfPresent(forwardHeaders, 'X-PW-UA', extractUAFeatures(headers['user-agent']));
+        let uaFeatures = extractUAFeatures(headers['user-agent']);
+
+        // Sec-Fetch context mismatch detection (paywalls-site-dz23):
+        // vai.json is fetched via sync XHR — browsers set Sec-Fetch-Dest: empty,
+        // Mode: cors. If we see document/navigate, the headless browser is leaking
+        // page-level Sec-Fetch onto the XHR. Emit marker so cloud-api can classify.
+        if (uaFeatures && cloudApiPath.endsWith('/vai.json') &&
+            headers['sec-fetch-dest'] === 'document' && headers['sec-fetch-mode'] === 'navigate') {
+            uaFeatures += ', sec-fetch-mismatch';
+        }
+
+        setIfPresent(forwardHeaders, 'X-PW-UA', uaFeatures);
         setIfPresent(forwardHeaders, 'X-PW-UA-HMAC', await computeUAHMAC(headers['user-agent'], cfg.vaiUAHmacKey));
         setIfPresent(forwardHeaders, 'X-PW-CT-FP',   await computeConfidenceToken(headers['user-agent'], headers['accept-language'], headers['sec-ch-ua']));
 

package/src/signal-extraction.js

@@ -514,6 +514,11 @@ export function extractUAFeatures(userAgent) {
   if (AUTOMATION_MARKERS.some(re => re.test(ua))) parts.push('automation');
   if (isFabricatedVersion(ua)) parts.push('fabricated');
 
+  // Stale version: Chrome family with ver=0-79 is 6+ years old (pre-2020)
+  if (family === 'chrome' && extractMajorVersion(ua) !== null && extractMajorVersion(ua) < 80) {
+    parts.push('stale');
+  }
+
   parts.push(`entropy=${computeUAEntropy(ua)}`);
 
   return parts.join(', ');

package/tests/bot-signal-extraction.test.js

@@ -200,5 +200,64 @@ describe('Legitimate browser UAs — correct feature extraction', () => {
     expect(result).toMatch(/ver=120-139/);
     expect(result).not.toMatch(/headless/);
     expect(result).not.toMatch(/fabricated/);
+    expect(result).not.toMatch(/stale/);
+  });
+});
+
+// ── 7. Stale browser version marker ───────────────────────────────────────
+
+describe('Stale browser version — signal extraction', () => {
+  test('Chrome/59 (2017, ver=0-79) should have stale marker', () => {
+    const result = extractUAFeatures(
+      'Mozilla/5.0 (Linux; Android 7.0; SM-G930V Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36'
+    );
+    expect(result).toMatch(/ver=0-79/);
+    expect(result).toMatch(/\bstale\b/);
+  });
+
+  test('Chrome/79 (2019, ver=0-79) should have stale marker', () => {
+    const result = extractUAFeatures(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36'
+    );
+    expect(result).toMatch(/ver=0-79/);
+    expect(result).toMatch(/\bstale\b/);
+  });
+
+  test('Chrome/83 (80-99 bucket, borderline old) should NOT have stale marker', () => {
+    const result = extractUAFeatures(
+      'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36'
+    );
+    expect(result).toMatch(/ver=80-99/);
+    expect(result).not.toMatch(/\bstale\b/);
+  });
+
+  test('Chrome/145 (current) should NOT have stale marker', () => {
+    const result = extractUAFeatures(
+      'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36'
+    );
+    expect(result).toMatch(/ver=140-159/);
+    expect(result).not.toMatch(/\bstale\b/);
+  });
+
+  test('Safari/17 should NOT have stale marker', () => {
+    const result = extractUAFeatures(
+      'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15'
+    );
+    expect(result).not.toMatch(/\bstale\b/);
+  });
+
+  test('Firefox/130 should NOT have stale marker', () => {
+    const result = extractUAFeatures(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0'
+    );
+    expect(result).not.toMatch(/\bstale\b/);
+  });
+
+  test('Fabricated Chrome/48.0.1025.1402 also gets stale (both markers)', () => {
+    const result = extractUAFeatures(
+      'Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.1025.1402 Mobile Safari/537.36'
+    );
+    expect(result).toMatch(/\bfabricated\b/);
+    expect(result).toMatch(/\bstale\b/);
   });
 });

package/tests/proxy-vai-request.test.js

@@ -291,6 +291,56 @@ describe('proxyVAIRequest — signal extraction pipeline', () => {
   });
 });
 
+// ── sec-fetch-mismatch CDN marker emission ──────────────────────────────────
+//
+// When the CDN sees sec-fetch-dest: document + sec-fetch-mode: navigate on a
+// vai.json request, it appends sec-fetch-mismatch to X-PW-UA. This marker is
+// used by the cloud-api to reclassify the request as OTHER without inspecting
+// raw Sec-Fetch headers in the classification path.
+
+describe('CDN sec-fetch-mismatch marker emission', () => {
+  let handler;
+
+  beforeAll(async () => {
+    handler = await init('cloudflare');
+  });
+
+  async function proxyVAI(url, headerMap, cf) {
+    const request = makeRequest(url, headerMap, cf);
+    capturedFetchArgs = null;
+    await handler(request, ENV, CTX);
+    return capturedFetchArgs;
+  }
+
+  test('document/navigate on vai.json → appends sec-fetch-mismatch', async () => {
+    const mismatchHeaders = {
+      ...CHROME_MAC_HEADERS,
+      'sec-fetch-dest': 'document',
+      'sec-fetch-mode': 'navigate',
+    };
+    const args = await proxyVAI('https://pub.example.com/pw/vai.json', mismatchHeaders, CF_PROPS);
+    expect(args.headers['X-PW-UA']).toContain('sec-fetch-mismatch');
+  });
+
+  test('empty/cors on vai.json (normal XHR) → no sec-fetch-mismatch', async () => {
+    const args = await proxyVAI('https://pub.example.com/pw/vai.json', CHROME_MAC_HEADERS, CF_PROPS);
+    expect(args.headers['X-PW-UA']).not.toContain('sec-fetch-mismatch');
+  });
+
+  test('document/navigate on non-vai path → no sec-fetch-mismatch', async () => {
+    const mismatchHeaders = {
+      ...CHROME_MAC_HEADERS,
+      'sec-fetch-dest': 'document',
+      'sec-fetch-mode': 'navigate',
+    };
+    const args = await proxyVAI('https://pub.example.com/pw/access/check', mismatchHeaders, CF_PROPS);
+    // sec-fetch-mismatch only applies to vai.json requests
+    if (args && args.headers) {
+      expect(args.headers['X-PW-UA'] || '').not.toContain('sec-fetch-mismatch');
+    }
+  });
+});
+
 // ── logAccess — non-VAI path raw header forwarding ───────────────────────────
 //
 // Verifies that logAccess() does NOT transform headers like proxyVAIRequest().