@slicedearth/whoisleuth-cli 1.36.1 → 1.39.1

package/lib/security-txt.mjs

@@ -202,7 +202,7 @@ function parseSecurityTxt(text, options = {}) {
     const limitations = [
         ...(signedPayload.signed ? ['A cleartext signature was present but was not cryptographically verified.'] : []),
         ...(canonicalMatches === false ? ['The fetched URL was not listed by the file as a Canonical location.'] : []),
-        ...(valuesTruncated ? ['The response or normalized field set exceeded a collection bound.'] : []),
+        ...(valuesTruncated ? ['The response or normalised field set exceeded a collection bound.'] : []),
     ];
     const detail = state === 'malformed'
         ? 'The file did not contain at least one valid Contact field and exactly one valid Expires field.'
@@ -314,7 +314,7 @@ async function collectSecurityTxt(hostname, dependencies = {}) {
             }
             if (response.status === 404 || response.status === 410) {
                 await response.body?.cancel().catch(() => { });
-                return emptyResult('absent', 'No security.txt file was published at the standardized location for this hostname.', {
+                return emptyResult('absent', 'No security.txt file was published at the standardised location for this hostname.', {
                     observedAt, requestedUrl, finalUrl: result.finalUrl, httpStatus: response.status, durationMs: now() - startedAt,
                 });
             }
@@ -328,7 +328,7 @@ async function collectSecurityTxt(hostname, dependencies = {}) {
             const charset = contentType.match(/;\s*charset\s*=\s*"?([^;"\s]+)/iu)?.[1]?.toLowerCase() || null;
             if (!/^text\/plain(?:\s*;|$)/iu.test(contentType) || (charset !== null && charset !== 'utf-8')) {
                 await response.body?.cancel().catch(() => { });
-                return emptyResult('unsupported', 'The standardized endpoint did not return a UTF-8 text/plain security.txt document.', {
+                return emptyResult('unsupported', 'The standardised endpoint did not return a UTF-8 text/plain security.txt document.', {
                     observedAt, requestedUrl, finalUrl: result.finalUrl, httpStatus: response.status, durationMs: now() - startedAt,
                 });
             }

package/lib/threat-intelligence-manifests.mjs

@@ -352,7 +352,7 @@ function normalizeConnectorOutputs(value) {
         throw new TypeError('Connector outputs must be unique');
     }
     if (!entities.length) {
-        throw new TypeError('Connector outputs require at least one normalized entity type');
+        throw new TypeError('Connector outputs require at least one normalised entity type');
     }
     const entityTypes = new Set(entities);
     for (const relationship of relationships) {

package/lib/threatfox-intelligence.mjs

@@ -282,7 +282,7 @@ function createThreatfoxIntelligenceAdapter(dependencies = {}) {
                 truncated,
                 detail: findings.length
                     ? `Found ${findings.length} bounded malware-IOC record${findings.length === 1 ? '' : 's'} for this domain${truncated ? '; additional provider records may exist' : ''}.`
-                    : 'The provider reported a match but no returned record could be safely normalized.',
+                    : 'The provider reported a match but no returned record could be safely normalised.',
                 upstreamStatus,
                 findings,
                 limitations: [

package/lib/tls-intelligence.mjs

@@ -12,7 +12,8 @@ import * as tls from 'node:tls';
 import { domainToASCII } from 'node:url';
 import { createObservation } from "./observation.mjs";
 import { isPrivateAddress, resolvePublicAddresses } from "./safe-fetch.mjs";
-const TLS_PROFILE_VERSION = 2;
+import { parseCertificateExtensionProfile, } from "./certificate-extension-profile.mjs";
+const TLS_PROFILE_VERSION = 3;
 const TLS_PORT = 443;
 const TLS_TIMEOUT_MS = 5000;
 const MAX_RESOLVED_ADDRESSES = 64;
@@ -486,6 +487,15 @@ function normalizeCertificate(value, state, options = {}) {
         };
         certificate.extendedKeyUsage = certificatePurposes(parsedCertificate?.keyUsage || record.ext_key_usage, state);
         certificate.authorityInformationAccess = authorityInformationAccess(parsedCertificate?.infoAccess || record.infoAccess, state);
+        const extensionProfile = parseCertificateExtensionProfile(record.raw);
+        if (extensionProfile.parsed || extensionProfile.partial) {
+            certificate.extensionProfile = extensionProfile;
+            if (extensionProfile.partial)
+                state.discarded += 1;
+            if (extensionProfile.certificatePolicies.truncated || extensionProfile.crlDistributionPoints.truncated) {
+                state.truncated = true;
+            }
+        }
     }
     return certificate;
 }
@@ -562,7 +572,7 @@ function tlsFindings(profile) {
     if (profile.validity.status === 'not_yet_valid')
         findings.push({ id: 'certificate_not_yet_valid', tone: 'warning', label: 'Certificate not yet valid', detail: 'The leaf certificate validity period had not started at observation time.' });
     if (profile.authorization.authorized === false)
-        findings.push({ id: 'certificate_unauthorized', tone: 'warning', label: 'Certificate not authorized', detail: 'The runtime trust store did not authorize the observed certificate chain. This can reflect an incomplete chain, private CA, self-signed certificate, expiry, or another validation failure.' });
+        findings.push({ id: 'certificate_unauthorized', tone: 'warning', label: 'Certificate not authorised', detail: 'The runtime trust store did not authorise the observed certificate chain. This can reflect an incomplete chain, private CA, self-signed certificate, expiry, or another validation failure.' });
     if (profile.hostname.matches === false)
         findings.push({ id: 'hostname_mismatch', tone: 'warning', label: 'Hostname mismatch', detail: 'The observed leaf certificate did not match the SNI hostname.' });
     if (profile.certificate?.subjectAltNames?.dnsNames.some((name) => name.startsWith('*.')))
@@ -631,7 +641,7 @@ function buildTlsObservation(handshake = {}, options = {}) {
             truncated: state.truncated,
             limitations: [
                 'This is a point-in-time TLS handshake to one validated public address; other addresses or edge locations may present different results.',
-                'Authorization reflects the certificate authorities and verification behavior available to this runtime.',
+                'Authorisation reflects the certificate authorities and verification behaviour available to this runtime.',
                 'The profile records the negotiated connection only and does not enumerate supported TLS versions or cipher suites.',
                 ...(state.truncated ? ['One or more certificate fields or chain entries reached a retention limit.'] : []),
             ],

package/lib/urlhaus-intelligence.mjs

@@ -333,7 +333,7 @@ function createUrlhausIntelligenceAdapter(dependencies = {}) {
                 truncated,
                 detail: findings.length
                     ? `Found ${findings.length} bounded malware-distribution record${findings.length === 1 ? '' : 's'} for this host${truncated ? '; additional provider records may exist' : ''}.`
-                    : 'The provider reported this host but no returned record could be safely normalized.',
+                    : 'The provider reported this host but no returned record could be safely normalised.',
                 upstreamStatus,
                 findings,
                 limitations: [

package/lib/website-security-posture.mjs

@@ -50,7 +50,7 @@ function httpFindings(httpValue) {
         || !response.securityHeaders
         || typeof response.securityHeaders !== 'object'
         || Array.isArray(response.securityHeaders)) {
-        findings.push(finding('http_headers_unavailable', 'response headers', 'unavailable', 'neutral', 'Response-header posture unavailable', 'The selected HTTP observation did not include the normalized security-header set.', ['Selected HTTP response headers']));
+        findings.push(finding('http_headers_unavailable', 'response headers', 'unavailable', 'neutral', 'Response-header posture unavailable', 'The selected HTTP observation did not include the normalised security-header set.', ['Selected HTTP response headers']));
         return findings;
     }
     const headerChecks = [
@@ -221,10 +221,10 @@ function tlsFindings(tlsValue) {
             : finding('modern_tls_negotiated', 'certificate', 'observed', 'configured', 'Modern TLS negotiated', 'The single retained connection negotiated TLS 1.2 or later. This does not enumerate every protocol the endpoint supports.', ['TLS handshake']));
     }
     findings.push(authorization.authorized === true
-        ? finding('certificate_authorized', 'certificate', 'observed', 'configured', 'Certificate chain authorized', 'The runtime trust store authorized the observed certificate chain for the retained connection.', ['TLS handshake'])
+        ? finding('certificate_authorized', 'certificate', 'observed', 'configured', 'Certificate chain authorised', 'The runtime trust store authorised the observed certificate chain for the retained connection.', ['TLS handshake'])
         : authorization.authorized === false
-            ? finding('certificate_not_authorized', 'certificate', 'potential_exposure', 'review', 'Certificate chain not authorized', 'The runtime trust store did not authorize the observed certificate chain. Review the separately attributed TLS evidence for context.', ['TLS handshake'])
-            : finding('certificate_authorization_unavailable', 'certificate', 'unavailable', 'neutral', 'Certificate authorization unavailable', 'The retained TLS observation did not include a conclusive chain-authorization result.', ['TLS handshake']));
+            ? finding('certificate_not_authorized', 'certificate', 'potential_exposure', 'review', 'Certificate chain not authorised', 'The runtime trust store did not authorise the observed certificate chain. Review the separately attributed TLS evidence for context.', ['TLS handshake'])
+            : finding('certificate_authorization_unavailable', 'certificate', 'unavailable', 'neutral', 'Certificate authorisation unavailable', 'The retained TLS observation did not include a conclusive chain-authorization result.', ['TLS handshake']));
     findings.push(hostname.matches === true
         ? finding('certificate_hostname_match', 'certificate', 'observed', 'configured', 'Certificate hostname matched', 'The observed leaf certificate matched the hostname used for the retained TLS connection.', ['TLS handshake'])
         : hostname.matches === false
@@ -274,7 +274,7 @@ function dnsFindings(dnsValue, dnssecValue) {
         ? finding('dnssec_signed', 'domain controls', 'observed', 'configured', 'DNSSEC signing reported', 'The registry or WHOIS source reported a signed DNSSEC delegation.', ['Registry or WHOIS DNSSEC publication'])
         : dnssec === 'unsigned'
             ? finding('dnssec_unsigned', 'domain controls', 'observed_absence', 'review', 'DNSSEC signing not reported', 'The registry or WHOIS source reported an unsigned DNSSEC delegation.', ['Registry or WHOIS DNSSEC publication'])
-            : finding('dnssec_unavailable', 'domain controls', 'unavailable', 'neutral', 'DNSSEC state unavailable', 'The retained registry and WHOIS evidence did not provide a recognized DNSSEC state.', ['Registry or WHOIS DNSSEC publication']));
+            : finding('dnssec_unavailable', 'domain controls', 'unavailable', 'neutral', 'DNSSEC state unavailable', 'The retained registry and WHOIS evidence did not provide a recognised DNSSEC state.', ['Registry or WHOIS DNSSEC publication']));
     findings.push(!caaAvailable
         ? finding('caa_unavailable', 'domain controls', 'unavailable', 'neutral', 'CAA posture unavailable', 'The CAA query did not produce a conclusive response for this observation.', [caaSource])
         : caaCount > 0

package/lib/website-technology.mjs

@@ -179,7 +179,7 @@ const TECHNOLOGY_SIGNATURES = [
     {
         id: 'adobe-commerce-magento', name: 'Adobe Commerce / Magento Open Source', category: 'commerce',
         evidence: [
-            htmlEvidence(['data-mage-init=', 'type="text/x-magento-init"', "type='text/x-magento-init'"], 'Static markup contains Commerce frontend initialization markers.'),
+            htmlEvidence(['data-mage-init=', 'type="text/x-magento-init"', "type='text/x-magento-init'"], 'Static markup contains Commerce frontend initialisation markers.'),
         ],
     },
     {

package/lib/whois-chain.mjs

@@ -54,7 +54,7 @@ export async function buildWhoisChainUncached(query, options = {}) {
                 queryProfile: 'not-issued',
                 responseEncoding: 'utf-8',
                 error: admission.state === 'permission_required'
-                    ? 'WHOIS collection requires registry permission or source authorization; no socket was opened.'
+                    ? 'WHOIS collection requires registry permission or source authorisation; no socket was opened.'
                     : 'IANA publishes no domain WHOIS service for this suffix; no socket was opened.',
             }];
     }

package/package.json

@@ -33,9 +33,12 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "1.36.1",
+  "version": "1.39.1",
   "dependencies": {
+    "@peculiar/x509": "2.0.0",
+    "maxmind": "5.0.7",
     "parse5": "8.0.1",
+    "reflect-metadata": "0.2.2",
     "tldts": "7.4.10",
     "undici": "8.9.0"
   },
@@ -45,6 +48,7 @@
     "lib/**/*.mjs",
     "frontend/src/lib/analysis/**/*.js",
     "docs/cli.md",
+    "docs/cli-reference.md",
     "DISCLOSURE",
     "LICENSE",
     "LICENSES/*.txt",