@slicedearth/whoisleuth-cli 1.36.1 → 1.43.0

package/lib/tls-intelligence.mjs

@@ -12,7 +12,8 @@ import * as tls from 'node:tls';
 import { domainToASCII } from 'node:url';
 import { createObservation } from "./observation.mjs";
 import { isPrivateAddress, resolvePublicAddresses } from "./safe-fetch.mjs";
-const TLS_PROFILE_VERSION = 2;
+import { parseCertificateExtensionProfile, } from "./certificate-extension-profile.mjs";
+const TLS_PROFILE_VERSION = 3;
 const TLS_PORT = 443;
 const TLS_TIMEOUT_MS = 5000;
 const MAX_RESOLVED_ADDRESSES = 64;
@@ -486,6 +487,15 @@ function normalizeCertificate(value, state, options = {}) {
         };
         certificate.extendedKeyUsage = certificatePurposes(parsedCertificate?.keyUsage || record.ext_key_usage, state);
         certificate.authorityInformationAccess = authorityInformationAccess(parsedCertificate?.infoAccess || record.infoAccess, state);
+        const extensionProfile = parseCertificateExtensionProfile(record.raw);
+        if (extensionProfile.parsed || extensionProfile.partial) {
+            certificate.extensionProfile = extensionProfile;
+            if (extensionProfile.partial)
+                state.discarded += 1;
+            if (extensionProfile.certificatePolicies.truncated || extensionProfile.crlDistributionPoints.truncated) {
+                state.truncated = true;
+            }
+        }
     }
     return certificate;
 }
@@ -562,7 +572,7 @@ function tlsFindings(profile) {
     if (profile.validity.status === 'not_yet_valid')
         findings.push({ id: 'certificate_not_yet_valid', tone: 'warning', label: 'Certificate not yet valid', detail: 'The leaf certificate validity period had not started at observation time.' });
     if (profile.authorization.authorized === false)
-        findings.push({ id: 'certificate_unauthorized', tone: 'warning', label: 'Certificate not authorized', detail: 'The runtime trust store did not authorize the observed certificate chain. This can reflect an incomplete chain, private CA, self-signed certificate, expiry, or another validation failure.' });
+        findings.push({ id: 'certificate_unauthorized', tone: 'warning', label: 'Certificate not authorised', detail: 'The runtime trust store did not authorise the observed certificate chain. This can reflect an incomplete chain, private CA, self-signed certificate, expiry, or another validation failure.' });
     if (profile.hostname.matches === false)
         findings.push({ id: 'hostname_mismatch', tone: 'warning', label: 'Hostname mismatch', detail: 'The observed leaf certificate did not match the SNI hostname.' });
     if (profile.certificate?.subjectAltNames?.dnsNames.some((name) => name.startsWith('*.')))
@@ -631,7 +641,7 @@ function buildTlsObservation(handshake = {}, options = {}) {
             truncated: state.truncated,
             limitations: [
                 'This is a point-in-time TLS handshake to one validated public address; other addresses or edge locations may present different results.',
-                'Authorization reflects the certificate authorities and verification behavior available to this runtime.',
+                'Authorisation reflects the certificate authorities and verification behaviour available to this runtime.',
                 'The profile records the negotiated connection only and does not enumerate supported TLS versions or cipher suites.',
                 ...(state.truncated ? ['One or more certificate fields or chain entries reached a retention limit.'] : []),
             ],

package/lib/trust-store-comparison.mjs

@@ -0,0 +1,146 @@
+import { enumValue, exactKeys, requireBoundedString, requireIsoTimestamp, requireRecord, } from "./bounded-contract-normalizers.mjs";
+export const TRUST_STORE_COMPARISON_INPUT_SCHEMA = 'whoisleuth.trust-store-comparison.input';
+export const TRUST_STORE_COMPARISON_REVIEW_SCHEMA = 'whoisleuth.trust-store-comparison.review';
+export const TRUST_STORE_COMPARISON_REVIEW_VERSION = 1;
+export const MAX_TRUST_STORE_COMPARISON_STORES = 16;
+export const MAX_TRUST_STORE_ANCHORS = 2_048;
+export const MAX_TRUST_STORE_CHAIN_CERTIFICATES = 16;
+const ROOT_KEYS = new Set(['schema', 'version', 'certificate', 'stores']);
+const CERTIFICATE_KEYS = new Set([
+    'source', 'observedAt', 'state', 'chainTruncated',
+    'fingerprintsSha256', 'runtimeAuthorisation',
+]);
+const STORE_KEYS = new Set(['name', 'version', 'source', 'reviewedAt', 'state', 'anchorsSha256']);
+const EVIDENCE_STATES = new Set(['observed', 'partial', 'unavailable']);
+const RUNTIME_AUTHORISATION = new Set(['authorised', 'unauthorised', 'unknown']);
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+function digest(value, label) {
+    const normalised = requireBoundedString(value, label, 64).toLowerCase();
+    if (!SHA256_RE.test(normalised))
+        throw new TypeError(`${label} must be a SHA-256 hexadecimal digest.`);
+    return normalised;
+}
+function digests(value, label, maximum, sort = true) {
+    if (!Array.isArray(value) || value.length > maximum) {
+        throw new TypeError(`${label} must contain no more than ${maximum} SHA-256 digests.`);
+    }
+    const values = [...new Set(value.map((entry, index) => digest(entry, `${label}[${index}]`)))];
+    return Object.freeze(sort ? values.sort() : values);
+}
+export function compareTrustStoreEvidence(inputRaw, generatedAtValue = new Date().toISOString()) {
+    const input = requireRecord(inputRaw, 'Trust-store comparison input');
+    if (input.schema !== TRUST_STORE_COMPARISON_INPUT_SCHEMA || input.version !== 1) {
+        throw new TypeError(`Trust-store comparison input must use ${TRUST_STORE_COMPARISON_INPUT_SCHEMA} version 1.`);
+    }
+    exactKeys(input, ROOT_KEYS, 'Trust-store comparison input');
+    const certificateInput = requireRecord(input.certificate, 'certificate');
+    exactKeys(certificateInput, CERTIFICATE_KEYS, 'certificate');
+    const certificateState = enumValue(certificateInput.state, EVIDENCE_STATES, 'certificate.state');
+    if (typeof certificateInput.chainTruncated !== 'boolean')
+        throw new TypeError('certificate.chainTruncated must be a Boolean.');
+    const certificateFingerprints = digests(certificateInput.fingerprintsSha256, 'certificate.fingerprintsSha256', MAX_TRUST_STORE_CHAIN_CERTIFICATES, false);
+    if (certificateState === 'unavailable' && certificateFingerprints.length) {
+        throw new TypeError('An unavailable certificate observation cannot contain fingerprints.');
+    }
+    if (certificateState !== 'unavailable' && !certificateFingerprints.length) {
+        throw new TypeError('An observed or partial certificate observation requires at least one fingerprint.');
+    }
+    const certificate = Object.freeze({
+        source: requireBoundedString(certificateInput.source, 'certificate.source', 240),
+        observedAt: requireIsoTimestamp(certificateInput.observedAt, 'certificate.observedAt'),
+        state: certificateState,
+        chainTruncated: certificateInput.chainTruncated,
+        leafSha256: certificateFingerprints[0] ?? null,
+        fingerprintsSha256: certificateFingerprints,
+        runtimeAuthorisation: enumValue(certificateInput.runtimeAuthorisation, RUNTIME_AUTHORISATION, 'certificate.runtimeAuthorisation'),
+    });
+    if (!Array.isArray(input.stores) || input.stores.length < 1 || input.stores.length > MAX_TRUST_STORE_COMPARISON_STORES) {
+        throw new TypeError(`stores must contain between 1 and ${MAX_TRUST_STORE_COMPARISON_STORES} entries.`);
+    }
+    const storeKeys = new Set();
+    const stores = input.stores.map((raw, index) => {
+        const store = requireRecord(raw, `stores[${index}]`);
+        exactKeys(store, STORE_KEYS, `stores[${index}]`);
+        const name = requireBoundedString(store.name, `stores[${index}].name`, 120);
+        const version = requireBoundedString(store.version, `stores[${index}].version`, 120);
+        const key = `${name}\u0000${version}`;
+        if (storeKeys.has(key))
+            throw new TypeError(`stores[${index}] repeats a store name and version.`);
+        storeKeys.add(key);
+        const storeState = enumValue(store.state, EVIDENCE_STATES, `stores[${index}].state`);
+        const anchors = digests(store.anchorsSha256, `stores[${index}].anchorsSha256`, MAX_TRUST_STORE_ANCHORS);
+        if (storeState === 'unavailable' && anchors.length)
+            throw new TypeError(`stores[${index}] cannot contain anchors when unavailable.`);
+        if (storeState === 'observed' && !anchors.length)
+            throw new TypeError(`stores[${index}] requires at least one anchor when observed.`);
+        return Object.freeze({
+            name,
+            version,
+            source: requireBoundedString(store.source, `stores[${index}].source`, 240),
+            reviewedAt: requireIsoTimestamp(store.reviewedAt, `stores[${index}].reviewedAt`),
+            state: storeState,
+            anchors,
+        });
+    }).sort((left, right) => left.name.localeCompare(right.name) || left.version.localeCompare(right.version));
+    const chainSet = new Set(certificate.fingerprintsSha256);
+    const comparisons = stores.map((store) => {
+        const matchedAnchorSha256 = store.anchors.filter((anchor) => chainSet.has(anchor));
+        const completeInputs = certificate.state === 'observed'
+            && certificate.chainTruncated === false
+            && store.state === 'observed';
+        const state = matchedAnchorSha256.length
+            ? 'anchor_observed'
+            : completeInputs
+                ? 'not_observed'
+                : 'inconclusive';
+        return Object.freeze({
+            store: Object.freeze({
+                name: store.name,
+                version: store.version,
+                source: store.source,
+                reviewedAt: store.reviewedAt,
+                state: store.state,
+                anchorCount: store.anchors.length,
+            }),
+            state,
+            matchedAnchorSha256: Object.freeze(matchedAnchorSha256),
+            explanation: state === 'anchor_observed'
+                ? 'At least one supplied chain fingerprint exactly matched a supplied trust-anchor fingerprint.'
+                : state === 'not_observed'
+                    ? 'No supplied chain fingerprint matched this complete supplied trust-store snapshot.'
+                    : 'Certificate-chain or trust-store evidence was incomplete or unavailable, so non-observation cannot be established.',
+        });
+    });
+    const incomplete = certificate.state !== 'observed'
+        || certificate.chainTruncated
+        || stores.some((store) => store.state !== 'observed');
+    return Object.freeze({
+        schema: TRUST_STORE_COMPARISON_REVIEW_SCHEMA,
+        version: TRUST_STORE_COMPARISON_REVIEW_VERSION,
+        generatedAt: requireIsoTimestamp(generatedAtValue, 'generatedAt'),
+        state: incomplete ? 'partial' : 'complete',
+        certificate: Object.freeze({
+            source: certificate.source,
+            observedAt: certificate.observedAt,
+            state: certificate.state,
+            chainTruncated: certificate.chainTruncated,
+            leafSha256: certificate.leafSha256,
+            chainFingerprintCount: certificate.fingerprintsSha256.length,
+            runtimeAuthorisation: certificate.runtimeAuthorisation,
+        }),
+        comparisons: Object.freeze(comparisons),
+        counts: Object.freeze({
+            stores: comparisons.length,
+            anchorObserved: comparisons.filter((comparison) => comparison.state === 'anchor_observed').length,
+            notObserved: comparisons.filter((comparison) => comparison.state === 'not_observed').length,
+            inconclusive: comparisons.filter((comparison) => comparison.state === 'inconclusive').length,
+        }),
+        limitations: Object.freeze([
+            'This local comparison uses only supplied SHA-256 fingerprints and makes no TLS, certificate-authority, operating-system, or trust-store request.',
+            'An exact anchor fingerprint intersection does not build or validate a certificate path, check signatures, names, validity, constraints, revocation, policy, or application-specific trust.',
+            'A complete supplied chain can omit its root certificate. A not-observed result therefore does not mean the runtime, browser, operating system, or another client would reject the certificate.',
+            'Trust stores differ by product, platform, version, policy, update state, and local administration. The analyst-supplied source and version remain part of every comparison.',
+            'Runtime authorisation is preserved as separate context and is not overridden by this fingerprint comparison.',
+        ]),
+    });
+}

package/lib/urlhaus-intelligence.mjs

@@ -333,7 +333,7 @@ function createUrlhausIntelligenceAdapter(dependencies = {}) {
                 truncated,
                 detail: findings.length
                     ? `Found ${findings.length} bounded malware-distribution record${findings.length === 1 ? '' : 's'} for this host${truncated ? '; additional provider records may exist' : ''}.`
-                    : 'The provider reported this host but no returned record could be safely normalized.',
+                    : 'The provider reported this host but no returned record could be safely normalised.',
                 upstreamStatus,
                 findings,
                 limitations: [

package/lib/website-security-posture.mjs

@@ -50,7 +50,7 @@ function httpFindings(httpValue) {
         || !response.securityHeaders
         || typeof response.securityHeaders !== 'object'
         || Array.isArray(response.securityHeaders)) {
-        findings.push(finding('http_headers_unavailable', 'response headers', 'unavailable', 'neutral', 'Response-header posture unavailable', 'The selected HTTP observation did not include the normalized security-header set.', ['Selected HTTP response headers']));
+        findings.push(finding('http_headers_unavailable', 'response headers', 'unavailable', 'neutral', 'Response-header posture unavailable', 'The selected HTTP observation did not include the normalised security-header set.', ['Selected HTTP response headers']));
         return findings;
     }
     const headerChecks = [
@@ -221,10 +221,10 @@ function tlsFindings(tlsValue) {
             : finding('modern_tls_negotiated', 'certificate', 'observed', 'configured', 'Modern TLS negotiated', 'The single retained connection negotiated TLS 1.2 or later. This does not enumerate every protocol the endpoint supports.', ['TLS handshake']));
     }
     findings.push(authorization.authorized === true
-        ? finding('certificate_authorized', 'certificate', 'observed', 'configured', 'Certificate chain authorized', 'The runtime trust store authorized the observed certificate chain for the retained connection.', ['TLS handshake'])
+        ? finding('certificate_authorized', 'certificate', 'observed', 'configured', 'Certificate chain authorised', 'The runtime trust store authorised the observed certificate chain for the retained connection.', ['TLS handshake'])
         : authorization.authorized === false
-            ? finding('certificate_not_authorized', 'certificate', 'potential_exposure', 'review', 'Certificate chain not authorized', 'The runtime trust store did not authorize the observed certificate chain. Review the separately attributed TLS evidence for context.', ['TLS handshake'])
-            : finding('certificate_authorization_unavailable', 'certificate', 'unavailable', 'neutral', 'Certificate authorization unavailable', 'The retained TLS observation did not include a conclusive chain-authorization result.', ['TLS handshake']));
+            ? finding('certificate_not_authorized', 'certificate', 'potential_exposure', 'review', 'Certificate chain not authorised', 'The runtime trust store did not authorise the observed certificate chain. Review the separately attributed TLS evidence for context.', ['TLS handshake'])
+            : finding('certificate_authorization_unavailable', 'certificate', 'unavailable', 'neutral', 'Certificate authorisation unavailable', 'The retained TLS observation did not include a conclusive chain-authorization result.', ['TLS handshake']));
     findings.push(hostname.matches === true
         ? finding('certificate_hostname_match', 'certificate', 'observed', 'configured', 'Certificate hostname matched', 'The observed leaf certificate matched the hostname used for the retained TLS connection.', ['TLS handshake'])
         : hostname.matches === false
@@ -274,7 +274,7 @@ function dnsFindings(dnsValue, dnssecValue) {
         ? finding('dnssec_signed', 'domain controls', 'observed', 'configured', 'DNSSEC signing reported', 'The registry or WHOIS source reported a signed DNSSEC delegation.', ['Registry or WHOIS DNSSEC publication'])
         : dnssec === 'unsigned'
             ? finding('dnssec_unsigned', 'domain controls', 'observed_absence', 'review', 'DNSSEC signing not reported', 'The registry or WHOIS source reported an unsigned DNSSEC delegation.', ['Registry or WHOIS DNSSEC publication'])
-            : finding('dnssec_unavailable', 'domain controls', 'unavailable', 'neutral', 'DNSSEC state unavailable', 'The retained registry and WHOIS evidence did not provide a recognized DNSSEC state.', ['Registry or WHOIS DNSSEC publication']));
+            : finding('dnssec_unavailable', 'domain controls', 'unavailable', 'neutral', 'DNSSEC state unavailable', 'The retained registry and WHOIS evidence did not provide a recognised DNSSEC state.', ['Registry or WHOIS DNSSEC publication']));
     findings.push(!caaAvailable
         ? finding('caa_unavailable', 'domain controls', 'unavailable', 'neutral', 'CAA posture unavailable', 'The CAA query did not produce a conclusive response for this observation.', [caaSource])
         : caaCount > 0

package/lib/website-technology.mjs

@@ -7,7 +7,7 @@
 import { analyzeBrowserLibraries } from "./browser-library-profile.mjs";
 import { createObservation } from "./observation.mjs";
 import { MAX_STATIC_HTML_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
-const TECHNOLOGY_PROFILE_VERSION = 6;
+const TECHNOLOGY_PROFILE_VERSION = 8;
 const MAX_TECHNOLOGY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
 const MAX_TECHNOLOGY_TAG_LENGTH = MAX_TAG_LENGTH;
 const MAX_TECHNOLOGY_FINDINGS = 24;
@@ -40,15 +40,17 @@ function normalizedResourceHosts(value) {
     }
     return hosts;
 }
-const PASSIVE_HEADER_NAMES = new Set([
+const PASSIVE_TECHNOLOGY_HEADER_NAMES = Object.freeze([
     'cf-ray',
     'x-drupal-cache',
-    'x-fastly-request-id',
+    'x-served-by',
+    'x-nf-request-id',
     'x-powered-by',
     'x-shopify-stage',
     'x-sorting-hat-podid',
     'x-vercel-id',
 ]);
+const PASSIVE_HEADER_NAMES = new Set(PASSIVE_TECHNOLOGY_HEADER_NAMES);
 function normalizedResponseHeaders(value) {
     const input = value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -148,7 +150,10 @@ const TECHNOLOGY_SIGNATURES = [
     },
     {
         id: 'craft-cms', name: 'Craft CMS', category: 'content management',
-        evidence: [generatorEvidence(/^craft cms(?:\s|$)/i, 'Generator metadata identifies Craft CMS.')],
+        evidence: [
+            generatorEvidence(/^craft cms(?:\s|$)/i, 'Generator metadata identifies Craft CMS.'),
+            responseHeaderEvidence('x-powered-by', /(?:^|,\s*)craft cms(?:\s|$|\/)/i, 'The passive X-Powered-By response header identifies Craft CMS.'),
+        ],
     },
     {
         id: 'typo3', name: 'TYPO3 CMS', category: 'content management',
@@ -179,7 +184,7 @@ const TECHNOLOGY_SIGNATURES = [
     {
         id: 'adobe-commerce-magento', name: 'Adobe Commerce / Magento Open Source', category: 'commerce',
         evidence: [
-            htmlEvidence(['data-mage-init=', 'type="text/x-magento-init"', "type='text/x-magento-init'"], 'Static markup contains Commerce frontend initialization markers.'),
+            htmlEvidence(['data-mage-init=', 'type="text/x-magento-init"', "type='text/x-magento-init'"], 'Static markup contains Commerce frontend initialisation markers.'),
         ],
     },
     {
@@ -198,17 +203,23 @@ const TECHNOLOGY_SIGNATURES = [
     },
     {
         id: 'opencart', name: 'OpenCart', category: 'commerce',
-        evidence: [generatorEvidence(/^opencart(?:\s|$)/i, 'Generator metadata identifies OpenCart.')],
+        evidence: [
+            generatorEvidence(/^opencart(?:\s|$)/i, 'Generator metadata identifies OpenCart.'),
+            htmlEvidence(['index.php?route=common/home', 'image/catalog/opencart-logo.png'], 'Static markup contains OpenCart routing or default asset conventions.'),
+        ],
     },
     {
         id: 'prestashop', name: 'PrestaShop', category: 'commerce',
-        evidence: [generatorEvidence(/^prestashop(?:\s|$)/i, 'Generator metadata identifies PrestaShop.')],
+        evidence: [
+            generatorEvidence(/^prestashop(?:\s|$)/i, 'Generator metadata identifies PrestaShop.'),
+            htmlEvidence(['/modules/ps_'], 'Static resource paths use PrestaShop module conventions.'),
+        ],
     },
     {
         id: 'wix', name: 'Wix', category: 'site builder',
         requiresNonResourceEvidence: true,
         evidence: [
-            generatorEvidence(/^wix(?:\s|$)/i, 'Generator metadata identifies Wix.'),
+            generatorEvidence(/^wix(?:\.com)?(?:\s|$)/i, 'Generator metadata identifies Wix.'),
             htmlEvidence(['data-mesh-id='], 'Static markup contains a Wix-specific document attribute.', 'medium'),
             resourceEvidence(['static.parastorage.com', 'wixstatic.com'], 'A retained resource origin uses Wix delivery infrastructure.'),
         ],
@@ -316,7 +327,10 @@ const TECHNOLOGY_SIGNATURES = [
     },
     {
         id: 'netlify', name: 'Netlify', category: 'delivery platform',
-        evidence: [serverEvidence(/^netlify(?:\s|$|\/)/i, 'The selected response server header identifies Netlify.')],
+        evidence: [
+            serverEvidence(/^netlify(?:\s|$|\/)/i, 'The selected response server header identifies Netlify.'),
+            responseHeaderEvidence('x-nf-request-id', null, 'A Netlify request identifier response header was observed.', 'medium'),
+        ],
     },
     {
         id: 'vercel', name: 'Vercel', category: 'delivery platform',
@@ -327,7 +341,7 @@ const TECHNOLOGY_SIGNATURES = [
     },
     {
         id: 'fastly', name: 'Fastly', category: 'delivery platform',
-        evidence: [responseHeaderEvidence('x-fastly-request-id', null, 'A Fastly request identifier response header was observed.', 'medium')],
+        evidence: [responseHeaderEvidence('x-served-by', /(?:^|,\s*)cache-[a-z0-9-]+-[a-z]{3}(?:\s*,|$)/i, 'The passive X-Served-By response header contains a Fastly cache-node identifier.', 'medium')],
     },
     {
         id: 'nginx', name: 'nginx', category: 'web server',
@@ -434,4 +448,4 @@ function analyzeWebsiteTechnology(input = {}) {
         browserLibraryProfile,
     };
 }
-export { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, MAX_TECHNOLOGY_HTML_CHARS, MAX_TECHNOLOGY_TAGS, TECHNOLOGY_PROFILE_VERSION, TECHNOLOGY_SIGNATURE_CATALOGUE, analyzeWebsiteTechnology, };
+export { MAX_EVIDENCE_PER_TECHNOLOGY, MAX_TECHNOLOGY_EVIDENCE_DESCRIPTION_LENGTH, MAX_TECHNOLOGY_FINDINGS, MAX_TECHNOLOGY_HTML_CHARS, MAX_TECHNOLOGY_TAGS, PASSIVE_TECHNOLOGY_HEADER_NAMES, TECHNOLOGY_PROFILE_VERSION, TECHNOLOGY_SIGNATURE_CATALOGUE, analyzeWebsiteTechnology, };

package/lib/whois-chain.mjs

@@ -54,7 +54,7 @@ export async function buildWhoisChainUncached(query, options = {}) {
                 queryProfile: 'not-issued',
                 responseEncoding: 'utf-8',
                 error: admission.state === 'permission_required'
-                    ? 'WHOIS collection requires registry permission or source authorization; no socket was opened.'
+                    ? 'WHOIS collection requires registry permission or source authorisation; no socket was opened.'
                     : 'IANA publishes no domain WHOIS service for this suffix; no socket was opened.',
             }];
     }