@slicedearth/whoisleuth-cli 1.43.0 → 1.45.0

package/frontend/src/lib/analysis/lookup-source-refresh.js

@@ -1,3 +1,4 @@
+import { BoundedJsonResponseError, requestJsonCapped, } from "../bounded-json-response.js";
 export const LOOKUP_SOURCE_REFRESH_VERSION = 1;
 export const LOOKUP_SOURCE_STALE_AFTER_DAYS = 7;
 export const LOOKUP_FRESHNESS_POLICY_VERSION = 1;
@@ -141,47 +142,6 @@ function record(value) {
         ? value
         : {};
 }
-async function boundedJson(response) {
-    const declaredLength = Number(response.headers.get('content-length'));
-    if (Number.isFinite(declaredLength) && declaredLength > MAX_LOOKUP_SOURCE_REFRESH_BYTES) {
-        throw new Error('oversized');
-    }
-    if (!response.body)
-        return {};
-    const reader = response.body.getReader();
-    const chunks = [];
-    let total = 0;
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value)
-                continue;
-            total += value.byteLength;
-            if (total > MAX_LOOKUP_SOURCE_REFRESH_BYTES)
-                throw new Error('oversized');
-            chunks.push(value);
-        }
-    }
-    finally {
-        if (total > MAX_LOOKUP_SOURCE_REFRESH_BYTES)
-            await reader.cancel().catch(() => { });
-        reader.releaseLock();
-    }
-    const bytes = new Uint8Array(total);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    try {
-        return JSON.parse(new TextDecoder().decode(bytes));
-    }
-    catch {
-        return {};
-    }
-}
 function text(value, maximum = 180) {
     return String(value ?? '')
         .replace(/[\u0000-\u001f\u007f]+/gu, ' ')
@@ -194,6 +154,7 @@ function summarizeSource(plan, body, observedAt, depth, supersedesObservedAt) {
         version: LOOKUP_SOURCE_REFRESH_VERSION,
         id: plan.id,
         observedAt,
+        attemptedAt: observedAt,
         reason: plan.reason,
         evidenceIds: plan.evidenceIds.slice(0, 12),
         supersedesObservedAt,
@@ -208,7 +169,6 @@ function summarizeSource(plan, body, observedAt, depth, supersedesObservedAt) {
             detail: complete
                 ? `Registry RDAP returned a validated ${upstreamStatus} response.`
                 : `Registry RDAP returned ${Number.isFinite(upstreamStatus) ? `HTTP ${upstreamStatus}` : 'no complete structured record'}.`,
-            observedAt,
         };
     }
     if (plan.id === 'whois') {
@@ -221,7 +181,6 @@ function summarizeSource(plan, body, observedAt, depth, supersedesObservedAt) {
             detail: complete
                 ? `WHOIS returned a complete ${chain.length}-hop referral chain.`
                 : `WHOIS returned ${chain.length} hop${chain.length === 1 ? '' : 's'} with ${chainStatus || 'unknown'} chain status.`,
-            observedAt,
         };
     }
     const state = text(body.state, 40) || 'unknown';
@@ -234,7 +193,19 @@ function summarizeSource(plan, body, observedAt, depth, supersedesObservedAt) {
         ...base,
         state: complete ? 'complete' : 'limited',
         detail: `Domain evidence returned ${state}${sourceStates.length ? `; DNS, HTTP, and TLS states: ${sourceStates.join(', ')}` : ''}.`,
-        observedAt,
+    };
+}
+function unavailableRefreshResult(plan, attemptedAt, supersedesObservedAt, detail) {
+    return {
+        version: LOOKUP_SOURCE_REFRESH_VERSION,
+        id: plan.id,
+        state: 'unavailable',
+        detail,
+        observedAt: null,
+        attemptedAt,
+        reason: plan.reason,
+        evidenceIds: plan.evidenceIds.slice(0, 12),
+        supersedesObservedAt,
     };
 }
 export async function requestLookupSourceRefresh(plan, query, depth, options = {}) {
@@ -244,19 +215,24 @@ export async function requestLookupSourceRefresh(plan, query, depth, options = {
     const timeoutMs = Number.isFinite(options.timeoutMs)
         ? Math.max(1, Math.min(LOOKUP_SOURCE_REFRESH_TIMEOUT_MS, Math.round(Number(options.timeoutMs))))
         : LOOKUP_SOURCE_REFRESH_TIMEOUT_MS;
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort('timeout'), timeoutMs);
+    const attemptedAt = options.now?.() ?? new Date().toISOString();
+    const supersedesObservedAt = options.supersedesObservedAt === undefined
+        ? plan.supersedesObservedAt
+        : options.supersedesObservedAt;
     try {
         const url = `${plan.endpoint}?q=${encodeURIComponent(normalizedQuery)}${plan.id === 'availability' && depth === 'fast' ? '&fast=true' : ''}`;
-        const response = await (options.fetchImpl ?? fetch)(url, {
+        const { response, body: rawBody } = await requestJsonCapped(url, {
             credentials: 'same-origin',
-            signal: controller.signal,
+        }, {
+            ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+            maximumBytes: MAX_LOOKUP_SOURCE_REFRESH_BYTES,
+            timeoutMs,
         });
-        const body = record(await boundedJson(response));
+        const body = record(rawBody);
         if (!response.ok) {
             return {
-                ok: false,
-                message: text(body.error, 240) || `Source refresh failed with HTTP ${response.status}.`,
+                ok: true,
+                value: unavailableRefreshResult(plan, attemptedAt, supersedesObservedAt, text(body.error, 240) || `The source returned HTTP ${response.status}; no new observation was recorded.`),
             };
         }
         if (Object.keys(body).length > MAX_LOOKUP_SOURCE_REFRESH_KEYS) {
@@ -264,23 +240,20 @@ export async function requestLookupSourceRefresh(plan, query, depth, options = {
         }
         return {
             ok: true,
-            value: summarizeSource(plan, body, options.now?.() ?? new Date().toISOString(), depth, options.supersedesObservedAt === undefined
-                ? plan.supersedesObservedAt
-                : options.supersedesObservedAt),
+            value: summarizeSource(plan, body, attemptedAt, depth, supersedesObservedAt),
         };
     }
     catch (cause) {
-        if (cause instanceof Error && cause.message === 'oversized') {
-            return { ok: false, message: 'Source refresh returned an oversized response.' };
+        if (cause instanceof BoundedJsonResponseError && cause.code === 'response_too_large') {
+            return { ok: true, value: unavailableRefreshResult(plan, attemptedAt, supersedesObservedAt, 'The source response exceeded the local limit; no new observation was recorded.') };
         }
         return {
-            ok: false,
-            message: controller.signal.aborted ? 'Source refresh timed out.' : 'Source refresh could not be completed.',
+            ok: true,
+            value: unavailableRefreshResult(plan, attemptedAt, supersedesObservedAt, cause instanceof BoundedJsonResponseError && cause.code === 'timeout'
+                ? 'The source refresh timed out; no new observation was recorded.'
+                : 'The source refresh could not be completed; no new observation was recorded.'),
         };
     }
-    finally {
-        clearTimeout(timeout);
-    }
 }
 export function mergeLookupSourceRefreshLedger(current, result) {
     const candidates = [
@@ -289,10 +262,10 @@ export function mergeLookupSourceRefreshLedger(current, result) {
     ];
     const byObservation = new Map();
     for (const entry of candidates.slice(-MAX_LOOKUP_SOURCE_REFRESH_HISTORY * 4)) {
-        byObservation.set(`${entry.id}:${entry.observedAt}`, entry);
+        byObservation.set(`${entry.id}:${entry.attemptedAt}`, entry);
     }
     const ordered = [...byObservation.values()]
-        .sort((left, right) => Date.parse(left.observedAt) - Date.parse(right.observedAt));
+        .sort((left, right) => Date.parse(left.attemptedAt) - Date.parse(right.attemptedAt));
     const truncated = Boolean(current?.truncated)
         || ordered.length > MAX_LOOKUP_SOURCE_REFRESH_HISTORY
         || candidates.length > MAX_LOOKUP_SOURCE_REFRESH_HISTORY;

package/frontend/src/lib/analysis/utils.js

@@ -5,7 +5,7 @@ import { hammingDistanceHex, isInformativePerceptualHash, isPerceptualHash, } fr
 // this only gates whether a WHOIS/RDAP-sourced string is safe to drop into a
 // mailto: URI as the recipient, not a general email validator. mailto:
 // treats a comma as an additional-recipient separator (RFC 6068), so a
-// registrant/abuse-contact field containing e.g. "victim@x.com,cc@evil.com"
+// registrant/abuse-contact field containing e.g. "person@example.test,cc@hostile.example"
 // would silently add a second recipient to the outreach/abuse draft the user
 // opens - rejecting anything outside a single plain address closes that off.
 const SIMPLE_EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/;

package/frontend/src/lib/analysis/workspace-archive-crypto.js

@@ -1,7 +1,7 @@
 // Browser-local authenticated encryption for portable workspace archives.
 // This protects a downloaded file while it is locked. It does not encrypt the
 // active IndexedDB workspace or defend an unlocked page from same-origin code.
-import { MAX_WORKSPACE_ARCHIVE_BYTES, WORKSPACE_ARCHIVE_SCHEMA, WORKSPACE_ARCHIVE_VERSION, isSupportedWorkspaceArchiveVersion, readWorkspaceArchive, } from "./workspace-archive.js";
+import { MAX_WORKSPACE_ARCHIVE_BYTES, WORKSPACE_ARCHIVE_SCHEMA, isSupportedWorkspaceArchiveVersion, readWorkspaceArchive, } from "./workspace-archive.js";
 export const ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA = 'whoisleuth.encrypted-workspace-archive';
 export const ENCRYPTED_WORKSPACE_ARCHIVE_VERSION = 1;
 export const WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS = 600_000;
@@ -26,9 +26,6 @@ function hasExactKeys(value, expected) {
     const keys = Object.keys(value);
     return keys.length === expected.length && keys.every((key) => expected.includes(key));
 }
-function byteLength(value) {
-    return encoder.encode(value).byteLength;
-}
 function arrayBuffer(bytes) {
     return bytes.slice().buffer;
 }

package/frontend/src/lib/analysis/workspace-archive.js

@@ -2,7 +2,7 @@
 // authority for normalization and merge semantics; this module only packages
 // their portable contracts, verifies integrity, and previews conflicts.
 import { buildCaseExport, CASE_SCHEMA_VERSION, enforceStoreBudget, mergeCases, } from "./case-model.js";
-import { assertBrandProfileStoreBudget, BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, buildBrandProfileExport, mergeBrandProfiles, } from "./brand-profile-model.js";
+import { assertBrandProfileStoreBudget, BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, buildBrandProfileExport, mergeBrandProfiles, normalizeBrandProfileId, } from "./brand-profile-model.js";
 import { assertCampaignStoreBudget, buildCampaignExport, CAMPAIGN_SCHEMA, CAMPAIGN_SCHEMA_VERSION, mergeCampaigns, } from "./campaign-model.js";
 import { assertWatchlistStoreBudget, buildWatchlistExport, mergeWatchlistStores, WATCHLIST_SCHEMA, WATCHLIST_SCHEMA_VERSION, } from "./watchlist-store.js";
 import { assertShortlistStoreBudget, buildShortlistExport, mergeShortlistStores, SHORTLIST_SCHEMA, SHORTLIST_SCHEMA_VERSION, } from "./shortlist-model.js";
@@ -40,7 +40,6 @@ export function isSupportedWorkspaceArchiveVersion(value) {
         && SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS.some((version) => version === value);
 }
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
-const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 const CHECKSUM_RE = /^sha256:[a-f0-9]{64}$/;
 function record(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
@@ -101,9 +100,7 @@ async function checksum(value, cryptoProvider = globalThis.crypto) {
 }
 function settingsDocument(input) {
     const profiles = Array.isArray(input.brandProfiles) ? input.brandProfiles : [];
-    const requestedProfileId = typeof input.settings?.activeProfileId === 'string' && SAFE_ID_RE.test(input.settings.activeProfileId)
-        ? input.settings.activeProfileId
-        : '';
+    const requestedProfileId = normalizeBrandProfileId(input.settings?.activeProfileId) || '';
     const activeProfileId = profiles.some((profile) => profile?.id === requestedProfileId)
         ? requestedProfileId
         : '';
@@ -406,8 +403,7 @@ export async function readWorkspaceArchive(raw, options = {}) {
 }
 function settingsPreview(data, local, mergedProfiles) {
     const value = record(data) || {};
-    const requestedProfileId = typeof value.activeProfileId === 'string' ? value.activeProfileId : '';
-    const activeProfileId = SAFE_ID_RE.test(requestedProfileId) ? requestedProfileId : '';
+    const activeProfileId = normalizeBrandProfileId(value.activeProfileId) || '';
     const theme = normalizeTheme(value.theme);
     let skipped = 0;
     if (activeProfileId && !mergedProfiles.some((profile) => profile?.id === activeProfileId))

package/lib/bounded-file.mjs

@@ -0,0 +1,69 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+const MAX_BOUNDED_FILE_BYTES = 64 * 1024 * 1024;
+function boundedSize(value, fallback) {
+    return Number.isSafeInteger(value) && Number(value) >= 0 && Number(value) <= MAX_BOUNDED_FILE_BYTES
+        ? Number(value)
+        : fallback;
+}
+export async function readBoundedRegularFile(filePath, options, dependencies = {}) {
+    const label = options.label?.trim().slice(0, 120) || 'Input file';
+    const maximumBytes = boundedSize(options.maximumBytes, 0);
+    const minimumBytes = boundedSize(options.minimumBytes, 0);
+    if (maximumBytes < 1 || minimumBytes > maximumBytes) {
+        throw new TypeError(`${label} has an invalid byte boundary.`);
+    }
+    const expectedBytes = options.expectedBytes === null || options.expectedBytes === undefined
+        ? null
+        : boundedSize(options.expectedBytes, -1);
+    if (expectedBytes !== null && (expectedBytes < minimumBytes || expectedBytes > maximumBytes)) {
+        throw new TypeError(`${label} expected size is outside its byte boundary.`);
+    }
+    // Non-blocking open prevents a named pipe from stalling the process before
+    // the descriptor can be classified. Final-component symlinks remain denied
+    // unless an analyst-facing input explicitly opts in; artefacts resolved
+    // inside a verified directory must retain the default confinement boundary.
+    const flags = constants.O_RDONLY
+        | constants.O_NONBLOCK
+        | (options.allowSymbolicLink ? 0 : constants.O_NOFOLLOW);
+    const handle = await (dependencies.openFile ?? open)(filePath, flags);
+    try {
+        const before = await handle.stat();
+        if (!before.isFile())
+            throw new TypeError(`${label} must be a regular file.`);
+        if (before.size < minimumBytes)
+            throw new TypeError(`${label} is smaller than its ${minimumBytes}-byte minimum.`);
+        if (before.size > maximumBytes)
+            throw new TypeError(`${label} exceeds its ${maximumBytes}-byte maximum.`);
+        if (expectedBytes !== null && before.size !== expectedBytes) {
+            throw new TypeError(`${label} size does not match its declared size.`);
+        }
+        // Read from the already-opened descriptor and reserve only one sentinel
+        // byte beyond the admitted size. A concurrent append is detected without
+        // allocating from an attacker-controlled post-stat file length.
+        const storage = Buffer.allocUnsafe(Math.min(maximumBytes + 1, before.size + 1));
+        let offset = 0;
+        while (offset < storage.length) {
+            const { bytesRead } = await handle.read(storage, offset, storage.length - offset, null);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        const after = await handle.stat();
+        if (offset > maximumBytes
+            || after.size !== before.size
+            || offset !== after.size
+            || after.mtimeMs !== before.mtimeMs
+            || after.ctimeMs !== before.ctimeMs) {
+            throw new TypeError(`${label} changed while it was being read.`);
+        }
+        return Buffer.from(storage.subarray(0, offset));
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function readBoundedRegularTextFile(filePath, options, dependencies = {}) {
+    return (await readBoundedRegularFile(filePath, options, dependencies)).toString('utf8');
+}
+export { MAX_BOUNDED_FILE_BYTES };

package/lib/bounded-json-response.mjs

@@ -0,0 +1,157 @@
+// Environment-neutral browser/server JSON response boundary. It enforces a
+// declared and streamed byte ceiling before parsing and can apply one deadline
+// across both the fetch and body-read phases.
+export const SMALL_JSON_RESPONSE_BYTES = 64 * 1024;
+export const STANDARD_JSON_RESPONSE_BYTES = 2 * 1024 * 1024;
+export const LARGE_JSON_RESPONSE_BYTES = 8 * 1024 * 1024;
+export const DEFAULT_JSON_RESPONSE_TIMEOUT_MS = 40_000;
+const MAX_JSON_RESPONSE_TIMEOUT_MS = 120_000;
+export class BoundedJsonResponseError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'BoundedJsonResponseError';
+        this.code = code;
+    }
+}
+async function raceWithAbort(promise, signal, onLateResolution) {
+    if (signal.aborted)
+        throw signal.reason ?? new Error('Request aborted.');
+    return new Promise((resolve, reject) => {
+        let aborted = false;
+        const onAbort = () => {
+            aborted = true;
+            reject(signal.reason ?? new Error('Request aborted.'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        void promise.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            if (aborted) {
+                void Promise.resolve(onLateResolution?.(value)).catch(() => { });
+                return;
+            }
+            resolve(value);
+        }, (cause) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(cause);
+        });
+    });
+}
+function boundedPositiveInteger(value, fallback, maximum) {
+    return typeof value === 'number' && Number.isFinite(value)
+        ? Math.max(1, Math.min(maximum, Math.round(value)))
+        : fallback;
+}
+export async function readJsonResponseCapped(response, maximumBytes = STANDARD_JSON_RESPONSE_BYTES, signal) {
+    const maxBytes = boundedPositiveInteger(maximumBytes, STANDARD_JSON_RESPONSE_BYTES, LARGE_JSON_RESPONSE_BYTES);
+    const declared = response.headers.get('content-length');
+    if (declared && /^\d+$/u.test(declared)) {
+        const bytes = Number(declared);
+        if (!Number.isSafeInteger(bytes) || bytes > maxBytes) {
+            await response.body?.cancel().catch(() => { });
+            throw new BoundedJsonResponseError('response_too_large', `JSON response exceeded ${maxBytes} bytes.`);
+        }
+    }
+    if (!response.body)
+        return null;
+    const reader = response.body.getReader();
+    const cancelOnAbort = () => { void reader.cancel(signal?.reason).catch(() => { }); };
+    signal?.addEventListener('abort', cancelOnAbort, { once: true });
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const read = reader.read();
+            const { done, value } = signal ? await raceWithAbort(read, signal) : await read;
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel().catch(() => { });
+                throw new BoundedJsonResponseError('response_too_large', `JSON response exceeded ${maxBytes} bytes.`);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        signal?.removeEventListener('abort', cancelOnAbort);
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new BoundedJsonResponseError('invalid_json', 'Response body was not valid UTF-8 JSON.');
+    }
+}
+export async function requestJsonCapped(input, init = {}, options = {}) {
+    const timeoutMs = boundedPositiveInteger(options.timeoutMs, DEFAULT_JSON_RESPONSE_TIMEOUT_MS, MAX_JSON_RESPONSE_TIMEOUT_MS);
+    const controller = new AbortController();
+    const upstreamSignal = init.signal;
+    const forwardAbort = () => controller.abort(upstreamSignal?.reason);
+    if (upstreamSignal?.aborted)
+        forwardAbort();
+    else
+        upstreamSignal?.addEventListener('abort', forwardAbort, { once: true });
+    const timeoutReason = Object.freeze({ type: 'bounded-json-timeout' });
+    const timeout = setTimeout(() => controller.abort(timeoutReason), timeoutMs);
+    try {
+        if (controller.signal.aborted) {
+            throw new BoundedJsonResponseError('aborted', 'Request was cancelled.');
+        }
+        const fetchRequest = (options.fetchImpl ?? fetch)(input, {
+            ...init,
+            signal: controller.signal,
+        });
+        const response = await raceWithAbort(fetchRequest, controller.signal, async (lateResponse) => lateResponse.body?.cancel().catch(() => { }));
+        const contentType = response.headers.get('content-type')?.toLowerCase() ?? '';
+        const plausibleJson = !contentType
+            || contentType.includes('application/json')
+            || contentType.includes('+json');
+        if (options.allowNonJsonErrorResponse !== false && !response.ok && !plausibleJson) {
+            await response.body?.cancel().catch(() => { });
+            return { response, body: null };
+        }
+        let body;
+        try {
+            body = await readJsonResponseCapped(response, options.maximumBytes, controller.signal);
+        }
+        catch (cause) {
+            // Reverse proxies and hosting adapters can replace an upstream JSON
+            // error with a bounded HTML or plain-text response. Preserve the HTTP
+            // status so callers can apply retry and generic error handling, while
+            // continuing to require valid JSON for successful responses.
+            if (options.allowNonJsonErrorResponse !== false
+                && !response.ok
+                && cause instanceof BoundedJsonResponseError
+                && cause.code === 'invalid_json') {
+                body = null;
+            }
+            else {
+                throw cause;
+            }
+        }
+        return { response, body };
+    }
+    catch (cause) {
+        if (controller.signal.aborted) {
+            const timedOut = controller.signal.reason === timeoutReason;
+            throw new BoundedJsonResponseError(timedOut ? 'timeout' : 'aborted', timedOut ? `Request timed out after ${timeoutMs} ms.` : 'Request was cancelled.');
+        }
+        if (cause instanceof BoundedJsonResponseError)
+            throw cause;
+        throw cause;
+    }
+    finally {
+        clearTimeout(timeout);
+        upstreamSignal?.removeEventListener('abort', forwardAbort);
+    }
+}