@slicedearth/whoisleuth-cli 1.43.0 → 1.47.4

package/lib/browser-library-profile.mjs

@@ -4,10 +4,19 @@
 // scripts. Upstream URLs, filenames, inline bodies, and catalogue expressions
 // are treated as untrusted inputs and are not retained in the result.
 import { createHash } from 'node:crypto';
+import { Worker } from 'node:worker_threads';
 import { RETIRE_BROWSER_CATALOG } from "./generated/retire-browser-catalog.mjs";
 import { CISA_KEV_CATALOG } from "./generated/cisa-kev-catalog.mjs";
 import { createObservation } from "./observation.mjs";
 import { MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_STATIC_HTML_CHARS, analyzeStaticHtml, } from "./static-html-analysis.mjs";
+// Catalogue expressions are reviewed third-party inputs. Keep every individual
+// regular-expression evaluation and the aggregate inline-signature work small
+// enough that a target-controlled script cannot monopolise the Node event loop.
+// Full-content hashes still use the complete already-capped script body.
+const MAX_INLINE_LIBRARY_SCAN_CHARS = 1_024;
+const MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS = 4_096;
+const MAX_INLINE_LIBRARY_SCAN_MS = 750;
+const MAX_INLINE_LIBRARY_WORKER_BYTES = 64 * 1024;
 const BROWSER_LIBRARY_PROFILE_VERSION = 2;
 const MAX_LIBRARY_HTML_CHARS = MAX_STATIC_HTML_CHARS;
 const MAX_LIBRARY_FINDINGS = 16;
@@ -29,6 +38,68 @@ const SEVERITY_WEIGHT = Object.freeze({
 });
 const CATALOG_COMPONENTS = RETIRE_BROWSER_CATALOG.components;
 const KNOWN_EXPLOITED_IDENTIFIERS = new Set(CISA_KEV_CATALOG.identifiers);
+const INLINE_EXTRACTOR_CATALOGUE = Object.freeze(Object.entries(CATALOG_COMPONENTS).map(([component, value]) => {
+    const extractors = record(record(value).extractors);
+    return Object.freeze({
+        component,
+        patterns: Object.freeze((Array.isArray(extractors.filecontent) ? extractors.filecontent : [])
+            .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
+            .slice(0, 64)),
+        replacements: Object.freeze((Array.isArray(extractors.filecontentreplace) ? extractors.filecontentreplace : [])
+            .filter((pattern) => typeof pattern === 'string' && pattern.length > 0 && pattern.length <= 2_048)
+            .slice(0, 64)),
+    });
+}));
+const INLINE_REGEX_WORKER_SOURCE = String.raw `
+const { parentPort, workerData } = require('node:worker_threads');
+const versions = /^[0-9][0-9.a-z_-]{0,63}$/i;
+parentPort.on('message', (job) => {
+  const control = new Int32Array(job.control);
+  const output = new Uint8Array(job.output);
+  const matches = [];
+  const add = (component, version) => {
+    const normalized = String(version).replace(/(?:\.|-)?min$/i, '').slice(0, 64);
+    if (versions.test(normalized) && matches.length < 64) matches.push([component, normalized]);
+  };
+  try {
+    for (const entry of workerData.catalogue) {
+      for (const pattern of entry.patterns) {
+        let expression;
+        try { expression = new RegExp(pattern, 'g'); } catch { continue; }
+        let match;
+        let count = 0;
+        while ((match = expression.exec(job.value)) && count < 4) {
+          if (typeof match[1] === 'string') add(entry.component, match[1]);
+          if (match[0] === '') expression.lastIndex += 1;
+          count += 1;
+        }
+      }
+      for (const descriptorValue of entry.replacements) {
+        const descriptor = /^\/(.*[^\\])\/([^/]+)\/$/.exec(descriptorValue);
+        if (!descriptor || !descriptor[1]) continue;
+        let expression;
+        try { expression = new RegExp(descriptor[1], 'g'); } catch { continue; }
+        let match;
+        let count = 0;
+        while ((match = expression.exec(job.value)) && count < 4) {
+          let replaced = match[0];
+          try { replaced = match[0].replace(new RegExp(descriptor[1]), descriptor[2]); } catch { break; }
+          add(entry.component, replaced);
+          if (match[0] === '') expression.lastIndex += 1;
+          count += 1;
+        }
+      }
+    }
+    const encoded = Buffer.from(JSON.stringify(matches));
+    if (encoded.length > output.length) Atomics.store(control, 0, -2);
+    else { output.set(encoded); Atomics.store(control, 0, encoded.length); }
+  } catch {
+    Atomics.store(control, 0, -1);
+  }
+  Atomics.notify(control, 0);
+});
+`;
+let inlineRegexWorker = null;
 function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -106,32 +177,6 @@ function matchPattern(pattern, value) {
     }
     return matches;
 }
-function matchReplacementPattern(pattern, value) {
-    if (typeof pattern !== 'string' || pattern.length === 0 || pattern.length > 2_048)
-        return [];
-    const descriptor = /^\/(.*[^\\])\/([^/]+)\/$/.exec(pattern);
-    const expressionSource = descriptor?.[1];
-    const replacement = descriptor?.[2];
-    if (!expressionSource || replacement === undefined)
-        return [];
-    let expression;
-    try {
-        expression = new RegExp(expressionSource, 'g');
-    }
-    catch {
-        return [];
-    }
-    const matches = [];
-    let match;
-    while ((match = expression.exec(value)) && matches.length < MAX_MATCHES_PER_PATTERN) {
-        const replaced = match[0].replace(new RegExp(expressionSource), replacement).replace(/(?:\.|-)?min$/i, '');
-        if (VERSION_RE.test(replaced))
-            matches.push(replaced);
-        if (match[0] === '')
-            expression.lastIndex += 1;
-    }
-    return matches;
-}
 function addDetected(detected, component, version, method) {
     const normalizedVersion = version.replace(/(?:\.|-)?min$/i, '').slice(0, MAX_VERSION_LENGTH);
     if (!COMPONENT_RE.test(component) || !VERSION_RE.test(normalizedVersion))
@@ -174,24 +219,87 @@ function scanFilename(detected, reference) {
         }
     }
 }
-function scanInlineContent(detected, content) {
+function scanInlineSignatures(detected, value) {
+    if (!value)
+        return { timedOut: false, unavailable: false };
+    const controlBuffer = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
+    const outputBuffer = new SharedArrayBuffer(MAX_INLINE_LIBRARY_WORKER_BYTES);
+    const control = new Int32Array(controlBuffer);
+    try {
+        if (!inlineRegexWorker) {
+            const createdWorker = new Worker(INLINE_REGEX_WORKER_SOURCE, {
+                eval: true,
+                workerData: { catalogue: INLINE_EXTRACTOR_CATALOGUE },
+            });
+            inlineRegexWorker = createdWorker;
+            createdWorker.unref();
+            createdWorker.once('exit', () => {
+                if (inlineRegexWorker === createdWorker)
+                    inlineRegexWorker = null;
+            });
+            createdWorker.once('error', () => {
+                if (inlineRegexWorker === createdWorker)
+                    inlineRegexWorker = null;
+            });
+        }
+        inlineRegexWorker.postMessage({ value, control: controlBuffer, output: outputBuffer });
+    }
+    catch {
+        void inlineRegexWorker?.terminate().catch(() => { });
+        inlineRegexWorker = null;
+        return { timedOut: false, unavailable: true };
+    }
+    const wait = Atomics.wait(control, 0, 0, MAX_INLINE_LIBRARY_SCAN_MS);
+    const length = Atomics.load(control, 0);
+    if (wait === 'timed-out') {
+        void inlineRegexWorker?.terminate().catch(() => { });
+        inlineRegexWorker = null;
+        return { timedOut: true, unavailable: false };
+    }
+    if (length < 1 || length > MAX_INLINE_LIBRARY_WORKER_BYTES) {
+        return { timedOut: false, unavailable: true };
+    }
+    try {
+        const parsed = JSON.parse(Buffer.from(new Uint8Array(outputBuffer, 0, length)).toString('utf8'));
+        if (!Array.isArray(parsed))
+            return { timedOut: false, unavailable: true };
+        for (const item of parsed.slice(0, MAX_LIBRARY_FINDINGS * 4)) {
+            if (!Array.isArray(item) || item.length !== 2)
+                continue;
+            const [component, version] = item;
+            if (typeof component === 'string' && typeof version === 'string') {
+                addDetected(detected, component, version, 'inline signature');
+            }
+        }
+        return { timedOut: false, unavailable: false };
+    }
+    catch {
+        return { timedOut: false, unavailable: true };
+    }
+}
+function scanInlineContent(detected, content, maximumSignatureCharacters) {
     const normalized = content.replace(/\r\n?|\n/g, '\n');
     const digest = createHash('sha1').update(normalized).digest('hex');
-    scanExtractor(detected, 'filecontent', normalized, 'inline signature');
+    const retainedCharacters = Math.max(0, Math.min(MAX_INLINE_LIBRARY_SCAN_CHARS, maximumSignatureCharacters, normalized.length));
+    const headCharacters = Math.ceil(retainedCharacters / 2);
+    const tailCharacters = retainedCharacters - headCharacters;
+    const signatureContent = retainedCharacters === 0
+        ? ''
+        : normalized.length <= retainedCharacters
+            ? normalized
+            : `${normalized.slice(0, headCharacters)}${tailCharacters ? normalized.slice(-tailCharacters) : ''}`;
     for (const [componentName, rawComponent] of Object.entries(CATALOG_COMPONENTS)) {
-        const component = record(rawComponent);
-        const extractors = record(component.extractors);
-        const replacementPatterns = Array.isArray(extractors.filecontentreplace) ? extractors.filecontentreplace : [];
-        for (const pattern of replacementPatterns.slice(0, 64)) {
-            for (const version of matchReplacementPattern(pattern, normalized)) {
-                addDetected(detected, componentName, version, 'inline signature');
-            }
-        }
+        const extractors = record(record(rawComponent).extractors);
         const hashes = record(extractors.hashes);
         const version = hashes[digest];
         if (typeof version === 'string')
             addDetected(detected, componentName, version, 'inline hash');
     }
+    return {
+        charactersExamined: retainedCharacters,
+        truncated: retainedCharacters < normalized.length,
+        signatureContent,
+    };
 }
 function severity(value) {
     return typeof value === 'string' && Object.hasOwn(SEVERITY_WEIGHT, value)
@@ -243,6 +351,9 @@ function analyzeBrowserLibraries(input = {}) {
     const detected = new Map();
     let referencesExamined = 0;
     let inlineScriptsExamined = 0;
+    let inlineSignatureCharactersExamined = 0;
+    let inlineSignatureLimitReached = false;
+    const inlineSignatureSamples = [];
     for (const script of htmlAnalysis.scripts) {
         if (script.reference) {
             referencesExamined += 1;
@@ -251,9 +362,16 @@ function analyzeBrowserLibraries(input = {}) {
         }
         else if (script.inlineContent && script.mediaType !== 'application/ld+json') {
             inlineScriptsExamined += 1;
-            scanInlineContent(detected, script.inlineContent);
+            const remaining = Math.max(0, MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS - inlineSignatureCharactersExamined);
+            const signatureScan = scanInlineContent(detected, script.inlineContent, remaining);
+            inlineSignatureCharactersExamined += signatureScan.charactersExamined;
+            inlineSignatureLimitReached ||= signatureScan.truncated;
+            if (signatureScan.signatureContent)
+                inlineSignatureSamples.push(signatureScan.signatureContent);
         }
     }
+    const inlineSignatureResult = scanInlineSignatures(detected, inlineSignatureSamples.join('\u0000'));
+    const inlineSignatureUnavailable = inlineSignatureResult.timedOut || inlineSignatureResult.unavailable;
     const allFindings = [...detected.values()]
         .map(findingFromDetection)
         .sort((left, right) => ((right.highestSeverity ? SEVERITY_WEIGHT[right.highestSeverity] : -1)
@@ -267,6 +385,8 @@ function analyzeBrowserLibraries(input = {}) {
         || htmlAnalysis.tagLimitReached
         || htmlAnalysis.scriptLimitReached
         || htmlAnalysis.inlineLimitReached
+        || inlineSignatureLimitReached
+        || inlineSignatureUnavailable
         || findingLimitReached;
     const limitations = [
         'Library versions are inferred from passive static signatures and may be absent, transformed, or misleading.',
@@ -284,6 +404,12 @@ function analyzeBrowserLibraries(input = {}) {
         limitations.push(`Only the first ${MAX_SCRIPT_ELEMENTS} script elements were evaluated.`);
     if (htmlAnalysis.inlineLimitReached)
         limitations.push(`Inline script evaluation reached its ${MAX_INLINE_SCRIPT_TOTAL_CHARS}-character cumulative boundary.`);
+    if (inlineSignatureLimitReached)
+        limitations.push(`Passive library signature matching evaluated a deterministic ${MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS}-character cumulative sample across inline scripts; full-content hashes still used the complete bounded script content.`);
+    if (inlineSignatureResult.timedOut)
+        limitations.push(`Passive library signature matching exceeded its ${MAX_INLINE_LIBRARY_SCAN_MS} ms isolated-worker deadline; hash evidence was still evaluated.`);
+    if (inlineSignatureResult.unavailable)
+        limitations.push('Passive library signature matching was unavailable in its isolated worker; hash evidence was still evaluated.');
     if (findingLimitReached)
         limitations.push(`Only the first ${MAX_LIBRARY_FINDINGS} library findings were retained.`);
     return {
@@ -311,6 +437,9 @@ function analyzeBrowserLibraries(input = {}) {
                 referencesExamined,
                 inlineScriptsExamined,
                 inlineCharactersExamined: htmlAnalysis.inlineCharactersExamined,
+                inlineSignatureCharactersExamined,
+                inlineSignatureTimedOut: inlineSignatureResult.timedOut,
+                inlineSignatureUnavailable: inlineSignatureResult.unavailable,
                 catalogComponents: Object.keys(CATALOG_COMPONENTS).length,
                 findings: allFindings.length,
                 advisoryMatches: allFindings.reduce((sum, finding) => sum + finding.advisoryCount, 0),
@@ -320,4 +449,4 @@ function analyzeBrowserLibraries(input = {}) {
         findings: allFindings.slice(0, MAX_LIBRARY_FINDINGS),
     };
 }
-export { BROWSER_LIBRARY_PROFILE_VERSION, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_LIBRARY_FINDINGS, MAX_LIBRARY_HTML_CHARS, MAX_SCRIPT_ELEMENTS, analyzeBrowserLibraries, };
+export { BROWSER_LIBRARY_PROFILE_VERSION, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_INLINE_LIBRARY_SCAN_CHARS, MAX_INLINE_LIBRARY_SCAN_TOTAL_CHARS, MAX_LIBRARY_FINDINGS, MAX_LIBRARY_HTML_CHARS, MAX_SCRIPT_ELEMENTS, analyzeBrowserLibraries, };

package/lib/certificate-extension-profile.mjs

@@ -3,7 +3,8 @@
 // retained; malformed extensions fail soft and leave an explicit partial flag.
 import 'reflect-metadata';
 import { CertificatePolicyExtension, CRLDistributionPointsExtension, X509Certificate, } from '@peculiar/x509';
-export const MAX_CERTIFICATE_POLICIES = 16;
+import { MAX_LOOKUP_TLS_CERTIFICATE_POLICIES } from "./lookup-network-evidence-bounds.mjs";
+export const MAX_CERTIFICATE_POLICIES = MAX_LOOKUP_TLS_CERTIFICATE_POLICIES;
 export const MAX_CRL_DISTRIBUTION_POINTS = 32;
 function emptyProfile(partial = false) {
     return Object.freeze({

package/lib/cryptographic-assurance.mjs

@@ -0,0 +1,155 @@
+import { validateDnssecEvidence } from "./dnssec-evidence-validation.mjs";
+import { reviewRpkiRoute } from "./rpki-evidence.mjs";
+import { analyzeTlsaEvidence } from "./tlsa-evidence.mjs";
+const CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA = 'whoisleuth.cryptographic-assurance.input';
+const CRYPTOGRAPHIC_ASSURANCE_SCHEMA = 'whoisleuth.cryptographic-assurance.review';
+const CRYPTOGRAPHIC_ASSURANCE_VERSION = 1;
+function exactRecord(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError(`${label} must be one object.`);
+    const record = value;
+    const unexpected = Object.keys(record).find((key) => !keys.has(key));
+    if (unexpected)
+        throw new TypeError(`${label} contains unsupported field "${unexpected}".`);
+    return record;
+}
+function sourceLabel(value, label) {
+    if (typeof value !== 'string')
+        throw new TypeError(`${label}.source must be text.`);
+    const normalized = value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim();
+    if (!normalized || normalized.length > 160)
+        throw new TypeError(`${label}.source must contain from 1 to 160 characters.`);
+    return normalized;
+}
+function observationTime(value, label) {
+    if (typeof value !== 'string' || value.length > 64 || !Number.isFinite(Date.parse(value))) {
+        throw new TypeError(`${label}.observedAt must be one ISO-compatible timestamp.`);
+    }
+    return new Date(value).toISOString();
+}
+function suppliedEvidence(value, label) {
+    if (value === null || value === undefined)
+        return null;
+    const wrapper = exactRecord(value, new Set(['source', 'observedAt', 'evidence']), label);
+    if (!wrapper.evidence || typeof wrapper.evidence !== 'object' || Array.isArray(wrapper.evidence)) {
+        throw new TypeError(`${label}.evidence must be one object.`);
+    }
+    return {
+        source: sourceLabel(wrapper.source, label),
+        observedAt: observationTime(wrapper.observedAt, label),
+        evidence: wrapper.evidence,
+    };
+}
+function unavailableCard(family, label, authority) {
+    return Object.freeze({
+        family,
+        label,
+        authority,
+        source: null,
+        observedAt: null,
+        state: 'unavailable',
+        completeness: 'unavailable',
+        result: null,
+        limitations: Object.freeze([`No ${label.toLowerCase()} evidence was supplied. No state was inferred from another assurance family.`]),
+    });
+}
+function dnssecCompleteness(report) {
+    return report.state === 'consistent' || report.state === 'conflict' || report.state === 'unsigned'
+        ? 'complete'
+        : report.state === 'invalid' ? 'unavailable' : 'partial';
+}
+function rpkiCompleteness(report) {
+    return report.state === 'partial' ? 'partial' : report.state === 'invalid_input' ? 'unavailable' : 'complete';
+}
+function tlsaCompleteness(report) {
+    const comparisonMaterialComplete = !report.truncated
+        && report.rejectedCount === 0
+        && !report.authorityMaterialTruncated
+        && report.authorityMaterialRejectedCount === 0
+        && report.records.every((record) => record.state !== 'unavailable');
+    return comparisonMaterialComplete
+        && (report.state === 'matched' || report.state === 'different' || report.state === 'untrusted')
+        ? 'complete'
+        : report.state === 'invalid' || report.state === 'unavailable' ? 'unavailable' : 'partial';
+}
+function buildCryptographicAssuranceReview(inputValue, generatedAt = new Date().toISOString()) {
+    const input = exactRecord(inputValue, new Set(['schema', 'version', 'dnssec', 'routeOrigin', 'tlsa']), 'Cryptographic assurance input');
+    if (input.schema !== CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA || input.version !== CRYPTOGRAPHIC_ASSURANCE_VERSION) {
+        throw new TypeError(`Cryptographic assurance input must use ${CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA} version ${CRYPTOGRAPHIC_ASSURANCE_VERSION}.`);
+    }
+    const dnssecInput = suppliedEvidence(input.dnssec, 'dnssec');
+    const routeInput = suppliedEvidence(input.routeOrigin, 'routeOrigin');
+    const tlsaInput = suppliedEvidence(input.tlsa, 'tlsa');
+    if (!dnssecInput && !routeInput && !tlsaInput)
+        throw new TypeError('Cryptographic assurance input must supply at least one evidence family.');
+    const dnssec = dnssecInput ? validateDnssecEvidence({
+        ownerName: dnssecInput.evidence.ownerName,
+        delegationSigned: dnssecInput.evidence.delegationSigned,
+        dsRecords: dnssecInput.evidence.dsRecords,
+        dnskeyRecords: dnssecInput.evidence.dnskeyRecords,
+        rrSigRecords: dnssecInput.evidence.rrSigRecords,
+        observedAt: dnssecInput.evidence.observedAt ?? dnssecInput.observedAt,
+    }) : null;
+    const routeOrigin = routeInput ? reviewRpkiRoute({
+        routePrefix: routeInput.evidence.routePrefix,
+        originAsn: routeInput.evidence.originAsn,
+        authorizations: routeInput.evidence.authorizations,
+    }) : null;
+    const tlsa = tlsaInput ? analyzeTlsaEvidence({
+        serviceName: tlsaInput.evidence.serviceName,
+        dnssecState: tlsaInput.evidence.dnssecState,
+        pkixValidationState: tlsaInput.evidence.pkixValidationState,
+        records: tlsaInput.evidence.records,
+        certificateDerBase64: tlsaInput.evidence.certificateDerBase64,
+        spkiDerBase64: tlsaInput.evidence.spkiDerBase64,
+        authorityMaterials: tlsaInput.evidence.authorityMaterials,
+    }) : null;
+    const cards = [
+        dnssec && dnssecInput ? Object.freeze({
+            family: 'dnssec_validation',
+            label: 'DNSSEC evidence review',
+            authority: 'Supplied delegation, DS, DNSKEY, and signature-time evidence',
+            source: dnssecInput.source,
+            observedAt: dnssecInput.observedAt,
+            state: dnssec.state,
+            completeness: dnssecCompleteness(dnssec),
+            result: dnssec,
+            limitations: dnssec.limitations,
+        }) : unavailableCard('dnssec_validation', 'DNSSEC evidence review', 'Supplied delegation, DS, DNSKEY, and signature-time evidence'),
+        routeOrigin && routeInput ? Object.freeze({
+            family: 'route_origin_authorisation',
+            label: 'Route-origin authorisation',
+            authority: 'Analyst-supplied validated route-origin snapshot',
+            source: routeInput.source,
+            observedAt: routeInput.observedAt,
+            state: routeOrigin.state,
+            completeness: rpkiCompleteness(routeOrigin),
+            result: routeOrigin,
+            limitations: routeOrigin.limitations,
+        }) : unavailableCard('route_origin_authorisation', 'Route-origin authorisation', 'Analyst-supplied validated route-origin snapshot'),
+        tlsa && tlsaInput ? Object.freeze({
+            family: 'dane_tlsa',
+            label: 'DANE and TLSA evidence review',
+            authority: 'Supplied TLSA, DNSSEC, PKIX, and certificate material',
+            source: tlsaInput.source,
+            observedAt: tlsaInput.observedAt,
+            state: tlsa.state,
+            completeness: tlsaCompleteness(tlsa),
+            result: tlsa,
+            limitations: tlsa.limitations,
+        }) : unavailableCard('dane_tlsa', 'DANE and TLSA evidence review', 'Supplied TLSA, DNSSEC, PKIX, and certificate material'),
+    ];
+    return Object.freeze({
+        schema: CRYPTOGRAPHIC_ASSURANCE_SCHEMA,
+        version: CRYPTOGRAPHIC_ASSURANCE_VERSION,
+        generatedAt: observationTime(generatedAt, 'generatedAt'),
+        cards: Object.freeze(cards),
+        combinedState: null,
+        limitations: Object.freeze([
+            'DNSSEC, route-origin authorisation, and DANE or TLSA remain independently sourced evidence families with separate states, observation times, completeness, and limitations.',
+            'No scalar score or combined verdict is produced. A missing, failed, partial, or unsupported family is never inferred from another family.',
+            'These reviews do not establish ownership, availability, activity, safety, or maliciousness.',
+        ]),
+    });
+}
+export { CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA, CRYPTOGRAPHIC_ASSURANCE_SCHEMA, CRYPTOGRAPHIC_ASSURANCE_VERSION, buildCryptographicAssuranceReview, };

package/lib/ct-search.mjs

@@ -11,6 +11,7 @@ import { normalizeCtQuery } from "./ct-query.mjs";
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { createObservation } from "./observation.mjs";
+import { isValidAsciiHostname } from "./hostname.mjs";
 import { MAX_CT_RESPONSE_CERTIFICATE_GROUPS, MAX_CT_RESPONSE_DOMAINS_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH, MAX_CT_RESPONSE_RESULTS, MAX_CT_RESPONSE_TIMESTAMP_LENGTH, } from "./ct-response-bounds.mjs";
 const CRT_SH_TIMEOUT_MS = 20000;
 const MAX_RESULTS = MAX_CT_RESPONSE_RESULTS;
@@ -40,6 +41,12 @@ const MAX_TIMEOUT_RETRIES = 1;
 // iteration/set overhead after parsing. Legitimate responses under the byte
 // cap stay well within this limit.
 const MAX_CT_ROWS = 50_000;
+// crt.sh joins SAN values with newlines. Bound the amount of per-row and
+// whole-response hostname work independently of the JSON byte and row caps so
+// a small number of newline-dense strings cannot drive unbounded PSL parsing,
+// Set growth, or sorting before the result projection is truncated.
+const MAX_CT_NAMES_PER_ROW = 1_000;
+const MAX_CT_NAMES_EXAMINED = 100_000;
 // Structured-match bounds.
 const MAX_MATCHES = MAX_RESULTS; // 500
 const MAX_HOSTNAMES_PER_MATCH = MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH;
@@ -56,10 +63,12 @@ const MAX_SERIAL_LENGTH = 128;
 // Maximum length for an entry_timestamp string before it is rejected.
 const MAX_TIMESTAMP_LENGTH = MAX_CT_RESPONSE_TIMESTAMP_LENGTH;
 function normalizeHostname(raw) {
+    if (raw.length > 255)
+        return null;
     let h = raw.trim().toLowerCase();
     if (h.startsWith('*.'))
         h = h.slice(2);
-    return HOSTNAME_RE.test(h) ? h : null;
+    return HOSTNAME_RE.test(h) && isValidAsciiHostname(h, { requireLowercase: true }) ? h : null;
 }
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
@@ -75,7 +84,7 @@ async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
             res = await fetcher(`https://crt.sh/?q=${encodeURIComponent(keyword)}&output=json`, {
                 headers: whoisleuthRequestHeaders({ Accept: 'application/json' }),
                 signal: controller.signal,
-            });
+            }, 0);
         }
         catch (err) {
             if (!(err instanceof Error) || err.name !== 'AbortError')
@@ -255,6 +264,8 @@ function validateEntryTimestamp(value) {
  *     certificateCount: number
  *   }>,
  *   certificateGroups: CtCertificateGroup[],
+ *   namesExamined: number,
+ *   workTruncated: boolean,
  *   truncated: boolean
  * }}
  */
@@ -275,14 +286,20 @@ function summarizeCtResults(rows) {
     // firstObservedAt: string|null, lastObservedAt: string|null }>
     const groupMap = new Map();
     const certificateMap = new Map();
-    for (let i = 0; i < rows.length; i++) {
+    let namesExamined = 0;
+    let workTruncated = false;
+    rowLoop: for (let i = 0; i < rows.length; i++) {
         const row = rows[i];
         if (!row || typeof row !== 'object')
             continue;
         const certId = resolveCertId(row, i);
-        // Collect hostnames from name_value and common_name.
-        const rawBlob = `${row.name_value || ''}\n${row.common_name || ''}`;
-        const blob = rawBlob;
+        // Collect only direct string fields. Implicitly stringifying a nested
+        // array or object would traverse attacker-controlled structure before any
+        // hostname bound could take effect.
+        const nameFields = [
+            typeof row.name_value === 'string' ? row.name_value : '',
+            typeof row.common_name === 'string' ? row.common_name : '',
+        ];
         const ts = validateEntryTimestamp(row.entry_timestamp);
         let certificate = certificateMap.get(certId);
         if (!certificate) {
@@ -297,46 +314,65 @@ function summarizeCtResults(rows) {
         else if (ts !== null && (certificate.observedAt === null || ts > certificate.observedAt)) {
             certificate.observedAt = ts;
         }
-        if (rawBlob.split('\n').some((line) => line.trim().startsWith('*.')))
-            certificate.wildcardObserved = true;
-        for (const line of blob.split('\n')) {
-            const host = normalizeHostname(line);
-            if (!host)
-                continue;
-            // Legacy: always add if valid hostname.
-            legacyDomains.add(host);
-            // Structured: resolve registrable domain.
-            let regDomain;
-            if (registrableDomainByHostname.has(host)) {
-                regDomain = registrableDomainByHostname.get(host);
-            }
-            else {
-                regDomain = parse(host).domain || null;
-                registrableDomainByHostname.set(host, regDomain);
-            }
-            if (!regDomain)
-                continue;
-            certificate.hostnames.add(host);
-            certificate.domains.add(regDomain);
-            let group = groupMap.get(regDomain);
-            if (!group) {
-                group = {
-                    hostnames: new Set(),
-                    certIds: new Set(),
-                    firstObservedAt: null,
-                    lastObservedAt: null,
-                };
-                groupMap.set(regDomain, group);
-            }
-            group.hostnames.add(host);
-            group.certIds.add(certId);
-            if (ts !== null) {
-                if (group.firstObservedAt === null || ts < group.firstObservedAt) {
-                    group.firstObservedAt = ts;
+        let rowNamesExamined = 0;
+        for (const field of nameFields) {
+            let offset = 0;
+            while (offset <= field.length) {
+                if (namesExamined >= MAX_CT_NAMES_EXAMINED) {
+                    workTruncated = true;
+                    break rowLoop;
+                }
+                if (rowNamesExamined >= MAX_CT_NAMES_PER_ROW) {
+                    workTruncated = true;
+                    continue rowLoop;
                 }
-                if (group.lastObservedAt === null || ts > group.lastObservedAt) {
-                    group.lastObservedAt = ts;
+                const newline = field.indexOf('\n', offset);
+                const line = newline === -1 ? field.slice(offset) : field.slice(offset, newline);
+                namesExamined += 1;
+                rowNamesExamined += 1;
+                if (line.trim().startsWith('*.'))
+                    certificate.wildcardObserved = true;
+                const host = normalizeHostname(line);
+                if (host) {
+                    // Legacy: always add if valid hostname.
+                    legacyDomains.add(host);
+                    // Structured: resolve registrable domain.
+                    let regDomain;
+                    if (registrableDomainByHostname.has(host)) {
+                        regDomain = registrableDomainByHostname.get(host);
+                    }
+                    else {
+                        regDomain = parse(host).domain || null;
+                        registrableDomainByHostname.set(host, regDomain);
+                    }
+                    if (regDomain) {
+                        certificate.hostnames.add(host);
+                        certificate.domains.add(regDomain);
+                        let group = groupMap.get(regDomain);
+                        if (!group) {
+                            group = {
+                                hostnames: new Set(),
+                                certIds: new Set(),
+                                firstObservedAt: null,
+                                lastObservedAt: null,
+                            };
+                            groupMap.set(regDomain, group);
+                        }
+                        group.hostnames.add(host);
+                        group.certIds.add(certId);
+                        if (ts !== null) {
+                            if (group.firstObservedAt === null || ts < group.firstObservedAt) {
+                                group.firstObservedAt = ts;
+                            }
+                            if (group.lastObservedAt === null || ts > group.lastObservedAt) {
+                                group.lastObservedAt = ts;
+                            }
+                        }
+                    }
                 }
+                if (newline === -1)
+                    break;
+                offset = newline + 1;
             }
         }
     }
@@ -404,7 +440,9 @@ function summarizeCtResults(rows) {
             wildcardObserved: group.wildcardObserved,
         })),
         certificateGroupsTruncated,
-        truncated: legacyTruncated || matchTruncated || perMatchTruncated,
+        namesExamined,
+        workTruncated,
+        truncated: workTruncated || legacyTruncated || matchTruncated || perMatchTruncated,
     };
 }
 // ---------------------------------------------------------------------------
@@ -416,11 +454,12 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
     if (!trimmed) {
         return {
             domains: [], certCount: 0, truncated: false, matches: [], certificateGroups: [], certificateGroupsTruncated: false,
+            namesExamined: 0, workTruncated: false,
             observation: createObservation({
                 status: 'success', observedAt: new Date().toISOString(), source: 'certificate_transparency',
                 durationMs: Date.now() - startedAt, complete: true, truncated: false,
                 limitations: ['Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.'],
-                diagnostics: { certificateRows: 0, matches: 0, certificateGroups: 0 },
+                diagnostics: { certificateRows: 0, namesExamined: 0, workTruncated: false, matches: 0, certificateGroups: 0 },
             }),
         };
     }
@@ -438,9 +477,10 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
             truncated: summary.truncated || summary.certificateGroupsTruncated,
             limitations: [
                 'Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.',
+                ...(summary.workTruncated ? ['The response contained more hostname entries than the bounded local analysis could examine; retained results are partial.'] : []),
                 ...(summary.certificateGroupsTruncated ? ['The optional certificate-group projection was capped independently of the registrable-domain result set.'] : []),
             ],
-            diagnostics: { certificateRows: data.length, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
+            diagnostics: { certificateRows: data.length, namesExamined: summary.namesExamined, workTruncated: summary.workTruncated, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
         }),
     };
 }