@slicedearth/whoisleuth-cli 1.45.0 → 1.47.4

package/lib/cryptographic-assurance.mjs

@@ -0,0 +1,155 @@
+import { validateDnssecEvidence } from "./dnssec-evidence-validation.mjs";
+import { reviewRpkiRoute } from "./rpki-evidence.mjs";
+import { analyzeTlsaEvidence } from "./tlsa-evidence.mjs";
+const CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA = 'whoisleuth.cryptographic-assurance.input';
+const CRYPTOGRAPHIC_ASSURANCE_SCHEMA = 'whoisleuth.cryptographic-assurance.review';
+const CRYPTOGRAPHIC_ASSURANCE_VERSION = 1;
+function exactRecord(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError(`${label} must be one object.`);
+    const record = value;
+    const unexpected = Object.keys(record).find((key) => !keys.has(key));
+    if (unexpected)
+        throw new TypeError(`${label} contains unsupported field "${unexpected}".`);
+    return record;
+}
+function sourceLabel(value, label) {
+    if (typeof value !== 'string')
+        throw new TypeError(`${label}.source must be text.`);
+    const normalized = value.replace(/[\u0000-\u001f\u007f]+/gu, ' ').replace(/\s+/gu, ' ').trim();
+    if (!normalized || normalized.length > 160)
+        throw new TypeError(`${label}.source must contain from 1 to 160 characters.`);
+    return normalized;
+}
+function observationTime(value, label) {
+    if (typeof value !== 'string' || value.length > 64 || !Number.isFinite(Date.parse(value))) {
+        throw new TypeError(`${label}.observedAt must be one ISO-compatible timestamp.`);
+    }
+    return new Date(value).toISOString();
+}
+function suppliedEvidence(value, label) {
+    if (value === null || value === undefined)
+        return null;
+    const wrapper = exactRecord(value, new Set(['source', 'observedAt', 'evidence']), label);
+    if (!wrapper.evidence || typeof wrapper.evidence !== 'object' || Array.isArray(wrapper.evidence)) {
+        throw new TypeError(`${label}.evidence must be one object.`);
+    }
+    return {
+        source: sourceLabel(wrapper.source, label),
+        observedAt: observationTime(wrapper.observedAt, label),
+        evidence: wrapper.evidence,
+    };
+}
+function unavailableCard(family, label, authority) {
+    return Object.freeze({
+        family,
+        label,
+        authority,
+        source: null,
+        observedAt: null,
+        state: 'unavailable',
+        completeness: 'unavailable',
+        result: null,
+        limitations: Object.freeze([`No ${label.toLowerCase()} evidence was supplied. No state was inferred from another assurance family.`]),
+    });
+}
+function dnssecCompleteness(report) {
+    return report.state === 'consistent' || report.state === 'conflict' || report.state === 'unsigned'
+        ? 'complete'
+        : report.state === 'invalid' ? 'unavailable' : 'partial';
+}
+function rpkiCompleteness(report) {
+    return report.state === 'partial' ? 'partial' : report.state === 'invalid_input' ? 'unavailable' : 'complete';
+}
+function tlsaCompleteness(report) {
+    const comparisonMaterialComplete = !report.truncated
+        && report.rejectedCount === 0
+        && !report.authorityMaterialTruncated
+        && report.authorityMaterialRejectedCount === 0
+        && report.records.every((record) => record.state !== 'unavailable');
+    return comparisonMaterialComplete
+        && (report.state === 'matched' || report.state === 'different' || report.state === 'untrusted')
+        ? 'complete'
+        : report.state === 'invalid' || report.state === 'unavailable' ? 'unavailable' : 'partial';
+}
+function buildCryptographicAssuranceReview(inputValue, generatedAt = new Date().toISOString()) {
+    const input = exactRecord(inputValue, new Set(['schema', 'version', 'dnssec', 'routeOrigin', 'tlsa']), 'Cryptographic assurance input');
+    if (input.schema !== CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA || input.version !== CRYPTOGRAPHIC_ASSURANCE_VERSION) {
+        throw new TypeError(`Cryptographic assurance input must use ${CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA} version ${CRYPTOGRAPHIC_ASSURANCE_VERSION}.`);
+    }
+    const dnssecInput = suppliedEvidence(input.dnssec, 'dnssec');
+    const routeInput = suppliedEvidence(input.routeOrigin, 'routeOrigin');
+    const tlsaInput = suppliedEvidence(input.tlsa, 'tlsa');
+    if (!dnssecInput && !routeInput && !tlsaInput)
+        throw new TypeError('Cryptographic assurance input must supply at least one evidence family.');
+    const dnssec = dnssecInput ? validateDnssecEvidence({
+        ownerName: dnssecInput.evidence.ownerName,
+        delegationSigned: dnssecInput.evidence.delegationSigned,
+        dsRecords: dnssecInput.evidence.dsRecords,
+        dnskeyRecords: dnssecInput.evidence.dnskeyRecords,
+        rrSigRecords: dnssecInput.evidence.rrSigRecords,
+        observedAt: dnssecInput.evidence.observedAt ?? dnssecInput.observedAt,
+    }) : null;
+    const routeOrigin = routeInput ? reviewRpkiRoute({
+        routePrefix: routeInput.evidence.routePrefix,
+        originAsn: routeInput.evidence.originAsn,
+        authorizations: routeInput.evidence.authorizations,
+    }) : null;
+    const tlsa = tlsaInput ? analyzeTlsaEvidence({
+        serviceName: tlsaInput.evidence.serviceName,
+        dnssecState: tlsaInput.evidence.dnssecState,
+        pkixValidationState: tlsaInput.evidence.pkixValidationState,
+        records: tlsaInput.evidence.records,
+        certificateDerBase64: tlsaInput.evidence.certificateDerBase64,
+        spkiDerBase64: tlsaInput.evidence.spkiDerBase64,
+        authorityMaterials: tlsaInput.evidence.authorityMaterials,
+    }) : null;
+    const cards = [
+        dnssec && dnssecInput ? Object.freeze({
+            family: 'dnssec_validation',
+            label: 'DNSSEC evidence review',
+            authority: 'Supplied delegation, DS, DNSKEY, and signature-time evidence',
+            source: dnssecInput.source,
+            observedAt: dnssecInput.observedAt,
+            state: dnssec.state,
+            completeness: dnssecCompleteness(dnssec),
+            result: dnssec,
+            limitations: dnssec.limitations,
+        }) : unavailableCard('dnssec_validation', 'DNSSEC evidence review', 'Supplied delegation, DS, DNSKEY, and signature-time evidence'),
+        routeOrigin && routeInput ? Object.freeze({
+            family: 'route_origin_authorisation',
+            label: 'Route-origin authorisation',
+            authority: 'Analyst-supplied validated route-origin snapshot',
+            source: routeInput.source,
+            observedAt: routeInput.observedAt,
+            state: routeOrigin.state,
+            completeness: rpkiCompleteness(routeOrigin),
+            result: routeOrigin,
+            limitations: routeOrigin.limitations,
+        }) : unavailableCard('route_origin_authorisation', 'Route-origin authorisation', 'Analyst-supplied validated route-origin snapshot'),
+        tlsa && tlsaInput ? Object.freeze({
+            family: 'dane_tlsa',
+            label: 'DANE and TLSA evidence review',
+            authority: 'Supplied TLSA, DNSSEC, PKIX, and certificate material',
+            source: tlsaInput.source,
+            observedAt: tlsaInput.observedAt,
+            state: tlsa.state,
+            completeness: tlsaCompleteness(tlsa),
+            result: tlsa,
+            limitations: tlsa.limitations,
+        }) : unavailableCard('dane_tlsa', 'DANE and TLSA evidence review', 'Supplied TLSA, DNSSEC, PKIX, and certificate material'),
+    ];
+    return Object.freeze({
+        schema: CRYPTOGRAPHIC_ASSURANCE_SCHEMA,
+        version: CRYPTOGRAPHIC_ASSURANCE_VERSION,
+        generatedAt: observationTime(generatedAt, 'generatedAt'),
+        cards: Object.freeze(cards),
+        combinedState: null,
+        limitations: Object.freeze([
+            'DNSSEC, route-origin authorisation, and DANE or TLSA remain independently sourced evidence families with separate states, observation times, completeness, and limitations.',
+            'No scalar score or combined verdict is produced. A missing, failed, partial, or unsupported family is never inferred from another family.',
+            'These reviews do not establish ownership, availability, activity, safety, or maliciousness.',
+        ]),
+    });
+}
+export { CRYPTOGRAPHIC_ASSURANCE_INPUT_SCHEMA, CRYPTOGRAPHIC_ASSURANCE_SCHEMA, CRYPTOGRAPHIC_ASSURANCE_VERSION, buildCryptographicAssuranceReview, };

package/lib/ct-search.mjs

@@ -11,6 +11,7 @@ import { normalizeCtQuery } from "./ct-query.mjs";
 import { safeFetch, readTextCapped } from "./safe-fetch.mjs";
 import { whoisleuthRequestHeaders } from "./outbound-identity.mjs";
 import { createObservation } from "./observation.mjs";
+import { isValidAsciiHostname } from "./hostname.mjs";
 import { MAX_CT_RESPONSE_CERTIFICATE_GROUPS, MAX_CT_RESPONSE_DOMAINS_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_GROUP, MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH, MAX_CT_RESPONSE_RESULTS, MAX_CT_RESPONSE_TIMESTAMP_LENGTH, } from "./ct-response-bounds.mjs";
 const CRT_SH_TIMEOUT_MS = 20000;
 const MAX_RESULTS = MAX_CT_RESPONSE_RESULTS;
@@ -40,6 +41,12 @@ const MAX_TIMEOUT_RETRIES = 1;
 // iteration/set overhead after parsing. Legitimate responses under the byte
 // cap stay well within this limit.
 const MAX_CT_ROWS = 50_000;
+// crt.sh joins SAN values with newlines. Bound the amount of per-row and
+// whole-response hostname work independently of the JSON byte and row caps so
+// a small number of newline-dense strings cannot drive unbounded PSL parsing,
+// Set growth, or sorting before the result projection is truncated.
+const MAX_CT_NAMES_PER_ROW = 1_000;
+const MAX_CT_NAMES_EXAMINED = 100_000;
 // Structured-match bounds.
 const MAX_MATCHES = MAX_RESULTS; // 500
 const MAX_HOSTNAMES_PER_MATCH = MAX_CT_RESPONSE_HOSTNAMES_PER_MATCH;
@@ -56,10 +63,12 @@ const MAX_SERIAL_LENGTH = 128;
 // Maximum length for an entry_timestamp string before it is rejected.
 const MAX_TIMESTAMP_LENGTH = MAX_CT_RESPONSE_TIMESTAMP_LENGTH;
 function normalizeHostname(raw) {
+    if (raw.length > 255)
+        return null;
     let h = raw.trim().toLowerCase();
     if (h.startsWith('*.'))
         h = h.slice(2);
-    return HOSTNAME_RE.test(h) ? h : null;
+    return HOSTNAME_RE.test(h) && isValidAsciiHostname(h, { requireLowercase: true }) ? h : null;
 }
 function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
@@ -75,7 +84,7 @@ async function fetchCrtSh(keyword, attempt = 0, dependencies = {}) {
             res = await fetcher(`https://crt.sh/?q=${encodeURIComponent(keyword)}&output=json`, {
                 headers: whoisleuthRequestHeaders({ Accept: 'application/json' }),
                 signal: controller.signal,
-            });
+            }, 0);
         }
         catch (err) {
             if (!(err instanceof Error) || err.name !== 'AbortError')
@@ -255,6 +264,8 @@ function validateEntryTimestamp(value) {
  *     certificateCount: number
  *   }>,
  *   certificateGroups: CtCertificateGroup[],
+ *   namesExamined: number,
+ *   workTruncated: boolean,
  *   truncated: boolean
  * }}
  */
@@ -275,14 +286,20 @@ function summarizeCtResults(rows) {
     // firstObservedAt: string|null, lastObservedAt: string|null }>
     const groupMap = new Map();
     const certificateMap = new Map();
-    for (let i = 0; i < rows.length; i++) {
+    let namesExamined = 0;
+    let workTruncated = false;
+    rowLoop: for (let i = 0; i < rows.length; i++) {
         const row = rows[i];
         if (!row || typeof row !== 'object')
             continue;
         const certId = resolveCertId(row, i);
-        // Collect hostnames from name_value and common_name.
-        const rawBlob = `${row.name_value || ''}\n${row.common_name || ''}`;
-        const blob = rawBlob;
+        // Collect only direct string fields. Implicitly stringifying a nested
+        // array or object would traverse attacker-controlled structure before any
+        // hostname bound could take effect.
+        const nameFields = [
+            typeof row.name_value === 'string' ? row.name_value : '',
+            typeof row.common_name === 'string' ? row.common_name : '',
+        ];
         const ts = validateEntryTimestamp(row.entry_timestamp);
         let certificate = certificateMap.get(certId);
         if (!certificate) {
@@ -297,46 +314,65 @@ function summarizeCtResults(rows) {
         else if (ts !== null && (certificate.observedAt === null || ts > certificate.observedAt)) {
             certificate.observedAt = ts;
         }
-        if (rawBlob.split('\n').some((line) => line.trim().startsWith('*.')))
-            certificate.wildcardObserved = true;
-        for (const line of blob.split('\n')) {
-            const host = normalizeHostname(line);
-            if (!host)
-                continue;
-            // Legacy: always add if valid hostname.
-            legacyDomains.add(host);
-            // Structured: resolve registrable domain.
-            let regDomain;
-            if (registrableDomainByHostname.has(host)) {
-                regDomain = registrableDomainByHostname.get(host);
-            }
-            else {
-                regDomain = parse(host).domain || null;
-                registrableDomainByHostname.set(host, regDomain);
-            }
-            if (!regDomain)
-                continue;
-            certificate.hostnames.add(host);
-            certificate.domains.add(regDomain);
-            let group = groupMap.get(regDomain);
-            if (!group) {
-                group = {
-                    hostnames: new Set(),
-                    certIds: new Set(),
-                    firstObservedAt: null,
-                    lastObservedAt: null,
-                };
-                groupMap.set(regDomain, group);
-            }
-            group.hostnames.add(host);
-            group.certIds.add(certId);
-            if (ts !== null) {
-                if (group.firstObservedAt === null || ts < group.firstObservedAt) {
-                    group.firstObservedAt = ts;
+        let rowNamesExamined = 0;
+        for (const field of nameFields) {
+            let offset = 0;
+            while (offset <= field.length) {
+                if (namesExamined >= MAX_CT_NAMES_EXAMINED) {
+                    workTruncated = true;
+                    break rowLoop;
+                }
+                if (rowNamesExamined >= MAX_CT_NAMES_PER_ROW) {
+                    workTruncated = true;
+                    continue rowLoop;
                 }
-                if (group.lastObservedAt === null || ts > group.lastObservedAt) {
-                    group.lastObservedAt = ts;
+                const newline = field.indexOf('\n', offset);
+                const line = newline === -1 ? field.slice(offset) : field.slice(offset, newline);
+                namesExamined += 1;
+                rowNamesExamined += 1;
+                if (line.trim().startsWith('*.'))
+                    certificate.wildcardObserved = true;
+                const host = normalizeHostname(line);
+                if (host) {
+                    // Legacy: always add if valid hostname.
+                    legacyDomains.add(host);
+                    // Structured: resolve registrable domain.
+                    let regDomain;
+                    if (registrableDomainByHostname.has(host)) {
+                        regDomain = registrableDomainByHostname.get(host);
+                    }
+                    else {
+                        regDomain = parse(host).domain || null;
+                        registrableDomainByHostname.set(host, regDomain);
+                    }
+                    if (regDomain) {
+                        certificate.hostnames.add(host);
+                        certificate.domains.add(regDomain);
+                        let group = groupMap.get(regDomain);
+                        if (!group) {
+                            group = {
+                                hostnames: new Set(),
+                                certIds: new Set(),
+                                firstObservedAt: null,
+                                lastObservedAt: null,
+                            };
+                            groupMap.set(regDomain, group);
+                        }
+                        group.hostnames.add(host);
+                        group.certIds.add(certId);
+                        if (ts !== null) {
+                            if (group.firstObservedAt === null || ts < group.firstObservedAt) {
+                                group.firstObservedAt = ts;
+                            }
+                            if (group.lastObservedAt === null || ts > group.lastObservedAt) {
+                                group.lastObservedAt = ts;
+                            }
+                        }
+                    }
                 }
+                if (newline === -1)
+                    break;
+                offset = newline + 1;
             }
         }
     }
@@ -404,7 +440,9 @@ function summarizeCtResults(rows) {
             wildcardObserved: group.wildcardObserved,
         })),
         certificateGroupsTruncated,
-        truncated: legacyTruncated || matchTruncated || perMatchTruncated,
+        namesExamined,
+        workTruncated,
+        truncated: workTruncated || legacyTruncated || matchTruncated || perMatchTruncated,
     };
 }
 // ---------------------------------------------------------------------------
@@ -416,11 +454,12 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
     if (!trimmed) {
         return {
             domains: [], certCount: 0, truncated: false, matches: [], certificateGroups: [], certificateGroupsTruncated: false,
+            namesExamined: 0, workTruncated: false,
             observation: createObservation({
                 status: 'success', observedAt: new Date().toISOString(), source: 'certificate_transparency',
                 durationMs: Date.now() - startedAt, complete: true, truncated: false,
                 limitations: ['Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.'],
-                diagnostics: { certificateRows: 0, matches: 0, certificateGroups: 0 },
+                diagnostics: { certificateRows: 0, namesExamined: 0, workTruncated: false, matches: 0, certificateGroups: 0 },
             }),
         };
     }
@@ -438,9 +477,10 @@ async function searchCertificateTransparency(keyword, dependencies = {}) {
             truncated: summary.truncated || summary.certificateGroupsTruncated,
             limitations: [
                 'Certificate Transparency observations indicate public certificate logging, not current site activity or maliciousness.',
+                ...(summary.workTruncated ? ['The response contained more hostname entries than the bounded local analysis could examine; retained results are partial.'] : []),
                 ...(summary.certificateGroupsTruncated ? ['The optional certificate-group projection was capped independently of the registrable-domain result set.'] : []),
             ],
-            diagnostics: { certificateRows: data.length, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
+            diagnostics: { certificateRows: data.length, namesExamined: summary.namesExamined, workTruncated: summary.workTruncated, matches: summary.matches.length, certificateGroups: summary.certificateGroups.length, certificateGroupsTruncated: summary.certificateGroupsTruncated },
         }),
     };
 }

package/lib/dns-intelligence.mjs

@@ -7,11 +7,12 @@ import * as net from 'node:net';
 import { classifyMxRecords } from "./dns-mx.mjs";
 import { collectDnsDelegationHealth, skippedDnsDelegationHealth, } from "./dns-delegation-health.mjs";
 import { createObservation } from "./observation.mjs";
+import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, } from "./lookup-network-evidence-bounds.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 import { resolveServiceBindingRecords } from "./service-binding-dns.mjs";
 const DNS_TIMEOUT_MS = 5000;
-const MAX_RECORDS_PER_TYPE = 16;
-const MAX_PTR_RECORDS = 8;
+const MAX_RECORDS_PER_TYPE = MAX_LOOKUP_DNS_RECORDS_PER_TYPE;
+const MAX_PTR_RECORDS = MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS;
 const MAX_HOSTNAME_LENGTH = 253;
 const MAX_POLICY_LENGTH = 1024;
 const MAX_ERROR_LENGTH = 180;

package/lib/dns-resolver-selection.mjs

@@ -1,5 +1,6 @@
 import { Resolver } from 'node:dns/promises';
 import { isIP } from 'node:net';
+import { isPrivateAddress } from "./safe-fetch.mjs";
 const MAX_SELECTED_DNS_RESOLVERS = 3;
 const MAX_SELECTED_DNS_RESOLVER_TEXT = 256;
 function normalizeSelectedDnsResolvers(value) {
@@ -7,15 +8,16 @@ function normalizeSelectedDnsResolvers(value) {
         throw new TypeError(`DNS resolver selection must contain at most ${MAX_SELECTED_DNS_RESOLVER_TEXT} characters.`);
     }
     const values = [...new Set(value.split(',').map((item) => item.trim()).filter(Boolean))];
-    if (!values.length || values.length > MAX_SELECTED_DNS_RESOLVERS || values.some((item) => isIP(item) === 0)) {
-        throw new TypeError(`DNS resolver selection requires 1 to ${MAX_SELECTED_DNS_RESOLVERS} literal IPv4 or IPv6 addresses.`);
+    if (!values.length || values.length > MAX_SELECTED_DNS_RESOLVERS
+        || values.some((item) => isIP(item) === 0 || isPrivateAddress(item))) {
+        throw new TypeError(`DNS resolver selection requires 1 to ${MAX_SELECTED_DNS_RESOLVERS} publicly routable literal IPv4 or IPv6 addresses.`);
     }
     return values;
 }
 function createSelectedDnsResolvers(servers) {
     if (!Array.isArray(servers) || !servers.length || servers.length > MAX_SELECTED_DNS_RESOLVERS
-        || servers.some((item) => typeof item !== 'string' || isIP(item) === 0)) {
-        throw new TypeError('Validated DNS resolver addresses are required.');
+        || servers.some((item) => typeof item !== 'string' || isIP(item) === 0 || isPrivateAddress(item))) {
+        throw new TypeError('Validated publicly routable DNS resolver addresses are required.');
     }
     const resolver = new Resolver();
     resolver.setServers([...servers]);