@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/lib/security-txt.mjs

@@ -4,7 +4,7 @@
 // Risk. Published contact and policy values are normalized into a small,
 // bounded record; the response body itself is discarded after parsing.
 import { safeFetchDetailed, readTextCapped } from "./safe-fetch.mjs";
-import { createObservation } from "./observation.mjs";
+import { createObservation } from "../packages/evidence/observation.mjs";
 const SECURITY_TXT_VERSION = 1;
 const SECURITY_TXT_PATH = '/.well-known/security.txt';
 const SECURITY_TXT_TIMEOUT_MS = 6_000;
@@ -61,6 +61,23 @@ function normalizedPublishedUri(value, schemes) {
 function normalizedHttpsUrl(value) {
     return normalizedPublishedUri(value, HTTPS_PROTOCOLS);
 }
+function normalizedCanonicalComparisonUrl(value) {
+    if (!value || value.length > MAX_SECURITY_TXT_URL_LENGTH || URI_CONTROL_CHARACTER_RE.test(value))
+        return null;
+    try {
+        const url = new URL(value.trim());
+        if (url.protocol !== 'https:' || !url.hostname || url.username || url.password)
+            return null;
+        // A fragment is never part of the retrieval URI. Preserve the query only
+        // for the transient RFC 9116 Canonical comparison; retained values remain
+        // query-free under the existing privacy-minimised output contract.
+        url.hash = '';
+        return url.toString().slice(0, MAX_SECURITY_TXT_URL_LENGTH);
+    }
+    catch {
+        return null;
+    }
+}
 function eligibleHttpsFetchUrl(value) {
     if (!value || value.length > MAX_SECURITY_TXT_URL_LENGTH || URI_CONTROL_CHARACTER_RE.test(value))
         return null;
@@ -113,6 +130,7 @@ function parseSecurityTxt(text, options = {}) {
     const policies = [];
     const encryption = [];
     const canonical = [];
+    const canonicalComparison = [];
     const preferredLanguages = [];
     const expires = [];
     for (const rawLine of lines.slice(0, MAX_SECURITY_TXT_LINES)) {
@@ -157,8 +175,11 @@ function parseSecurityTxt(text, options = {}) {
         }
         else if (field === 'canonical') {
             normalized = normalizedHttpsUrl(value);
-            if (normalized)
+            const comparisonValue = normalizedCanonicalComparisonUrl(value);
+            if (normalized && comparisonValue) {
                 canonical.push(normalized);
+                canonicalComparison.push(comparisonValue);
+            }
             else
                 malformedCount += 1;
         }
@@ -187,8 +208,10 @@ function parseSecurityTxt(text, options = {}) {
         .some((entry) => entry.truncated);
     const expiresAt = expires.length === 1 ? expires[0] : null;
     const finalUrl = options.finalUrl ? normalizedHttpsUrl(options.finalUrl) : null;
-    const canonicalMatches = boundedCanonical.values.length && finalUrl
-        ? boundedCanonical.values.some((value) => value.toLowerCase() === finalUrl.toLowerCase())
+    const finalComparisonUrl = options.finalUrl ? normalizedCanonicalComparisonUrl(options.finalUrl) : null;
+    const canonicalMatches = boundedCanonical.values.length && finalUrl && finalComparisonUrl
+        ? canonicalComparison.slice(0, MAX_SECURITY_TXT_VALUES)
+            .some((value) => value.toLowerCase() === finalComparisonUrl.toLowerCase())
         : null;
     const stale = Boolean(expiresAt && Date.parse(expiresAt) <= (options.now ?? Date.now()));
     const requiredMalformed = boundedContacts.values.length === 0 || expires.length !== 1;

package/lib/service-binding-dns.mjs

@@ -450,16 +450,21 @@ function defaultTcpExchange(query, resolver, options) {
         const chunks = [];
         let totalLength = 0;
         let settled = false;
+        let hardDeadline = null;
         const finish = (error, response) => {
             if (settled)
                 return;
             settled = true;
+            if (hardDeadline)
+                clearTimeout(hardDeadline);
             socket.destroy();
             if (error)
                 reject(error);
             else
                 resolve(response);
         };
+        hardDeadline = setTimeout(() => finish(new ServiceBindingDnsError('DNS TCP query timed out', 'ETIMEOUT')), options.timeoutMs);
+        hardDeadline.unref();
         socket.setTimeout(options.timeoutMs, () => finish(new ServiceBindingDnsError('DNS TCP query timed out', 'ETIMEOUT')));
         socket.once('error', (error) => finish(error));
         socket.on('data', (chunk) => {
@@ -605,4 +610,4 @@ async function resolveServiceBindingRecords(nameValue, type, options = {}) {
         .slice(0, MAX_ERROR_LENGTH);
     throw new ServiceBindingDnsError(detail || 'DNS query failed', 'EDNSFAIL');
 }
-export { DNS_TIMEOUT_MS as SERVICE_BINDING_DNS_TIMEOUT_MS, HTTPS_TYPE, MAX_SERVICE_BINDING_RECORDS, SVCB_TYPE, ServiceBindingDnsError, buildServiceBindingDnsQuery, formatIpv6, parseResolverEndpoint, parseServiceBindingDnsResponse, resolveServiceBindingRecords, };
+export { DNS_TIMEOUT_MS as SERVICE_BINDING_DNS_TIMEOUT_MS, HTTPS_TYPE, MAX_DNS_MESSAGE_BYTES, MAX_SERVICE_BINDING_RECORDS, SVCB_TYPE, ServiceBindingDnsError, buildServiceBindingDnsQuery, defaultTcpExchange, formatIpv6, parseResolverEndpoint, parseServiceBindingDnsResponse, resolveServiceBindingRecords, };