@slicedearth/whoisleuth-cli 2.3.0 → 2.5.1

package/lib/registry-insights.mjs

@@ -7,6 +7,8 @@
 import { compareRegistrySources } from "./registry-comparison.mjs";
 import { inspectRdapCapabilities } from "./rdap-capabilities.mjs";
 import { isRecord, recordOrEmpty } from "./json-record.mjs";
+import { MAX_RDAP_REDACTIONS, MAX_RDAP_STATUSES } from "./rdap-types.mjs";
+import { MAX_WHOIS_STATUSES } from "./whois-contracts.mjs";
 export const REGISTRY_INSIGHTS_VERSION = 1;
 export const MAX_REGISTRY_INSIGHT_STATUSES = 40;
 export const MAX_REGISTRY_INSIGHT_ISSUES = 12;
@@ -37,6 +39,20 @@ function strings(value, maximum = MAX_REGISTRY_INSIGHT_STATUSES) {
 function normalizedStatus(value) {
     return text(value, 160).toLowerCase().replace(/[^\p{L}\p{N}]+/gu, '');
 }
+function statusInventory(value, maximum) {
+    if (!Array.isArray(value))
+        return { values: [], partial: value !== undefined };
+    const unique = new Set();
+    let partial = value.length > maximum;
+    for (const item of value.slice(0, maximum)) {
+        if (typeof item !== 'string' || item.length > 160 || CONTROL_RE.test(item) || !item.trim()) {
+            partial = true;
+            continue;
+        }
+        unique.add(item.trim());
+    }
+    return { values: [...unique], partial };
+}
 function sourceState(status, partial) {
     if (partial || status === 'partial')
         return 'partial';
@@ -45,9 +61,13 @@ function sourceState(status, partial) {
         ? 'complete'
         : 'unavailable';
 }
-function redactionBlob(parsed) {
-    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 50) : [];
-    return redactions.map((item) => {
+function registrantRedactionBlob(parsed) {
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, MAX_RDAP_REDACTIONS) : [];
+    return redactions.filter((item) => {
+        // A path or reason can mention a role without selecting it. Do not infer
+        // registrant scope from arbitrary JSONPath expressions or other prose.
+        return /^(?:registry )?registrant(?:\b|$)/iu.test(text(record(item).name, 240));
+    }).map((item) => {
         const value = record(item);
         return [
             value.name,
@@ -92,7 +112,8 @@ function disclosure(source, parsedValue, status) {
         ? parsed.chainStatus === 'partial' || strings(parsed.fieldsTruncated, 20).length > 0
         : parsed.serverTruncated === true
             || parsed.entitiesTruncated === true
-            || parsed.statusesTruncated === true;
+            || parsed.statusesTruncated === true
+            || parsed.redactionsTruncated === true;
     const publicationState = sourceState(status, partial);
     if (publicationState === 'unavailable') {
         return {
@@ -110,7 +131,7 @@ function disclosure(source, parsedValue, status) {
             parsed.registrantPhone,
             parsed.registrantAddress,
         ].map((part) => text(part, 320)).filter(Boolean).join(' ');
-    const redactions = redactionBlob(parsed);
+    const redactions = registrantRedactionBlob(parsed);
     const combined = `${registrant} ${redactions}`.trim();
     if (WITHHELD_RE.test(combined)) {
         return { source, state: 'withheld', detail: 'The publication indicates that registrant data was withheld or not disclosed.' };
@@ -124,6 +145,13 @@ function disclosure(source, parsedValue, status) {
     if (registrant) {
         return { source, state: 'public', detail: 'The source published at least one usable registrant contact field.' };
     }
+    if (Array.isArray(parsed.redactions) && parsed.redactions.length > 0) {
+        return {
+            source,
+            state: 'unavailable',
+            detail: 'Redaction declarations do not establish registrant scope, so missing registrant fields remain unclassified.',
+        };
+    }
     if (publicationState === 'partial') {
         return {
             source,
@@ -137,9 +165,9 @@ function disclosure(source, parsedValue, status) {
         detail: 'The source completed without a usable registrant contact or an explicit disclosure marker.',
     };
 }
-function lifecycle(statusesValue, evidenceState) {
-    const rawStatuses = strings(statusesValue);
-    const normalized = rawStatuses.map(normalizedStatus);
+function lifecycle(statuses, evidenceState) {
+    const rawStatuses = statuses.slice(0, MAX_REGISTRY_INSIGHT_STATUSES);
+    const normalized = statuses.map(normalizedStatus);
     const has = (value) => normalized.includes(value);
     const observedState = (value) => has(value) ? true : evidenceState === 'complete' ? false : null;
     const pendingDelete = observedState('pendingdelete');
@@ -200,16 +228,20 @@ function lifecycle(statusesValue, evidenceState) {
             serverStatuses: serverLocks,
         },
         acquisitionPath,
-        limitation: 'EPP statuses describe the current registry lifecycle. They do not guarantee deletion, release timing, transfer completion, eligibility, price, or acquisition success.',
+        limitation: 'EPP statuses describe the current registry lifecycle. They do not guarantee deletion, release timing, transfer completion, eligibility, price, or acquisition success.'
+            + (statuses.length > rawStatuses.length ? ` The display lists ${rawStatuses.length} of ${statuses.length} distinct statuses; lifecycle decisions use the full admitted inventory.` : ''),
     };
 }
-function publicationDiagnostic(source, parsedValue, status, observedAt) {
+function publicationDiagnostic(source, parsedValue, status, observedAt, statuses) {
     const usablePublication = isRecord(parsedValue);
     const parsed = record(parsedValue);
     const partial = parsed.serverTruncated === true
         || parsed.chainStatus === 'partial'
         || parsed.entitiesTruncated === true
         || parsed.statusesTruncated === true
+        || statuses.partial
+        || parsed.eventsTruncated === true
+        || parsed.redactionsTruncated === true
         || strings(parsed.fieldsTruncated, 20).length > 0;
     const state = usablePublication ? sourceState(status, partial) : 'unavailable';
     const issues = [];
@@ -219,14 +251,18 @@ function publicationDiagnostic(source, parsedValue, status, observedAt) {
         issues.push('The RDAP server declared a truncated response.');
     if (parsed.entitiesTruncated === true)
         issues.push('The normalised entity inventory was capped.');
-    if (parsed.statusesTruncated === true)
-        issues.push('The normalised status inventory was capped.');
+    if (parsed.statusesTruncated === true || statuses.partial)
+        issues.push('The normalised status inventory contains omitted or rejected values.');
+    if (parsed.eventsTruncated === true)
+        issues.push('The normalised event inventory contains omitted or rejected fields.');
+    if (parsed.redactionsTruncated === true)
+        issues.push('The normalised redaction inventory contains omitted or rejected declarations.');
     if (strings(parsed.fieldsTruncated, 20).length)
         issues.push('One or more normalised WHOIS fields were capped.');
     if (parsed.chainStatus === 'partial')
         issues.push('The WHOIS referral chain was incomplete or conflicting.');
     const conformance = strings(parsed.conformance, 30);
-    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, 50) : [];
+    const redactions = Array.isArray(parsed.redactions) ? parsed.redactions.slice(0, MAX_RDAP_REDACTIONS) : [];
     return {
         source,
         state,
@@ -277,14 +313,16 @@ export function buildRegistryInsights(input) {
                 : counts.equivalent
                     ? 'consistent'
                     : 'unavailable';
+    const rdapStatuses = statusInventory(rdap.statuses, MAX_RDAP_STATUSES);
+    const whoisStatuses = statusInventory(whois.statuses, MAX_WHOIS_STATUSES);
     const publications = [
-        publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt),
-        publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt),
-        publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt),
+        publicationDiagnostic('registry_rdap', input.rdapParsed, input.rdapStatus, input.rdapFetchedAt, rdapStatuses),
+        publicationDiagnostic('whois', input.whoisParsed, input.whoisStatus, input.whoisQueriedAt, whoisStatuses),
+        publicationDiagnostic('registrar_rdap', input.registrarRdapParsed, input.registrarRdapStatus, input.registrarRdapFetchedAt, statusInventory(registrarRdap.statuses, MAX_RDAP_STATUSES)),
     ];
     const lifecycleCandidates = [
-        { statuses: strings(rdap.statuses), state: publications[0].state },
-        { statuses: strings(whois.statuses), state: publications[1].state },
+        { statuses: rdapStatuses.values, state: publications[0].state },
+        { statuses: whoisStatuses.values, state: publications[1].state },
     ].filter((candidate) => candidate.state !== 'unavailable');
     const lifecycleSource = lifecycleCandidates.find((candidate) => candidate.statuses.length)
         ?? lifecycleCandidates[0]

package/lib/response-policy.mjs

@@ -1,7 +1,7 @@
 // Privacy-minimized interpretation of selected response policies. Header and
 // cookie values are read transiently from the already-selected homepage
 // response and reduced to fixed signal identifiers plus bounded counts.
-export const RESPONSE_POLICY_VERSION = 2;
+export const RESPONSE_POLICY_VERSION = 3;
 export const MAX_RESPONSE_POLICY_HEADER_BYTES = 8 * 1024;
 export const MAX_CSP_META_POLICIES = 4;
 export const MAX_RESPONSE_POLICY_DIRECTIVES = 64;
@@ -13,7 +13,9 @@ export const MIN_RECOMMENDED_HSTS_SECONDS = 180 * 24 * 60 * 60;
 const CONTROL_RE = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
 const DIRECTIVE_NAME_RE = /^[a-z][a-z0-9-]{0,63}$/;
 const ATTRIBUTE_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]{1,128}$/;
-const CSP_NONCE_OR_HASH_RE = /^'(?:nonce-[^']+|sha(?:256|384|512)-[^']+)'$/i;
+// CSP source-list grammar, not an entropy or digest-strength judgement. Invalid
+// source expressions are ignored by browsers and cannot suppress unsafe-inline.
+const CSP_NONCE_OR_HASH_RE = /^'(?:nonce-|sha(?:256|384|512)-)[A-Za-z0-9+/_-]+={0,2}'$/i;
 const REFERRER_POLICIES = new Set([
     'no-referrer',
     'no-referrer-when-downgrade',
@@ -42,7 +44,8 @@ function readHeader(headers, name) {
         return { state: 'absent', value: null };
     if (CONTROL_RE.test(raw))
         return { state: 'malformed', value: null };
-    if (new TextEncoder().encode(raw).byteLength > MAX_RESPONSE_POLICY_HEADER_BYTES) {
+    if (raw.length > MAX_RESPONSE_POLICY_HEADER_BYTES
+        || new TextEncoder().encode(raw).byteLength > MAX_RESPONSE_POLICY_HEADER_BYTES) {
         return { state: 'partial', value: null };
     }
     return { state: 'present', value: raw.trim() };
@@ -55,61 +58,96 @@ function addSignal(signals, id, count) {
 function unavailableHeaderState(header) {
     return header.state === 'present' ? 'malformed' : header.state;
 }
-function analyzeCsp(header, signals) {
+function inlineControl(sources, scriptsBlocked) {
+    if (scriptsBlocked)
+        return 'restricted';
+    if (!sources)
+        return 'uncontrolled';
+    return sources.includes("'unsafe-inline'")
+        && !sources.includes("'strict-dynamic'")
+        && !sources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))
+        ? 'unqualified'
+        : 'restricted';
+}
+function intersectInlineControls(controls) {
+    if (controls.includes('restricted'))
+        return 'restricted';
+    if (controls.includes('unknown'))
+        return 'unknown';
+    return controls.includes('unqualified') ? 'unqualified' : 'uncontrolled';
+}
+function analyzeCsp(header, signals, fromMeta = false) {
     if (header.state !== 'present' || !header.value) {
         return { state: unavailableHeaderState(header), inlineControl: 'unknown' };
     }
-    const directives = new Map();
+    // Fetch combines repeated policy headers with commas. Each policy is
+    // independently enforced; later policies cannot loosen an earlier one.
+    const policies = [];
+    let directiveCount = 0;
     let tokenCount = 0;
-    let partial = false;
-    for (const rawDirective of header.value.split(';')) {
-        const normalized = rawDirective.trim();
-        if (!normalized)
-            continue;
-        const [rawName = '', ...rawTokens] = normalized.split(/\s+/u);
-        const name = rawName.toLowerCase();
-        if (!DIRECTIVE_NAME_RE.test(name))
-            return { state: 'malformed', inlineControl: 'unknown' };
-        if (directives.has(name))
-            continue;
-        if (directives.size >= MAX_RESPONSE_POLICY_DIRECTIVES) {
-            partial = true;
-            break;
+    for (const rawPolicy of (fromMeta ? [header.value] : header.value.split(','))) {
+        const directives = new Map();
+        for (const rawDirective of rawPolicy.split(';')) {
+            const normalized = rawDirective.trim();
+            if (!normalized)
+                continue;
+            const [rawName = '', ...rawTokens] = normalized.split(/[\t\n\f\r ]+/u);
+            const name = rawName.toLowerCase();
+            if (!DIRECTIVE_NAME_RE.test(name))
+                return { state: 'malformed', inlineControl: 'unknown' };
+            // Duplicate directives use their first value. Count even ignored input
+            // against the aggregate work bound rather than resetting per policy.
+            directiveCount += 1;
+            tokenCount += rawTokens.length;
+            if (directiveCount > MAX_RESPONSE_POLICY_DIRECTIVES || tokenCount > MAX_RESPONSE_POLICY_TOKENS) {
+                return { state: 'partial', inlineControl: 'unknown' };
+            }
+            if (!directives.has(name))
+                directives.set(name, rawTokens.map((token) => token.toLowerCase()));
         }
-        const remaining = Math.max(0, MAX_RESPONSE_POLICY_TOKENS - tokenCount);
-        const tokens = rawTokens.slice(0, remaining).map((token) => token.toLowerCase());
-        if (tokens.length !== rawTokens.length)
-            partial = true;
-        tokenCount += tokens.length;
-        directives.set(name, tokens);
+        if (directives.size)
+            policies.push(directives);
     }
-    if (!directives.size)
+    if (!policies.length)
         return { state: 'malformed', inlineControl: 'unknown' };
-    const defaultSources = directives.get('default-src');
-    const scriptSources = directives.get('script-src') || defaultSources;
-    if (!defaultSources)
+    if (policies.every((policy) => !policy.has('default-src')))
         addSignal(signals, 'csp_default_source_missing');
-    if (!directives.has('base-uri'))
+    if (policies.every((policy) => !policy.has('base-uri')))
         addSignal(signals, 'csp_base_uri_missing');
-    if (!directives.has('object-src') && !defaultSources)
+    if (policies.every((policy) => !policy.has('object-src') && !policy.has('default-src'))) {
         addSignal(signals, 'csp_object_source_unbounded');
-    let inlineControl = scriptSources ? 'restricted' : 'uncontrolled';
-    if (scriptSources) {
-        if (scriptSources.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token))) {
-            addSignal(signals, 'csp_permissive_script_source');
-        }
-        if (scriptSources.includes("'unsafe-eval'"))
-            addSignal(signals, 'csp_unsafe_eval');
-        if (scriptSources.includes("'unsafe-inline'")
-            && !scriptSources.some((token) => CSP_NONCE_OR_HASH_RE.test(token))) {
-            addSignal(signals, 'csp_unsafe_inline');
-            inlineControl = 'unqualified';
-        }
     }
-    return {
-        state: partial ? 'partial' : 'parsed',
-        inlineControl: partial ? 'unknown' : inlineControl,
-    };
+    const contexts = policies.map((policy) => {
+        const scripts = policy.get('script-src') ?? policy.get('default-src');
+        const elements = policy.get('script-src-elem') ?? scripts;
+        const attributes = policy.get('script-src-attr') ?? scripts;
+        const sandbox = fromMeta ? undefined : policy.get('sandbox');
+        const scriptsBlocked = sandbox !== undefined && !sandbox.includes('allow-scripts');
+        return {
+            blocks: inlineControl(elements, scriptsBlocked),
+            attributes: inlineControl(attributes, scriptsBlocked),
+            // script-src-elem/attr never govern evaluation, even when they contain
+            // an unsafe-eval token. An absent script/default source is uncontrolled.
+            evaluation: !scriptsBlocked && (!scripts || scripts.includes("'unsafe-eval'")),
+            declaresEvaluation: scripts?.includes("'unsafe-eval'") === true,
+            broadSource: !scriptsBlocked && (!elements || (!elements.includes("'strict-dynamic'")
+                && elements.some((token) => ['*', 'http:', 'https:', 'data:', 'blob:'].includes(token)))),
+            declaresBroadSource: elements !== undefined,
+        };
+    });
+    if (contexts.every((context) => context.broadSource) && contexts.some((context) => context.declaresBroadSource)) {
+        addSignal(signals, 'csp_permissive_script_source');
+    }
+    if (contexts.every((context) => context.evaluation) && contexts.some((context) => context.declaresEvaluation)) {
+        addSignal(signals, 'csp_unsafe_eval');
+    }
+    const blocks = intersectInlineControls(contexts.map((context) => context.blocks));
+    if (blocks === 'unqualified')
+        addSignal(signals, 'csp_unsafe_inline');
+    if (intersectInlineControls(contexts.map((context) => context.attributes)) === 'unqualified') {
+        addSignal(signals, 'csp_unsafe_inline_attributes');
+    }
+    return { state: 'parsed', inlineControl: blocks };
 }
 export function analyzeCspMetaPolicies(value, sourceTruncated = false) {
     const candidates = Array.isArray(value) ? value : [];
@@ -127,7 +165,7 @@ export function analyzeCspMetaPolicies(value, sourceTruncated = false) {
         }
         const policyContent = policy.content;
         const content = readHeader({ get: () => policyContent }, 'content-security-policy');
-        const analysis = analyzeCsp(content, []);
+        const analysis = analyzeCsp(content, [], true);
         if (analysis.state !== 'parsed') {
             truncated = true;
             continue;