@slicedearth/whoisleuth-cli 2.4.0 → 2.5.1

package/lib/whois-normalization.mjs

@@ -21,7 +21,9 @@ export function normalizeWhoisChain(value) {
             ...(typeof hop.queriedAt === 'string' ? { queriedAt: hop.queriedAt.slice(0, 64) } : {}),
             ...(typeof hop.queryProfile === 'string' ? { queryProfile: hop.queryProfile.slice(0, 80) } : {}),
             ...(typeof hop.responseEncoding === 'string' ? { responseEncoding: hop.responseEncoding.slice(0, 40) } : {}),
-            ...(typeof hop.response === 'string' ? { response: hop.response.slice(0, MAX_WHOIS_BYTES) } : {}),
+            // Parser and authority analysis share protocol line endings, while the
+            // original hop retains its wire text. Lone and embedded controls remain.
+            ...(typeof hop.response === 'string' ? { response: hop.response.slice(0, MAX_WHOIS_BYTES).replace(/\r\n/g, '\n') } : {}),
             ...(typeof hop.error === 'string' ? { error: hop.error.slice(0, 1000) } : {}),
         });
     }

package/lib/whois-parser.mjs

@@ -1,13 +1,13 @@
 // WHOIS response parsing. Transport, referral-chain and stable public exports
 // remain owned by the facade in whois.mts.
 import { registryDateIso } from "./registry-dates.mjs";
-import { analyzeWhoisChainAuthority } from "./whois-authority.mjs";
+import { analyzeWhoisChainAuthority, whoisResponseMatchesDomain } from "./whois-authority.mjs";
 import { normalizeWhoisChain } from "./whois-normalization.mjs";
 import { applyWhoisCommonFormats } from "./whois-common-formats.mjs";
 import { applyWhoisDialects } from "./whois-dialects.mjs";
 import { WHOIS_FIELD_PATTERNS, normalizedWhoisContact, } from "./whois-parser-support.mjs";
 import { boundedWhoisValue, whoisFieldLimit, } from "./whois-values.mjs";
-function parseWhoisChain(chain) {
+function parseWhoisChain(chain, requestedDomain) {
     const source = normalizeWhoisChain(chain);
     const fields = {};
     const truncatedFields = new Set();
@@ -18,6 +18,8 @@ function parseWhoisChain(chain) {
         const text = hop.response;
         if (!text)
             return;
+        if (hopIndex > 0 && requestedDomain !== undefined && !whoisResponseMatchesDomain(text, requestedDomain))
+            return;
         // hopIndex 0 is always whois.iana.org, whose "domain:"/"created:"/
         // "changed:" fields describe the TLD's own root delegation record, not
         // the queried domain - e.g. "created: 1992-08-14" for .gt is Guatemala's
@@ -118,7 +120,7 @@ function parseWhoisChain(chain) {
     // Existence is decided authority-aware, not by a global "any hop said no
     // match" flag: positive registry evidence is never overridden by a later
     // registrar hop that failed, rate-limited, or returned "no match".
-    const authority = analyzeWhoisChainAuthority(source);
+    const authority = analyzeWhoisChainAuthority(source, requestedDomain);
     return {
         ...fields,
         nameservers: [...nameservers],

package/package.json

@@ -33,38 +33,37 @@
   "bugs": {
     "url": "https://github.com/slicedearth/whoisleuth/issues"
   },
-  "version": "2.4.0",
+  "version": "2.5.1",
   "dependencies": {
-    "@peculiar/x509": "2.0.0",
+    "@nuintun/qrcode": "5.0.3",
+    "@peculiar/x509": "2.1.0",
+    "fast-png": "8.0.0",
     "fflate": "0.8.3",
     "maxmind": "5.0.7",
     "parse5": "8.0.1",
+    "pdfjs-dist": "6.3.289",
+    "postal-mime": "3.0.0",
     "reflect-metadata": "0.2.2",
-    "tldts": "7.4.11",
-    "undici": "8.10.1"
+    "saxes": "6.0.0",
+    "tldts": "7.4.14",
+    "undici": "8.11.0"
   },
   "files": [
     "bin/**/*.mjs",
     "cli/**/*.mjs",
     "lib/**/*.mjs",
     "frontend/src/lib/**/*.js",
-    "packages/cases/**/*.mjs",
-    "packages/comparison/**/*.mjs",
-    "packages/contracts/**/*.mjs",
-    "packages/evidence/**/*.mjs",
-    "packages/interchange/**/*.mjs",
-    "packages/investigation/**/*.mjs",
-    "packages/monitoring/**/*.mjs",
-    "packages/workspace/**/*.mjs",
+    "packages/**/*.mjs",
+    "README.md",
     "docs/cli.md",
     "docs/cli-reference.md",
+    "docs/contextual-reviews.md",
     "DISCLOSURE",
     "LICENSE",
-    "LICENSES/*.txt",
     "NOTICE",
-    "README.md",
     "SECURITY.md",
     "TRADEMARKS.md",
+    "LICENSES/Retire.js-Apache-2.0.txt",
     "third-party-notices.txt"
   ],
   "publishConfig": {

package/packages/analysis/analyst-taxonomy.mjs

@@ -0,0 +1,40 @@
+// Deliberately small interoperability projection over reviewed MISP
+// taxonomies. WHOISleuth retains its own bounded workflow vocabulary and
+// derives machine tags only when an analyst-owned disposition and reason make
+// the mapping unambiguous. These tags never alter collection or scoring.
+const ANALYST_REVIEW_REASONS = Object.freeze([
+    Object.freeze({ value: '', label: 'Not recorded' }),
+    Object.freeze({ value: 'authorized_or_owned', label: 'Authorised or owned domain' }),
+    Object.freeze({ value: 'shared_infrastructure', label: 'Shared infrastructure explained the signal' }),
+    Object.freeze({ value: 'generic_platform_or_template', label: 'Generic platform or template' }),
+    Object.freeze({ value: 'parked_or_reseller', label: 'Parking or reseller page' }),
+    Object.freeze({ value: 'insufficient_evidence', label: 'Insufficient evidence' }),
+    Object.freeze({ value: 'legitimate_third_party', label: 'Legitimate third party' }),
+    Object.freeze({ value: 'confirmed_credential_abuse', label: 'Confirmed credential abuse' }),
+    Object.freeze({ value: 'confirmed_malware', label: 'Confirmed malware' }),
+    Object.freeze({ value: 'other_reviewed', label: 'Other reviewed reason' }),
+]);
+const ANALYST_REVIEW_REASON_VALUES = new Set(ANALYST_REVIEW_REASONS.map(({ value }) => value).filter(Boolean));
+const MISP_TAXONOMY_REFERENCES = Object.freeze([
+    Object.freeze({ namespace: 'domain-abuse', version: 2, sourceSha256: '5fcfb44742daac97061726faaaadd2ce6b7eac55306acaae3d30c3882d18f991', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/domain-abuse/machinetag.json' }),
+    Object.freeze({ namespace: 'estimative-language', version: 5, sourceSha256: '1010927d396f66f7cc58a229ebb8af6ad2cdc0250ad5f8ce3b1bd9aacf5ab4da', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/estimative-language/machinetag.json' }),
+    Object.freeze({ namespace: 'event-assessment', version: 2, sourceSha256: '39291bdd50e1b2975a93e33e396f42b398178015580a84402bc3d8d549dd721e', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/event-assessment/machinetag.json' }),
+    Object.freeze({ namespace: 'false-positive', version: 7, sourceSha256: 'ffc8d35ae36eb1d39f33611d1090793021f2bfe3b4b31ae41631e22cf544a2fb', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/false-positive/machinetag.json' }),
+    Object.freeze({ namespace: 'phishing', version: 5, sourceSha256: '8628ebe4d5935216a7b006a4d975669c4ae1a554ef8ed78ffaadd62f763d7263', sourceUrl: 'https://github.com/MISP/misp-taxonomies/blob/main/phishing/machinetag.json' }),
+]);
+function analystInteroperabilityTags(disposition, reviewReasonCode) {
+    const tags = new Set();
+    if (disposition === 'false_positive')
+        tags.add('false-positive:confirmed="true"');
+    if ((disposition === 'false_positive' || disposition === 'expected')
+        && ['authorized_or_owned', 'shared_infrastructure', 'generic_platform_or_template', 'parked_or_reseller', 'legitimate_third_party'].includes(String(reviewReasonCode)))
+        tags.add('false-positive:risk="high"');
+    if (reviewReasonCode === 'insufficient_evidence') {
+        tags.add('estimative-language:confidence-in-analytic-judgment="low"');
+    }
+    if (disposition === 'confirmed_abuse' && reviewReasonCode === 'confirmed_credential_abuse') {
+        tags.add('phishing:techniques="fake-website"');
+    }
+    return [...tags].sort();
+}
+export { ANALYST_REVIEW_REASONS, ANALYST_REVIEW_REASON_VALUES, MISP_TAXONOMY_REFERENCES, analystInteroperabilityTags, };

package/packages/analysis/bounded-json.mjs

@@ -0,0 +1,330 @@
+export const MAX_BOUNDED_JSON_DEPTH = 48;
+export const MAX_BOUNDED_JSON_KEYS = 50_000;
+export const MAX_BOUNDED_JSON_VALUES = 100_000;
+export const MAX_BOUNDED_JSON_CONTAINER_ITEMS = 10_000;
+export const UNSAFE_JSON_OBJECT_KEYS = Object.freeze(['__proto__']);
+/** Aggregate work allowed by a separately enforced UTF-8 byte budget. */
+export function boundedJsonLimitsForBytes(maximumBytes) {
+    if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 1) {
+        throw new TypeError('The JSON byte budget must be a positive safe integer.');
+    }
+    // A member needs at least five bytes (comma, two quotes, colon, value).
+    // Values need at least two bytes each, apart from a scalar root or the last
+    // array item. These upper bounds do not depend on a model's current fields.
+    // Nesting and individual-container limits remain independently bounded.
+    return {
+        maximumKeys: Math.floor(maximumBytes / 5),
+        maximumValues: Math.ceil(maximumBytes / 2),
+        // Decoded text is a lower bound on its UTF-8 JSON representation. Checking
+        // it before stringify also prevents an oversized string allocation.
+        maximumStringCodeUnits: maximumBytes,
+    };
+}
+function syntaxError() {
+    throw new TypeError('Artefact input is not valid JSON.');
+}
+export function isSafeJsonObjectKey(value) {
+    return !UNSAFE_JSON_OBJECT_KEYS.includes(value);
+}
+export function assertBoundedJsonStructure(value, label = 'JSON value', limits = {}) {
+    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
+    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
+    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
+    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
+    let keys = 0;
+    let values = 0;
+    let stringCodeUnits = 0;
+    const ancestors = new Set();
+    const text = (value) => {
+        stringCodeUnits += value.length;
+        if (limits.maximumStringCodeUnits !== undefined && stringCodeUnits > limits.maximumStringCodeUnits) {
+            throw new TypeError(`${label} exceeds the aggregate text limit.`);
+        }
+    };
+    const visit = (current, depth) => {
+        values += 1;
+        if (values > maximumValues) {
+            throw new TypeError(`${label} exceeds the ${maximumValues}-value limit.`);
+        }
+        if (depth > maximumDepth) {
+            throw new TypeError(`${label} exceeds the ${maximumDepth}-level nesting limit.`);
+        }
+        if (typeof current === 'string') {
+            text(current);
+            return;
+        }
+        if (current === null || typeof current === 'boolean')
+            return;
+        if (typeof current === 'number') {
+            if (!Number.isFinite(current))
+                throw new TypeError(`${label} contains a non-JSON number.`);
+            return;
+        }
+        if (typeof current !== 'object')
+            throw new TypeError(`${label} contains a non-JSON value.`);
+        if (ancestors.has(current))
+            throw new TypeError(`${label} contains a cyclic object reference.`);
+        let prototype;
+        let ownKeys;
+        let descriptors;
+        try {
+            prototype = Object.getPrototypeOf(current);
+            ownKeys = Reflect.ownKeys(current);
+            descriptors = Object.getOwnPropertyDescriptors(current);
+        }
+        catch {
+            throw new TypeError(`${label} could not be inspected safely.`);
+        }
+        if (ownKeys.some((key) => typeof key !== 'string')) {
+            throw new TypeError(`${label} contains a symbol key.`);
+        }
+        if (ownKeys.some((key) => {
+            const descriptor = descriptors[String(key)];
+            return !descriptor || !Object.hasOwn(descriptor, 'value');
+        })) {
+            throw new TypeError(`${label} contains an accessor property.`);
+        }
+        ancestors.add(current);
+        if (Array.isArray(current)) {
+            if (prototype !== Array.prototype) {
+                throw new TypeError(`${label} contains an array with a custom prototype.`);
+            }
+            const length = descriptors.length?.value;
+            if (!Number.isSafeInteger(length) || length < 0 || length > maximumContainerItems) {
+                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
+            }
+            const indexes = ownKeys.filter((key) => key !== 'length');
+            if (indexes.length !== length
+                || indexes.some((key, index) => key !== String(index) || descriptors[key]?.enumerable !== true)) {
+                throw new TypeError(`${label} contains a sparse, extended, or non-enumerable array.`);
+            }
+            for (const key of indexes)
+                visit(descriptors[key].value, depth + 1);
+        }
+        else {
+            if (prototype !== Object.prototype && prototype !== null) {
+                throw new TypeError(`${label} contains an object with a custom prototype.`);
+            }
+            const objectKeys = ownKeys;
+            if (objectKeys.length > maximumContainerItems) {
+                throw new TypeError(`${label} contains a container with more than ${maximumContainerItems} items.`);
+            }
+            if (objectKeys.some((key) => descriptors[key]?.enumerable !== true)) {
+                throw new TypeError(`${label} contains a non-enumerable object property.`);
+            }
+            keys += objectKeys.length;
+            if (keys > maximumKeys) {
+                throw new TypeError(`${label} exceeds the ${maximumKeys}-key limit.`);
+            }
+            for (const key of objectKeys) {
+                if (!isSafeJsonObjectKey(key))
+                    throw new TypeError(`${label} contains an unsafe object key.`);
+                text(key);
+                visit(descriptors[key].value, depth + 1);
+            }
+        }
+        ancestors.delete(current);
+    };
+    visit(value, 0);
+}
+export function scanBoundedJson(raw, limits = {}, observeString) {
+    const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
+    const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
+    const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
+    const maximumContainerItems = limits.maximumContainerItems ?? MAX_BOUNDED_JSON_CONTAINER_ITEMS;
+    let index = 0;
+    let keys = 0;
+    let values = 0;
+    let stringCodeUnits = 0;
+    const whitespace = () => {
+        while (index < raw.length) {
+            const code = raw.charCodeAt(index);
+            if (code !== 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d)
+                break;
+            index += 1;
+        }
+    };
+    const stringToken = () => {
+        const start = index;
+        index += 1;
+        while (index < raw.length) {
+            const character = raw[index];
+            if (character === '"') {
+                index += 1;
+                let value;
+                try {
+                    value = JSON.parse(raw.slice(start, index));
+                }
+                catch {
+                    syntaxError();
+                }
+                stringCodeUnits += value.length;
+                if (limits.maximumStringCodeUnits !== undefined && stringCodeUnits > limits.maximumStringCodeUnits) {
+                    throw new TypeError('Artefact JSON exceeds the aggregate text limit.');
+                }
+                return { value, offset: start };
+            }
+            if (character === '\\') {
+                index += 1;
+                if (index >= raw.length)
+                    syntaxError();
+                if (raw[index] === 'u') {
+                    if (!/^[a-fA-F0-9]{4}$/u.test(raw.slice(index + 1, index + 5)))
+                        syntaxError();
+                    index += 5;
+                }
+                else {
+                    if (!/["\\/bfnrt]/u.test(raw[index]))
+                        syntaxError();
+                    index += 1;
+                }
+                continue;
+            }
+            if (character.charCodeAt(0) <= 0x1f)
+                syntaxError();
+            index += 1;
+        }
+        return syntaxError();
+    };
+    const literal = (token) => {
+        if (raw.slice(index, index + token.length) !== token)
+            syntaxError();
+        index += token.length;
+    };
+    const number = () => {
+        const match = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/u.exec(raw.slice(index));
+        if (!match)
+            syntaxError();
+        if (!Number.isFinite(Number(match[0]))) {
+            throw new TypeError('Artefact JSON contains a non-finite number.');
+        }
+        index += match[0].length;
+    };
+    const value = (depth, propertyKey) => {
+        values += 1;
+        if (values > maximumValues) {
+            throw new TypeError(`Artefact JSON exceeds the ${maximumValues}-value limit.`);
+        }
+        if (depth > maximumDepth) {
+            throw new TypeError(`Artefact JSON exceeds the ${maximumDepth}-level nesting limit.`);
+        }
+        whitespace();
+        const character = raw[index];
+        if (character === '"') {
+            const parsedString = stringToken();
+            observeString?.({ ...parsedString, kind: 'value', ...(propertyKey === undefined ? {} : { propertyKey }) });
+            return;
+        }
+        if (character === '{') {
+            index += 1;
+            whitespace();
+            const seen = new Set();
+            if (raw[index] === '}') {
+                index += 1;
+                return;
+            }
+            while (index < raw.length) {
+                if (raw[index] !== '"')
+                    syntaxError();
+                const parsedKey = stringToken();
+                const key = parsedKey.value;
+                if (seen.size >= maximumContainerItems) {
+                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
+                }
+                keys += 1;
+                if (keys > maximumKeys) {
+                    throw new TypeError(`Artefact JSON exceeds the ${maximumKeys}-key limit.`);
+                }
+                if (seen.has(key))
+                    throw new TypeError('Artefact JSON contains a duplicate object key.');
+                if (!isSafeJsonObjectKey(key))
+                    throw new TypeError('Artefact JSON contains an unsafe object key.');
+                seen.add(key);
+                observeString?.({ ...parsedKey, kind: 'key' });
+                whitespace();
+                if (raw[index] !== ':')
+                    syntaxError();
+                index += 1;
+                value(depth + 1, key);
+                whitespace();
+                if (raw[index] === '}') {
+                    index += 1;
+                    return;
+                }
+                if (raw[index] !== ',')
+                    syntaxError();
+                index += 1;
+                whitespace();
+            }
+            syntaxError();
+        }
+        if (character === '[') {
+            index += 1;
+            whitespace();
+            if (raw[index] === ']') {
+                index += 1;
+                return;
+            }
+            let items = 0;
+            while (index < raw.length) {
+                items += 1;
+                if (items > maximumContainerItems) {
+                    throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
+                }
+                value(depth + 1);
+                whitespace();
+                if (raw[index] === ']') {
+                    index += 1;
+                    return;
+                }
+                if (raw[index] !== ',')
+                    syntaxError();
+                index += 1;
+                whitespace();
+            }
+            syntaxError();
+        }
+        if (character === 't') {
+            literal('true');
+            return;
+        }
+        if (character === 'f') {
+            literal('false');
+            return;
+        }
+        if (character === 'n') {
+            literal('null');
+            return;
+        }
+        number();
+    };
+    whitespace();
+    value(0);
+    whitespace();
+    if (index !== raw.length)
+        syntaxError();
+}
+export function parseBoundedJson(raw, options) {
+    const label = options.label ?? 'Artefact input';
+    if (typeof raw !== 'string')
+        throw new TypeError(`${label} must be UTF-8 JSON text.`);
+    const bytes = new TextEncoder().encode(raw).byteLength;
+    if (bytes < 1 || bytes > options.maximumBytes) {
+        throw new TypeError(`${label} must be between 1 byte and ${options.maximumBytes} bytes.`);
+    }
+    scanBoundedJson(raw, options.limits);
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return syntaxError();
+    }
+}
+export function parseBoundedJsonObject(raw, options) {
+    const label = options.label ?? 'Artefact input';
+    const parsed = parseBoundedJson(raw, options);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new TypeError(`${label} must contain one JSON object.`);
+    }
+    return parsed;
+}

package/packages/analysis/candidate-provenance-bounds.mjs

@@ -0,0 +1,4 @@
+// Browser-safe bounds shared by candidate discovery responses and the
+// Discover-to-Bulk handoff. These are provenance labels, not domain names;
+// they remain bounded independently of the target-domain contract.
+export const MAX_CANDIDATE_SOURCE_LENGTH = 253;