@sudobility/sider_lib 0.0.5 → 0.0.7

package/dist/tokenize.js

@@ -43,17 +43,33 @@ export function tokenizeObservation(raw, known) {
         });
     };
     // 1. Known values (exact substring match everywhere).
+    //
+    // `known` is EVERY cookie and storage entry the page has, not the ones this
+    // request uses, so most of them appear nowhere in it. Masking still runs
+    // unconditionally — that costs nothing and protects a value wherever it turns
+    // up — but a SLOT is only proposed for a value actually found in the request.
+    //
+    // Minting one regardless, at a default of `authorization`, invented an
+    // injection point out of an absence of evidence: a public GET carried 21
+    // headers all named `authorization`, each holding a different analytics
+    // cookie, because every cookie on the page fell through to that default.
+    // Where a value goes is something to observe, never to assume.
     for (const s of known) {
         if (!s.value)
             continue;
-        const loc = locate(raw, s.value) ?? { at: "header", name: "authorization" };
+        const loc = locate(raw, s.value);
         const ph = samplePlaceholder(s.slotId);
         url = url.split(s.value).join(ph);
         for (const k of Object.keys(headers))
             headers[k] = headers[k].split(s.value).join(ph);
         requestBody = replaceInJson(requestBody, s.value, ph);
         responseBody = replaceInJson(responseBody, s.value, ph);
-        ensure(s.slotId, s.kind, s.role, loc, s.resolverHint);
+        if (!loc)
+            continue;
+        // Found inside the Cookie header: the browser put it there, so it is
+        // attached automatically at execution rather than substituted by us.
+        const inCookieHeader = loc.at === "header" && loc.name.toLowerCase() === "cookie";
+        ensure(s.slotId, s.kind, inCookieHeader ? "auto_cookie" : s.role, inCookieHeader ? { at: "cookie", name: loc.name } : loc, s.resolverHint);
     }
     // 2. Credential-bearing headers (by name), even when the value wasn't in storage.
     for (const name of Object.keys(headers)) {

package/dist/tokenize.test.js

@@ -40,3 +40,46 @@ test("leaves non-secret data untouched", () => {
     const { observation } = tokenizeObservation(raw({ responseBody: { price: 400, section: "A1" } }), []);
     expect(observation.responseBody).toEqual({ price: 400, section: "A1" });
 });
+// --- where a secret goes is observed, never assumed ------------------------
+const analyticsCookie = (value = "GA1.2.9876") => ({
+    value,
+    slotId: "slot:www.usfca.edu:cookie_ga",
+    kind: "unknown",
+    role: "active_inject",
+    resolverHint: { from: "cookie", name: "_ga" },
+});
+test("proposes no slot for a page secret the request never carries", () => {
+    // Every cookie and storage entry on the page is offered as `known`, not the
+    // ones this request uses. Defaulting the absent ones to an Authorization
+    // header gave a public GET 21 headers all named `authorization`, each holding
+    // a different analytics cookie.
+    const { slots } = tokenizeObservation(raw(), [analyticsCookie()]);
+    expect(slots).toEqual([]);
+});
+test("still masks a value it proposes no slot for", () => {
+    // Absent from the REQUEST is not absent from the observation: the same value
+    // echoed in a response body must not be uploaded in the clear.
+    const { observation, slots } = tokenizeObservation(raw({ responseBody: { tracker: "GA1.2.9876" } }), [analyticsCookie()]);
+    expect(JSON.stringify(observation.responseBody)).not.toContain("GA1.2.9876");
+    expect(slots).toEqual([]);
+});
+test("proposes a slot where the value is actually found", () => {
+    const { slots } = tokenizeObservation(raw({ requestHeaders: { "x-session": "GA1.2.9876" } }), [analyticsCookie()]);
+    expect(slots).toHaveLength(1);
+    expect(slots[0].injectionLocation).toEqual({ at: "header", name: "x-session" });
+    expect(slots[0].role).toBe("active_inject");
+});
+test("finds a value in a query parameter", () => {
+    const { slots } = tokenizeObservation(raw({ url: "https://resale.fifa.com/api/seats?sid=GA1.2.9876" }), [analyticsCookie()]);
+    expect(slots[0].injectionLocation).toEqual({ at: "query", param: "sid" });
+});
+test("finds a value in the request body", () => {
+    const { slots } = tokenizeObservation(raw({ method: "POST", requestBody: { auth: { token: "GA1.2.9876" } } }), [analyticsCookie()]);
+    expect(slots[0].injectionLocation).toEqual({ at: "body", jsonPath: "auth.token" });
+});
+test("a value found in the Cookie header is attached by the browser, not injected", () => {
+    const { slots } = tokenizeObservation(raw({ requestHeaders: { cookie: "_ga=GA1.2.9876" } }), [analyticsCookie()]);
+    const slot = slots.find((s) => s.id === "slot:www.usfca.edu:cookie_ga");
+    expect(slot.role).toBe("auto_cookie");
+    expect(slot.injectionLocation.at).toBe("cookie");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sudobility/sider_lib",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "Sider business logic — recipe compiler, egress gates, tokenizer, clustering. Pure, no Chrome/DOM/server.",
   "license": "BUSL-1.1",
   "publishConfig": {
@@ -19,7 +19,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@sudobility/sider_types": "^0.0.5"
+    "@sudobility/sider_types": "^0.0.6"
   },
   "devDependencies": {
     "@types/bun": "^1.3.14",

package/src/tokenize.test.ts

@@ -52,3 +52,69 @@ test("leaves non-secret data untouched", () => {
   const { observation } = tokenizeObservation(raw({ responseBody: { price: 400, section: "A1" } }), []);
   expect(observation.responseBody).toEqual({ price: 400, section: "A1" });
 });
+
+// --- where a secret goes is observed, never assumed ------------------------
+
+const analyticsCookie = (value = "GA1.2.9876"): KnownSecret => ({
+  value,
+  slotId: "slot:www.usfca.edu:cookie_ga",
+  kind: "unknown",
+  role: "active_inject",
+  resolverHint: { from: "cookie", name: "_ga" },
+});
+
+test("proposes no slot for a page secret the request never carries", () => {
+  // Every cookie and storage entry on the page is offered as `known`, not the
+  // ones this request uses. Defaulting the absent ones to an Authorization
+  // header gave a public GET 21 headers all named `authorization`, each holding
+  // a different analytics cookie.
+  const { slots } = tokenizeObservation(raw(), [analyticsCookie()]);
+  expect(slots).toEqual([]);
+});
+
+test("still masks a value it proposes no slot for", () => {
+  // Absent from the REQUEST is not absent from the observation: the same value
+  // echoed in a response body must not be uploaded in the clear.
+  const { observation, slots } = tokenizeObservation(
+    raw({ responseBody: { tracker: "GA1.2.9876" } }),
+    [analyticsCookie()],
+  );
+  expect(JSON.stringify(observation.responseBody)).not.toContain("GA1.2.9876");
+  expect(slots).toEqual([]);
+});
+
+test("proposes a slot where the value is actually found", () => {
+  const { slots } = tokenizeObservation(
+    raw({ requestHeaders: { "x-session": "GA1.2.9876" } }),
+    [analyticsCookie()],
+  );
+  expect(slots).toHaveLength(1);
+  expect(slots[0]!.injectionLocation).toEqual({ at: "header", name: "x-session" });
+  expect(slots[0]!.role).toBe("active_inject");
+});
+
+test("finds a value in a query parameter", () => {
+  const { slots } = tokenizeObservation(
+    raw({ url: "https://resale.fifa.com/api/seats?sid=GA1.2.9876" }),
+    [analyticsCookie()],
+  );
+  expect(slots[0]!.injectionLocation).toEqual({ at: "query", param: "sid" });
+});
+
+test("finds a value in the request body", () => {
+  const { slots } = tokenizeObservation(
+    raw({ method: "POST", requestBody: { auth: { token: "GA1.2.9876" } } }),
+    [analyticsCookie()],
+  );
+  expect(slots[0]!.injectionLocation).toEqual({ at: "body", jsonPath: "auth.token" });
+});
+
+test("a value found in the Cookie header is attached by the browser, not injected", () => {
+  const { slots } = tokenizeObservation(
+    raw({ requestHeaders: { cookie: "_ga=GA1.2.9876" } }),
+    [analyticsCookie()],
+  );
+  const slot = slots.find((s) => s.id === "slot:www.usfca.edu:cookie_ga");
+  expect(slot!.role).toBe("auto_cookie");
+  expect(slot!.injectionLocation.at).toBe("cookie");
+});

package/src/tokenize.ts

@@ -88,15 +88,36 @@ export function tokenizeObservation(raw: RawObservation, known: KnownSecret[]):
   };
 
   // 1. Known values (exact substring match everywhere).
+  //
+  // `known` is EVERY cookie and storage entry the page has, not the ones this
+  // request uses, so most of them appear nowhere in it. Masking still runs
+  // unconditionally — that costs nothing and protects a value wherever it turns
+  // up — but a SLOT is only proposed for a value actually found in the request.
+  //
+  // Minting one regardless, at a default of `authorization`, invented an
+  // injection point out of an absence of evidence: a public GET carried 21
+  // headers all named `authorization`, each holding a different analytics
+  // cookie, because every cookie on the page fell through to that default.
+  // Where a value goes is something to observe, never to assume.
   for (const s of known) {
     if (!s.value) continue;
-    const loc = locate(raw, s.value) ?? { at: "header" as const, name: "authorization" };
+    const loc = locate(raw, s.value);
     const ph = samplePlaceholder(s.slotId);
     url = url.split(s.value).join(ph);
     for (const k of Object.keys(headers)) headers[k] = headers[k]!.split(s.value).join(ph);
     requestBody = replaceInJson(requestBody, s.value, ph);
     responseBody = replaceInJson(responseBody, s.value, ph);
-    ensure(s.slotId, s.kind, s.role, loc, s.resolverHint);
+    if (!loc) continue;
+    // Found inside the Cookie header: the browser put it there, so it is
+    // attached automatically at execution rather than substituted by us.
+    const inCookieHeader = loc.at === "header" && loc.name.toLowerCase() === "cookie";
+    ensure(
+      s.slotId,
+      s.kind,
+      inCookieHeader ? "auto_cookie" : s.role,
+      inCookieHeader ? { at: "cookie", name: loc.name } : loc,
+      s.resolverHint,
+    );
   }
 
   // 2. Credential-bearing headers (by name), even when the value wasn't in storage.