capjs-core 0.1.4 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capjs-core",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Stateless server-side challenge generator and verifier for Cap, a lightweight, modern open-source CAPTCHA alternative. No storage, no filesystem - bring your own.",
   "keywords": [
     "anti-abuse",

package/src/index.js

@@ -241,9 +241,12 @@ export async function validateChallenge(secret, body, opts = {}) {
     }
 
     if (body.instr_blocked === true) {
-      if (instrMeta.blockAutomatedBrowsers) {
-        return fail("instr_automated_browser", { instr_error: true });
-      }
+      return fail(
+        instrMeta.blockAutomatedBrowsers
+          ? "instr_automated_browser"
+          : "instr_failed",
+        { instr_error: true },
+      );
     } else if (body.instr_timeout === true) {
       return fail("instr_timeout", { instr_error: true });
     } else if (body.instr) {
@@ -435,9 +438,12 @@ async function validateChallengeV2(secret, body, payload, opts = {}) {
         return fail("instr_expired", { instr_error: true });
       }
       if (s.blocked === true) {
-        if (meta.blockAutomatedBrowsers) {
-          return fail("instr_automated_browser", { instr_error: true });
-        }
+        return fail(
+          meta.blockAutomatedBrowsers
+            ? "instr_automated_browser"
+            : "instr_failed",
+          { instr_error: true },
+        );
       } else if (s.timeout === true) {
         return fail("instr_timeout", { instr_error: true });
       } else if (s.instr) {

package/src/instrumentation.js

@@ -412,7 +412,7 @@ function buildClientScript({
 
     `try { const ${nKey}ie = (0, eval); const ${nKey}eg = ${nKey}ie('this'); if (${nKey}eg !== globalThis) return null; const ${nKey}leak2 = ${JSON.stringify(["Bun", "process", "require", "global", "__dirname", "Deno"].map(h))}; for (const ${nKey}k of Object.getOwnPropertyNames(${nKey}eg)) { if (${hSet}(${nKey}leak2, ${hF}(${nKey}k))) return null; } } catch { return null }`,
 
-    `try { var ${evalLocalVar} = ${evalSecret}; var ${evalA} = '${evalLocalVar.slice(0, 2)}'; var ${evalB} = '${evalLocalVar.slice(2)}'; var ${evalC} = ${evalA} + ${evalB}; var ${evalLocalVar}r1 = (0, eval)('typeof ' + ${evalC}); if (${evalLocalVar}r1 !== 'undefined') return null; var ${evalLocalVar}r2 = eval(${evalC}); if (${evalLocalVar}r2 !== ${evalSecret}) return null; var ${evalLocalVar}r3 = eval(${evalA} + ${evalB} + '+1'); if (${evalLocalVar}r3 !== ${evalSecret + 1}) return null; var ${evalLocalVar}arr = ['(', '(', ')', '=', '>', 't', 'h', 'i', 's', ')', '(', ')']; var ${evalLocalVar}arrow = (0, eval)(${evalLocalVar}arr.join('')); if (${evalLocalVar}arrow !== globalThis) return null; var ${evalLocalVar}r4 = eval('(function(){return ' + ${evalC} + '*2;})()'); if (${evalLocalVar}r4 !== ${evalSecret * 2}) return null; } catch { return null }`,
+    `if (!new Function(${JSON.stringify(`try { var ${evalLocalVar} = ${evalSecret}; var ${evalA} = '${evalLocalVar.slice(0, 2)}'; var ${evalB} = '${evalLocalVar.slice(2)}'; var ${evalC} = ${evalA} + ${evalB}; var ${evalLocalVar}r1 = (0, eval)('typeof ' + ${evalC}); if (${evalLocalVar}r1 !== 'undefined') return false; var ${evalLocalVar}r2 = eval(${evalC}); if (${evalLocalVar}r2 !== ${evalSecret}) return false; var ${evalLocalVar}r3 = eval(${evalA} + ${evalB} + '+1'); if (${evalLocalVar}r3 !== ${evalSecret + 1}) return false; var ${evalLocalVar}arr = ['(', '(', ')', '=', '>', 't', 'h', 'i', 's', ')', '(', ')']; var ${evalLocalVar}arrow = (0, eval)(${evalLocalVar}arr.join('')); if (${evalLocalVar}arrow !== globalThis) return false; var ${evalLocalVar}r4 = eval('(function(){return ' + ${evalC} + '*2;})()'); if (${evalLocalVar}r4 !== ${evalSecret * 2}) return false; return true; } catch { return false }`)})()) return null;`,
   ];
 
   return `(function(){window.onload=async function(){try {${helpers}const ${dvKey}=await (async function(){${shuffle(envChecks).join("")}${blockChecks}