idmission-web-sdk 2.3.183 → 2.3.184

package/dist/lib/camera/getUserMediaIntegrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getUserMediaIntegrity.d.ts","sourceRoot":"","sources":["../../../src/lib/camera/getUserMediaIntegrity.ts"],"names":[],"mappings":"AAcA,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAA;AAErD,iFAAiF;AACjF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB,CAAA;AAYD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,mBAAmB,CAS3D;AA4HD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,CAAC,EAAE,mBAAmB,GAC1B,eAAe,CAqBjB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,mBAAmB,GAAG,OAAO,CActE"}
+{"version":3,"file":"getUserMediaIntegrity.d.ts","sourceRoot":"","sources":["../../../src/lib/camera/getUserMediaIntegrity.ts"],"names":[],"mappings":"AAcA,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAA;AAErD,iFAAiF;AACjF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB,CAAA;AAYD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,mBAAmB,CAS3D;AAgKD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,CAAC,EAAE,mBAAmB,GAC1B,eAAe,CAqBjB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,mBAAmB,GAAG,OAAO,CActE"}

package/dist/sdk2.cjs.development.js

@@ -235,7 +235,7 @@ typeof SuppressedError === "function" ? SuppressedError : function (error, suppr
   return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
 
-var webSdkVersion = '2.3.183';
+var webSdkVersion = '2.3.184';
 
 function getPlatform() {
   // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -3675,15 +3675,46 @@ function checkLayer2() {
           details: details
         };
       }
+      // Use same-realm toString calls to avoid cross-realm issues
+      // (Chrome produces unexpected results when calling toString from
+      // one realm on a native host function from another realm).
+      var pageToString = Function.prototype.toString;
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       var iframeToString = iframeWindow.Function.prototype.toString;
-      var pageResult = iframeToString.call(navigator.mediaDevices.getUserMedia);
-      var iframeGUM = (_b = (_a = iframeWindow.navigator) === null || _a === void 0 ? void 0 : _a.mediaDevices) === null || _b === void 0 ? void 0 : _b.getUserMedia;
-      var iframeResult = iframeGUM ? iframeToString.call(iframeGUM) : undefined;
-      if (iframeResult !== undefined && pageResult !== iframeResult) {
-        details.push('Layer 2: page getUserMedia toString differs from iframe getUserMedia toString');
+      // Validate that the page's toString itself hasn't been tampered
+      // by comparing toString-on-toString across realms (safe: both are
+      // plain Function objects, not host functions).
+      var pageToStringStr = pageToString.call(pageToString);
+      var iframeToStringStr = iframeToString.call(iframeToString);
+      if (pageToStringStr !== iframeToStringStr) {
+        details.push('Layer 2: Function.prototype.toString appears tampered');
       }
-      if (!pageResult.includes('[native code]')) {
+      // Compare page vs iframe getUserMedia via same-realm toString.
+      // Legitimate shims (e.g. webrtc-adapter) replace getUserMedia
+      // before the SDK loads, so the page's version may not contain
+      // [native code]. We use the iframe's clean getUserMedia as a
+      // reference: if the iframe's IS native, a non-native page version
+      // is expected when a shim is present and is not flagged. We only
+      // flag when the page's getUserMedia doesn't match the boot-time
+      // snapshot (Layer 1) AND the iframe confirms no shim is in play.
+      var pageResult = pageToString.call(navigator.mediaDevices.getUserMedia);
+      var iframeGUM = (_b = (_a = iframeWindow.navigator) === null || _a === void 0 ? void 0 : _a.mediaDevices) === null || _b === void 0 ? void 0 : _b.getUserMedia;
+      if (iframeGUM) {
+        var iframeResult = iframeToString.call(iframeGUM);
+        var pageIsNative = pageResult.includes('[native code]');
+        var iframeIsNative = iframeResult.includes('[native code]');
+        if (!pageIsNative && !iframeIsNative) {
+          // Neither is native — something has tampered at a deep level
+          details.push('Layer 2: neither page nor iframe getUserMedia appear native');
+        } else if (pageIsNative && !iframeIsNative) {
+          // Page claims native but iframe disagrees — suspicious
+          details.push('Layer 2: page getUserMedia claims native but iframe does not');
+        }
+        // pageIsNative=false, iframeIsNative=true → legitimate shim (e.g. adapter.js), not flagged
+        // both native → clean, not flagged
+      } else if (!pageResult.includes('[native code]')) {
+        // No iframe getUserMedia available to compare against;
+        // fall back to checking the page's result alone
         details.push('Layer 2: page getUserMedia toString does not contain [native code]');
       }
     } finally {