insa-check-core 0.1.0

package/LICENSE

@@ -0,0 +1,24 @@
+insa-check
+
+Copyright (c) 2026 the insa-check author (https://github.com/zikra-abdusemed-cmd).
+All rights reserved.
+
+You may install and run unmodified copies of this software that you obtained from
+the author or from the author's official package (https://www.npmjs.com/package/insa-check),
+for the purpose of auditing websites and source code that you own or are authorized
+to test.
+
+You may not copy, modify, merge, publish, distribute, sublicense or sell this
+software, in whole or in part, without the author's prior written permission.
+
+Third-party packages that this software depends on are licensed separately under
+their own terms.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY CLAIM, DAMAGES OR OTHER LIABILITY ARISING FROM THE USE OF THE SOFTWARE. A REPORT
+PRODUCED BY THIS SOFTWARE IS NOT A CERTIFICATION OF SECURITY OR COMPLIANCE.
+
+This software is not affiliated with or endorsed by the Information Network Security
+Administration (INSA).

package/dist/annex-b.d.ts

@@ -0,0 +1,6 @@
+import type { AnnexItem } from "./types.js";
+/** Edition of the standard this registry was transcribed from. */
+export declare const STANDARD = "INSA Secure Website Management Standard, Version 1.0 (2014 EC), Annex B: Minimum security testing of the website";
+/** The registry with English guided-review content applied (content/en.ts). Use localizeItem() for other locales. */
+export declare const ANNEX_B: readonly AnnexItem[];
+//# sourceMappingURL=annex-b.d.ts.map

package/dist/annex-b.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annex-b.d.ts","sourceRoot":"","sources":["../src/annex-b.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAQ,MAAM,YAAY,CAAC;AAElD,kEAAkE;AAClE,eAAO,MAAM,QAAQ,qHAC+F,CAAC;AAgQrH,qHAAqH;AACrH,eAAO,MAAM,OAAO,EAAE,SAAS,SAAS,EAA4C,CAAC"}

package/dist/annex-b.js

@@ -0,0 +1,152 @@
+import { localizeItem } from "./content/index.js";
+/** Edition of the standard this registry was transcribed from. */
+export const STANDARD = "INSA Secure Website Management Standard, Version 1.0 (2014 EC), Annex B: Minimum security testing of the website";
+/*
+ * Every Annex B item, in the standard's order. Section headings, numbers and
+ * titles are transcribed verbatim from docs/checklist.pdf (pages 10–16),
+ * including the original wording and capitalisation.
+ *
+ * `tier` is the intended automation route:
+ *   1 = passive check from the URL
+ *   2 = source-code / configuration analysis
+ *   3 = manual, authenticated or active testing by a person
+ * `checks` names the automated checks that decide the item, per kind:
+ *   url  -> checks/index.ts       (Tier 1, live site)
+ *   code -> code/checks/index.ts  (Tier 2, static analysis; some Tier 1 items are also checkable in code)
+ * Items a scan has no check for are reported as "manual" with `manualNote`.
+ */
+const S = {
+    info: "Information Disclosure",
+    privacy: "Privacy and Confidentiality",
+    state: "State Management",
+    auth: "Authentication and Authorization Process",
+    input: "User Input Management",
+    session: "Session Management",
+    upload: "File Upload",
+    content: "Content",
+    xml: "XML Processing",
+    deploy: "Deployment",
+    misc: "Miscellaneous",
+};
+function item(id, section, title, tier, manualNote, checks) {
+    return { id: String(id), section, title, tier, manualNote, ...(checks ? { checks } : {}) };
+}
+const INJECTION_NOTE = "Active test, not performed by this passive tool. Test inputs with an authorised DAST tool or manual payloads, and review the code that handles them.";
+const ITEMS = [
+    // Information Disclosure
+    item(1, S.info, "Test for extraneous files in the document root", 1, "Look for backups, VCS metadata, config and temp files (e.g. .git/, .env, *.bak, *.old) in the web root.", { url: "exposed-files" }),
+    item(2, S.info, "Test for extraneous directory listings", 1, "Request directories without an index file and confirm the server does not list their contents.", { url: "directory-listing" }),
+    item(3, S.info, "Test for accessible debug functionality", 1, "Check for debug/status endpoints (phpinfo, server-status, framework debug toolbars, actuator, elmah) and debug mode in production.", { url: "debug-pages", code: ["django-debug", "js-debug", "flask-debug", "laravel-debug"] }),
+    item(4, S.info, "Test for sensitive information in log and error messages", 1, "Trigger errors (bad parameters, missing pages) and confirm no stack traces, SQL, paths or versions are shown; review log contents.", { url: "error-messages" }),
+    item(5, S.info, "Test for sensitive information in robots.txt", 1, "Read /robots.txt and confirm Disallow entries do not reveal hidden admin areas or sensitive paths.", { url: "robots-txt" }),
+    item(6, S.info, "Test for sensitive information in source code", 1, "Inspect page source, comments and client-side JavaScript for credentials, API keys, internal notes or hostnames.", { url: "page-source-secrets", code: ["py-hardcoded-secrets", "js-hardcoded-secrets", "php-hardcoded-secrets", "ts-hardcoded-secrets"] }),
+    item(7, S.info, "Test for disclosure of internal addresses", 1, "Check headers, bodies and error pages for private IP addresses or internal hostnames.", { url: "internal-addresses" }),
+    // Privacy and Confidentiality
+    item(8, S.privacy, "Test for sensitive information stored in URLs", 3, "Walk authenticated flows and confirm tokens, passwords or personal data never appear in URLs or query strings."),
+    item(9, S.privacy, "Test for unencrypted sensitive information stored at the client-side", 3, "Inspect cookies, localStorage, sessionStorage and IndexedDB after login for unencrypted sensitive data."),
+    item(10, S.privacy, "Test for sensitive information stored in (externally) archived pages", 1, "Search web archives (e.g. web.archive.org) and search-engine caches for old pages exposing sensitive content.", { url: "archived-pages" }),
+    item(11, S.privacy, "Test for content included from untrusted sources", 1, "List third-party scripts, styles and frames; confirm each origin is trusted and uses Subresource Integrity where possible.", { url: "third-party-content" }),
+    item(12, S.privacy, "Test for caching of pages with sensitive information", 3, "After login, confirm sensitive pages send Cache-Control: no-store and are not cached by browsers or proxies."),
+    item(13, S.privacy, "Test for insecure transmission of sensitive information", 1, "Confirm forms, logins and APIs that carry sensitive data submit only over HTTPS.", { url: "insecure-forms" }),
+    item(14, S.privacy, "Test for non-SSL/TLS pages on sites processing sensitive information", 1, "Request the site over plain HTTP and confirm it redirects to HTTPS.", { url: "https-redirect" }),
+    item(15, S.privacy, "Test for SSL/TLS pages served with mixed content", 1, "Load HTTPS pages and check for sub-resources (scripts, images, frames) fetched over plain HTTP.", { url: "mixed-content" }),
+    item(16, S.privacy, "Test for missing HSTS header on full SSL sites", 1, "Confirm HTTPS responses include Strict-Transport-Security with an adequate max-age.", { url: "hsts" }),
+    item(17, S.privacy, "Test for known vulnerabilities in SSL/TLS", 1, "Check that SSLv3/TLS 1.0/1.1 and weak cipher suites are disabled (e.g. with testssl.sh or SSL Labs).", { url: "legacy-tls" }),
+    item(18, S.privacy, "Test for weak, untrusted or expired SSL certificates", 1, "Verify the certificate chain is trusted, matches the hostname, is unexpired and uses a strong key.", { url: "certificate" }),
+    item(19, S.privacy, "Test for the usage of unproven cryptographic primitives", 2, "Review source and configuration for custom or deprecated algorithms (MD5, SHA-1, DES, RC4, home-made crypto).", { code: ["py-weak-crypto", "js-weak-crypto", "php-weak-crypto", "ts-weak-crypto"] }),
+    item(20, S.privacy, "Test for the incorrect usage of cryptographic primitives", 2, "Review code for misuse: static IVs/keys, ECB mode, unsalted password hashes, weak random number generators.", { code: ["py-crypto-misuse", "js-crypto-misuse", "php-crypto-misuse", "ts-crypto-misuse"] }),
+    // State Management
+    item(21, S.state, "Test for client-side state management", 3, "Check whether security-relevant state (prices, roles, workflow step) is kept client-side in hidden fields or cookies and can be tampered with."),
+    item(22, S.state, "Test for invalid state transitions", 3, "Attempt to skip, repeat or reorder steps in multi-step workflows and confirm the server rejects invalid transitions."),
+    // Authentication and Authorization Process
+    item(23, S.auth, "Test for missing authentication or authorization", 3, "Request protected pages and APIs without a session, and with a low-privilege session, and confirm access is denied."),
+    item(24, S.auth, "Test for client-side authentication", 3, "Confirm authentication decisions are made on the server, not in JavaScript or other client-side code."),
+    item(25, S.auth, "Test for predictable and default credentials", 3, "Try vendor defaults and common credentials on all login interfaces, including admin panels and CMS back-ends."),
+    item(26, S.auth, "Test for predictable authentication or authorization tokens", 3, "Collect several tokens and analyse them for predictability (sequential, time-based, low entropy)."),
+    item(27, S.auth, "Test for authentication or authorization based on obscurity", 3, "Check whether protection relies on hidden URLs or parameters instead of real access control."),
+    item(28, S.auth, "Test for identifier-based authorization/ Privilege escalation citation", 3, "Change object identifiers and role parameters (IDOR) and confirm users cannot reach other users' data or higher privileges."),
+    item(29, S.auth, "Test for acceptance of weak passwords", 3, "Try setting short, common or trivial passwords and confirm the password policy rejects them."),
+    item(30, S.auth, "Test for account recovery process", 3, "Review password reset: token strength and expiry, no account enumeration, no secret questions with guessable answers."),
+    item(31, S.auth, "Test any “remember me” function", 3, "Inspect persistent-login tokens for strength, expiry, HttpOnly/Secure flags and server-side revocation."),
+    item(32, S.auth, "Test for fail-open conditions", 3, "Force errors during authentication/authorisation (malformed input, back-end failure) and confirm access is denied."),
+    item(33, S.auth, "Test any impersonation function/ re CAPTCHA", 3, "Review impersonation/“login as” features and CAPTCHA implementation for bypasses."),
+    item(34, S.auth, "Test for plaintext retrieval of passwords", 2, "Confirm the application never displays or emails existing passwords (implies reversible storage).", { code: ["py-plaintext-passwords", "js-plaintext-passwords", "php-plaintext-passwords"] }),
+    item(35, S.auth, "Test for username enumeration/ Test username uniqueness", 3, "Compare responses for valid and invalid usernames on login, registration and reset; confirm usernames are unique."),
+    item(36, S.auth, "Check for unsafe distribution of credentials", 3, "Review how initial credentials are delivered (not in plaintext email/URL; forced change on first use)."),
+    item(37, S.auth, "Test for missing rate limiting on authentication functionality", 2, "Confirm repeated failed logins trigger throttling, lockout or CAPTCHA (test only with permission).", { code: ["django-auth-rate-limit", "js-auth-rate-limit", "flask-auth-rate-limit", "laravel-auth-rate-limit"] }),
+    item(38, S.auth, "Test for missing re-authentication when changing credentials", 3, "Confirm changing password, e-mail or MFA settings requires the current password."),
+    item(39, S.auth, "Test for missing logout functionality", 3, "Confirm every authenticated page offers logout and that logout ends the session server-side."),
+    item(40, S.auth, "Test any multi-stage mechanisms", 3, "For multi-step login/MFA, confirm steps cannot be skipped or completed out of order."),
+    // User Input Management
+    item(41, S.input, "Test for SQL injection", 2, INJECTION_NOTE, { code: ["py-sql-injection", "js-sql-injection", "php-sql-injection", "ts-sql-injection"] }),
+    item(42, S.input, "Test for path traversal and filename injection", 2, INJECTION_NOTE, { code: ["py-path-traversal", "js-path-traversal", "php-path-traversal", "ts-path-traversal"] }),
+    item(43, S.input, "Test for cross-site scripting (Stored, DOM and reflected)", 2, INJECTION_NOTE, { code: ["py-xss", "js-xss", "php-xss", "ts-xss"] }),
+    item(44, S.input, "Test for system command injection", 2, INJECTION_NOTE, { code: ["py-command-injection", "js-command-injection", "php-command-injection", "ts-command-injection"] }),
+    item(45, S.input, "Test for XML injection", 2, INJECTION_NOTE),
+    item(46, S.input, "Test for XPath injection", 2, INJECTION_NOTE, { code: "py-xpath-injection" }),
+    item(47, S.input, "Test for XSL(T) injection", 2, INJECTION_NOTE),
+    item(48, S.input, "Test for SMTP injection", 2, INJECTION_NOTE),
+    item(49, S.input, "Test for SSI injection", 2, INJECTION_NOTE),
+    item(50, S.input, "Test for HTTP header injection", 2, INJECTION_NOTE),
+    item(51, S.input, "Test for HTTP parameter injection", 2, INJECTION_NOTE),
+    item(52, S.input, "Test for native software flaws (buffer overflow, integer bugs, format strings)", 2, "Review native components and extensions with static analysis; fuzz only in an authorised test environment."),
+    item(53, S.input, "Test for LDAP injection", 2, INJECTION_NOTE, { code: "py-ldap-injection" }),
+    item(54, S.input, "Test for dynamic scripting injection", 2, INJECTION_NOTE, { code: ["py-code-injection", "js-code-injection", "php-code-injection", "ts-code-injection"] }),
+    item(55, S.input, "Test for regular expression injection", 2, INJECTION_NOTE, { code: ["py-regex-injection", "js-regex-injection", "php-regex-injection"] }),
+    item(56, S.input, "Test for data property/field injection", 2, INJECTION_NOTE, { code: ["py-mass-assignment", "js-mass-assignment", "php-mass-assignment"] }),
+    item(57, S.input, "Test for protocol-specific injection", 2, INJECTION_NOTE),
+    item(58, S.input, "Test for expression language injection", 2, INJECTION_NOTE, { code: ["py-template-injection", "js-template-injection"] }),
+    item(59, S.input, "Fuzz all request parameters", 3, "Active test: fuzz every parameter with an authorised DAST tool in a test environment and review anomalies."),
+    item(60, S.input, "Test for arbitrary redirection", 2, "Find parameters that control redirects and confirm they cannot send users to arbitrary external sites.", { code: ["py-open-redirect", "js-open-redirect", "php-open-redirect", "ts-open-redirect"] }),
+    // Session Management
+    item(61, S.session, "Test for cross-site request forgery (CSRF)", 2, "Confirm state-changing requests require an unpredictable anti-CSRF token or SameSite cookies, and reject cross-site requests.", { code: ["django-csrf", "js-csrf", "flask-csrf", "laravel-csrf", "ts-csrf"] }),
+    item(62, S.session, "Test for predictable CSRF tokens", 3, "Collect several CSRF tokens and confirm they are random and bound to the session."),
+    item(63, S.session, "Test for missing session revocation on logout", 3, "After logout, replay the old session cookie and confirm it is rejected."),
+    item(64, S.session, "Test for missing session regeneration on login", 2, "Compare the session ID before and after login; it must change.", { code: ["django-login-session-rotation", "js-login-session-rotation", "laravel-login-session-rotation"] }),
+    item(65, S.session, "Test for missing session regeneration when changing credentials", 3, "Confirm the session ID changes after a password change."),
+    item(66, S.session, "Test for missing revocation of other sessions when changing credentials", 3, "Log in from two browsers, change the password in one, and confirm the other session is ended."),
+    item(67, S.session, "Test for missing Secure flag on session cookies", 1, "After login, inspect session cookies for the Secure attribute.", { url: "cookie-secure", code: ["django-session-cookie-secure", "js-session-cookie-secure", "flask-session-cookie-secure", "laravel-session-cookie-secure"] }),
+    item(68, S.session, "Test for missing HttpOnly Flag on session cookies", 1, "After login, inspect session cookies for the HttpOnly attribute.", { url: "cookie-httponly", code: ["django-session-cookie-httponly", "js-session-cookie-httponly", "flask-session-cookie-httponly", "laravel-session-cookie-httponly"] }),
+    item(69, S.session, "Test for non-restrictive domain on session cookies", 1, "Check the Domain attribute of session cookies is not broader than necessary (e.g. not the parent domain).", { url: "cookie-domain", code: ["django-session-cookie-domain", "js-session-cookie-domain"] }),
+    item(70, S.session, "Test for non-restrictive or missing path on session cookies", 1, "Check the Path attribute of session cookies limits them to the application's path.", { url: "cookie-path", code: ["django-session-cookie-path", "js-session-cookie-path"] }),
+    item(71, S.session, "Test for predictable session identifiers", 3, "Collect many session IDs and analyse their randomness (e.g. Burp Sequencer)."),
+    item(72, S.session, "Test for session identifier collisions", 3, "Check session IDs are long enough and generated so that two users cannot receive the same ID."),
+    item(73, S.session, "Test for session fixation", 2, "Set a known session ID before login and confirm it is not accepted after authentication.", { code: ["django-login-session-rotation", "js-login-session-rotation", "laravel-login-session-rotation"] }),
+    item(74, S.session, "Test for insecure transmission of session identifiers", 3, "Confirm session IDs are sent only over HTTPS and never in URLs."),
+    item(75, S.session, "Test for external session hijacking", 3, "Assess whether a stolen session can be reused from another client and whether binding or anomaly detection exists."),
+    item(76, S.session, "Test for missing periodic expiration of sessions", 2, "Confirm idle and absolute session timeouts are enforced server-side.", { code: ["django-session-expiry", "js-session-expiry", "laravel-session-expiry"] }),
+    item(77, S.session, "Check for disclosure of tokens in logs", 2, "Review application, proxy and server logs for session IDs, tokens or passwords.", { code: ["py-secrets-in-logs", "js-secrets-in-logs", "php-secrets-in-logs", "ts-secrets-in-logs"] }),
+    // File Upload
+    item(78, S.upload, "Test for storage of uploaded files in the document root", 2, "Confirm uploaded files are stored outside the web root or served through a controlled handler.", { code: "django-media-root" }),
+    item(79, S.upload, "Test for execution or interpretation of uploaded files", 3, "Upload harmless test files with script extensions (in a test environment) and confirm they are not executed."),
+    item(80, S.upload, "Test for uploading outside of designated upload directory", 2, "Try path-traversal file names on upload and confirm files land only in the upload directory.", { code: ["django-upload-path", "js-upload-path", "php-upload-path"] }),
+    item(81, S.upload, "Test for missing size restrictions on uploaded files", 2, "Confirm the server enforces a maximum upload size.", { code: ["django-upload-size", "js-upload-size", "php-upload-size"] }),
+    item(82, S.upload, "Test for missing type validation on uploaded files", 2, "Confirm file type is validated server-side by content, not only by extension or Content-Type.", { code: ["django-upload-type", "js-upload-type", "php-upload-type"] }),
+    // Content
+    item(83, S.content, "Test for missing or non-specific content type definitions", 1, "Confirm every response has an accurate Content-Type header (not missing, not generic).", { url: "content-type" }),
+    item(84, S.content, "Test for missing character set definitions", 1, "Confirm text responses declare a charset (Content-Type header or <meta charset>).", { url: "charset" }),
+    item(85, S.content, "Test for missing anti content sniffing measures", 1, "Confirm responses send X-Content-Type-Options: nosniff.", { url: "x-content-type-options" }),
+    // XML Processing
+    item(86, S.xml, "Test for XML external entity expansion", 2, "Review XML parser configuration to ensure external entities are disabled; actively test only with permission.", { code: ["py-xml-xxe", "js-xml-xxe", "php-xml-xxe", "ts-xml-xxe"] }),
+    item(87, S.xml, "Test for external DTD parsing", 2, "Confirm XML parsers do not load external DTDs.", { code: ["py-xml-dtd", "js-xml-dtd", "php-xml-dtd"] }),
+    item(88, S.xml, "Test for extraneous or dangerous XML extensions", 2, "Review XML processing for unneeded features such as XInclude or XSLT extensions.", { code: "py-xml-extensions" }),
+    item(89, S.xml, "Test for recursive entity expansion", 2, "Confirm parsers limit entity expansion (billion-laughs protection).", { code: "py-xml-entity-expansion" }),
+    // Deployment
+    item(90, S.deploy, "Test for missing security updates", 3, "Compare installed versions of OS, web server, CMS, plugins and libraries with vendor security advisories."),
+    item(91, S.deploy, "Test for unsupported or end-of-life software versions", 1, "Identify server and framework versions (headers, banners, generator tags) and confirm none are end-of-life.", { url: "server-banner" }),
+    item(92, S.deploy, "Test for HTTP TRACK and TRACE methods/ dangerous Methods", 1, "Send TRACE/TRACK and OPTIONS requests; confirm TRACE/TRACK are disabled and no unneeded methods (PUT, DELETE) are allowed.", { url: "http-trace" }),
+    item(93, S.deploy, "Test for extraneous functionality", 3, "Identify sample apps, unused modules, admin consoles and test pages that should be removed."),
+    item(94, S.deploy, "Test for default credentials", 3, "Try default credentials on server, CMS, database and management interfaces."),
+    item(95, S.deploy, "Test for Bugs in web server software", 3, "Check the identified web server version against known vulnerabilities (CVE databases)."),
+    // Miscellaneous
+    item(96, S.misc, "Test for missing anti-clickjacking measures", 1, "Confirm pages send X-Frame-Options or CSP frame-ancestors that prevent framing by other sites.", { url: "anti-clickjacking" }),
+    item(97, S.misc, "Test for open redirection", 2, "Test redirect parameters with external URLs and confirm they are rejected or restricted to an allow-list.", { code: ["py-open-redirect", "js-open-redirect", "php-open-redirect", "ts-open-redirect"] }),
+    item(98, S.misc, "Test for insecure cross-domain access policy", 1, "Check CORS headers (no wildcard with credentials, no reflected Origin) and /crossdomain.xml / clientaccesspolicy.xml.", { url: "cross-domain-policy" }),
+    item(99, S.misc, "Test for missing rate limiting on e-mail functionality", 3, "Confirm contact, invite and reset forms throttle repeated submissions (test only with permission)."),
+    item(100, S.misc, "Test for missing rate limiting on resource intensive functionality", 3, "Identify expensive operations (search, export, report generation) and confirm they are rate limited."),
+    item(101, S.misc, "Test for inappropriate rate limiting resulting in a denial of service", 3, "Confirm rate limiting or lockout cannot be abused to lock out legitimate users."),
+    item(102, S.misc, "Test for application- or setup-specific problems", 3, "Review business logic and deployment specifics not covered above."),
+];
+/** The registry with English guided-review content applied (content/en.ts). Use localizeItem() for other locales. */
+export const ANNEX_B = ITEMS.map((item) => localizeItem(item));
+//# sourceMappingURL=annex-b.js.map

package/dist/annex-b.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"annex-b.js","sourceRoot":"","sources":["../src/annex-b.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,kEAAkE;AAClE,MAAM,CAAC,MAAM,QAAQ,GACnB,kHAAkH,CAAC;AAErH;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,GAAG;IACR,IAAI,EAAE,wBAAwB;IAC9B,OAAO,EAAE,6BAA6B;IACtC,KAAK,EAAE,kBAAkB;IACzB,IAAI,EAAE,0CAA0C;IAChD,KAAK,EAAE,uBAAuB;IAC9B,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,gBAAgB;IACrB,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,eAAe;CACb,CAAC;AAEX,SAAS,IAAI,CACX,EAAU,EACV,OAAe,EACf,KAAa,EACb,IAAU,EACV,UAAkB,EAClB,MAA4B;IAE5B,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,cAAc,GAClB,sJAAsJ,CAAC;AAEzJ,MAAM,KAAK,GAAyB;IAClC,yBAAyB;IACzB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,gDAAgD,EAAE,CAAC,EACjE,yGAAyG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;IACtI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,wCAAwC,EAAE,CAAC,EACzD,gGAAgG,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC;IACjI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,yCAAyC,EAAE,CAAC,EAC1D,oIAAoI,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;IACnO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,0DAA0D,EAAE,CAAC,EAC3E,oIAAoI,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;IAClK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,8CAA8C,EAAE,CAAC,EAC/D,oGAAoG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;IAC9H,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,+CAA+C,EAAE,CAAC,EAChE,kHAAkH,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,EAAE,CAAC;IAC9P,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,2CAA2C,EAAE,CAAC,EAC5D,uFAAuF,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC;IAEzH,8BAA8B;IAC9B,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,+CAA+C,EAAE,CAAC,EACnE,gHAAgH,CAAC;IACnH,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,sEAAsE,EAAE,CAAC,EAC1F,yGAAyG,CAAC;IAC5G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,sEAAsE,EAAE,CAAC,EAC3F,+GAA+G,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;IAC7I,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,kDAAkD,EAAE,CAAC,EACvE,4HAA4H,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;IAC/J,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,sDAAsD,EAAE,CAAC,EAC3E,8GAA8G,CAAC;IACjH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,yDAAyD,EAAE,CAAC,EAC9E,kFAAkF,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;IAChH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,sEAAsE,EAAE,CAAC,EAC3F,qEAAqE,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;IACnG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,kDAAkD,EAAE,CAAC,EACvE,iGAAiG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;IAC9H,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,gDAAgD,EAAE,CAAC,EACrE,qFAAqF,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACzG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,2CAA2C,EAAE,CAAC,EAChE,sGAAsG,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;IAChI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,sDAAsD,EAAE,CAAC,EAC3E,oGAAoG,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;IAC/H,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,yDAAyD,EAAE,CAAC,EAC9E,+GAA+G,EAAE,EAAE,IAAI,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;IACvM,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,0DAA0D,EAAE,CAAC,EAC/E,6GAA6G,EAAE,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,CAAC;IAE7M,mBAAmB;IACnB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,uCAAuC,EAAE,CAAC,EAC1D,gJAAgJ,CAAC;IACnJ,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,oCAAoC,EAAE,CAAC,EACvD,sHAAsH,CAAC;IAEzH,2CAA2C;IAC3C,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,kDAAkD,EAAE,CAAC,EACpE,qHAAqH,CAAC;IACxH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,qCAAqC,EAAE,CAAC,EACvD,uGAAuG,CAAC;IAC1G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,8CAA8C,EAAE,CAAC,EAChE,+GAA+G,CAAC;IAClH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,6DAA6D,EAAE,CAAC,EAC/E,mGAAmG,CAAC;IACtG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,6DAA6D,EAAE,CAAC,EAC/E,8FAA8F,CAAC;IACjG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,wEAAwE,EAAE,CAAC,EAC1F,6HAA6H,CAAC;IAChI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,uCAAuC,EAAE,CAAC,EACzD,8FAA8F,CAAC;IACjG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,mCAAmC,EAAE,CAAC,EACrD,uHAAuH,CAAC;IAC1H,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,iCAAiC,EAAE,CAAC,EACnD,yGAAyG,CAAC;IAC5G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,+BAA+B,EAAE,CAAC,EACjD,oHAAoH,CAAC;IACvH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,6CAA6C,EAAE,CAAC,EAC/D,mFAAmF,CAAC;IACtF,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,2CAA2C,EAAE,CAAC,EAC7D,mGAAmG,EAAE,EAAE,IAAI,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,EAAE,CAAC;IACjM,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,yDAAyD,EAAE,CAAC,EAC3E,mHAAmH,CAAC;IACtH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,8CAA8C,EAAE,CAAC,EAChE,wGAAwG,CAAC;IAC3G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,gEAAgE,EAAE,CAAC,EAClF,oGAAoG,EAAE,EAAE,IAAI,EAAE,CAAC,wBAAwB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,yBAAyB,CAAC,EAAE,CAAC;IACvN,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,8DAA8D,EAAE,CAAC,EAChF,kFAAkF,CAAC;IACrF,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,uCAAuC,EAAE,CAAC,EACzD,8FAA8F,CAAC;IACjG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,iCAAiC,EAAE,CAAC,EACnD,sFAAsF,CAAC;IAEzF,wBAAwB;IACxB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,CAAC;IAC3J,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,gDAAgD,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,CAAC;IACvL,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,2DAA2D,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;IACtJ,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,mCAAmC,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,EAAE,CAAC;IACtL,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAE,cAAc,CAAC;IAC9D,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,0BAA0B,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAChG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,2BAA2B,EAAE,CAAC,EAAE,cAAc,CAAC;IACjE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,yBAAyB,EAAE,CAAC,EAAE,cAAc,CAAC;IAC/D,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAE,cAAc,CAAC;IAC9D,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,gCAAgC,EAAE,CAAC,EAAE,cAAc,CAAC;IACtE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,mCAAmC,EAAE,CAAC,EAAE,cAAc,CAAC;IACzE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,gFAAgF,EAAE,CAAC,EACnG,4GAA4G,CAAC;IAC/G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,yBAAyB,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC9F,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,sCAAsC,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,CAAC;IAC7K,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,uCAAuC,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IAC5J,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,wCAAwC,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,EAAE,CAAC;IAC7J,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,sCAAsC,EAAE,CAAC,EAAE,cAAc,CAAC;IAC5E,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,wCAAwC,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,EAAE,CAAC;IAC5I,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,6BAA6B,EAAE,CAAC,EAChD,4GAA4G,CAAC;IAC/G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,gCAAgC,EAAE,CAAC,EACnD,wGAAwG,EAAE,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,CAAC;IAExM,qBAAqB;IACrB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,4CAA4C,EAAE,CAAC,EACjE,+HAA+H,EAAE,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;IACjN,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,kCAAkC,EAAE,CAAC,EACvD,mFAAmF,CAAC;IACtF,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,+CAA+C,EAAE,CAAC,EACpE,yEAAyE,CAAC;IAC5E,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,gDAAgD,EAAE,CAAC,EACrE,gEAAgE,EAAE,EAAE,IAAI,EAAE,CAAC,+BAA+B,EAAE,2BAA2B,EAAE,gCAAgC,CAAC,EAAE,CAAC;IAC/K,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,iEAAiE,EAAE,CAAC,EACtF,yDAAyD,CAAC;IAC5D,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,yEAAyE,EAAE,CAAC,EAC9F,+FAA+F,CAAC;IAClG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,iDAAiD,EAAE,CAAC,EACtE,gEAAgE,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,8BAA8B,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,+BAA+B,CAAC,EAAE,CAAC;IACjO,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,mDAAmD,EAAE,CAAC,EACxE,kEAAkE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,gCAAgC,EAAE,4BAA4B,EAAE,+BAA+B,EAAE,iCAAiC,CAAC,EAAE,CAAC;IAC7O,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,oDAAoD,EAAE,CAAC,EACzE,2GAA2G,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,8BAA8B,EAAE,0BAA0B,CAAC,EAAE,CAAC;IAC5M,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,6DAA6D,EAAE,CAAC,EAClF,oFAAoF,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,4BAA4B,EAAE,wBAAwB,CAAC,EAAE,CAAC;IAC/K,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,0CAA0C,EAAE,CAAC,EAC/D,8EAA8E,CAAC;IACjF,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAC7D,+FAA+F,CAAC;IAClG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,2BAA2B,EAAE,CAAC,EAChD,0FAA0F,EAAE,EAAE,IAAI,EAAE,CAAC,+BAA+B,EAAE,2BAA2B,EAAE,gCAAgC,CAAC,EAAE,CAAC;IACzM,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,uDAAuD,EAAE,CAAC,EAC5E,iEAAiE,CAAC;IACpE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,qCAAqC,EAAE,CAAC,EAC1D,oHAAoH,CAAC;IACvH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,kDAAkD,EAAE,CAAC,EACvE,sEAAsE,EAAE,EAAE,IAAI,EAAE,CAAC,uBAAuB,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,EAAE,CAAC;IAC7J,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAC7D,iFAAiF,EAAE,EAAE,IAAI,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,CAAC;IAEzL,cAAc;IACd,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,yDAAyD,EAAE,CAAC,EAC7E,gGAAgG,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAClI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,wDAAwD,EAAE,CAAC,EAC5E,8GAA8G,CAAC;IACjH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,2DAA2D,EAAE,CAAC,EAC/E,8FAA8F,EAAE,EAAE,IAAI,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,CAAC;IACxK,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,sDAAsD,EAAE,CAAC,EAC1E,oDAAoD,EAAE,EAAE,IAAI,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,CAAC;IAC9H,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,oDAAoD,EAAE,CAAC,EACxE,+FAA+F,EAAE,EAAE,IAAI,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,CAAC;IAEzK,UAAU;IACV,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,2DAA2D,EAAE,CAAC,EAChF,wFAAwF,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IACpH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,4CAA4C,EAAE,CAAC,EACjE,mFAAmF,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC1G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,iDAAiD,EAAE,CAAC,EACtE,yDAAyD,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC;IAE/F,iBAAiB;IACjB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,wCAAwC,EAAE,CAAC,EACzD,+GAA+G,EAAE,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;IACvL,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,+BAA+B,EAAE,CAAC,EAChD,gDAAgD,EAAE,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;IAC1G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,iDAAiD,EAAE,CAAC,EAClE,kFAAkF,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACpH,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,qCAAqC,EAAE,CAAC,EACtD,qEAAqE,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IAE7G,aAAa;IACb,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,mCAAmC,EAAE,CAAC,EACvD,2GAA2G,CAAC;IAC9G,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,uDAAuD,EAAE,CAAC,EAC3E,6GAA6G,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;IAC1I,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,0DAA0D,EAAE,CAAC,EAC9E,4HAA4H,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;IACtJ,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,mCAAmC,EAAE,CAAC,EACvD,6FAA6F,CAAC;IAChG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,8BAA8B,EAAE,CAAC,EAClD,6EAA6E,CAAC;IAChF,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,sCAAsC,EAAE,CAAC,EAC1D,wFAAwF,CAAC;IAE3F,gBAAgB;IAChB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,6CAA6C,EAAE,CAAC,EAC/D,gGAAgG,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC;IACjI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,2BAA2B,EAAE,CAAC,EAC7C,2GAA2G,EAAE,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,CAAC;IAC3M,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,8CAA8C,EAAE,CAAC,EAChE,uHAAuH,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;IAC1J,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,wDAAwD,EAAE,CAAC,EAC1E,oGAAoG,CAAC;IACvG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,oEAAoE,EAAE,CAAC,EACvF,sGAAsG,CAAC;IACzG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,uEAAuE,EAAE,CAAC,EAC1F,iFAAiF,CAAC;IACpF,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,kDAAkD,EAAE,CAAC,EACrE,mEAAmE,CAAC;CACvE,CAAC;AAEF,qHAAqH;AACrH,MAAM,CAAC,MAAM,OAAO,GAAyB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC"}

package/dist/checks/content/page.d.ts

@@ -0,0 +1,7 @@
+import type { Check } from "../../types.js";
+export declare const thirdPartyContent: Check;
+export declare const insecureForms: Check;
+export declare const mixedContent: Check;
+export declare const contentType: Check;
+export declare const charset: Check;
+//# sourceMappingURL=page.d.ts.map

package/dist/checks/content/page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../../src/checks/content/page.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAO5C,eAAO,MAAM,iBAAiB,EAAE,KA6B/B,CAAC;AAGF,eAAO,MAAM,aAAa,EAAE,KAc3B,CAAC;AAGF,eAAO,MAAM,YAAY,EAAE,KAiB1B,CAAC;AAKF,eAAO,MAAM,WAAW,EAAE,KA+BzB,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,KAarB,CAAC"}

package/dist/checks/content/page.js

@@ -0,0 +1,133 @@
+import { findTags, resolveUrl } from "../html.js";
+import { landingPage } from "../util.js";
+const LIMITED = "Only the landing page was examined; pages behind the login need manual review.";
+// --- #11 Content included from untrusted sources ------------------------------------
+export const thirdPartyContent = {
+    key: "third-party-content",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        const origin = new URL(page.url).origin;
+        const insecure = [];
+        const external = new Set();
+        const noIntegrity = [];
+        for (const t of findTags(page.body, ["script", "iframe", "link"])) {
+            if (t.name === "link" && !/stylesheet/i.test(t.attrs["rel"] ?? ""))
+                continue;
+            const url = resolveUrl(t.name === "link" ? t.attrs["href"] : t.attrs["src"], page.url);
+            if (!url || url.origin === origin)
+                continue;
+            external.add(url.origin);
+            if (url.protocol === "http:")
+                insecure.push(url.href);
+            else if (t.name !== "iframe" && !t.attrs["integrity"])
+                noIntegrity.push(url.href);
+        }
+        if (insecure.length) {
+            return { status: "fail", detail: `${insecure.length} third-party resource(s) are loaded over plain HTTP and can be tampered with.`, evidence: insecure };
+        }
+        if (external.size) {
+            return {
+                status: "manual",
+                detail: `Content is loaded from ${external.size} external origin(s); ${noIntegrity.length} script/style file(s) have no integrity attribute. Confirm each origin is trusted. ${LIMITED}`,
+                evidence: [...external].sort(),
+            };
+        }
+        return { status: "pass", detail: `The landing page loads no scripts, styles or frames from other origins. ${LIMITED}` };
+    },
+};
+// --- #13 Insecure transmission of sensitive information --------------------------------
+export const insecureForms = {
+    key: "insecure-forms",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        const forms = findTags(page.body, ["form"]);
+        const overHttp = forms.map((f) => resolveUrl(f.attrs["action"] || page.url, page.url)).filter((u) => u?.protocol === "http:");
+        const hasPassword = findTags(page.body, ["input"]).some((i) => (i.attrs["type"] ?? "").toLowerCase() === "password");
+        if (overHttp.length) {
+            return { status: "fail", detail: `${overHttp.length} form(s) submit over plain HTTP${hasPassword ? ", including a password field" : ""}.`, evidence: overHttp.map((u) => u.href) };
+        }
+        if (new URL(page.url).protocol !== "https:")
+            return { status: "fail", detail: "The page is served over plain HTTP, so anything submitted from it is unencrypted." };
+        return { status: "pass", detail: `${forms.length} form(s) on the landing page submit over HTTPS. ${LIMITED}` };
+    },
+};
+// --- #15 Mixed content ------------------------------------------------------------------
+export const mixedContent = {
+    key: "mixed-content",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        if (new URL(page.url).protocol !== "https:") {
+            return { status: "manual", detail: "The site is not served over HTTPS (see item 14), so mixed content does not apply yet." };
+        }
+        const mixed = new Set();
+        for (const t of findTags(page.body, ["script", "img", "iframe", "link", "audio", "video", "source", "embed", "object"])) {
+            if (t.name === "link" && !/stylesheet|icon|preload|manifest/i.test(t.attrs["rel"] ?? ""))
+                continue;
+            const raw = t.attrs["src"] ?? t.attrs["href"] ?? t.attrs["data"];
+            if (raw && /^http:\/\//i.test(raw.trim()))
+                mixed.add(`<${t.name}> ${raw.trim()}`);
+        }
+        if (mixed.size)
+            return { status: "fail", detail: `${mixed.size} resource(s) on the HTTPS page are loaded over plain HTTP.`, evidence: [...mixed] };
+        return { status: "pass", detail: `No HTTP resources are referenced by the HTTPS landing page. ${LIMITED}` };
+    },
+};
+// --- #83 Content type / #84 character set ------------------------------------------------
+const GENERIC_TYPES = /^(application\/octet-stream|\*\/\*|unknown\/unknown|application\/unknown)$/i;
+export const contentType = {
+    key: "content-type",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        const origin = new URL(page.url).origin;
+        const problems = [];
+        const checked = [];
+        const examine = (url, header, expected, what) => {
+            const type = (header ?? "").split(";")[0].trim();
+            checked.push(`${url}: ${type || "(none)"}`);
+            if (!type)
+                problems.push(`${url}: no Content-Type`);
+            else if (GENERIC_TYPES.test(type))
+                problems.push(`${url}: generic type ${type}`);
+            else if (!expected.test(type))
+                problems.push(`${url}: ${type} for ${what}`);
+        };
+        examine(page.url, page.headers["content-type"], /html|xml/i, "an HTML page");
+        const firstOf = (tag, attr, filter) => findTags(page.body, [tag]).filter((t) => filter(t.attrs)).map((t) => resolveUrl(t.attrs[attr], page.url)).find((u) => u?.origin === origin);
+        const script = firstOf("script", "src", () => true);
+        const style = firstOf("link", "href", (a) => /stylesheet/i.test(a["rel"] ?? ""));
+        if (script) {
+            const res = await ctx.request(script.href);
+            if (res.status === 200)
+                examine(script.href, res.headers["content-type"], /javascript|ecmascript/i, "a script");
+        }
+        if (style) {
+            const res = await ctx.request(style.href);
+            if (res.status === 200)
+                examine(style.href, res.headers["content-type"], /css/i, "a stylesheet");
+        }
+        if (problems.length)
+            return { status: "fail", detail: `${problems.length} response(s) have a missing, generic or wrong Content-Type.`, evidence: problems };
+        return { status: "pass", detail: `Content-Type is specific on ${checked.length} response(s) checked.`, evidence: checked };
+    },
+};
+export const charset = {
+    key: "charset",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        const header = page.headers["content-type"] ?? "";
+        const inHeader = /charset\s*=\s*["']?([\w-]+)/i.exec(header)?.[1];
+        const head = page.body.slice(0, 2048);
+        const inMeta = /<meta[^>]+charset\s*=\s*["']?([\w-]+)/i.exec(head)?.[1];
+        if (inHeader)
+            return { status: "pass", detail: `Character set ${inHeader} is declared in the Content-Type header.`, evidence: [header] };
+        if (inMeta)
+            return { status: "pass", detail: `Character set ${inMeta} is declared in a <meta> tag (not in the Content-Type header).` };
+        return { status: "fail", detail: "No character set is declared in the Content-Type header or in a <meta> tag near the top of the page.", evidence: [header || "(no Content-Type)"] };
+    },
+};
+//# sourceMappingURL=page.js.map

package/dist/checks/content/page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page.js","sourceRoot":"","sources":["../../../src/checks/content/page.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,OAAO,GAAG,gFAAgF,CAAC;AAEjG,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAU;IACtC,GAAG,EAAE,qBAAqB;IAC1B,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,SAAS;YAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACvF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YAC5C,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;iBACjD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,+EAA+E,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC3J,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,0BAA0B,QAAQ,CAAC,IAAI,wBAAwB,WAAW,CAAC,MAAM,sFAAsF,OAAO,EAAE;gBACxL,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;aAC/B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2EAA2E,OAAO,EAAE,EAAE,CAAC;IAC1H,CAAC;CACF,CAAC;AAEF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,aAAa,GAAU;IAClC,GAAG,EAAE,gBAAgB;IACrB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC;QACxI,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,CAAC;QACrH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,kCAAkC,WAAW,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACrL,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mFAAmF,EAAE,CAAC;QACpK,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,mDAAmD,OAAO,EAAE,EAAE,CAAC;IACjH,CAAC;CACF,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAU;IACjC,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uFAAuF,EAAE,CAAC;QAC/H,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxH,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAE,SAAS;YACnG,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,4DAA4D,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QACnJ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+DAA+D,OAAO,EAAE,EAAE,CAAC;IAC9G,CAAC;CACF,CAAC;AAEF,4FAA4F;AAC5F,MAAM,aAAa,GAAG,6EAA6E,CAAC;AAEpG,MAAM,CAAC,MAAM,WAAW,GAAU;IAChC,GAAG,EAAE,cAAc;IACnB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,MAA0B,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE;YAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;iBAC/C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,kBAAkB,IAAI,EAAE,CAAC,CAAC;iBAC5E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,IAAI,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,MAA8C,EAAE,EAAE,CAC5F,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;QAC9I,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,wBAAwB,EAAE,UAAU,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,6DAA6D,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC5J,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,OAAO,CAAC,MAAM,uBAAuB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC7H,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAU;IAC5B,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,QAAQ,0CAA0C,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACzI,IAAI,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,MAAM,gEAAgE,EAAE,CAAC;QACvI,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sGAAsG,EAAE,QAAQ,EAAE,CAAC,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC;IACvL,CAAC;CACF,CAAC"}

package/dist/checks/cookies/cookie-flags.d.ts

@@ -0,0 +1,3 @@
+export declare const cookieSecure: import("../../types.js").UrlCheck;
+export declare const cookieHttpOnly: import("../../types.js").UrlCheck;
+//# sourceMappingURL=cookie-flags.d.ts.map

package/dist/checks/cookies/cookie-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-flags.d.ts","sourceRoot":"","sources":["../../../src/checks/cookies/cookie-flags.ts"],"names":[],"mappings":"AA2CA,eAAO,MAAM,YAAY,mCAAiD,CAAC;AAC3E,eAAO,MAAM,cAAc,mCAAuD,CAAC"}

package/dist/checks/cookies/cookie-flags.js

@@ -0,0 +1,41 @@
+import { landingPage, looksLikeSessionCookie, parseSetCookie } from "../util.js";
+const NO_COOKIES = {
+    status: "manual",
+    detail: "No cookies were set on the landing page. Session cookies issued after login must be reviewed manually.",
+};
+async function observedCookies(ctx) {
+    const res = await landingPage(ctx);
+    return res.setCookies.map(parseSetCookie);
+}
+/** Annex B items 67/68 concern session cookies: fail on session-like cookies, list the rest as advisory. */
+function flagCheck(key, flag, label) {
+    return {
+        kind: "url",
+        key,
+        async run(ctx) {
+            const cookies = await observedCookies(ctx);
+            if (cookies.length === 0)
+                return NO_COOKIES;
+            const missing = cookies.filter((c) => !c[flag]);
+            const sessionMissing = missing.filter((c) => looksLikeSessionCookie(c.name));
+            if (sessionMissing.length > 0) {
+                return {
+                    status: "fail",
+                    detail: `Session-like cookie(s) set without the ${label} flag.`,
+                    evidence: sessionMissing.map((c) => c.name),
+                };
+            }
+            if (missing.length > 0) {
+                return {
+                    status: "pass",
+                    detail: `No session-like cookie lacks ${label}. Cookies listed below lack it; confirm none of them carries session data.`,
+                    evidence: missing.map((c) => c.name),
+                };
+            }
+            return { status: "pass", detail: `All ${cookies.length} cookie(s) set ${label}.`, evidence: cookies.map((c) => c.name) };
+        },
+    };
+}
+export const cookieSecure = flagCheck("cookie-secure", "secure", "Secure");
+export const cookieHttpOnly = flagCheck("cookie-httponly", "httpOnly", "HttpOnly");
+//# sourceMappingURL=cookie-flags.js.map

package/dist/checks/cookies/cookie-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-flags.js","sourceRoot":"","sources":["../../../src/checks/cookies/cookie-flags.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAEpG,MAAM,UAAU,GAAiB;IAC/B,MAAM,EAAE,QAAQ;IAChB,MAAM,EACJ,wGAAwG;CAC3G,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,GAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC5C,CAAC;AAED,4GAA4G;AAC5G,SAAS,SAAS,CAAC,GAAW,EAAE,IAA2B,EAAE,KAAa;IACxE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,GAAG;QACH,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,UAAU,CAAC;YAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,0CAA0C,KAAK,QAAQ;oBAC/D,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAC5C,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO;oBACL,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,gCAAgC,KAAK,4EAA4E;oBACzH,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBACrC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,OAAO,CAAC,MAAM,kBAAkB,KAAK,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3H,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,iBAAiB,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC"}

package/dist/checks/cookies/cookie-scope.d.ts

@@ -0,0 +1,6 @@
+import type { Check } from "../../types.js";
+/** #69 Non-restrictive domain on session cookies. */
+export declare const cookieDomain: Check;
+/** #70 Non-restrictive or missing path on session cookies. */
+export declare const cookiePath: Check;
+//# sourceMappingURL=cookie-scope.d.ts.map

package/dist/checks/cookies/cookie-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-scope.d.ts","sourceRoot":"","sources":["../../../src/checks/cookies/cookie-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAA6B,MAAM,gBAAgB,CAAC;AAavE,qDAAqD;AACrD,eAAO,MAAM,YAAY,EAAE,KAuB1B,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,UAAU,EAAE,KAqBxB,CAAC"}

package/dist/checks/cookies/cookie-scope.js

@@ -0,0 +1,60 @@
+import { landingPage, looksLikeSessionCookie, parseSetCookie } from "../util.js";
+const NONE = {
+    status: "manual",
+    detail: "No session-like cookies were set on the landing page. Session cookies issued after login must be reviewed manually.",
+};
+async function sessionCookies(ctx) {
+    const res = await landingPage(ctx);
+    return { host: new URL(res.url).hostname, cookies: res.setCookies.map(parseSetCookie).filter((c) => looksLikeSessionCookie(c.name)) };
+}
+/** #69 Non-restrictive domain on session cookies. */
+export const cookieDomain = {
+    key: "cookie-domain",
+    kind: "url",
+    async run(ctx) {
+        const { host, cookies } = await sessionCookies(ctx);
+        if (cookies.length === 0)
+            return NONE;
+        const broad = cookies.filter((c) => c.domain && c.domain.replace(/^\./, "").toLowerCase() !== host.toLowerCase());
+        if (broad.length) {
+            return {
+                status: "fail",
+                detail: "Session cookie(s) are scoped to a parent domain, so every subdomain receives them.",
+                evidence: broad.map((c) => `${c.name}: Domain=${c.domain}`),
+            };
+        }
+        const explicit = cookies.filter((c) => c.domain);
+        return {
+            status: "pass",
+            detail: explicit.length
+                ? `Session cookie Domain matches the host (${host}); note that an explicit Domain also includes its subdomains.`
+                : "Session cookies set no Domain attribute, so they are host-only (most restrictive).",
+            evidence: cookies.map((c) => c.name),
+        };
+    },
+};
+/** #70 Non-restrictive or missing path on session cookies. */
+export const cookiePath = {
+    key: "cookie-path",
+    kind: "url",
+    async run(ctx) {
+        const { cookies } = await sessionCookies(ctx);
+        if (cookies.length === 0)
+            return NONE;
+        const missing = cookies.filter((c) => c.path === undefined);
+        if (missing.length) {
+            return { status: "fail", detail: "Session cookie(s) set no Path attribute.", evidence: missing.map((c) => c.name) };
+        }
+        const root = cookies.filter((c) => c.path === "/");
+        if (root.length) {
+            // Whether "/" is too broad depends on what else is hosted on the same host.
+            return {
+                status: "manual",
+                detail: 'Session cookie(s) use Path=/, covering the whole host. Acceptable only if no other application shares this host.',
+                evidence: root.map((c) => c.name),
+            };
+        }
+        return { status: "pass", detail: "Session cookies are limited to a specific path.", evidence: cookies.map((c) => `${c.name}: Path=${c.path}`) };
+    },
+};
+//# sourceMappingURL=cookie-scope.js.map

package/dist/checks/cookies/cookie-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-scope.js","sourceRoot":"","sources":["../../../src/checks/cookies/cookie-scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAEpG,MAAM,IAAI,GAAiB;IACzB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,qHAAqH;CAC9H,CAAC;AAEF,KAAK,UAAU,cAAc,CAAC,GAAgB;IAC5C,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AACxI,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,YAAY,GAAU;IACjC,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,oFAAoF;gBAC5F,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;aAC5D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACrB,CAAC,CAAC,2CAA2C,IAAI,+DAA+D;gBAChH,CAAC,CAAC,oFAAoF;YACxF,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACrC,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,UAAU,GAAU;IAC/B,GAAG,EAAE,aAAa;IAClB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0CAA0C,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACtH,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,4EAA4E;YAC5E,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,kHAAkH;gBAC1H,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClC,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iDAAiD,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAClJ,CAAC;CACF,CAAC"}

package/dist/checks/deployment/server-banner.d.ts

@@ -0,0 +1,4 @@
+import type { Check } from "../../types.js";
+/** #91 Unsupported or end-of-life software versions, from version banners. */
+export declare const serverBanner: Check;
+//# sourceMappingURL=server-banner.d.ts.map

package/dist/checks/deployment/server-banner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-banner.d.ts","sourceRoot":"","sources":["../../../src/checks/deployment/server-banner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAqB5C,8EAA8E;AAC9E,eAAO,MAAM,YAAY,EAAE,KAiC1B,CAAC"}

package/dist/checks/deployment/server-banner.js

@@ -0,0 +1,60 @@
+import { findTags } from "../html.js";
+import { landingPage } from "../util.js";
+/**
+ * End-of-life thresholds, reviewed 2026-10. Versions below `eolBelow` no longer receive security fixes.
+ * Kept conservative: distributions back-port fixes, so only clearly unsupported lines are flagged.
+ */
+const PRODUCTS = [
+    { name: "PHP", pattern: /PHP\/(\d+)\.(\d+)/i, eolBelow: [8, 2] },
+    { name: "Apache httpd", pattern: /Apache\/(\d+)\.(\d+)/i, eolBelow: [2, 4] },
+    { name: "nginx", pattern: /nginx\/(\d+)\.(\d+)/i, eolBelow: [1, 18] },
+    { name: "Microsoft IIS", pattern: /Microsoft-IIS\/(\d+)\.(\d+)/i, eolBelow: [10, 0] },
+    { name: "OpenSSL", pattern: /OpenSSL\/(\d+)\.(\d+)/i, eolBelow: [3, 0] },
+    { name: "Apache Tomcat", pattern: /Tomcat\/(\d+)\.(\d+)/i, eolBelow: [9, 0] },
+    { name: "Python", pattern: /Python\/(\d+)\.(\d+)/i, eolBelow: [3, 9] },
+    { name: "ASP.NET", pattern: /^(\d+)\.(\d+)[\d.]*$/, eolBelow: [4, 0] },
+    { name: "Drupal", pattern: /Drupal (\d+)(?:\.(\d+))?/i, eolBelow: [10, 0] },
+    { name: "Joomla!", pattern: /Joomla!? (\d+)\.(\d+)/i, eolBelow: [4, 0] },
+];
+/** #91 Unsupported or end-of-life software versions, from version banners. */
+export const serverBanner = {
+    key: "server-banner",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        const banners = [];
+        for (const h of ["server", "x-powered-by", "x-aspnet-version", "x-aspnetmvc-version", "x-generator"]) {
+            if (page.headers[h])
+                banners.push([h, page.headers[h]]);
+        }
+        for (const m of findTags(page.body, ["meta"])) {
+            if ((m.attrs["name"] ?? "").toLowerCase() === "generator" && m.attrs["content"])
+                banners.push(["meta generator", m.attrs["content"]]);
+        }
+        const eol = [];
+        const disclosed = [];
+        for (const [source, value] of banners) {
+            let matched = false;
+            for (const p of PRODUCTS) {
+                if (p.name === "ASP.NET" && source !== "x-aspnet-version")
+                    continue;
+                const m = p.pattern.exec(value);
+                if (!m)
+                    continue;
+                matched = true;
+                const [major, minor] = [Number(m[1]), Number(m[2] ?? 0)];
+                const old = major < p.eolBelow[0] || (major === p.eolBelow[0] && minor < p.eolBelow[1]);
+                (old ? eol : disclosed).push(`${p.name} ${major}.${minor} (${source}: ${value})`);
+            }
+            if (!matched && /\d+\.\d+/.test(value))
+                disclosed.push(`${source}: ${value}`);
+        }
+        if (eol.length)
+            return { status: "fail", detail: `${eol.length} end-of-life software version(s) identified from version banners.`, evidence: [...eol, ...disclosed] };
+        if (disclosed.length) {
+            return { status: "manual", detail: "Software versions are disclosed in banners. None is on this tool's end-of-life list; verify their support status, and consider hiding the versions.", evidence: disclosed };
+        }
+        return { status: "pass", detail: "No software version is disclosed in response headers or generator tags, so no end-of-life version could be identified." };
+    },
+};
+//# sourceMappingURL=server-banner.js.map