insa-check-core 0.1.0

package/dist/checks/deployment/server-banner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-banner.js","sourceRoot":"","sources":["../../../src/checks/deployment/server-banner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC;;;GAGG;AACH,MAAM,QAAQ,GAAoE;IAChF,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IAChE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IAC5E,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;IACrE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,8BAA8B,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;IACrF,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IACxE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IAC7E,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IACtE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;IACtE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;IAC3E,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;CACzE,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAU;IACjC,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,aAAa,CAAC,EAAE,CAAC;YACrG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACxI,CAAC;QACD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,kBAAkB;oBAAE,SAAS;gBACpE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,CAAC;oBAAE,SAAS;gBACjB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzD,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxF,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,KAAK,GAAG,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,KAAK,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,mEAAmE,EAAE,QAAQ,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC;QACtK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qJAAqJ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QAClN,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,wHAAwH,EAAE,CAAC;IAC9J,CAAC;CACF,CAAC"}

package/dist/checks/deployment/trace.d.ts

@@ -0,0 +1,3 @@
+import type { Check } from "../../types.js";
+export declare const traceMethod: Check;
+//# sourceMappingURL=trace.d.ts.map

package/dist/checks/deployment/trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../../src/checks/deployment/trace.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAK5C,eAAO,MAAM,WAAW,EAAE,KA0BzB,CAAC"}

package/dist/checks/deployment/trace.js

@@ -0,0 +1,30 @@
+import { randomBytes } from "node:crypto";
+import { effectiveOrigin } from "../util.js";
+const MARKER_HEADER = "x-insa-check-trace";
+export const traceMethod = {
+    key: "http-trace",
+    kind: "url",
+    async run(ctx) {
+        const origin = await effectiveOrigin(ctx);
+        const enabled = [];
+        const evidence = [];
+        for (const method of ["TRACE", "TRACK"]) {
+            const marker = randomBytes(8).toString("hex");
+            const res = await ctx.request(`${origin}/`, {
+                method,
+                followRedirects: false,
+                headers: { [MARKER_HEADER]: marker },
+            });
+            evidence.push(`${method} / → HTTP ${res.status}`);
+            // Only an echo of our request proves the method is live (some apps answer 200 to any verb).
+            const echoed = res.body.includes(marker) || res.body.startsWith(`${method} /`);
+            if (res.status >= 200 && res.status < 300 && echoed)
+                enabled.push(method);
+        }
+        if (enabled.length > 0) {
+            return { status: "fail", detail: `${enabled.join(" and ")} enabled: the request is echoed back.`, evidence };
+        }
+        return { status: "pass", detail: "TRACE and TRACK are not enabled (request not echoed).", evidence };
+    },
+};
+//# sourceMappingURL=trace.js.map

package/dist/checks/deployment/trace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.js","sourceRoot":"","sources":["../../../src/checks/deployment/trace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,MAAM,CAAC,MAAM,WAAW,GAAU;IAChC,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,EAAE;gBAC1C,MAAM;gBACN,eAAe,EAAE,KAAK;gBACtB,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE;aACrC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClD,4FAA4F;YAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;YAC/E,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uCAAuC,EAAE,QAAQ,EAAE,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,uDAAuD,EAAE,QAAQ,EAAE,CAAC;IACvG,CAAC;CACF,CAAC"}

package/dist/checks/headers/clickjacking.d.ts

@@ -0,0 +1,5 @@
+import type { Check } from "../../types.js";
+export declare const clickjacking: Check;
+/** Returns a CSP directive's value ("" if present but empty), or undefined if absent. */
+export declare function cspDirective(policy: string, name: string): string | undefined;
+//# sourceMappingURL=clickjacking.d.ts.map

package/dist/checks/headers/clickjacking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clickjacking.d.ts","sourceRoot":"","sources":["../../../src/checks/headers/clickjacking.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,eAAO,MAAM,YAAY,EAAE,KA+C1B,CAAC;AAEF,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM7E"}

package/dist/checks/headers/clickjacking.js

@@ -0,0 +1,57 @@
+import { landingPage } from "../util.js";
+export const clickjacking = {
+    key: "anti-clickjacking",
+    kind: "url",
+    async run(ctx) {
+        const res = await landingPage(ctx);
+        const csp = res.headers["content-security-policy"];
+        const xfo = res.headers["x-frame-options"];
+        const evidence = [
+            csp ? `Content-Security-Policy: ${csp}` : null,
+            xfo ? `X-Frame-Options: ${xfo}` : null,
+        ].filter((e) => e !== null);
+        // CSP frame-ancestors takes precedence over X-Frame-Options in modern browsers.
+        // Multiple CSP headers are comma-joined; a frame-ancestors in any of them restricts framing.
+        const ancestors = csp
+            ?.split(",")
+            .map((policy) => cspDirective(policy, "frame-ancestors"))
+            .find((v) => v !== undefined);
+        if (ancestors !== undefined) {
+            const sources = ancestors.split(/\s+/).filter(Boolean);
+            const permissive = sources.some((s) => s === "*" || /^(https?|wss?):?$/i.test(s));
+            if (permissive) {
+                return { status: "fail", detail: `CSP frame-ancestors allows any site to frame the page ("${ancestors}").`, evidence };
+            }
+            return { status: "pass", detail: `Framing restricted by CSP frame-ancestors ${ancestors || "(none)"}.`, evidence };
+        }
+        if (!xfo) {
+            return {
+                status: "fail",
+                detail: "Neither X-Frame-Options nor CSP frame-ancestors is set; the page can be framed.",
+                evidence,
+            };
+        }
+        const values = xfo.split(",").map((v) => v.trim().toUpperCase());
+        if (values.every((v) => v === "DENY" || v === "SAMEORIGIN")) {
+            return { status: "pass", detail: `X-Frame-Options: ${values[0]}.`, evidence };
+        }
+        if (values.some((v) => v.startsWith("ALLOW-FROM"))) {
+            return {
+                status: "fail",
+                detail: "X-Frame-Options ALLOW-FROM is ignored by modern browsers; use CSP frame-ancestors.",
+                evidence,
+            };
+        }
+        return { status: "fail", detail: `X-Frame-Options value "${xfo}" is invalid.`, evidence };
+    },
+};
+/** Returns a CSP directive's value ("" if present but empty), or undefined if absent. */
+export function cspDirective(policy, name) {
+    for (const part of policy.split(";")) {
+        const [directive, ...sources] = part.trim().split(/\s+/);
+        if (directive?.toLowerCase() === name)
+            return sources.join(" ");
+    }
+    return undefined;
+}
+//# sourceMappingURL=clickjacking.js.map

package/dist/checks/headers/clickjacking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clickjacking.js","sourceRoot":"","sources":["../../../src/checks/headers/clickjacking.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAU;IACjC,GAAG,EAAE,mBAAmB;IACxB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,CAAC,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;YAC9C,GAAG,CAAC,CAAC,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;SACvC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAEzC,gFAAgF;QAChF,6FAA6F;QAC7F,MAAM,SAAS,GAAG,GAAG;YACnB,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;aACxD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2DAA2D,SAAS,KAAK,EAAE,QAAQ,EAAE,CAAC;YACzH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,6CAA6C,SAAS,IAAI,QAAQ,GAAG,EAAE,QAAQ,EAAE,CAAC;QACrH,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,iFAAiF;gBACzF,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,YAAY,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,oFAAoF;gBAC5F,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,GAAG,eAAe,EAAE,QAAQ,EAAE,CAAC;IAC5F,CAAC;CACF,CAAC;AAEF,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/checks/headers/content-type-options.d.ts

@@ -0,0 +1,3 @@
+import type { Check } from "../../types.js";
+export declare const contentTypeOptions: Check;
+//# sourceMappingURL=content-type-options.d.ts.map

package/dist/checks/headers/content-type-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-type-options.d.ts","sourceRoot":"","sources":["../../../src/checks/headers/content-type-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAG5C,eAAO,MAAM,kBAAkB,EAAE,KAchC,CAAC"}

package/dist/checks/headers/content-type-options.js

@@ -0,0 +1,17 @@
+import { landingPage } from "../util.js";
+export const contentTypeOptions = {
+    key: "x-content-type-options",
+    kind: "url",
+    async run(ctx) {
+        const res = await landingPage(ctx);
+        const value = res.headers["x-content-type-options"];
+        if (!value) {
+            return { status: "fail", detail: "X-Content-Type-Options header is missing." };
+        }
+        if (value.trim().toLowerCase() !== "nosniff") {
+            return { status: "fail", detail: `X-Content-Type-Options is "${value}", expected "nosniff".`, evidence: [value] };
+        }
+        return { status: "pass", detail: "X-Content-Type-Options: nosniff is set.", evidence: [value] };
+    },
+};
+//# sourceMappingURL=content-type-options.js.map

package/dist/checks/headers/content-type-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-type-options.js","sourceRoot":"","sources":["../../../src/checks/headers/content-type-options.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,CAAC,MAAM,kBAAkB,GAAU;IACvC,GAAG,EAAE,wBAAwB;IAC7B,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,8BAA8B,KAAK,wBAAwB,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACpH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAClG,CAAC;CACF,CAAC"}

package/dist/checks/headers/cors.d.ts

@@ -0,0 +1,4 @@
+import type { Check } from "../../types.js";
+/** #98 Insecure cross-domain access policy (CORS, Flash/Silverlight policy files). */
+export declare const crossDomainPolicy: Check;
+//# sourceMappingURL=cors.d.ts.map

package/dist/checks/headers/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/checks/headers/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAM5C,sFAAsF;AACtF,eAAO,MAAM,iBAAiB,EAAE,KA8B/B,CAAC"}

package/dist/checks/headers/cors.js

@@ -0,0 +1,38 @@
+import { effectiveOrigin, landingPage } from "../util.js";
+/** An origin that cannot exist, to see whether the server reflects arbitrary origins. */
+const PROBE_ORIGIN = "https://insa-check-origin.invalid";
+/** #98 Insecure cross-domain access policy (CORS, Flash/Silverlight policy files). */
+export const crossDomainPolicy = {
+    key: "cross-domain-policy",
+    kind: "url",
+    async run(ctx) {
+        const origin = await effectiveOrigin(ctx);
+        const page = await landingPage(ctx);
+        const res = await ctx.request(page.url, { headers: { origin: PROBE_ORIGIN } });
+        const acao = res.headers["access-control-allow-origin"];
+        const credentials = (res.headers["access-control-allow-credentials"] ?? "").toLowerCase() === "true";
+        const problems = [];
+        const review = [];
+        if (acao === PROBE_ORIGIN || acao === "null") {
+            (credentials ? problems : review).push(`Access-Control-Allow-Origin reflects any origin (${acao})${credentials ? " and allows credentials: other sites can read authenticated responses" : ""}`);
+        }
+        else if (acao === "*" && credentials) {
+            problems.push("Access-Control-Allow-Origin: * is combined with Allow-Credentials: true");
+        }
+        const flash = await ctx.request(`${origin}/crossdomain.xml`, { followRedirects: false });
+        if (flash.status === 200 && /<allow-access-from[^>]+domain\s*=\s*["']\*["']/i.test(flash.body))
+            problems.push("/crossdomain.xml allows access from any domain");
+        const silverlight = await ctx.request(`${origin}/clientaccesspolicy.xml`, { followRedirects: false });
+        if (silverlight.status === 200 && /<domain[^>]+uri\s*=\s*["']\*["']/i.test(silverlight.body))
+            problems.push("/clientaccesspolicy.xml allows access from any domain");
+        if (problems.length)
+            return { status: "fail", detail: `${problems.length} insecure cross-domain setting(s).`, evidence: problems };
+        if (review.length)
+            return { status: "manual", detail: "Any origin may read responses (without credentials). Acceptable only for fully public data.", evidence: review };
+        return {
+            status: "pass",
+            detail: acao === "*" ? "CORS allows any origin without credentials (public data only); no permissive policy files." : "No permissive CORS headers or cross-domain policy files found.",
+        };
+    },
+};
+//# sourceMappingURL=cors.js.map

package/dist/checks/headers/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/checks/headers/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE1D,yFAAyF;AACzF,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAEzD,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAU;IACtC,GAAG,EAAE,qBAAqB;IAC1B,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,kCAAkC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QACrG,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7C,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CACpC,oDAAoD,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,uEAAuE,CAAC,CAAC,CAAC,EAAE,EAAE,CACzJ,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,kBAAkB,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,iDAAiD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAChK,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,yBAAyB,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QACtG,IAAI,WAAW,CAAC,MAAM,KAAK,GAAG,IAAI,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAErK,IAAI,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,oCAAoC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACnI,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,6FAA6F,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACxK,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,4FAA4F,CAAC,CAAC,CAAC,gEAAgE;SACvL,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/html.d.ts

@@ -0,0 +1,11 @@
+/** Minimal HTML helpers for passive checks. Regex-based: good enough to read attributes, not a full parser. */
+export interface Tag {
+    name: string;
+    attrs: Record<string, string>;
+}
+/** Opening tags of the given names with their attributes (names lower-cased; valueless attributes = ""). */
+export declare function findTags(html: string, names: string[]): Tag[];
+export declare function htmlComments(html: string): string[];
+/** Resolves a possibly relative URL; undefined if it cannot be parsed or is not http(s). */
+export declare function resolveUrl(value: string | undefined, base: string): URL | undefined;
+//# sourceMappingURL=html.d.ts.map

package/dist/checks/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/checks/html.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAE/G,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,4GAA4G;AAC5G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,EAAE,CAW7D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,GAAG,SAAS,CAQnF"}

package/dist/checks/html.js

@@ -0,0 +1,30 @@
+/** Minimal HTML helpers for passive checks. Regex-based: good enough to read attributes, not a full parser. */
+/** Opening tags of the given names with their attributes (names lower-cased; valueless attributes = ""). */
+export function findTags(html, names) {
+    const out = [];
+    const tagRe = new RegExp(`<(${names.join("|")})\\b([^>]*)>`, "gi");
+    for (const m of html.matchAll(tagRe)) {
+        const attrs = {};
+        for (const a of (m[2] ?? "").matchAll(/([\w:-]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g)) {
+            attrs[a[1].toLowerCase()] = a[2] ?? a[3] ?? a[4] ?? "";
+        }
+        out.push({ name: m[1].toLowerCase(), attrs });
+    }
+    return out;
+}
+export function htmlComments(html) {
+    return [...html.matchAll(/<!--([\s\S]*?)-->/g)].map((m) => m[1].trim());
+}
+/** Resolves a possibly relative URL; undefined if it cannot be parsed or is not http(s). */
+export function resolveUrl(value, base) {
+    if (!value)
+        return undefined;
+    try {
+        const url = new URL(value, base);
+        return url.protocol === "http:" || url.protocol === "https:" ? url : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=html.js.map

package/dist/checks/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/checks/html.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAO/G,4GAA4G;AAC5G,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,KAAe;IACpD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,2DAA2D,CAAC,EAAE,CAAC;YACnG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAyB,EAAE,IAAY;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/checks/index.d.ts

@@ -0,0 +1,7 @@
+import type { Check } from "../types.js";
+/**
+ * All automated checks, keyed by Check.key. Annex B items opt in via AnnexItem.check.
+ * Tier 2 (code scanning) and Tier 3 (assisted manual) checks register here too.
+ */
+export declare const CHECKS: ReadonlyMap<string, Check>;
+//# sourceMappingURL=index.d.ts.map

package/dist/checks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAiBzC;;;GAGG;AACH,eAAO,MAAM,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CA6B7C,CAAC"}

package/dist/checks/index.js

@@ -0,0 +1,48 @@
+import { cookieHttpOnly, cookieSecure } from "./cookies/cookie-flags.js";
+import { charset, contentType, insecureForms, mixedContent, thirdPartyContent } from "./content/page.js";
+import { cookieDomain, cookiePath } from "./cookies/cookie-scope.js";
+import { serverBanner } from "./deployment/server-banner.js";
+import { traceMethod } from "./deployment/trace.js";
+import { crossDomainPolicy } from "./headers/cors.js";
+import { archivedPages, debugPages, errorMessages, internalAddresses, pageSource, robotsTxt } from "./info-disclosure/more.js";
+import { clickjacking } from "./headers/clickjacking.js";
+import { contentTypeOptions } from "./headers/content-type-options.js";
+import { directoryListing } from "./info-disclosure/directory-listing.js";
+import { exposedFiles } from "./info-disclosure/exposed-files.js";
+import { certificate } from "./tls/certificate.js";
+import { hsts } from "./tls/hsts.js";
+import { httpsRedirect } from "./tls/https-redirect.js";
+import { legacyProtocols } from "./tls/legacy-protocols.js";
+/**
+ * All automated checks, keyed by Check.key. Annex B items opt in via AnnexItem.check.
+ * Tier 2 (code scanning) and Tier 3 (assisted manual) checks register here too.
+ */
+export const CHECKS = new Map([
+    httpsRedirect,
+    hsts,
+    certificate,
+    legacyProtocols,
+    contentTypeOptions,
+    clickjacking,
+    cookieSecure,
+    cookieHttpOnly,
+    traceMethod,
+    exposedFiles,
+    directoryListing,
+    debugPages,
+    errorMessages,
+    robotsTxt,
+    pageSource,
+    internalAddresses,
+    archivedPages,
+    thirdPartyContent,
+    insecureForms,
+    mixedContent,
+    cookieDomain,
+    cookiePath,
+    contentType,
+    charset,
+    serverBanner,
+    crossDomainPolicy,
+].map((c) => [c.key, c]));
+//# sourceMappingURL=index.js.map

package/dist/checks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC/H,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAA+B,IAAI,GAAG,CACvD;IACE,aAAa;IACb,IAAI;IACJ,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,WAAW;IACX,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,aAAa;IACb,SAAS;IACT,UAAU;IACV,iBAAiB;IACjB,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,WAAW;IACX,OAAO;IACP,YAAY;IACZ,iBAAiB;CAClB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACzB,CAAC"}

package/dist/checks/info-disclosure/directory-listing.d.ts

@@ -0,0 +1,6 @@
+import type { Check } from "../../types.js";
+export declare function isDirectoryListing(body: string): boolean;
+/** Parent directories of same-origin resources referenced by the page, e.g. /static/js/app.js -> /static/js/, /static/. */
+export declare function directoriesFromHtml(html: string, pageUrl: string): string[];
+export declare const directoryListing: Check;
+//# sourceMappingURL=directory-listing.d.ts.map

package/dist/checks/info-disclosure/directory-listing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-listing.d.ts","sourceRoot":"","sources":["../../../src/checks/info-disclosure/directory-listing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAc5C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,2HAA2H;AAC3H,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB3E;AAED,eAAO,MAAM,gBAAgB,EAAE,KA0B9B,CAAC"}

package/dist/checks/info-disclosure/directory-listing.js

@@ -0,0 +1,60 @@
+import { landingPage } from "../util.js";
+const COMMON_DIRS = ["/images/", "/img/", "/uploads/", "/assets/", "/static/", "/css/", "/js/", "/files/"];
+const MAX_PROBES = 12;
+const LISTING_SIGNATURES = [
+    /<title>\s*Index of \//i, // Apache, nginx autoindex
+    /<h1>\s*Index of \//i,
+    /Directory listing for \//i, // Python http.server
+    /<title>\s*Directory Listing For/i, // Tomcat
+    /\[To Parent Directory\]/i, // IIS
+];
+export function isDirectoryListing(body) {
+    return LISTING_SIGNATURES.some((re) => re.test(body));
+}
+/** Parent directories of same-origin resources referenced by the page, e.g. /static/js/app.js -> /static/js/, /static/. */
+export function directoriesFromHtml(html, pageUrl) {
+    const base = new URL(pageUrl);
+    const dirs = new Set();
+    for (const match of html.matchAll(/(?:src|href)\s*=\s*["']([^"'#?]+)/gi)) {
+        let url;
+        try {
+            url = new URL(match[1], base);
+        }
+        catch {
+            continue;
+        }
+        if (url.origin !== base.origin)
+            continue;
+        const segments = url.pathname.split("/").slice(1, -1);
+        for (let i = segments.length; i > 0; i--) {
+            dirs.add(`/${segments.slice(0, i).join("/")}/`);
+        }
+    }
+    return [...dirs];
+}
+export const directoryListing = {
+    key: "directory-listing",
+    kind: "url",
+    async run(ctx) {
+        const page = await landingPage(ctx);
+        const origin = new URL(page.url).origin;
+        const candidates = [...new Set([...directoriesFromHtml(page.body, page.url), ...COMMON_DIRS])].slice(0, MAX_PROBES);
+        const listed = [];
+        if (isDirectoryListing(page.body))
+            listed.push(page.url);
+        await Promise.all(candidates.map(async (dir) => {
+            const res = await ctx.request(`${origin}${dir}`);
+            if (res.status === 200 && isDirectoryListing(res.body))
+                listed.push(`${origin}${dir}`);
+        }));
+        if (listed.length > 0) {
+            return { status: "fail", detail: `Directory listing is enabled on ${listed.length} path(s).`, evidence: listed.sort() };
+        }
+        return {
+            status: "pass",
+            detail: `No directory listing found on ${candidates.length + 1} paths checked.`,
+            evidence: candidates,
+        };
+    },
+};
+//# sourceMappingURL=directory-listing.js.map

package/dist/checks/info-disclosure/directory-listing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-listing.js","sourceRoot":"","sources":["../../../src/checks/info-disclosure/directory-listing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAC3G,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,MAAM,kBAAkB,GAAG;IACzB,wBAAwB,EAAE,0BAA0B;IACpD,qBAAqB;IACrB,2BAA2B,EAAE,qBAAqB;IAClD,kCAAkC,EAAE,SAAS;IAC7C,0BAA0B,EAAE,MAAM;CACnC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QACzE,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,SAAS;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAU;IACrC,GAAG,EAAE,mBAAmB;IACxB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACxC,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAEpH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;YACjD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;QACzF,CAAC,CAAC,CACH,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mCAAmC,MAAM,CAAC,MAAM,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1H,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,iCAAiC,UAAU,CAAC,MAAM,GAAG,CAAC,iBAAiB;YAC/E,QAAQ,EAAE,UAAU;SACrB,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/checks/info-disclosure/exposed-files.d.ts

@@ -0,0 +1,4 @@
+import type { Check } from "../../types.js";
+export declare const EXPOSED_FILE_PATHS: string[];
+export declare const exposedFiles: Check;
+//# sourceMappingURL=exposed-files.d.ts.map

package/dist/checks/info-disclosure/exposed-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposed-files.d.ts","sourceRoot":"","sources":["../../../src/checks/info-disclosure/exposed-files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAgD5C,eAAO,MAAM,kBAAkB,UAA4B,CAAC;AAE5D,eAAO,MAAM,YAAY,EAAE,KAmB1B,CAAC"}

package/dist/checks/info-disclosure/exposed-files.js

@@ -0,0 +1,56 @@
+import { effectiveOrigin } from "../util.js";
+const PROBES = [
+    {
+        path: "/.git/HEAD",
+        matches: (b) => /^(ref: refs\/|[0-9a-f]{40}\s*$)/.test(b),
+        describe: () => "Git repository metadata (HEAD) is downloadable",
+    },
+    {
+        path: "/.git/config",
+        matches: (b) => /^\s*\[core\]/m.test(b),
+        describe: () => "Git repository config is downloadable",
+    },
+    {
+        path: "/.env",
+        matches: (b) => !/^\s*</.test(b) && envAssignments(b) >= 2,
+        describe: (b) => `Environment file with ${envAssignments(b)} variable assignments (values not shown)`,
+    },
+    {
+        path: "/.svn/wc.db",
+        matches: (b) => b.startsWith("SQLite format 3"),
+        describe: () => "Subversion working-copy database is downloadable",
+    },
+    {
+        path: "/.DS_Store",
+        matches: (b) => b.slice(0, 8).includes("Bud1"),
+        describe: () => "macOS .DS_Store (reveals file names) is downloadable",
+    },
+    {
+        path: "/.htpasswd",
+        matches: (b) => !/^\s*</.test(b) && /^[^:\s]+:(\$|\{SHA\}|[./0-9A-Za-z]{13}$)/m.test(b),
+        describe: () => "Password hash file .htpasswd is downloadable",
+    },
+];
+function envAssignments(body) {
+    return body.split("\n").filter((line) => /^\s*(export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=/.test(line)).length;
+}
+export const EXPOSED_FILE_PATHS = PROBES.map((p) => p.path);
+export const exposedFiles = {
+    key: "exposed-files",
+    kind: "url",
+    async run(ctx) {
+        const origin = await effectiveOrigin(ctx);
+        const findings = [];
+        await Promise.all(PROBES.map(async (probe) => {
+            const res = await ctx.request(`${origin}${probe.path}`, { followRedirects: false });
+            if (res.status === 200 && probe.matches(res.body)) {
+                findings.push(`${origin}${probe.path}: ${probe.describe(res.body)}`);
+            }
+        }));
+        if (findings.length > 0) {
+            return { status: "fail", detail: `${findings.length} sensitive file(s) are publicly accessible.`, evidence: findings.sort() };
+        }
+        return { status: "pass", detail: `None of ${EXPOSED_FILE_PATHS.join(", ")} are exposed.` };
+    },
+};
+//# sourceMappingURL=exposed-files.js.map

package/dist/checks/info-disclosure/exposed-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposed-files.js","sourceRoot":"","sources":["../../../src/checks/info-disclosure/exposed-files.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAU7C,MAAM,MAAM,GAAY;IACtB;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,QAAQ,EAAE,GAAG,EAAE,CAAC,gDAAgD;KACjE;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,QAAQ,EAAE,GAAG,EAAE,CAAC,uCAAuC;KACxD;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,cAAc,CAAC,CAAC,CAAC,0CAA0C;KACtG;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAC/C,QAAQ,EAAE,GAAG,EAAE,CAAC,kDAAkD;KACnE;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9C,QAAQ,EAAE,GAAG,EAAE,CAAC,sDAAsD;KACvE;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,QAAQ,EAAE,GAAG,EAAE,CAAC,8CAA8C;KAC/D;CACF,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3G,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,YAAY,GAAU;IACjC,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,KAAK;IACX,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACzB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YACpF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,6CAA6C,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChI,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;IAC7F,CAAC;CACF,CAAC"}

package/dist/checks/info-disclosure/more.d.ts

@@ -0,0 +1,8 @@
+import type { Check } from "../../types.js";
+export declare const debugPages: Check;
+export declare const errorMessages: Check;
+export declare const robotsTxt: Check;
+export declare const pageSource: Check;
+export declare const internalAddresses: Check;
+export declare const archivedPages: Check;
+//# sourceMappingURL=more.d.ts.map

package/dist/checks/info-disclosure/more.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"more.d.ts","sourceRoot":"","sources":["../../../src/checks/info-disclosure/more.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAsB5C,eAAO,MAAM,UAAU,EAAE,KAexB,CAAC;AAgBF,eAAO,MAAM,aAAa,EAAE,KAgB3B,CAAC;AAMF,eAAO,MAAM,SAAS,EAAE,KAoBvB,CAAC;AAoBF,eAAO,MAAM,UAAU,EAAE,KA6BxB,CAAC;AAMF,eAAO,MAAM,iBAAiB,EAAE,KAmB/B,CAAC;AAGF,eAAO,MAAM,aAAa,EAAE,KAY3B,CAAC"}