reaproof 0.3.0 → 0.4.0

package/src/macos.mjs

@@ -1,38 +1,120 @@
-import { spawnSync } from 'node:child_process';
+import { worstSeverity } from './rules.mjs';
 
-const GET_TASK_ALLOW = /<key>com\.apple\.security\.get-task-allow<\/key>\s*<true\/>/;
-// `codesign -dv` prints for example: CodeDirectory v=20500 size=278 flags=0x10002(adhoc,runtime)
-const CODE_DIRECTORY_FLAGS = /^CodeDirectory .*\bflags=0x[0-9a-f]+\(([^)]*)\)/m;
+// What a Mach-O file, the format of macOS and iOS programs, gives away or leaves open. The
+// facts come from `readMachO`; nothing here runs the file or asks the system about it, so
+// the checks give the same answer on any machine.
 
-export function isAppBundleName(name) {
-  return name.endsWith('.app');
+// A stripped build keeps a marker or two. A handful of names says little about the code,
+// so names alone are reported from a hundred up.
+const MIN_NAMES = 100;
+const HOME_FOLDER = /^(?:\/Users\/|\/home\/|[A-Za-z]:\\Users\\)/;
+// A path is long, and one is enough to show whose machine it names.
+const MAX_SAMPLE_SOURCES = 1;
+
+const HARDENED_RUNTIME = 0x10000;
+// The names `codesign -dv` prints for the bits of `flags=`, so the evidence can be compared with it.
+const SIGNATURE_FLAG_NAMES = [
+  [0x1, 'host'],
+  [0x2, 'adhoc'],
+  [0x100, 'hard'],
+  [0x200, 'kill'],
+  [0x400, 'expires'],
+  [0x800, 'restrict'],
+  [0x1000, 'enforcement'],
+  [0x2000, 'library-validation'],
+  [HARDENED_RUNTIME, 'runtime'],
+  [0x20000, 'linker-signed'],
+];
+// Entitlements that open the running program to others, by the system the program is for.
+// `get-task-allow` lets another process attach to it, and is spelled differently on the
+// Mac. `disable-library-validation` lets a Mac program load plug-ins and libraries whoever
+// signed them. Others are left alone: `allow-dyld-environment-variables` still needs that
+// one before it can bring in code from another signer (Apple's page for it says so), and
+// those that loosen memory protection, as a JavaScript engine needs, are a different matter.
+const OPENING_ENTITLEMENTS = {
+  macos: [
+    ['com.apple.security.get-task-allow', 'high'],
+    ['com.apple.security.cs.disable-library-validation', 'medium'],
+  ],
+  ios: [['get-task-allow', 'high']],
+};
+const isGranted = (entitlements, key) =>
+  new RegExp(`<key>${key.replaceAll('.', '\\.')}</key>\\s*<true/>`).test(entitlements);
+
+/**
+ * @param {string} path how the file is shown to the user
+ * @param {import('./macho.mjs').MachOImage[]} images one per architecture
+ */
+export function checkMachO(path, images) {
+  // The system grants entitlements and the Hardened Runtime to a process, by its own executable.
+  const executables = images.filter(({ kind }) => kind === 'executable');
+  return [
+    ...checkNames(path, images.filter(({ kind }) => kind !== 'other')),
+    ...checkEntitlements(path, executables),
+    ...checkRuntime(path, executables),
+  ];
 }
 
 /**
- * Reports release-signing settings of a macOS app that make it easy to look inside while
- * it runs. Reads the signature with the system's own `codesign`; the app is never started.
- *
- * @param {string} path how the bundle is shown to the user
- * @param {string} appPath absolute path of the `.app` directory
+ * Names and paths that only a developer or a debugger needs, left in what ships. Other
+ * files link against the names a library exports, so those have to stay; nothing links
+ * against a program's, so there every name it defines counts.
  */
-export function checkAppBundle(path, appPath) {
-  if (process.platform !== 'darwin') return [];
-  const signature = runCodesign(['-dv', appPath]);
-  // Unsigned, or no codesign on this machine: there is no release signature to judge.
-  if (signature.status !== 0) return [];
-
-  const findings = [];
-  const entitlements = runCodesign(['-d', '--entitlements', '-', '--xml', appPath]).stdout ?? '';
-  if (GET_TASK_ALLOW.test(entitlements)) {
-    findings.push({ rule: 'macos-entitlement', severity: 'high', path, detail: {} });
-  }
-  const flags = signature.stderr.match(CODE_DIRECTORY_FLAGS)?.[1].split(',') ?? [];
-  if (!flags.includes('runtime')) {
-    findings.push({ rule: 'macos-runtime', severity: 'medium', path, detail: {} });
+function checkNames(path, images) {
+  const builds = images.map((image) => ({
+    architecture: image.architecture,
+    names: image.localNames + (image.kind === 'executable' ? image.exportedNames : 0),
+    debugEntries: image.debugEntries,
+    sources: image.sourcePaths,
+  }));
+  if (builds.length === 0) return [];
+  // The builds in a universal binary are of the same code. The one with the most names
+  // speaks for the file, so that its numbers can be checked against that one build.
+  const [{ architecture, names, debugEntries, sources }] = builds.sort((one, other) => other.names - one.names);
+  if (sources.length === 0 && names < MIN_NAMES) return [];
+  const detail = {
+    architecture,
+    names,
+    debugEntries,
+    sourceCount: sources.length,
+    sampleSources: sources.slice(0, MAX_SAMPLE_SOURCES),
+    // A path under someone's home folder names the account that built the file.
+    namesBuilder: sources.some((source) => HOME_FOLDER.test(source)),
+  };
+  return [{ rule: 'native-symbols', severity: 'medium', path, detail }];
+}
+
+function checkEntitlements(path, executables) {
+  const granted = new Map();
+  for (const { system, signature } of executables) {
+    for (const [key, severity] of OPENING_ENTITLEMENTS[system] ?? []) {
+      if (signature && isGranted(signature.entitlements, key)) granted.set(key, { severity });
+    }
   }
-  return findings;
+  if (granted.size === 0) return [];
+  const severity = worstSeverity([...granted.values()]);
+  return [{ rule: 'macos-entitlement', severity, path, detail: { entitlements: [...granted.keys()] } }];
+}
+
+/**
+ * The Hardened Runtime is a protection of the Mac, and a Mac program that is not signed
+ * has none either. Each architecture's build carries its own signature, so each is listed
+ * with what it says.
+ */
+function checkRuntime(path, executables) {
+  const unprotected = executables.filter(
+    ({ system, signature }) => system === 'macos' && !(signature && signature.flags & HARDENED_RUNTIME),
+  );
+  if (unprotected.length === 0) return [];
+  const slices = unprotected.map(({ architecture, signature }) => ({
+    architecture,
+    flags: signature ? describeFlags(signature.flags) : null,
+  }));
+  return [{ rule: 'macos-runtime', severity: 'medium', path, detail: { slices } }];
 }
 
-function runCodesign(args) {
-  return spawnSync('codesign', args, { encoding: 'utf8' });
+/** @returns {string} for example '0x10002(adhoc,runtime)', the way `codesign -dv` writes it */
+function describeFlags(flags) {
+  const names = SIGNATURE_FLAG_NAMES.filter(([bit]) => flags & bit).map(([, name]) => name);
+  return `0x${flags.toString(16)}(${names.join(',') || 'none'})`;
 }

package/src/program.mjs

@@ -0,0 +1,26 @@
+// Telling a Linux or Windows program from other files by how it opens. (A macOS or iOS one
+// is known by `readMachO` reading it.)
+
+const ELF_MAGIC = Buffer.from([0x7f, 0x45, 0x4c, 0x46]);
+// In an ELF header: which way round its numbers are written, then what kind of file it is.
+// A program is an executable or a shared object; an object file is a step of a build.
+const ELF_BYTE_ORDER = 5;
+const ELF_BIG_ENDIAN = 2;
+const ELF_KIND = 16;
+const ELF_PROGRAM_KINDS = [2, 3];
+// A Windows program opens with a DOS header that says, at this offset, where the real one starts.
+const DOS_HEADER_BYTES = 64;
+const PE_HEADER_POINTER = 0x3c;
+
+/** @param {import('./bytes.mjs').ByteSource} source */
+export function isLinuxOrWindowsProgram(source) {
+  if (source.byteLength < DOS_HEADER_BYTES) return false;
+  const opening = source.read(0, DOS_HEADER_BYTES);
+  if (opening.subarray(0, ELF_MAGIC.length).equals(ELF_MAGIC)) {
+    const isBigEndian = opening[ELF_BYTE_ORDER] === ELF_BIG_ENDIAN;
+    return ELF_PROGRAM_KINDS.includes(isBigEndian ? opening.readUInt16BE(ELF_KIND) : opening.readUInt16LE(ELF_KIND));
+  }
+  if (opening.toString('latin1', 0, 2) !== 'MZ') return false;
+  const headerOffset = opening.readUInt32LE(PE_HEADER_POINTER);
+  return headerOffset + 4 <= source.byteLength && source.read(headerOffset, 4).toString('latin1') === 'PE\0\0';
+}

package/src/remote.mjs

@@ -1,7 +1,8 @@
+import { extname } from 'node:path';
 import { checkInlineMaps, checkMapFile, findMapReferences } from './checks/sourcemaps.mjs';
-import { summarizeFindings } from './rules.mjs';
-import { MAX_FILE_BYTES, ScanError, startResult } from './scan.mjs';
-import { toShown } from './text.mjs';
+import { isScript } from './rules.mjs';
+import { finishResult, MAX_FILE_BYTES, ScanError, startResult } from './scan.mjs';
+import { toShown, toShownText } from './text.mjs';
 
 const REQUEST_TIMEOUT_MS = 15_000;
 // One page and its own files, read one after another: a check, not a crawl.
@@ -15,6 +16,9 @@ const USER_AGENT = 'reaproof (source map exposure check)';
 const SCRIPT_SOURCE = /<script\b[^>]{0,2000}?\bsrc\s*=\s*["']([^"']{1,2000})["']/gi;
 const LINK_TARGET = /<link\b[^>]{0,2000}?\bhref\s*=\s*["']([^"']{1,2000})["']/gi;
 const CODE_PATH = /\.(?:m?js|css)$/i;
+// Why a file of the site could not be used is the message of the error thrown for it: a
+// short code such as this one or 'HTTP 404'.
+const TOO_LARGE = 'TOO_LARGE';
 
 export function isWebAddress(input) {
   return /^https?:\/\//i.test(input);
@@ -31,18 +35,28 @@ export function isWebAddress(input) {
  * @param {string} pageAddress an http(s) address
  */
 export async function scanDeployedSite(pageAddress) {
-  const requested = toAddress(pageAddress);
-  if (!requested) throw new ScanError('page-unreachable', pageAddress);
-  const result = startResult({ root: requested.href, isDeployed: true, targets: [requested.href], frameworks: [] });
-  const html = await fetchText(requested, result.skippedLargeFiles, null);
-  if (!html) throw new ScanError('page-unreachable', pageAddress);
-
+  const html = await fetchPage(pageAddress);
   // A site may answer from another address than the one typed (www, https). That one is home.
   const page = html.address;
-  Object.assign(result, { root: page.href, targets: [page.href] });
-  // A file too large to read is put on the same list the local scan puts one on.
-  const read = (address) => fetchText(address, result.skippedLargeFiles, page.origin);
+  const result = startResult({
+    root: page.href,
+    isDeployed: true,
+    targets: [page.href],
+    targetsPickedByName: false,
+    frameworks: [],
+  });
+  // A file that is not there, or does not answer, is no finding. One too large to read is
+  // put on the same list the local scan puts one on.
+  const read = async (address) => {
+    try {
+      return await fetchText(address, page.origin);
+    } catch (error) {
+      if (error.message === TOO_LARGE) result.skippedLargeFiles.push(address.pathname);
+      return null;
+    }
+  };
   const { ownAssets, otherOriginCount } = listCodeAssets(html.text.slice(0, MAX_PAGE_CHARACTERS), page);
+  result.filesSeen = ownAssets.length;
   result.skippedOtherOrigins = otherOriginCount;
   const addFindings = (findings) => {
     for (const finding of findings) result.findings.push({ ...toShown(finding), diskPath: null });
@@ -53,6 +67,7 @@ export async function scanDeployedSite(pageAddress) {
     const code = await read(asset);
     if (!code) continue;
     result.filesScanned += 1;
+    if (isScript(extname(asset.pathname).toLowerCase())) result.scriptsScanned += 1;
     addFindings(checkInlineMaps(asset.pathname, code.text));
 
     for (const mapAddress of listMapCandidates(code)) {
@@ -63,7 +78,24 @@ export async function scanDeployedSite(pageAddress) {
       if (map) addFindings(checkMapFile(mapAddress.pathname, map.text));
     }
   }
-  return Object.assign(result, summarizeFindings(result.findings));
+  return finishResult(result);
+}
+
+/** The page itself has to be read, so a failure here ends the check and says why. */
+async function fetchPage(pageAddress) {
+  const unreachable = (reason) => new ScanError('page-unreachable', pageAddress, { reason });
+  const requested = toAddress(pageAddress);
+  if (!requested) throw unreachable('INVALID_ADDRESS');
+  try {
+    return await fetchText(requested, null);
+  } catch (error) {
+    if (error.name === 'TimeoutError' || error.name === 'AbortError') throw unreachable('TIMEOUT');
+    // Node wraps a network error in "fetch failed" and keeps underneath the system's code
+    // for it, or for a request it refuses to make (a blocked port, say) a few words. An
+    // answer that could not be used carries its own short code as the message.
+    const cause = error.cause ?? error;
+    throw unreachable(toShownText(String(cause.code ?? cause.message)));
+  }
 }
 
 /**
@@ -108,27 +140,21 @@ function toAddress(reference, base) {
 
 /**
  * @param {URL} address
- * @param {string[]} skippedLargeFiles gains the path of a file that was there but too large to read
  * @param {string | null} homeOrigin the one site the file may be read from, or null for the page itself
- * @returns {Promise<{ text: string, sourceMapHeader: string | null, address: URL } | null>}
- *   null when there is nothing usable; `address` is where the file was finally read from
+ * @returns {Promise<{ text: string, sourceMapHeader: string | null, address: URL }>}
+ *   `address` is where the file was finally read from
+ * @throws when the server answered with something that cannot be used, with a short code
+ *   as the message, and whatever `fetch` throws when it did not answer
  */
-async function fetchText(address, skippedLargeFiles, homeOrigin) {
-  try {
-    const response = await request(address, homeOrigin);
-    if (!response?.ok) return null;
-    const text = await readCapped(response);
-    if (text === null) {
-      skippedLargeFiles.push(address.pathname);
-      return null;
-    }
-    // ECMA-426 section 11.1.1: `sourcemap` is the header, `x-sourcemap` its deprecated name.
-    const sourceMapHeader = response.headers.get('sourcemap') ?? response.headers.get('x-sourcemap');
-    return { text, sourceMapHeader, address: new URL(response.url) };
-  } catch {
-    // Unreachable, timed out or cut off: treated the same as a file that is not there.
-    return null;
-  }
+async function fetchText(address, homeOrigin) {
+  const response = await request(address, homeOrigin);
+  if (!response) throw new Error('LEFT_THE_SITE');
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  const text = await readCapped(response);
+  if (text === null) throw new Error(TOO_LARGE);
+  // ECMA-426 section 11.1.1: `sourcemap` is the header, `x-sourcemap` its deprecated name.
+  const sourceMapHeader = response.headers.get('sourcemap') ?? response.headers.get('x-sourcemap');
+  return { text, sourceMapHeader, address: new URL(response.url) };
 }
 
 /**