rentgen/stolen-data-entry.ts

257 lines
7.8 KiB
TypeScript
Raw Permalink Normal View History

2022-01-27 22:30:57 +01:00
import ExtendedRequest, { HAREntry } from './extended-request';
2022-05-02 17:04:56 +02:00
import { SaferEmitter } from './safer-emitter';
2021-11-07 17:44:22 +01:00
import {
2022-01-27 22:30:57 +01:00
getshorthost,
isBase64,
isBase64JSON,
isJSONObject,
isURL,
maskString,
parseToObject,
safeDecodeURIComponent,
} from './util';
export type Sources = 'cookie' | 'pathname' | 'queryparams' | 'header' | 'request_body';
2021-11-07 17:44:22 +01:00
export const Classifications = <const>{
2022-01-27 22:30:57 +01:00
id: 'Identyfikator internetowy',
history: 'Część historii przeglądania',
location: 'Informacje na temat mojego położenia',
2021-11-07 17:44:22 +01:00
};
const ID_PREVIEW_MAX_LENGTH = 20;
2021-11-24 14:19:12 +01:00
const MIN_COOKIE_LENGTH_FOR_AUTO_MARK = 15;
const id = (function* id() {
2022-01-27 22:30:57 +01:00
let i = 0;
while (true) {
i++;
yield i;
}
})();
2022-01-27 22:30:57 +01:00
export type DecodingSchema = 'base64' | 'raw';
2022-05-02 17:04:56 +02:00
export class StolenDataEntry extends SaferEmitter {
2022-01-27 22:30:57 +01:00
public isIAB = false;
public id: number;
private marked = false;
public classification: keyof typeof Classifications;
public decoding_applied: DecodingSchema = 'raw';
public decodings_available: DecodingSchema[] = ['raw'];
2022-01-27 22:30:57 +01:00
constructor(
public request: ExtendedRequest,
public source: Sources,
public name: string,
public value: string
) {
super();
this.id = id.next().value as number;
this.classification = this.classify();
if (isBase64(value)) {
this.decodings_available.push('base64');
}
}
2022-01-27 22:30:57 +01:00
getPriority() {
let priority = 0;
priority += Math.min(this.value.length, 50);
2022-07-09 15:51:34 +02:00
if (this.value.includes(this.request.originalHost)) {
2022-01-27 22:30:57 +01:00
priority += 100;
}
2022-07-09 15:51:34 +02:00
if (this.request.originalPathname && this.value.includes(this.request.originalPathname)) {
2022-01-27 22:30:57 +01:00
priority += 100;
}
if (this.source === 'cookie') {
priority += 200;
}
return priority;
}
2022-01-27 22:30:57 +01:00
get isMarked() {
return this.marked;
2021-11-22 17:54:15 +01:00
}
2022-01-27 22:30:57 +01:00
hasValue(value: string) {
return this.value === value;
}
2022-01-27 22:30:57 +01:00
static parseValue(value: unknown): string | Record<string, unknown> {
if (isBase64JSON(value)) {
return StolenDataEntry.parseValue({
base64: JSON.parse(atob(value)),
});
}
if (value === undefined) {
return '';
}
if (isJSONObject(value)) {
const object = parseToObject(value);
return object;
} else if (isURL(value)) {
const url = new URL(value);
let hash = url.hash;
if (hash.includes('=')) {
//facebook sometimes includes querystring-encoded data into the hash... attempt to parse it
try {
hash = Object.fromEntries(
hash
.slice(1)
.split('&')
.map((kv) => kv.split('='))
);
} catch (e) {
// failed to parse as query string
console.log(
'Failed attempt to parse hash location as query string, probably safe to ignore:',
e
);
}
}
const searchParams = Object.fromEntries(
(
url.searchParams as unknown as {
entries: () => Iterable<[string, string]>;
}
).entries()
);
if (typeof hash !== 'object' && Object.keys(searchParams).length === 0) {
2022-01-27 22:30:57 +01:00
return value; // just a string;
}
const object = {
[Symbol.for('originalString')]: value, // so it doesn't appear raw in the table but can be easily retrieved later
host: url.host,
path: url.pathname,
searchParams,
...(hash === '' ? {} : typeof hash === 'string' ? { hash } : hash),
2022-01-27 22:30:57 +01:00
};
return object;
} else if (value === null) {
return 'null';
} else {
2022-07-09 15:51:34 +02:00
return (value as any).toString();
}
}
getParsedValue(key_path: string): string | Record<string | symbol, unknown> {
2022-01-27 22:30:57 +01:00
let object = StolenDataEntry.parseValue(this.value);
for (const key of key_path.split('.')) {
if (key === '') continue;
2022-01-29 20:41:03 +01:00
if (typeof key === 'string') {
throw new Error('something went wrong when parsing ' + key_path);
2022-01-29 20:41:03 +01:00
}
2022-01-27 22:30:57 +01:00
object = StolenDataEntry.parseValue(object[key]);
}
return object;
}
2022-01-27 22:30:57 +01:00
mark() {
const had_been_marked_before = this.marked;
this.marked = true;
if (!had_been_marked_before) {
this.emit('change');
}
2021-11-24 14:19:12 +01:00
}
2022-01-27 22:30:57 +01:00
unmark() {
const had_been_marked_before = this.marked;
this.marked = false;
if (had_been_marked_before) {
this.emit('change', this.request.origin);
2022-01-27 22:30:57 +01:00
}
2021-11-24 14:19:12 +01:00
}
2022-01-27 22:30:57 +01:00
toggleMark() {
if (this.marked) {
this.unmark();
} else {
this.mark();
}
}
2021-11-07 17:44:22 +01:00
2022-01-27 22:30:57 +01:00
private classify(): keyof typeof Classifications {
let result: keyof typeof Classifications;
if (this.exposesOrigin()) {
result = 'history';
} else {
result = 'id';
}
return result;
2021-11-07 17:44:22 +01:00
}
2021-11-07 17:51:30 +01:00
2022-01-27 22:30:57 +01:00
isRelatedToID() {
return this.request.stolenData.some((entry) => entry.classification == 'id');
2022-01-27 22:30:57 +01:00
}
2021-11-08 20:14:28 +01:00
2022-01-27 22:30:57 +01:00
matchesHAREntry(har: HAREntry): boolean {
return this.request.matchesHAREntry(har);
}
2022-01-27 22:30:57 +01:00
getValuePreview(key = ''): string {
const value = this.getParsedValue(key);
const str =
typeof value === 'object' && value[Symbol.for('originalString')]
? (value[Symbol.for('originalString')] as string)
: value.toString();
if (typeof value !== 'object' && this.classification == 'id') {
return maskString(value, 1 / 3, ID_PREVIEW_MAX_LENGTH);
} else if (typeof value === 'object' && value[Symbol.for('originalString')]) {
2022-01-27 22:30:57 +01:00
return value[Symbol.for('originalString')] as string;
} else {
return str;
}
}
2022-01-27 22:30:57 +01:00
getUniqueKey() {
return this.request.shorthost + ';' + this.name + ';' + this.value;
}
2022-01-27 22:30:57 +01:00
exposesOrigin(): boolean {
return this.exposesHost() || this.exposesPath();
}
2021-11-24 14:19:12 +01:00
2022-01-27 22:30:57 +01:00
autoMark() {
if (
this.classification == 'history' ||
((this.source === 'cookie' ||
this.name.toLowerCase().includes('id') ||
this.name.toLowerCase().includes('cookie') ||
this.name.toLowerCase().includes('ga') ||
this.name.toLowerCase().includes('ses') ||
this.name.toLowerCase().includes('fb')) &&
this.value.length > MIN_COOKIE_LENGTH_FOR_AUTO_MARK)
) {
if (
(this.request.shorthost.includes('google') ||
this.request.shorthost.includes('youtube')) &&
this.name == 'CONSENT'
) {
// this cookie contains "YES" and might distract the person looking at it into thinking i gave consent on the reported site
return;
}
this.mark();
}
2021-11-24 14:19:12 +01:00
}
2022-01-27 22:30:57 +01:00
exposesPath() {
2022-07-09 15:51:34 +02:00
const pathname = this.request.originalPathname;
if (pathname === null) {
return false;
}
2022-01-27 22:30:57 +01:00
return (
this.request.originalPathname !== '/' &&
[this.value, safeDecodeURIComponent(this.value)].some((haystack) =>
2022-07-09 15:51:34 +02:00
haystack.includes(pathname)
2022-01-27 22:30:57 +01:00
)
);
}
2022-01-27 22:30:57 +01:00
exposesHost() {
return [this.value, safeDecodeURIComponent(this.value)].some((haystack) =>
haystack.includes(getshorthost(this.request.origin))
2022-01-27 22:30:57 +01:00
);
}
}