487 lines
31 KiB
JavaScript
487 lines
31 KiB
JavaScript
// Suita de probe a inventarului criptografic.
|
|
// Folosire: node test/proba.mjs [--json]
|
|
// Modulul masurat se poate schimba cu CRYPTO_INVENTORY_MODULE=<cale>/inventar.mjs (asa il foloseste
|
|
// control-negativ.mjs pe o copie stricata). Fixturile raman mereu cele din test/fixturi.
|
|
// Fiecare proba ruleaza izolat: o proba care arunca iese ROSU cu mesajul ei, restul ruleaza mai departe.
|
|
import { readFileSync, readdirSync, statSync, existsSync, mkdtempSync, writeFileSync, rmSync, copyFileSync } from 'node:fs';
|
|
import { join, resolve, dirname } from 'node:path';
|
|
import { fileURLToPath, pathToFileURL } from 'node:url';
|
|
import { spawnSync } from 'node:child_process';
|
|
import { tmpdir } from 'node:os';
|
|
import { generateKeyPairSync } from 'node:crypto';
|
|
|
|
const AICI = dirname(fileURLToPath(import.meta.url));
|
|
const FIX = join(AICI, 'fixturi');
|
|
const CALE_MODUL = process.env.CRYPTO_INVENTORY_MODULE ? resolve(process.env.CRYPTO_INVENTORY_MODULE) : join(AICI, '..', 'inventar.mjs');
|
|
const inv = await import(pathToFileURL(CALE_MODUL).href);
|
|
const CA_JSON = process.argv.includes('--json');
|
|
|
|
// numarul total de marcaje EXPECT scrise de mana in fixturi; o schimbare aici se face constient
|
|
const MARCAJE_ASTEPTATE = 96;
|
|
const FISIERE_CU_MARCAJE = ['js/node-crypto.mjs', 'js/webcrypto.js', 'js/biblioteci.ts', 'js/tls.cjs', 'python/crypto_py.py', 'java/Crypto.java', 'go/crypto.go', 'negative/variabile.js'];
|
|
|
|
const probe = [];
|
|
const proba = (nume, fn) => probe.push({ nume, fn });
|
|
function asigura(cond, mesaj) { if (!cond) throw new Error(mesaj); }
|
|
|
|
const memo = new Map();
|
|
function scan(dir, optiuni = {}) {
|
|
const k = dir + JSON.stringify(optiuni);
|
|
if (!memo.has(k)) {
|
|
try { memo.set(k, { rez: inv.scan(dir, optiuni) }); } catch (err) { memo.set(k, { err }); }
|
|
}
|
|
const r = memo.get(k);
|
|
if (r.err) throw r.err;
|
|
return r.rez;
|
|
}
|
|
|
|
function marcaje(rel) {
|
|
const r = [];
|
|
readFileSync(join(FIX, rel), 'utf8').split('\n').forEach((l, i) => {
|
|
const m = /EXPECT:\s*(.+?)\s*$/.exec(l);
|
|
if (!m) return;
|
|
for (const p of m[1].split(' ; ')) {
|
|
const [n, c] = p.split(' | ').map((s) => s.trim());
|
|
r.push(`${i + 1}|${n}|${c}`);
|
|
}
|
|
});
|
|
return r.sort();
|
|
}
|
|
|
|
function gasiriDin(rez, rel) {
|
|
return rez.findings.filter((g) => g.file === rel);
|
|
}
|
|
|
|
function comparaExact(rel) {
|
|
const rez = scan(FIX);
|
|
const ast = marcaje(rel);
|
|
asigura(ast.length > 0, `${rel}: fixtura nu are marcaje`);
|
|
const real = gasiriDin(rez, rel).map((g) => `${g.line}|${g.name}|${g.classification}`).sort();
|
|
const lipsa = ast.filter((x) => !real.includes(x));
|
|
const extra = real.filter((x) => !ast.includes(x));
|
|
asigura(!lipsa.length && !extra.length && ast.length === real.length,
|
|
`${rel}: lipsa [${lipsa.join(', ')}] extra [${extra.join(', ')}] (asteptate ${ast.length}, gasite ${real.length})`);
|
|
}
|
|
|
|
// --- pozitive: fiecare gasire asteptata, cu linia si clasa ei, si nimic in plus ---
|
|
for (const rel of FISIERE_CU_MARCAJE.filter((f) => !f.startsWith('negative/'))) {
|
|
proba(`pozitiv: ${rel}`, () => comparaExact(rel));
|
|
}
|
|
|
|
proba('pozitiv: numarul total de marcaje EXPECT este cel scris', () => {
|
|
const n = FISIERE_CU_MARCAJE.reduce((s, f) => s + marcaje(f).length, 0);
|
|
asigura(n === MARCAJE_ASTEPTATE, `marcaje citite ${n}, scrise ${MARCAJE_ASTEPTATE}`);
|
|
const rez = scan(FIX);
|
|
const inFisiere = rez.findings.filter((g) => FISIERE_CU_MARCAJE.includes(g.file)).length;
|
|
asigura(inFisiere === MARCAJE_ASTEPTATE, `gasiri in fisierele cu marcaje: ${inFisiere}, marcaje ${MARCAJE_ASTEPTATE}`);
|
|
});
|
|
|
|
proba('pozitiv: variabila rezolvata la un literal unic poarta resolvedFrom', () => {
|
|
const g = gasiriDin(scan(FIX), 'js/node-crypto.mjs').find((x) => x.name === 'SHA-256');
|
|
asigura(g && /HASH_ALG \(line 6\)/.test(g.resolvedFrom || ''), `resolvedFrom: ${g && g.resolvedFrom}`);
|
|
const j = gasiriDin(scan(FIX), 'java/Crypto.java').find((x) => x.name === 'SHA-256');
|
|
asigura(j && /DIGEST/.test(j.resolvedFrom || ''), `java resolvedFrom: ${j && j.resolvedFrom}`);
|
|
});
|
|
|
|
proba('pozitiv: manifestele dau biblioteci declarate, nu gasiri', () => {
|
|
const rez = scan(join(FIX, 'manifeste'));
|
|
asigura(rez.findings.length === 0, `gasiri din manifeste: ${rez.findings.length}`);
|
|
const libs = rez.libraries.map((b) => `${b.file}:${b.line} ${b.name}`).sort();
|
|
const ast = ['go.mod:6 github.com/cloudflare/circl', 'go.mod:7 golang.org/x/crypto', 'package.json:10 @noble/post-quantum',
|
|
'package.json:5 ethers', 'package.json:7 jsonwebtoken', 'pom.xml:5 org.bouncycastle:bcprov-jdk18on',
|
|
'requirements.txt:2 cryptography', 'requirements.txt:3 pyjwt'].sort();
|
|
asigura(JSON.stringify(libs) === JSON.stringify(ast), `biblioteci: ${libs.join(' | ')}`);
|
|
const bom = inv.buildCbom(rez, { deterministic: true });
|
|
const c = bom.components.filter((x) => x.type === 'library');
|
|
asigura(c.length === 8 && c.every((x) => x.properties.some((p) => p.name.endsWith('declared-only') && p.value === 'true')), 'componentele library nu poarta declared-only');
|
|
});
|
|
|
|
proba('pozitiv: material PEM (certificat si cheie publica)', () => {
|
|
const rez = scan(FIX);
|
|
const c = gasiriDin(rez, 'material/certificat-proba.pem');
|
|
asigura(c.length === 1 && c[0].assetType === 'certificate' && c[0].name === 'EC-secp256r1' && c[0].classification === 'quantum-vulnerable' && c[0].line === 1, `certificat: ${JSON.stringify(c.map((x) => [x.assetType, x.name, x.line]))}`);
|
|
asigura(/crypto-inventory-fixture/.test(c[0].certificate.subjectName), 'subiectul certificatului lipseste');
|
|
const p = gasiriDin(rez, 'material/cheie-publica-proba.pem');
|
|
asigura(p.length === 1 && p[0].assetType === 'related-crypto-material' && p[0].material.type === 'public-key' && p[0].name === 'RSA-2048' && p[0].line === 2, `cheie publica: ${JSON.stringify(p.map((x) => [x.assetType, x.name, x.line]))}`);
|
|
});
|
|
|
|
proba('pozitiv: cheie privata generata la rulare e raportata, iar valoarea ei nu apare in iesire', () => {
|
|
const d = mkdtempSync(join(tmpdir(), 'ci-cheie-'));
|
|
try {
|
|
const { privateKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
|
|
const pem = privateKey.export({ type: 'pkcs8', format: 'pem' });
|
|
writeFileSync(join(d, 'config.txt'), `setari\n${pem}`);
|
|
const rez = inv.scan(d);
|
|
asigura(rez.findings.length === 1, `gasiri: ${rez.findings.length}`);
|
|
const g = rez.findings[0];
|
|
asigura(g.assetType === 'related-crypto-material' && g.material.type === 'private-key' && g.name === 'EC-secp256r1' && g.line === 2, `gasirea: ${JSON.stringify([g.assetType, g.material, g.name, g.line])}`);
|
|
const corp = pem.split('\n').filter((l) => l && !l.startsWith('-----')).join('');
|
|
const iesire = JSON.stringify(inv.buildCbom(rez)) + JSON.stringify(rez.findings) + inv.renderSummary(rez);
|
|
for (let i = 0; i + 24 <= corp.length; i += 8) asigura(!iesire.includes(corp.slice(i, i + 24)), `o bucata din cheia privata apare in iesire (offset ${i})`);
|
|
} finally {
|
|
rmSync(d, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
// --- clasificare ---
|
|
proba('clasificare: secp256k1 este quantum-vulnerable, cu recomandare de cont post-cuantic', () => {
|
|
const a = inv.classify({ grup: 'SECP256K1' });
|
|
asigura(a.classification === 'quantum-vulnerable' && a.quantumVulnerable === true, `clasa ${a.classification}`);
|
|
asigura(/post-quantum key/.test(a.recommendation) && /not a library swap/.test(a.recommendation), 'recomandarea nu vorbeste de contul post-cuantic');
|
|
const f = gasiriDin(scan(FIX), 'js/node-crypto.mjs').find((x) => x.curve === 'secp256k1');
|
|
asigura(f && f.classification === 'quantum-vulnerable', 'gasirea secp256k1 din fixtura nu e quantum-vulnerable');
|
|
});
|
|
|
|
proba('clasificare: MD5 si SHA-1 sunt weak-now, SHA-256 quantum-safe', () => {
|
|
const c = (h) => inv.classify({ grup: 'HASH', hash: h }).classification;
|
|
asigura(c('MD5') === 'weak-now' && c('SHA1') === 'weak-now' && c('SHA256') === 'quantum-safe', `MD5 ${c('MD5')} SHA1 ${c('SHA1')} SHA256 ${c('SHA256')}`);
|
|
});
|
|
|
|
proba('clasificare: AES-128 quantum-safe cu nota Grover, ECB weak-now, DES weak-now', () => {
|
|
const a = inv.classify({ grup: 'CIPHER', nume: 'AES', param: '128', mod: 'gcm' });
|
|
asigura(a.classification === 'quantum-safe' && /Grover/.test(a.reason + a.recommendation) && a.nistQuantumSecurityLevel === 1, `AES-128: ${a.classification} ${a.nistQuantumSecurityLevel}`);
|
|
asigura(inv.classify({ grup: 'CIPHER', nume: 'AES', param: '256', mod: 'ecb' }).classification === 'weak-now', 'ECB nu e weak-now');
|
|
asigura(inv.classify({ grup: 'CIPHER', nume: 'DES' }).classification === 'weak-now', 'DES nu e weak-now');
|
|
asigura(inv.classify({ grup: 'TLS', param: '1.1', rol: 'min' }).classification === 'weak-now', 'TLS 1.1 nu e weak-now');
|
|
});
|
|
|
|
proba('clasificare: fiecare gasire vulnerabila sau slaba are motiv si recomandare', () => {
|
|
const rez = scan(FIX);
|
|
for (const g of rez.findings) {
|
|
asigura(g.reason && g.reason.length > 20, `${g.file}:${g.line} ${g.name} fara motiv`);
|
|
if (g.classification === 'quantum-vulnerable' || g.classification === 'weak-now' || g.classification === 'unknown') {
|
|
asigura(g.recommendation && g.recommendation.length > 20, `${g.file}:${g.line} ${g.name} (${g.classification}) fara recomandare`);
|
|
}
|
|
}
|
|
});
|
|
|
|
proba('clasificare: JWT asimetric spune ca standardul post-cuantic nu e final', () => {
|
|
const g = gasiriDin(scan(FIX), 'js/biblioteci.ts').find((x) => x.name === 'JWS RS256');
|
|
asigura(g && /no final standard/.test(g.recommendation) && /draft/.test(g.recommendation), 'recomandarea JWT nu spune ca nu exista standard final');
|
|
});
|
|
|
|
// --- negative ---
|
|
function controlPozitivMd5() {
|
|
const g = gasiriDin(scan(FIX), 'js/node-crypto.mjs').find((x) => x.name === 'MD5');
|
|
asigura(g, 'controlul pozitiv al metodei: MD5 din js/node-crypto.mjs lipseste, deci un zero nu inseamna nimic');
|
|
}
|
|
|
|
proba('negativ: comentariile JS nu produc gasiri', () => {
|
|
controlPozitivMd5();
|
|
const g = gasiriDin(scan(FIX), 'negative/comentarii.js');
|
|
asigura(g.length === 0, `comentariile au produs: ${g.map((x) => `${x.line} ${x.name}`).join(', ')}`);
|
|
});
|
|
|
|
proba('negativ: apelul scris intr-un sir JS nu e folosire', () => {
|
|
controlPozitivMd5();
|
|
const g = gasiriDin(scan(FIX), 'negative/siruri.js');
|
|
asigura(g.length === 0, `sirurile au produs: ${g.map((x) => `${x.line} ${x.name}`).join(', ')}`);
|
|
});
|
|
|
|
proba('negativ: comentariile si docstring-urile Python nu produc gasiri', () => {
|
|
const rez = scan(FIX);
|
|
asigura(gasiriDin(rez, 'python/crypto_py.py').some((x) => x.name === 'MD5'), 'controlul pozitiv: hashlib.md5 din fixtura Python lipseste');
|
|
const g = gasiriDin(rez, 'negative/docstring.py');
|
|
asigura(g.length === 0, `docstring/comentariu au produs: ${g.map((x) => `${x.line} ${x.name}`).join(', ')}`);
|
|
});
|
|
|
|
proba('negativ: comentariile si sirurile Java si Go nu produc gasiri', () => {
|
|
const rez = scan(FIX);
|
|
asigura(gasiriDin(rez, 'java/Crypto.java').some((x) => x.name === 'MD5') && gasiriDin(rez, 'go/crypto.go').some((x) => x.name === 'MD5'), 'controlul pozitiv: MD5 din fixturile Java/Go lipseste');
|
|
const g = [...gasiriDin(rez, 'negative/Comentarii.java'), ...gasiriDin(rez, 'negative/comentarii.go')];
|
|
asigura(g.length === 0, `au produs: ${g.map((x) => `${x.file}:${x.line} ${x.name}`).join(', ')}`);
|
|
});
|
|
|
|
proba('negativ: fisier fara criptografie da zero gasiri, si a fost citit', () => {
|
|
const rez = scan(join(FIX, 'negative'));
|
|
asigura(rez.stats.filesSeen === 7 && rez.stats.codeFilesTotal === 7, `vazute ${rez.stats.filesSeen}, analizate ${rez.stats.codeFilesTotal}`);
|
|
const g = gasiriDin(rez, 'fara-cripto.js');
|
|
asigura(g.length === 0, `fara-cripto.js a produs ${g.length}`);
|
|
});
|
|
|
|
proba('negativ: algoritm din variabila reasignata sau din parametru iese unknown, nu ghicit', () => {
|
|
comparaExact('negative/variabile.js');
|
|
const g = gasiriDin(scan(FIX), 'negative/variabile.js');
|
|
asigura(g.every((x) => x.classification === 'unknown' && !x.resolvedFrom), 'o variabila nerezolvabila a primit o valoare');
|
|
});
|
|
|
|
proba('negativ: fisierul binar e sarit si numarat', () => {
|
|
const rez = scan(join(FIX, 'binar'));
|
|
asigura(rez.stats.filesSeen === 1 && rez.stats.notRead.binary === 1 && rez.findings.length === 0, `vazute ${rez.stats.filesSeen}, binare ${rez.stats.notRead.binary}, gasiri ${rez.findings.length}`);
|
|
asigura(rez.stats.notReadExamples.binary.includes('modul.js'), 'exemplul binar lipseste din statistica');
|
|
// control pozitiv: aceiasi octeti fara NUL dau gasirea, deci zeroul de mai sus vine din saritura
|
|
const d = mkdtempSync(join(tmpdir(), 'ci-binar-'));
|
|
try {
|
|
const b = readFileSync(join(FIX, 'binar', 'modul.js'));
|
|
writeFileSync(join(d, 'modul.js'), Buffer.from([...b].filter((x) => x !== 0)));
|
|
const r2 = inv.scan(d);
|
|
asigura(r2.findings.some((x) => x.name === 'MD5'), 'controlul pozitiv: fara NUL, fisierul nu produce MD5');
|
|
} finally { rmSync(d, { recursive: true, force: true }); }
|
|
});
|
|
|
|
proba('negativ: fisier prea mare sarit si numarat', () => {
|
|
const rez = scan(join(FIX, 'limite'), { maxFileBytes: 400 });
|
|
asigura(rez.stats.filesSeen === 2 && rez.stats.notRead.tooLarge === 1, `vazute ${rez.stats.filesSeen}, prea mari ${rez.stats.notRead.tooLarge}`);
|
|
asigura(/^mare\.js \(\d+ bytes\)$/.test(rez.stats.notReadExamples.tooLarge[0] || ''), `exemplu: ${rez.stats.notReadExamples.tooLarge[0]}`);
|
|
asigura(!rez.findings.some((x) => x.file === 'mare.js') && rez.findings.some((x) => x.file === 'mic.js'), 'gasirile nu corespund limitei');
|
|
const tot = scan(join(FIX, 'limite'));
|
|
asigura(tot.findings.some((x) => x.file === 'mare.js' && x.name === 'MD5'), 'controlul pozitiv: fara limita, mare.js nu da MD5');
|
|
});
|
|
|
|
proba('negativ: limita de fisiere numara restul', () => {
|
|
const rez = scan(join(FIX, 'limite'), { maxFiles: 1 });
|
|
asigura(rez.stats.filesSeen === 2 && rez.stats.notRead.fileLimit === 1 && rez.stats.codeFilesTotal === 1, `vazute ${rez.stats.filesSeen}, peste limita ${rez.stats.notRead.fileLimit}`);
|
|
});
|
|
|
|
// --- cazurile-limita ale formelor liniare (2026-09-29, revizuirea adversariala: cautarea PEM, literalul regex JS, docstring-ul
|
|
// Python si rezolvarea variabilelor aveau cost patratic; formele noi trebuie sa dea EXACT ce dadeau cele vechi, si aici stau
|
|
// cazurile pe care o forma liniara scrisa gresit le-ar schimba). Modulele se iau de langa modulul masurat (copia controlului).
|
|
const LIB = join(dirname(CALE_MODUL), 'lib');
|
|
const lexer = await import(pathToFileURL(join(LIB, 'lexer.mjs')).href);
|
|
const pem = await import(pathToFileURL(join(LIB, 'pem.mjs')).href);
|
|
const contextMod = await import(pathToFileURL(join(LIB, 'context.mjs')).href);
|
|
|
|
proba('limite: un bloc PEM care incepe in liniutele unui antet fara sfarsit e gasit', () => {
|
|
const corp = 'A'.repeat(64);
|
|
const t = `-----BEGIN PRIVATE KEY-----BEGIN CERTIFICATE-----${corp}-----END CERTIFICATE-----`;
|
|
const b = [...pem.blocuriPem(t)].map((x) => `${x.index}|${x.tip}|${x.corp}`);
|
|
asigura(JSON.stringify(b) === JSON.stringify([`22|CERTIFICATE|${corp}`]), `blocuri: ${JSON.stringify(b)}`);
|
|
const fara = [...pem.blocuriPem(`-----BEGIN CERTIFICATE-----${corp}."-----END CERTIFICATE-----`)];
|
|
asigura(fara.length === 0, 'un caracter din afara alfabetului corpului inainte de sfarsit trebuie sa anuleze blocul');
|
|
});
|
|
|
|
proba('limite: literalul regex JS se cauta din starea lui, nu din ce a esuat alt literal pe acelasi rand', () => {
|
|
// primul `/` deschide o clasa care nu se inchide (esec pana la capatul randului, trecand prin 8 IN clasa); al doilea porneste
|
|
// din 8 IN AFARA clasei si se inchide la 10
|
|
const r = lexer.curata('x =/[ =/ x/;', 'javascript');
|
|
asigura(JSON.stringify(r.siruri) === JSON.stringify([[7, 11]]), `siruri: ${JSON.stringify(r.siruri)}`);
|
|
});
|
|
|
|
proba('limite: docstring Python pe randul lui (si dupa un sir neterminat), dar nu dupa cod pe acelasi rand', () => {
|
|
// docstring-ul de dupa sirul neterminat e INDENTAT: spatiile de inainte de el sunt pe randul nou, nu in coada sirului
|
|
const t = "a = 'abc\n '''doc'''\ny = '''s'''\n r'''d2'''\n";
|
|
const r = lexer.curata(t, 'python');
|
|
asigura(!r.code.includes('doc') && !r.code.includes('d2'), `docstring-urile trebuiau golite: ${JSON.stringify(r.code)}`);
|
|
asigura(r.code.includes("'''s'''"), `sirul triplu de dupa cod trebuia pastrat: ${JSON.stringify(r.code)}`);
|
|
const s = t.indexOf("'''s'''");
|
|
asigura(r.siruri.some(([a, b]) => a === s && b === s + 7), `intervalul sirului s lipseste: ${JSON.stringify(r.siruri)}`);
|
|
});
|
|
|
|
proba('limite: peste plafonul de variabile pe fisier numele ies unknown si fisierul se numara', () => {
|
|
const d = mkdtempSync(join(tmpdir(), 'ci-plafon-'));
|
|
try {
|
|
const n = contextMod.REZOLVARI_PE_FISIER;
|
|
const linii = ["import { createHash } from 'node:crypto';"];
|
|
for (let i = 0; i <= n; i++) linii.push(`const h${i} = 'sha256';`, `createHash(h${i});`);
|
|
writeFileSync(join(d, 'multe.mjs'), linii.join('\n') + '\n');
|
|
const rez = inv.scan(d);
|
|
const rezolvate = rez.findings.filter((g) => g.name === 'SHA-256' && g.resolvedFrom).length;
|
|
const necunoscute = rez.findings.filter((g) => g.classification === 'unknown').length;
|
|
asigura(rezolvate === n && necunoscute === 1, `rezolvate ${rezolvate} (cerut ${n}), unknown ${necunoscute} (cerut 1)`);
|
|
asigura(rez.stats.resolutionLimitFiles === 1 && rez.stats.resolutionLimitExamples[0] === 'multe.mjs', `statistica: ${rez.stats.resolutionLimitFiles}`);
|
|
} finally { rmSync(d, { recursive: true, force: true }); }
|
|
});
|
|
|
|
// --- CBOM ---
|
|
const E = {
|
|
bom: ['$schema', 'bomFormat', 'specVersion', 'serialNumber', 'version', 'metadata', 'components', 'services', 'externalReferences', 'dependencies', 'compositions', 'properties', 'vulnerabilities', 'annotations', 'formulation', 'declarations', 'definitions', 'signature'],
|
|
component: ['type', 'mime-type', 'bom-ref', 'supplier', 'manufacturer', 'authors', 'author', 'publisher', 'group', 'name', 'version', 'description', 'scope', 'hashes', 'licenses', 'copyright', 'cpe', 'purl', 'omniborId', 'swhid', 'swid', 'modified', 'pedigree', 'externalReferences', 'properties', 'components', 'evidence', 'releaseNotes', 'modelCard', 'data', 'cryptoProperties', 'signature', 'tags'],
|
|
componentType: ['application', 'framework', 'library', 'container', 'platform', 'operating-system', 'device', 'device-driver', 'firmware', 'file', 'machine-learning-model', 'data', 'cryptographic-asset'],
|
|
cryptoProperties: ['assetType', 'algorithmProperties', 'certificateProperties', 'relatedCryptoMaterialProperties', 'protocolProperties', 'oid'],
|
|
assetType: ['algorithm', 'certificate', 'protocol', 'related-crypto-material'],
|
|
algorithmProperties: ['primitive', 'parameterSetIdentifier', 'curve', 'executionEnvironment', 'implementationPlatform', 'certificationLevel', 'mode', 'padding', 'cryptoFunctions', 'classicalSecurityLevel', 'nistQuantumSecurityLevel'],
|
|
primitive: ['drbg', 'mac', 'block-cipher', 'stream-cipher', 'signature', 'hash', 'pke', 'xof', 'kdf', 'key-agree', 'kem', 'ae', 'combiner', 'other', 'unknown'],
|
|
mode: ['cbc', 'ecb', 'ccm', 'gcm', 'cfb', 'ofb', 'ctr', 'other', 'unknown'],
|
|
padding: ['pkcs5', 'pkcs7', 'pkcs1v15', 'oaep', 'raw', 'other', 'unknown'],
|
|
cryptoFunctions: ['generate', 'keygen', 'encrypt', 'decrypt', 'digest', 'tag', 'keyderive', 'sign', 'verify', 'encapsulate', 'decapsulate', 'other', 'unknown'],
|
|
protocolProperties: ['type', 'version', 'cipherSuites', 'ikev2TransformTypes', 'cryptoRefArray'],
|
|
protocolType: ['tls', 'ssh', 'ipsec', 'ike', 'sstp', 'wpa', 'other', 'unknown'],
|
|
certificateProperties: ['subjectName', 'issuerName', 'notValidBefore', 'notValidAfter', 'signatureAlgorithmRef', 'subjectPublicKeyRef', 'certificateFormat', 'certificateExtension'],
|
|
relatedCryptoMaterialProperties: ['type', 'id', 'state', 'algorithmRef', 'creationDate', 'activationDate', 'updateDate', 'expirationDate', 'value', 'size', 'format', 'securedBy'],
|
|
materialType: ['private-key', 'public-key', 'secret-key', 'key', 'ciphertext', 'signature', 'digest', 'initialization-vector', 'nonce', 'seed', 'salt', 'shared-secret', 'tag', 'additional-data', 'password', 'credential', 'token', 'other', 'unknown'],
|
|
evidence: ['identity', 'occurrences', 'callstack', 'licenses', 'copyright'],
|
|
occurrence: ['bom-ref', 'location', 'line', 'offset', 'symbol', 'additionalContext'],
|
|
};
|
|
|
|
export function valideazaCbom(bom) {
|
|
const err = [];
|
|
const e = (m) => err.push(m);
|
|
const chei = (o, perm, unde) => { for (const k of Object.keys(o)) if (!perm.includes(k)) e(`${unde}: cheie nepermisa "${k}"`); };
|
|
const sir = (v, unde) => { if (typeof v !== 'string' || !v.length) e(`${unde}: trebuie sir nevid`); };
|
|
const dataIso = (v, unde) => { if (typeof v !== 'string' || Number.isNaN(Date.parse(v)) || !/^\d{4}-\d{2}-\d{2}T/.test(v)) e(`${unde}: nu e date-time`); };
|
|
chei(bom, E.bom, 'bom');
|
|
if (bom.bomFormat !== 'CycloneDX') e('bomFormat');
|
|
if (bom.specVersion !== '1.6') e('specVersion');
|
|
if (!/^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(bom.serialNumber || '')) e(`serialNumber ${bom.serialNumber}`);
|
|
if (!Number.isInteger(bom.version) || bom.version < 1) e('version');
|
|
const md = bom.metadata || {};
|
|
if (md.timestamp !== undefined) dataIso(md.timestamp, 'metadata.timestamp');
|
|
if (!md.tools || !Array.isArray(md.tools.components) || !md.tools.components.length) e('metadata.tools.components');
|
|
else for (const t of md.tools.components) { sir(t.name, 'tool.name'); sir(t.version, 'tool.version'); if (!E.componentType.includes(t.type)) e('tool.type'); }
|
|
if (!Array.isArray(bom.components)) { e('components nu e lista'); return err; }
|
|
const refs = new Set();
|
|
for (const [i, c] of bom.components.entries()) {
|
|
const u = `components[${i}]`;
|
|
chei(c, E.component, u);
|
|
if (!E.componentType.includes(c.type)) e(`${u}.type ${c.type}`);
|
|
sir(c.name, `${u}.name`);
|
|
sir(c['bom-ref'], `${u}.bom-ref`);
|
|
if (refs.has(c['bom-ref'])) e(`${u}: bom-ref dublat ${c['bom-ref']}`);
|
|
refs.add(c['bom-ref']);
|
|
if (c.properties) for (const p of c.properties) { sir(p.name, `${u}.properties.name`); if (typeof p.value !== 'string') e(`${u}.properties.value`); }
|
|
if (c.type === 'cryptographic-asset') {
|
|
const cp = c.cryptoProperties;
|
|
if (!cp) { e(`${u}: cryptoProperties lipsa`); continue; }
|
|
chei(cp, E.cryptoProperties, `${u}.cryptoProperties`);
|
|
if (!E.assetType.includes(cp.assetType)) e(`${u}.assetType ${cp.assetType}`);
|
|
if (cp.oid !== undefined && !/^[0-2](\.\d+)+$/.test(cp.oid)) e(`${u}.oid ${cp.oid}`);
|
|
if (cp.assetType === 'algorithm') {
|
|
const ap = cp.algorithmProperties;
|
|
if (!ap) { e(`${u}: algorithmProperties lipsa`); continue; }
|
|
chei(ap, E.algorithmProperties, `${u}.algorithmProperties`);
|
|
if (!E.primitive.includes(ap.primitive)) e(`${u}.primitive ${ap.primitive}`);
|
|
if (ap.parameterSetIdentifier !== undefined) sir(ap.parameterSetIdentifier, `${u}.parameterSetIdentifier`);
|
|
if (ap.curve !== undefined) sir(ap.curve, `${u}.curve`);
|
|
if (ap.mode !== undefined && !E.mode.includes(ap.mode)) e(`${u}.mode ${ap.mode}`);
|
|
if (ap.padding !== undefined && !E.padding.includes(ap.padding)) e(`${u}.padding ${ap.padding}`);
|
|
if (ap.cryptoFunctions !== undefined && (!Array.isArray(ap.cryptoFunctions) || ap.cryptoFunctions.some((f) => !E.cryptoFunctions.includes(f)))) e(`${u}.cryptoFunctions`);
|
|
if (ap.classicalSecurityLevel !== undefined && (!Number.isInteger(ap.classicalSecurityLevel) || ap.classicalSecurityLevel < 0)) e(`${u}.classicalSecurityLevel`);
|
|
if (ap.nistQuantumSecurityLevel !== undefined && (!Number.isInteger(ap.nistQuantumSecurityLevel) || ap.nistQuantumSecurityLevel < 0 || ap.nistQuantumSecurityLevel > 6)) e(`${u}.nistQuantumSecurityLevel`);
|
|
} else if (cp.assetType === 'protocol') {
|
|
const pp = cp.protocolProperties || {};
|
|
chei(pp, E.protocolProperties, `${u}.protocolProperties`);
|
|
if (!E.protocolType.includes(pp.type)) e(`${u}.protocolProperties.type`);
|
|
if (pp.version !== undefined) sir(pp.version, `${u}.protocolProperties.version`);
|
|
} else if (cp.assetType === 'certificate') {
|
|
const cc = cp.certificateProperties || {};
|
|
chei(cc, E.certificateProperties, `${u}.certificateProperties`);
|
|
for (const k of ['notValidBefore', 'notValidAfter']) if (cc[k] !== undefined) dataIso(cc[k], `${u}.${k}`);
|
|
} else if (cp.assetType === 'related-crypto-material') {
|
|
const rm = cp.relatedCryptoMaterialProperties || {};
|
|
chei(rm, E.relatedCryptoMaterialProperties, `${u}.relatedCryptoMaterialProperties`);
|
|
if (!E.materialType.includes(rm.type)) e(`${u}.relatedCryptoMaterialProperties.type`);
|
|
if (rm.size !== undefined && !Number.isInteger(rm.size)) e(`${u}.size`);
|
|
if (rm.value !== undefined) e(`${u}: valoarea materialului nu are voie sa apara`);
|
|
}
|
|
}
|
|
if (!c.evidence || !Array.isArray(c.evidence.occurrences) || !c.evidence.occurrences.length) { e(`${u}: evidence.occurrences lipsa`); continue; }
|
|
chei(c.evidence, E.evidence, `${u}.evidence`);
|
|
for (const o of c.evidence.occurrences) {
|
|
chei(o, E.occurrence, `${u}.occurrence`);
|
|
sir(o.location, `${u}.occurrence.location`);
|
|
if (o.line !== undefined && (!Number.isInteger(o.line) || o.line < 1)) e(`${u}.occurrence.line`);
|
|
}
|
|
}
|
|
return err;
|
|
}
|
|
|
|
proba('cbom: structura CycloneDX 1.6 (campuri obligatorii, tipuri, enumerari)', () => {
|
|
const rez = scan(FIX);
|
|
for (const det of [false, true]) {
|
|
const bom = inv.buildCbom(rez, { deterministic: det });
|
|
const err = valideazaCbom(bom);
|
|
asigura(err.length === 0, `erori (${det ? 'determinist' : 'normal'}): ${err.slice(0, 5).join('; ')}`);
|
|
asigura(det ? bom.metadata.timestamp === undefined : typeof bom.metadata.timestamp === 'string', 'timestamp');
|
|
}
|
|
const bom = inv.buildCbom(rez);
|
|
const tipuri = new Set(bom.components.map((c) => (c.cryptoProperties ? c.cryptoProperties.assetType : c.type)));
|
|
for (const t of ['algorithm', 'protocol', 'certificate', 'related-crypto-material', 'library']) asigura(tipuri.has(t), `lipseste tipul ${t}`);
|
|
// controlul negativ al validatorului: o forma stricata trebuie sa fie refuzata
|
|
const rau = JSON.parse(JSON.stringify(bom));
|
|
rau.components[0].cryptoProperties = { assetType: 'algorithm', algorithmProperties: { primitive: 'magic' } };
|
|
rau.components[1]['bom-ref'] = rau.components[2]['bom-ref'];
|
|
rau.specVersion = '1.5';
|
|
asigura(valideazaCbom(rau).length >= 3, 'validatorul nu refuza un CBOM stricat');
|
|
});
|
|
|
|
proba('cbom: bom-ref unice si stabile intre doua rulari', () => {
|
|
const a = inv.buildCbom(inv.scan(FIX), { deterministic: true });
|
|
const b = inv.buildCbom(inv.scan(FIX), { deterministic: true });
|
|
const ra = a.components.map((c) => c['bom-ref']);
|
|
asigura(new Set(ra).size === ra.length, `bom-ref dublate: ${ra.length - new Set(ra).size}`);
|
|
asigura(JSON.stringify(a) === JSON.stringify(b), 'doua rulari deterministe difera');
|
|
const gasiri = inv.scan(FIX).findings.length;
|
|
const occ = a.components.filter((c) => c.type === 'cryptographic-asset').reduce((s, c) => s + c.evidence.occurrences.length, 0);
|
|
asigura(occ === gasiri, `occurrences ${occ} != gasiri ${gasiri}`);
|
|
});
|
|
|
|
proba('cbom: fiecare occurrence arata un fisier care exista, cu o linie din fisier', () => {
|
|
const bom = inv.buildCbom(scan(FIX));
|
|
let n = 0;
|
|
for (const c of bom.components) {
|
|
for (const o of c.evidence.occurrences) {
|
|
const f = join(FIX, o.location);
|
|
asigura(existsSync(f) && statSync(f).isFile(), `nu exista: ${o.location}`);
|
|
const linii = readFileSync(f, 'utf8').split('\n').length;
|
|
asigura(o.line >= 1 && o.line <= linii, `${o.location}: linia ${o.line} din ${linii}`);
|
|
n++;
|
|
}
|
|
}
|
|
asigura(n > 50, `prea putine occurrences: ${n}`);
|
|
});
|
|
|
|
// --- CLI ---
|
|
function cli(args) {
|
|
return spawnSync(process.execPath, [CALE_MODUL, ...args], { encoding: 'utf8', timeout: 60000 });
|
|
}
|
|
|
|
proba('cli: --fail-on vulnerable iese 1 pe cod vulnerabil si 0 pe cod fara criptografie', () => {
|
|
const r = cli(['scan', join(FIX, 'js'), '--fail-on', 'vulnerable', '--summary']);
|
|
asigura(r.status === 1 && /quantum-vulnerable finding/.test(r.stderr), `status ${r.status}, stderr ${r.stderr.slice(0, 200)}`);
|
|
const d = mkdtempSync(join(tmpdir(), 'ci-cli-'));
|
|
try {
|
|
copyFileSync(join(FIX, 'negative', 'fara-cripto.js'), join(d, 'fara-cripto.js'));
|
|
const r0 = cli(['scan', d, '--fail-on', 'vulnerable', '--summary']);
|
|
asigura(r0.status === 0, `fara criptografie: status ${r0.status}`);
|
|
} finally { rmSync(d, { recursive: true, force: true }); }
|
|
const r2 = cli(['scan', join(FIX, 'js'), '--fail-on', 'nimic']);
|
|
asigura(r2.status === 2, `valoare --fail-on invalida: status ${r2.status}`);
|
|
const r3 = cli(['scan', join(FIX, 'js'), '--fail-on', 'weak', '--summary']);
|
|
asigura(r3.status === 1 && /weak-now finding/.test(r3.stderr), `--fail-on weak: status ${r3.status}`);
|
|
});
|
|
|
|
proba('cli: --summary spune cate fisiere nu au fost citite si de ce', () => {
|
|
const r = cli(['scan', FIX, '--summary', '--max-file-bytes', '400']);
|
|
asigura(r.status === 0, `status ${r.status} ${r.stderr}`);
|
|
const m = /Not read: (\d+) binary, (\d+) too large \(> 400 bytes\), (\d+) over the file limit/.exec(r.stdout);
|
|
asigura(m && m[1] === '1' && Number(m[2]) >= 1 && m[3] === '0', `randul "Not read": ${m ? m[0] : 'lipsa'}`);
|
|
asigura(/e\.g\. binary: binar\/modul\.js/.test(r.stdout), 'exemplul binar lipseste din rezumat');
|
|
const rj = cli(['scan', join(FIX, 'go'), '--deterministic']);
|
|
const bom = JSON.parse(rj.stdout);
|
|
asigura(bom.specVersion === '1.6' && valideazaCbom(bom).length === 0, 'CBOM-ul de pe stdout nu e valid');
|
|
});
|
|
|
|
proba('rezumat: caracterele de control din numele de fisiere nu ajung in terminal', () => {
|
|
const rez = scan(FIX);
|
|
const i = rez.findings.findIndex((g) => g.classification === 'quantum-vulnerable');
|
|
asigura(i >= 0, 'controlul pozitiv: fixturile trebuie sa aiba o gasire vulnerabila');
|
|
const rau = 'x\u001b]0;titlu\u0007\u001b[31mrosu.js';
|
|
const t = inv.renderSummary({ ...rez, findings: rez.findings.map((g, k) => (k === i ? { ...g, file: rau } : g)) });
|
|
asigura(t.includes('x?]0;titlu??[31mrosu.js'), 'numele fisierului trebuia sa apara, cu caracterele de control inlocuite');
|
|
asigura(!/[\u0000-\u0009\u000b-\u001f\u007f]/.test(t), 'un caracter de control a ajuns in rezumat');
|
|
});
|
|
|
|
proba('rezumat: numaratoarea pe clase egala cu gasirile', () => {
|
|
const rez = scan(FIX);
|
|
const c = inv.countByClass(rez.findings);
|
|
const s = Object.values(c).reduce((a, b) => a + b, 0);
|
|
asigura(s === rez.findings.length, `suma claselor ${s}, gasiri ${rez.findings.length}`);
|
|
const t = inv.renderSummary(rez);
|
|
for (const [k, v] of Object.entries(c)) asigura(new RegExp(`${k}\\s+${v}\\b`).test(t), `rezumatul nu arata ${k} ${v}`);
|
|
});
|
|
|
|
// --- rularea ---
|
|
const rezultate = {};
|
|
const erori = {};
|
|
for (const p of probe) {
|
|
try { await p.fn(); rezultate[p.nume] = 'VERDE'; } catch (err) { rezultate[p.nume] = 'ROSU'; erori[p.nume] = String(err && err.message || err); }
|
|
}
|
|
const verzi = Object.values(rezultate).filter((x) => x === 'VERDE').length;
|
|
if (CA_JSON) {
|
|
process.stdout.write(JSON.stringify({ suita: 'crypto-inventory', modul: CALE_MODUL, rulate: probe.length, verzi, rosii: probe.length - verzi, rezultate, erori }) + '\n');
|
|
} else {
|
|
for (const p of probe) process.stdout.write(`${rezultate[p.nume].padEnd(6)} ${p.nume}${erori[p.nume] ? `\n ${erori[p.nume]}` : ''}\n`);
|
|
process.stdout.write(`\n${verzi} din ${probe.length} probe verzi (modul: ${CALE_MODUL})\n`);
|
|
}
|
|
process.exitCode = verzi === probe.length ? 0 : 1;
|