// ─────────────────────────────────────────────────────────────────────────────
// A08:2025  SOFTWARE OR DATA INTEGRITY FAILURES           (2021: A08 Software and Data Integrity Failures)
// ─────────────────────────────────────────────────────────────────────────────
// WHAT    : Code or data is trusted without verifying it hasn't been tampered
//           with — by the client, the network, or the pipeline.
// HAPPENS : insecure deserialization (eval / node-serialize / JSON with
//           __proto__ -> prototype pollution in JS); unsigned auto-updates;
//           CI/CD pipeline that builds from unverified sources or lets PRs
//           mutate the pipeline; CDN scripts without SRI; trusting client-side
//           state (price in hidden field, role in cookie, isAdmin in JWT body
//           that isn't verified); JWT signature skipped (`jwt.decode`);
//           cache poisoning; unsigned webhooks.
// SPOT    : eval / new Function / vm.runInContext on input; `JSON.parse` then
//           deep merge / Object.assign into defaults; lodash.merge / _.set
//           with user keys; <script src="https://cdn..."> with no integrity=;
//           req.body.price used in charge(); jwt.decode(token) used as truth;
//           update URL over http; webhook handler with no signature check.
// FIX     : never eval; parse with a reviver / Object.create(null) /
//           deny __proto__, constructor, prototype keys; Object.freeze
//           (Object.prototype) in hardened runtimes; SRI integrity attr +
//           crossorigin; HMAC-signed tokens/cookies verified with
//           timingSafeEqual; verify JWT signature + alg allowlist; server-side
//           source of truth for prices/roles; signed releases (Sigstore);
//           pipeline: protected branches, required reviews, no secrets in
//           fork builds, verified artifacts.
// SAY     : CWE-502 Deserialization of Untrusted Data, CWE-1321 Prototype
//           Pollution, CWE-345 Insufficient Verification of Data Authenticity,
//           CWE-353 Missing Support for Integrity Check, CWE-494 Download of
//           Code Without Integrity Check, CWE-347 Improper Verification of
//           Cryptographic Signature. Pitch: "Verify before you trust: sign
//           what crosses a boundary and check the signature on the way in."
// ─────────────────────────────────────────────────────────────────────────────
'use strict';
const assert = require('node:assert/strict');
const crypto = require('node:crypto');

// ── 1. Prototype pollution via deserialization + merge
// VULNERABLE:
//   function merge(target, src) { for (const k in src) {
//     target[k] = (typeof src[k] === 'object') ? merge(target[k] || {}, src[k]) : src[k]; } return target; }
//   merge(config, JSON.parse('{"__proto__":{"isAdmin":true}}'));   // now ({}).isAdmin === true everywhere
// FIXED: deny the three dangerous keys; only recurse into plain objects; use null-prototype targets.
const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
function isPlainObject(v) {
  if (v === null || typeof v !== 'object' || Array.isArray(v)) return false;
  const p = Object.getPrototypeOf(v);
  return p === Object.prototype || p === null;
}
function safeMerge(target, src) {
  if (!isPlainObject(src)) return target;
  for (const key of Object.keys(src)) {                       // own enumerable only
    if (FORBIDDEN_KEYS.has(key)) continue;
    const val = src[key];
    if (isPlainObject(val)) {
      if (!isPlainObject(target[key]) || !Object.hasOwn(target, key)) target[key] = Object.create(null);
      safeMerge(target[key], val);
    } else {
      target[key] = val;
    }
  }
  return target;
}
const evil = JSON.parse('{"__proto__":{"polluted":"yes"},"constructor":{"prototype":{"polluted2":"yes"}},"ok":{"deep":1}}');
const cfg = safeMerge(Object.create(null), evil);
assert.equal({}.polluted, undefined);                         // Object.prototype untouched
assert.equal({}.polluted2, undefined);
assert.equal(Object.prototype.polluted, undefined);
assert.equal(cfg.ok.deep, 1);
assert.equal(Object.hasOwn(cfg, '__proto__'), false);
assert.equal(Object.hasOwn(cfg, 'constructor'), false);
// JSON.parse reviver variant: drop the keys at parse time
function safeParse(text) {
  return JSON.parse(text, (k, v) => (FORBIDDEN_KEYS.has(k) ? undefined : v));
}
const parsed = safeParse('{"a":1,"__proto__":{"x":1},"b":{"constructor":{"y":2}}}');
assert.deepEqual(parsed, { a: 1, b: {} });
assert.equal({}.x, undefined);
// Mitigations also: Object.freeze(Object.prototype) at startup; --disable-proto=delete; Map instead of {} for user keys.

// ── 2. Insecure deserialization: eval / new Function
// VULNERABLE:
//   const obj = eval('(' + req.body.data + ')');                     // RCE
//   const fn = new Function('return ' + req.query.expr)();             // RCE
//   node-serialize .unserialize(cookie)  // IIFE in payload => RCE (classic CVE)
// FIXED: JSON.parse only (data, not code), then validate the shape against a schema.
function parseOrder(text) {
  const o = safeParse(text);
  if (!isPlainObject(o)) throw new TypeError('order must be an object');
  if (typeof o.sku !== 'string' || !Number.isInteger(o.qty) || o.qty < 1) throw new TypeError('bad order');
  return { sku: o.sku, qty: o.qty };                            // allowlist the fields you copy out
}
assert.deepEqual(parseOrder('{"sku":"a1","qty":2,"isAdmin":true}'), { sku: 'a1', qty: 2 });
assert.throws(() => parseOrder('{"sku":"a1","qty":"2"}'), /bad order/);
assert.throws(() => parseOrder('"string"'), /must be an object/);

// ── 3. Trusting client-side state (price in hidden field / role in body)
// VULNERABLE:
//   charge(req.user, req.body.price * req.body.qty);               // attacker posts price=0.01
//   if (req.body.role === 'admin') grantAdmin();
// FIXED: server-side source of truth; the client only sends identifiers.
const catalog = new Map([['a1', 1999]]);
function priceOrder({ sku, qty }) {
  const unit = catalog.get(sku);
  if (unit === undefined) throw new Error('unknown sku');
  return unit * qty;
}
assert.equal(priceOrder(parseOrder('{"sku":"a1","qty":2,"price":1}')), 3998);   // client "price" ignored

// ── 4. HMAC-signed cookie / token verified with timingSafeEqual
// VULNERABLE: cookie `prefs=eyJ1aWQiOjEsInJvbGUiOiJhZG1pbiJ9` (base64 JSON) read back and trusted.
// FIXED:
const SECRET = crypto.randomBytes(32);
function signCookie(obj, key = SECRET) {
  const body = Buffer.from(JSON.stringify(obj)).toString('base64url');
  return body + '.' + crypto.createHmac('sha256', key).update(body).digest('base64url');
}
function readCookie(cookie, key = SECRET) {
  const dot = cookie.lastIndexOf('.');
  if (dot < 0) return null;
  const body = cookie.slice(0, dot);
  const mac = Buffer.from(cookie.slice(dot + 1));
  const want = Buffer.from(crypto.createHmac('sha256', key).update(body).digest('base64url'));
  if (mac.length !== want.length || !crypto.timingSafeEqual(mac, want)) return null;
  return safeParse(Buffer.from(body, 'base64url').toString('utf8'));
}
const c = signCookie({ uid: 1, role: 'user' });
assert.deepEqual(readCookie(c), { uid: 1, role: 'user' });
const forged = Buffer.from(JSON.stringify({ uid: 1, role: 'admin' })).toString('base64url') + '.' + c.split('.')[1];
assert.equal(readCookie(forged), null);                        // signature doesn't match tampered body
assert.equal(readCookie(c.slice(0, -1) + (c.endsWith('A') ? 'B' : 'A')), null);
assert.equal(readCookie('nodot'), null);
// JWT: same idea — ALWAYS jwt.verify(token, key, { algorithms: ['RS256'] }); jwt.decode() is NOT verification.

// ── 5. Subresource Integrity for CDN scripts
// VULNERABLE: <script src="https://cdn.example.com/lib.js"></script>      // CDN compromise => XSS on every page
// FIXED:
function sriTag(src, bytes) {
  const hash = crypto.createHash('sha384').update(bytes).digest('base64');
  return `<script src="${src}" integrity="sha384-${hash}" crossorigin="anonymous"></script>`;
}
const tag = sriTag('https://cdn.example.com/lib.js', Buffer.from('console.log(1)'));
assert.match(tag, /integrity="sha384-[A-Za-z0-9+/=]{64}"/);
assert.match(tag, /crossorigin="anonymous"/);
// Browser recomputes the hash of the fetched bytes; mismatch => script refused.

// ── 6. Pipeline / update integrity (checklist)
//   Auto-update: fetch over TLS, verify detached signature (minisign/Sigstore cosign) before install.
//   CI: protected branches, required reviews, pipeline-as-code reviewed, no secrets exposed to fork PRs,
//       artifacts hashed + attested (SLSA provenance), deploy only artifacts built by CI (no laptop builds).
//   Webhooks: verify X-Hub-Signature-256 (HMAC of raw body) with timingSafeEqual before parsing.

console.log('ok: owasp/a08-software-data-integrity-failures.js');