new file: internal/analysis/active/taint/scanner.go

	new file:   internal/analysis/active/taint/scanner_test.go
	modified:   internal/analysis/active/taint/taint_analyzer.go
	modified:   internal/analysis/active/taint/taint_analyzer_test.go
	modified:   internal/analysis/active/taint/taint_shim.js
	modified:   internal/browser/session/session.go

Author: xkilldash9x

internal/analysis/active/taint/scanner.go

@@ -0,0 +1,98 @@
+// Filename: internal/analysis/active/taint/scanner.go
+package taint
+
+import (
+	"regexp"
+	"strconv"
+	"strings"
+	"unicode"
+)
+
+// PANScanner handles the verification of credit card numbers (Primary Account Numbers).
+type PANScanner struct {
+	// matcher uses a robust regex to identify potential PAN candidates.
+	// It is unexported but accessible within the 'taint' package (e.g., by analyzer.go).
+	matcher *regexp.Regexp
+}
+
+// The modernized and comprehensive regex pattern for PAN detection.
+// Covers Visa, MasterCard (including 2-series), Amex, Discover, and Diners Club.
+// It handles common separators (spaces, dashes).
+// This must be kept in sync with the CC_REGEX in taint_shim.js.
+const panPattern = `\b(?:4[0-9]{3}(?:[- ]?[0-9]{4}){2}(?:[- ]?[0-9]{1,4})?|(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)(?:[- ]?[0-9]{4}){3}|3[47][0-9]{2}(?:[- ]?[0-9]{6})[- ]?[0-9]{5}|6(?:011|5[0-9]{2}|4[4-9][0-9])(?:[- ]?[0-9]{4}){3}|3(?:0[0-5]|[68][0-9])[0-9](?:[- ]?[0-9]{6})[- ]?[0-9]{4})\b`
+
+// NewPANScanner initializes a PANScanner by compiling the detection regex once for efficient reuse.
+func NewPANScanner() *PANScanner {
+	return &PANScanner{
+		matcher: regexp.MustCompile(panPattern),
+	}
+}
+
+// HasValidPAN checks if an input string contains at least one sequence that matches
+// the PAN pattern and subsequently passes the Luhn algorithm validation.
+func (ps *PANScanner) HasValidPAN(input string) bool {
+	// Find all sequences matching the regex pattern.
+	matches := ps.matcher.FindAllString(input, -1)
+
+	for _, match := range matches {
+		// Clean the match (remove separators) before validation.
+		clean := stripSeparators(match)
+		if luhnCheck(clean) {
+			// If any match is valid, return true immediately.
+			return true
+		}
+	}
+	// No valid PANs found in the input.
+	return false
+}
+
+// stripSeparators removes non-digit characters (like dashes and spaces) from a potential PAN string.
+func stripSeparators(pan string) string {
+	// Use strings.Map to iterate over runes and keep only digits.
+	return strings.Map(func(r rune) rune {
+		if unicode.IsDigit(r) {
+			return r
+		}
+		// Return -1 to drop the rune from the result.
+		return -1
+	}, pan)
+}
+
+// luhnCheck implements the Luhn algorithm (Mod 10 checksum) to validate a cleaned credit card number.
+func luhnCheck(ccNumber string) bool {
+	// Basic length validation (PANs are typically 13-19 digits).
+	if len(ccNumber) < 13 || len(ccNumber) > 19 {
+		return false
+	}
+
+	var sum int
+	// 'alt' determines whether the current digit should be doubled (every second digit from the right).
+	alt := false
+
+	// Iterate backwards through the number string.
+	for i := len(ccNumber) - 1; i >= 0; i-- {
+		// Convert the character digit to an integer.
+		digit, err := strconv.Atoi(string(ccNumber[i]))
+		if err != nil {
+			// Should not happen if stripSeparators and the regex are correct, but handle defensively.
+			return false
+		}
+
+		if alt {
+			// Double the digit.
+			digit *= 2
+			// If the result is greater than 9, subtract 9 (equivalent to summing the digits of the result).
+			if digit > 9 {
+				digit -= 9
+			}
+		}
+
+		// Add the digit (or the processed doubled digit) to the total sum.
+		sum += digit
+		// Toggle the alternate flag for the next iteration.
+		alt = !alt
+	}
+
+	// The number is valid if the total sum is divisible by 10.
+	return sum%10 == 0
+}

internal/analysis/active/taint/scanner_test.go

@@ -0,0 +1,212 @@
+// Filename: internal/analysis/active/taint/scanner_test.go
+package taint
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/xkilldash9x/scalpel-cli/api/schemas"
+)
+
+// --- Unit Tests for PANScanner Logic ---
+
+func TestStripSeparators(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{"No separators", "1234567890", "1234567890"},
+		{"Spaces", "1234 5678 90", "1234567890"},
+		{"Dashes", "1234-5678-90", "1234567890"},
+		{"Mixed", "1234- 5678 - 90", "1234567890"},
+		{"Non-digits", "12a34b", "1234"}, // Should remove letters
+		{"Symbols", "12$34#", "1234"},    // Should remove symbols
+		{"Empty", "", ""},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := stripSeparators(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestLuhnCheck(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string // Input should be cleaned (digits only)
+		isValid bool
+	}{
+		// Valid Numbers (Mathematically verified)
+		{"Valid Visa", "453201511283034", true}, // Corrected: Ends in 34 (Sum 50)
+		{"Valid MasterCard", "5555555555554444", true},
+		{"Valid Amex", "371449635398431", true},
+
+		// Invalid Numbers
+		{"Invalid Checksum (Single Digit Off)", "453201511283035", false}, // Corrected: Ends in 35 (Sum 51)
+		{"Invalid Checksum (Transposition)", "453201511283036", false},
+		{"Too Short", "123456", false},
+		{"Too Long", "123456789012345678901", false}, // > 19 digits
+		{"Empty", "", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := luhnCheck(tt.input)
+			assert.Equal(t, tt.isValid, result, "Input: %s", tt.input)
+		})
+	}
+}
+
+func TestPANScanner_HasValidPAN(t *testing.T) {
+	scanner := NewPANScanner()
+
+	tests := []struct {
+		name        string
+		input       string
+		expectMatch bool
+	}{
+		// 1. Positive Matches (Valid Regex + Valid Luhn)
+		{
+			name:        "Simple Visa",
+			input:       "Here is a card: 453201511283034 thanks", // Corrected Check Digit
+			expectMatch: true,
+		},
+		{
+			name:        "Formatted MasterCard",
+			input:       "Payment: 5555-5555-5555-4444",
+			expectMatch: true,
+		},
+		{
+			name:        "Amex with spaces",
+			input:       "AMEX 3714 496353 98431",
+			expectMatch: true,
+		},
+		{
+			name:        "Mixed text",
+			input:       "user_id: 1234, cc: 4532-0151-1128-3034, exp: 12/25", // Corrected Check Digit
+			expectMatch: true,
+		},
+
+		// 2. Negative Matches (Valid Regex + Invalid Luhn) -> False Positive Reduction
+		{
+			name:        "Regex Match but Invalid Luhn (Visa-like)",
+			input:       "4111111111111112", // Ends in 2 (Sum 31) -> Invalid. (All 1s is Valid Sum 30)
+			expectMatch: false,
+		},
+		{
+			name:        "Regex Match but Invalid Luhn (MC-like)",
+			input:       "5100000000000001", // Ends in 1 -> Sum ends in 1 -> Invalid
+			expectMatch: false,
+		},
+
+		// 3. Negative Matches (No Regex Match)
+		{
+			name:        "Random Numbers",
+			input:       "Call 18005550199 for help",
+			expectMatch: false,
+		},
+		{
+			name:        "Short Number",
+			input:       "4123",
+			expectMatch: false,
+		},
+		{
+			name:        "IIN not in list",
+			input:       "9000000000000000", // 9 is not a major card scheme start
+			expectMatch: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			match := scanner.HasValidPAN(tt.input)
+			assert.Equal(t, tt.expectMatch, match, "Input: %s", tt.input)
+		})
+	}
+}
+
+// --- Integration Tests (Analyzer + Scanner) ---
+
+func TestProcessSensitiveDataEvent_ConfirmedLeak(t *testing.T) {
+	// Setup Analyzer
+	analyzer, reporter, _ := setupAnalyzer(t, nil, false)
+	analyzer.wg.Add(1)
+	go analyzer.correlateWorker(0)
+
+	// Valid Visa that passes Luhn
+	validCC := "4532-0151-1128-3034" // Corrected Check Digit
+
+	// Create a Sensitive Data Event
+	event := SinkEvent{
+		Type:      schemas.TaintSink("SENSITIVE_STORAGE_WRITE"),
+		Value:     validCC,
+		Detail:    "Sensitive pattern detected in storage value",
+		PageURL:   "http://example.com/checkout",
+		PageTitle: "Checkout",
+	}
+
+	// Expect a Report
+	reporter.On("Report", mock.MatchedBy(func(f CorrelatedFinding) bool {
+		return f.IsConfirmed == true &&
+			f.Origin == schemas.TaintSource("HEURISTIC_CLIENT_DATA") &&
+			f.Value == validCC &&
+			f.Sink == schemas.TaintSink("SENSITIVE_STORAGE_WRITE")
+	})).Return().Once()
+
+	analyzer.eventsChan <- event
+	finalizeCorrelationTest(t, analyzer)
+
+	reporter.AssertExpectations(t)
+}
+
+func TestProcessSensitiveDataEvent_Suppressed_FalsePositive(t *testing.T) {
+	analyzer, reporter, _ := setupAnalyzer(t, nil, false)
+	analyzer.wg.Add(1)
+	go analyzer.correlateWorker(0)
+
+	// Looks like a CC (Regex match) but INVALID Luhn
+	invalidLuhnCC := "4111-1111-1111-1112" // Sum 31
+
+	event := SinkEvent{
+		Type:   schemas.TaintSink("SENSITIVE_STORAGE_WRITE"),
+		Value:  invalidLuhnCC,
+		Detail: "Sensitive pattern detected (shim guess)",
+	}
+
+	// We expect NO report because the backend verification (Luhn) should fail
+	analyzer.eventsChan <- event
+	finalizeCorrelationTest(t, analyzer)
+
+	assert.Empty(t, reporter.GetFindings(), "Should suppress false positive CC numbers")
+}
+
+func TestProcessSensitiveDataEvent_OtherSecrets(t *testing.T) {
+	analyzer, reporter, _ := setupAnalyzer(t, nil, false)
+	analyzer.wg.Add(1)
+	go analyzer.correlateWorker(0)
+
+	// A value that does NOT look like a credit card, but was flagged by the shim
+	apiKey := "AKIAIOSFODNN7EXAMPLE"
+
+	event := SinkEvent{
+		Type:   schemas.TaintSink("SENSITIVE_STORAGE_WRITE"),
+		Value:  apiKey,
+		Detail: "Sensitive pattern detected: AWS Key",
+	}
+
+	// Expect Report (Unconfirmed/Heuristic)
+	reporter.On("Report", mock.MatchedBy(func(f CorrelatedFinding) bool {
+		return f.IsConfirmed == false &&
+			f.Value == apiKey &&
+			f.Detail == "Potential Secret/Key Leak: Sensitive pattern detected: AWS Key"
+	})).Return().Once()
+
+	analyzer.eventsChan <- event
+	finalizeCorrelationTest(t, analyzer)
+
+	reporter.AssertExpectations(t)
+}