hai/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-05-20 03:12:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(stealth): address security review findings

Browse Source 
1. HIGH — Function.toString Map exfiltration:
   Replaced Map with WeakMap + bound methods. A malicious page could
   monkeypatch Map.prototype.has to capture the override store, then
   use it to cloak malicious functions as [native code]. WeakMap with
   pre-bound has/get methods prevents this side-channel.

2. MEDIUM — Static GPU fingerprint:
   Default GPU renderer now randomly selects from 5 common Apple chip
   variants (M1, M1 Pro, M1 Max, M2, M3) per session. Prevents sites
   from building a static GStack-specific fingerprint signature.

3. Tests updated: 54 total (35 unit + 19 e2e), 0 failures.
   Added tests for WeakMap usage and GPU randomization.
This commit is contained in:
gstack
2026-04-21 03:08:06 +00:00
parent 8df1c003b5
commit 1eae837260
3 changed files with 39 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
browse/test/stealth-e2e.test.ts
View File

@@ -65,7 +65,7 @@ describe('stealth e2e — fingerprint verification', () => {
expect(vendor).not.toContain('SwiftShader');
});
test('WebGL renderer is spoofed to Apple M1 Pro', async () => {
test('WebGL renderer is spoofed to an Apple chip', async () => {
const renderer = await page.evaluate(() => {
const canvas = document.createElement('canvas');
const gl = canvas.getContext('webgl');
@@ -75,7 +75,7 @@ describe('stealth e2e — fingerprint verification', () => {
return gl.getParameter(ext.UNMASKED_RENDERER_WEBGL);
});
expect(renderer).toBeTruthy();
expect(renderer).toContain('Apple M1 Pro');
expect(renderer).toMatch(/Apple.*M[123]/);
expect(renderer).not.toContain('SwiftShader');
expect(renderer).not.toContain('llvmpipe');
});
@@ -91,7 +91,7 @@ describe('stealth e2e — fingerprint verification', () => {
});
// WebGL2 might not be available in all environments
if (renderer !== null) {
expect(renderer).toContain('Apple M1 Pro');
expect(renderer).toMatch(/Apple.*M[123]/);
}
});