2 Commits

Author	SHA1	Message	Date
gstack	1eae837260	fix(stealth): address security review findings ... 1. HIGH — Function.toString Map exfiltration: Replaced Map with WeakMap + bound methods. A malicious page could monkeypatch Map.prototype.has to capture the override store, then use it to cloak malicious functions as [native code]. WeakMap with pre-bound has/get methods prevents this side-channel. 2. MEDIUM — Static GPU fingerprint: Default GPU renderer now randomly selects from 5 common Apple chip variants (M1, M1 Pro, M1 Max, M2, M3) per session. Prevents sites from building a static GStack-specific fingerprint signature. 3. Tests updated: 54 total (35 unit + 19 e2e), 0 failures. Added tests for WeakMap usage and GPU randomization.	2026-04-21 03:08:06 +00:00
gstack	8df1c003b5	test(stealth): comprehensive unit + e2e tests, fix platform mismatch ... Tests (52 total, 0 failures): Unit tests (33): - Module exports validation (stealthArgs shape, applyStealthPatches type) - Launch args content (AutomationControlled, no-first-run, no forbidden flags) - Init script source analysis (all 10 patch vectors verified present) - applyStealthPatches API (mock context, GPU args, serialization, idempotency) - Adversarial edge cases (array spread safety, extension compat, GPU plausibility) - Import integration (browser-manager.ts correctly imports and calls both paths) - Old inline patches removal verification E2E tests (19): - Real Chromium launch with stealth patches applied - navigator.webdriver value AND property existence - WebGL1 + WebGL2 renderer spoofing - PluginArray instanceof + shape verification - Complete chrome object (app, runtime, loadTimes, csi) - Languages, permissions, CDP artifacts, Playwright globals - Platform/UA consistency - Patches survive page navigation Bug fix: navigator.platform now spoofed to 'MacIntel' when UA claims Macintosh. Previously reported 'Linux x86_64' in containers, which contradicts the Mac user agent and is a detectable fingerprint mismatch. Caught by the e2e test.	2026-04-21 03:06:40 +00:00