CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-08-06 06:18:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
236 Commits 309 Branches 0 Tags
1eae837260fd5cd90aa09392a6ced3627f6b3c95
Commit Graph
3 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
gstack 1eae837260 fix(stealth): address security review findings 
1. HIGH — Function.toString Map exfiltration:
   Replaced Map with WeakMap + bound methods. A malicious page could
   monkeypatch Map.prototype.has to capture the override store, then
   use it to cloak malicious functions as [native code]. WeakMap with
   pre-bound has/get methods prevents this side-channel.

2. MEDIUM — Static GPU fingerprint:
   Default GPU renderer now randomly selects from 5 common Apple chip
   variants (M1, M1 Pro, M1 Max, M2, M3) per session. Prevents sites
   from building a static GStack-specific fingerprint signature.

3. Tests updated: 54 total (35 unit + 19 e2e), 0 failures.
   Added tests for WeakMap usage and GPU randomization.
 2026-04-21 03:08:06 +00:00
gstack 8df1c003b5 test(stealth): comprehensive unit + e2e tests, fix platform mismatch 
Tests (52 total, 0 failures):

Unit tests (33):
- Module exports validation (stealthArgs shape, applyStealthPatches type)
- Launch args content (AutomationControlled, no-first-run, no forbidden flags)
- Init script source analysis (all 10 patch vectors verified present)
- applyStealthPatches API (mock context, GPU args, serialization, idempotency)
- Adversarial edge cases (array spread safety, extension compat, GPU plausibility)
- Import integration (browser-manager.ts correctly imports and calls both paths)
- Old inline patches removal verification

E2E tests (19):
- Real Chromium launch with stealth patches applied
- navigator.webdriver value AND property existence
- WebGL1 + WebGL2 renderer spoofing
- PluginArray instanceof + shape verification
- Complete chrome object (app, runtime, loadTimes, csi)
- Languages, permissions, CDP artifacts, Playwright globals
- Platform/UA consistency
- Patches survive page navigation

Bug fix: navigator.platform now spoofed to 'MacIntel' when UA claims
Macintosh. Previously reported 'Linux x86_64' in containers, which
contradicts the Mac user agent and is a detectable fingerprint mismatch.
Caught by the e2e test.
 2026-04-21 03:06:40 +00:00
gstack 46b2e35917 feat(browse): comprehensive anti-bot stealth patches 
Add stealth.ts module that addresses all known automation fingerprints:

1. navigator.webdriver property deletion (not just value override) -
   bot detectors check property existence via 'webdriver' in navigator
2. WebGL renderer spoofing (SwiftShader → Apple M1 Pro) - SwiftShader
   is the #1 giveaway of container/headless environments
3. Proper PluginArray that passes instanceof checks - raw arrays fail
   PluginArray instanceof which DataDome/Cloudflare check
4. Complete chrome object (app, runtime, loadTimes, csi) - shallow
   stubs missing chrome.app get flagged
5. CDP runtime artifact cleanup (cdc_*, $cdc_*, __webdriver*)
6. Permissions API normalization (prompt, not denied)
7. Media devices presence for containers
8. Function.toString() protection - overridden functions look native

Passes SannySoft (bot.sannysoft.com) 100%. Replaces inline patches in
browser-manager.ts with shared module used by both headless launch()
and headed launchHeaded() paths.

Tested against: NYT, LinkedIn, Google, Bloomberg, BleepingComputer,
Brave Search, DuckDuckGo - all previously blocked from automation
browsers, all now pass through.

Remaining hard targets (Reddit, FT, WSJ) blocked by IP reputation
checks beyond browser fingerprinting.
 2026-04-21 02:45:00 +00:00