feat(probes): isLiteral detect api.ipify.org with shady link (#389)

* feat(probes): isLiteral detect api.ipify.org with shady link

* Update workspaces/js-x-ray/test/probes/isLiteral.spec.ts

Co-authored-by: Thomas.G <gentilhomme.thomas@gmail.com>

---------

Co-authored-by: Thomas.G <gentilhomme.thomas@gmail.com>

Author: clemgbld

.changeset/seven-tools-spend.md

@@ -0,0 +1,5 @@
+---
+"@nodesecure/js-x-ray": minor
+---
+
+feat(probes): isLiteral detect api.ipify.org with shady link

workspaces/js-x-ray/src/probes/isLiteral.ts

@@ -21,7 +21,7 @@ const kNodeDeps = new Set(builtinModules);
 const kShadyLinkRegExps = [
   kMapRegexIps.regexIPv4,
   kMapRegexIps.regexIPv6,
-  /(http[s]?:\/\/(bit\.ly|ipinfo\.io|httpbin\.org).*)$/,
+  /(http[s]?:\/\/(bit\.ly|ipinfo\.io|httpbin\.org|api\.ipify\.org).*)$/,
   /(http[s]?:\/\/.*\.(link|xyz|tk|ml|ga|cf|gq|pw|top|club|mw|bd|ke|am|sbs|date|quest|cd|bid|cd|ws|icu|cam|uno|email|stream))$/
 ];
 

workspaces/js-x-ray/test/probes/isLiteral.spec.ts

@@ -1,5 +1,5 @@
 // Import Node.js Dependencies
-import { test } from "node:test";
+import { test, describe } from "node:test";
 import assert from "node:assert";
 
 // Import Internal Dependencies
@@ -78,50 +78,35 @@ test("should not throw any warnings without hexadecimal value (and should call a
   assert.strictEqual(astNode.value, "hello world!");
 });
 
-test("should detect shady link when an URL is bit.ly", () => {
-  const str = "const foo = 'http://bit.ly/foo'";
-  const ast = parseScript(str);
-  const sastAnalysis = getSastAnalysis(isLiteral).execute(ast.body);
-
-  assert.strictEqual(sastAnalysis.warnings().length, 1);
-  const warning = sastAnalysis.getWarning("shady-link");
-  assert.strictEqual(warning.value, "http://bit.ly/foo");
-});
-
-test("should detect shady link when an URL is ipinfo.io when protocol is http", () => {
-  const str = "const foo = 'http://ipinfo.io/json'";
-  const ast = parseScript(str);
-  const sastAnalysis = getSastAnalysis(isLiteral).execute(ast.body);
-  assert.strictEqual(sastAnalysis.warnings().length, 1);
-  const warning = sastAnalysis.getWarning("shady-link");
-  assert.strictEqual(warning.value, "http://ipinfo.io/json");
-});
-
-test("should detect shady link when an URL is ipinfo.io when protocol is https", () => {
-  const str = "const foo = 'https://ipinfo.io/json'";
-  const ast = parseScript(str);
-  const sastAnalysis = getSastAnalysis(isLiteral).execute(ast.body);
-  assert.strictEqual(sastAnalysis.warnings().length, 1);
-  const warning = sastAnalysis.getWarning("shady-link");
-  assert.strictEqual(warning.value, "https://ipinfo.io/json");
-});
-
-test("should detect shady link when an URL is httpbin.org when protocol is http", () => {
-  const str = "const foo = 'http://httpbin.org/ip'";
-  const ast = parseScript(str);
-  const sastAnalysis = getSastAnalysis(isLiteral).execute(ast.body);
-  assert.strictEqual(sastAnalysis.warnings().length, 1);
-  const warning = sastAnalysis.getWarning("shady-link");
-  assert.strictEqual(warning.value, "http://httpbin.org/ip");
-});
-
-test("should detect shady link when an URL is httpbin.org when protocol is https", () => {
-  const str = "const foo = 'https://httpbin.org/ip'";
-  const ast = parseScript(str);
-  const sastAnalysis = getSastAnalysis(isLiteral).execute(ast.body);
-  assert.strictEqual(sastAnalysis.warnings().length, 1);
-  const warning = sastAnalysis.getWarning("shady-link");
-  assert.strictEqual(warning.value, "https://httpbin.org/ip");
+describe("known suspicious domain", () => {
+  const suspiciousDomains = [
+    "bit.ly/foo",
+    "ipinfo.io/json",
+    "httpbin.org/ip",
+    "api.ipify.org/ip"
+  ];
+
+  test("should detect shady link when an URL is known to be suspicious when protocol is http", () => {
+    for (const suspicousDomain of suspiciousDomains) {
+      const str = `const foo = 'http://${suspicousDomain}'`;
+      const ast = parseScript(str);
+      const sastAnalysis = getSastAnalysis(isLiteral).execute(ast.body);
+      assert.strictEqual(sastAnalysis.warnings().length, 1);
+      const warning = sastAnalysis.getWarning("shady-link");
+      assert.strictEqual(warning.value, `http://${suspicousDomain}`);
+    }
+  });
+
+  test("should detect shady link when an URL is known to be suspicious when protocol is https", () => {
+    for (const suspicousDomain of suspiciousDomains) {
+      const str = `const foo = 'https://${suspicousDomain}'`;
+      const ast = parseScript(str);
+      const sastAnalysis = getSastAnalysis(isLiteral).execute(ast.body);
+      assert.strictEqual(sastAnalysis.warnings().length, 1);
+      const warning = sastAnalysis.getWarning("shady-link");
+      assert.strictEqual(warning.value, `https://${suspicousDomain}`);
+    }
+  });
 });
 
 test("should detect shady link when an URL has a suspicious domain", () => {