Permissions-Policy Auditor
Pricing
Pay per usage
Fetch one public URL and deeply audit its Permissions-Policy and legacy Feature-Policy headers. Parse feature directives, classify high-risk browser features, and get a readiness score.
Pricing
Pay per usage
Rating
0.0
(0)
Developer
Sanskar Jaiswal
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
5 days ago
Last modified
Categories
Share
FROM apify/actor-node:22
WORKDIR /usr/src/appCOPY package*.json ./RUN npm install --omit=devCOPY . ./CMD ["npm", "start"]{ "name": "permissions-policy-auditor", "version": "0.1.0", "description": "Apify Actor that fetches one public URL and deeply audits its Permissions-Policy and legacy Feature-Policy response headers. Parses each feature directive, classifies sensitive and high-risk browser features, flags over-permissive wildcards, missing high-risk restrictions, deprecated Feature-Policy usage, and conflicting dual headers. Returns a readiness score, grade, issues, and recommendations.", "type": "module", "private": true, "main": "src/main.js", "scripts": { "start": "node src/main.js", "test": "node --test test/*.test.js", "lint": "node --check src/main.js" }, "dependencies": { "apify": "^3.4.5" }, "devDependencies": {}}{ "actorSpecification": 1, "name": "permissions-policy-auditor", "title": "Permissions-Policy Auditor", "description": "Fetch one public URL and deeply audit its Permissions-Policy and legacy Feature-Policy response headers. Parses feature directives, classifies high-risk browser features, flags over-permissive wildcards and missing restrictions. Returns score, grade, and recommendations.", "version": "0.1", "buildTag": "latest", "meta": { "templateId": "js-start" }, "input": "./input_schema.json", "output": "./output_schema.json", "storages": { "dataset": "./dataset_schema.json" }, "dockerfile": "./Dockerfile", "defaultRunOptions": { "build": "latest", "timeoutSecs": 120, "memoryMbytes": 512 }}{ "actorSpecification": 1, "views": { "overview": { "title": "Permissions-Policy audits", "transformation": { "fields": [ "inputUrl", "finalUrl", "ok", "score", "grade", "hasPermissionsPolicy", "hasFeaturePolicy", "directiveCount", "highRiskFeaturesMissing", "highRiskFeaturesAllowedAll", "checkedAt", "error" ] }, "display": { "component": "table", "properties": { "inputUrl": { "label": "Input URL", "format": "link" }, "finalUrl": { "label": "Final URL", "format": "link" }, "ok": { "label": "OK", "format": "boolean" }, "score": { "label": "Score" }, "grade": { "label": "Grade" }, "hasPermissionsPolicy": { "label": "Has PP", "format": "boolean" }, "hasFeaturePolicy": { "label": "Has FP", "format": "boolean" }, "directiveCount": { "label": "Directives" }, "highRiskFeaturesMissing": { "label": "High-risk missing" }, "highRiskFeaturesAllowedAll": { "label": "High-risk * " }, "checkedAt": { "label": "Checked at", "format": "date" }, "error": { "label": "Page error" } } } } }, "fields": { "inputUrl": { "type": "string", "title": "Input URL" }, "normalizedInputUrl": { "type": "string", "title": "Normalized input URL" }, "finalUrl": { "type": "string", "title": "Final URL" }, "https": { "type": "boolean", "title": "HTTPS" }, "ok": { "type": "boolean", "title": "OK" }, "checkedAt": { "type": "string", "title": "Checked at", "format": "date-time" }, "httpStatus": { "type": ["integer", "null"], "title": "HTTP status" }, "hasPermissionsPolicy": { "type": "boolean", "title": "Has Permissions-Policy" }, "hasFeaturePolicy": { "type": "boolean", "title": "Has Feature-Policy" }, "rawPermissionsPolicy": { "type": ["string", "null"], "title": "Raw Permissions-Policy" }, "rawFeaturePolicy": { "type": ["string", "null"], "title": "Raw Feature-Policy" }, "directives": { "type": "array", "title": "Per-directive analysis" }, "directiveCount": { "type": "integer", "title": "Directive count" }, "highRiskFeaturesManaged": { "type": "array", "title": "High-risk features managed" }, "highRiskFeaturesMissing": { "type": "array", "title": "High-risk features missing" }, "highRiskFeaturesAllowedAll": { "type": "array", "title": "High-risk features allowed for all origins" }, "score": { "type": "integer", "title": "Score" }, "grade": { "type": "string", "title": "Grade" }, "issues": { "type": "array", "title": "Issues" }, "recommendations": { "type": "array", "title": "Recommendations" }, "error": { "type": ["string", "null"], "title": "Page error" } }}{ "title": "Permissions-Policy Auditor input", "description": "Fetch one public URL and deeply audit its Permissions-Policy and legacy Feature-Policy response headers. The actor parses each feature directive, classifies sensitive and high-risk browser features (camera, microphone, geolocation, payment, USB, etc.), flags over-permissive wildcards, missing high-risk feature restrictions, deprecated Feature-Policy usage, and conflicting dual headers. Returns a readiness score, letter grade, issues, and recommendations. URLs with credentials and private network targets are rejected.", "type": "object", "schemaVersion": 1, "properties": { "startUrl": { "title": "URL", "type": "string", "description": "Public HTTP or HTTPS URL to audit.", "editor": "textfield", "prefill": "https://example.com/" }, "timeoutSeconds": { "title": "Timeout seconds", "type": "integer", "description": "Request timeout from 3 to 30 seconds.", "editor": "number", "default": 10, "minimum": 3, "maximum": 30 } }, "required": ["startUrl"]}{ "actorOutputSchemaVersion": 1, "title": "Permissions-Policy Audit Results", "properties": { "results": { "type": "string", "title": "Results", "template": "{{links.apiDefaultDatasetUrl}}/items" } }}1import { Actor } from 'apify';2import dns from 'node:dns/promises';3import net from 'node:net';4import { fileURLToPath } from 'node:url';5
6const USER_AGENT = 'PermissionsPolicyAuditor/0.1 (+https://apify.com)';7const DEFAULT_TIMEOUT_SECONDS = 10;8
9/* ---------------------------------------------------------------------------10 * SSRF protection — shared pattern used across URL-fetching factory actors.11 * Allows only HTTP/HTTPS, rejects URL credentials, rejects localhost/private12 * IP literals, DNS-resolves hostnames, and rejects DNS that resolves to13 * private IP ranges.14 * ------------------------------------------------------------------------- */15
16function isPrivateIPv4(ip) {17 const parts = ip.split('.').map(Number);18 if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return false;19 const [a, b] = parts;20 return a === 1021 || (a === 172 && b >= 16 && b <= 31)22 || (a === 192 && b === 168)23 || a === 12724 || a === 025 || (a === 169 && b === 254);26}27
28function isPrivateIPv6(ip) {29 const normalized = ip.toLowerCase();30 return normalized === '::1'31 || normalized.startsWith('fc')32 || normalized.startsWith('fd')33 || normalized.startsWith('fe80:');34}35
36export async function normalizeAndValidateUrl(rawUrl) {37 if (!rawUrl || typeof rawUrl !== 'string') throw new Error('startUrl is required');38 if (/^[a-z][a-z0-9+.-]*:/i.test(rawUrl) && !/^https?:\/\//i.test(rawUrl)) {39 throw new Error('Only HTTP and HTTPS URLs are supported');40 }41 const withScheme = /^https?:\/\//i.test(rawUrl) ? rawUrl : `https://${rawUrl}`;42 const url = new URL(withScheme);43 if (!['http:', 'https:'].includes(url.protocol)) throw new Error('Only HTTP and HTTPS URLs are supported');44 if (!url.hostname || url.username || url.password) throw new Error('URL must be public and must not include credentials');45
46 const literalType = net.isIP(url.hostname);47 if (literalType === 4 && isPrivateIPv4(url.hostname)) throw new Error('Private IPv4 targets are blocked');48 if (literalType === 6 && isPrivateIPv6(url.hostname)) throw new Error('Private IPv6 targets are blocked');49
50 const records = literalType ? [{ address: url.hostname, family: literalType }] : await dns.lookup(url.hostname, { all: true });51 for (const record of records) {52 if (record.family === 4 && isPrivateIPv4(record.address)) throw new Error('DNS resolves to a private IPv4 address; blocked for SSRF safety');53 if (record.family === 6 && isPrivateIPv6(record.address)) throw new Error('DNS resolves to a private IPv6 address; blocked for SSRF safety');54 }55 return url;56}57
58/* ---------------------------------------------------------------------------59 * HTTP fetch with manual redirect revalidation (SSRF-safe).60 * ------------------------------------------------------------------------- */61
62async function fetchHeaders(initialUrl, timeoutSeconds, redirectsRemaining = 3) {63 await normalizeAndValidateUrl(initialUrl.href);64 const controller = new AbortController();65 const timeout = setTimeout(() => controller.abort(), timeoutSeconds * 1000);66 try {67 const response = await fetch(initialUrl, {68 redirect: 'manual',69 signal: controller.signal,70 headers: {71 'user-agent': USER_AGENT,72 accept: 'text/html,application/xhtml+xml,*/*;q=0.1',73 },74 });75
76 if ([301, 302, 303, 307, 308].includes(response.status)) {77 if (redirectsRemaining <= 0) throw new Error('Too many redirects');78 const location = response.headers.get('location');79 if (!location) throw new Error('Redirect without Location header');80 const nextUrl = new URL(location, initialUrl.href);81 try { await response.arrayBuffer(); } catch { /* drain */ }82 return fetchHeaders(nextUrl, timeoutSeconds, redirectsRemaining - 1);83 }84
85 try { await response.arrayBuffer(); } catch { /* drain */ }86
87 const headerMap = {};88 response.headers.forEach((value, key) => {89 headerMap[key.toLowerCase()] = value;90 });91
92 return {93 ok: response.ok,94 status: response.status,95 finalUrl: response.url || initialUrl.href,96 https: (response.url || initialUrl.href).startsWith('https://'),97 headers: headerMap,98 error: null,99 };100 } catch (error) {101 return {102 ok: false,103 status: null,104 finalUrl: initialUrl.href,105 https: initialUrl.protocol === 'https:',106 headers: {},107 error: error.message,108 };109 } finally {110 clearTimeout(timeout);111 }112}113
114/* ---------------------------------------------------------------------------115 * Permissions-Policy header parser.116 *117 * Modern syntax (Permissions-Policy):118 * camera=(), microphone=(self), geolocation=("https://example.com"), payment=*119 *120 * Each directive: feature=(allowlist) or feature=*121 * Allowlist tokens: * (all), self (same-origin), () (none),122 * "https://origin" (specific origin), "https://*.example.com" (wildcard origin)123 *124 * Legacy syntax (Feature-Policy):125 * camera 'none'; microphone 'self'; geolocation https://example.com126 * ------------------------------------------------------------------------- */127
128export function parsePermissionsPolicy(headerValue) {129 if (!headerValue || typeof headerValue !== 'string') return [];130
131 const directives = [];132 const parts = splitTopLevel(headerValue, ',');133 for (const part of parts) {134 const trimmed = part.trim();135 if (!trimmed) continue;136 const eqIdx = trimmed.indexOf('=');137 if (eqIdx === -1) continue;138 const feature = trimmed.slice(0, eqIdx).trim().toLowerCase();139 const allowlistRaw = trimmed.slice(eqIdx + 1).trim();140 if (!feature) continue;141
142 const { allowlist, allowAll, allowSelf, allowNone } = parseAllowlist(allowlistRaw);143
144 directives.push({145 feature,146 allowlist,147 allowAll,148 allowSelf,149 allowNone,150 raw: trimmed,151 });152 }153 return directives;154}155
156export function parseFeaturePolicy(headerValue) {157 if (!headerValue || typeof headerValue !== 'string') return [];158
159 // Feature-Policy uses semicolons to separate directives.160 const directives = [];161 const parts = headerValue.split(';');162 for (const part of parts) {163 const trimmed = part.trim();164 if (!trimmed) continue;165 const tokens = trimmed.split(/\s+/);166 if (tokens.length === 0) continue;167 const feature = tokens[0].trim().toLowerCase();168 if (!feature) continue;169 const originTokens = tokens.slice(1);170
171 const allowlist = [];172 let allowAll = false;173 let allowSelf = false;174 let allowNone = false;175
176 if (originTokens.length === 0) {177 allowAll = true;178 } else {179 for (const tok of originTokens) {180 const lt = tok.trim().toLowerCase();181 if (lt === '*') allowAll = true;182 else if (lt === "'self'") allowSelf = true;183 else if (lt === "'none'") allowNone = true;184 else if (lt === 'self') allowSelf = true;185 else if (lt === 'none') allowNone = true;186 else allowlist.push(tok);187 }188 }189
190 directives.push({191 feature,192 allowlist,193 allowAll,194 allowSelf,195 allowNone,196 raw: trimmed,197 });198 }199 return directives;200}201
202function splitTopLevel(str, delimiter) {203 const result = [];204 let depth = 0;205 let current = '';206 for (const char of str) {207 if (char === '(') depth++;208 else if (char === ')') depth = Math.max(0, depth - 1);209 if (char === delimiter && depth === 0) {210 result.push(current);211 current = '';212 } else {213 current += char;214 }215 }216 if (current.trim()) result.push(current);217 return result;218}219
220function parseAllowlist(raw) {221 const trimmed = raw.trim();222
223 // Bare * (no parens)224 if (trimmed === '*') {225 return { allowlist: [], allowAll: true, allowSelf: false, allowNone: false };226 }227
228 // Parenthesized allowlist229 const parenMatch = /^\((.*)\)$/s.exec(trimmed);230 if (parenMatch) {231 const inner = parenMatch[1].trim();232 if (!inner || inner.toLowerCase() === 'none') {233 return { allowlist: [], allowAll: false, allowSelf: false, allowNone: true };234 }235 const tokens = inner.split(/\s+/).filter(Boolean);236 const allowlist = [];237 let allowAll = false;238 let allowSelf = false;239 for (const tok of tokens) {240 const lt = tok.trim().toLowerCase();241 if (lt === '*') allowAll = true;242 else if (lt === 'self') allowSelf = true;243 else allowlist.push(tok);244 }245 return { allowlist, allowAll, allowSelf, allowNone: false };246 }247
248 // No parens, no * — treat as bare token (non-standard but handle gracefully)249 if (trimmed.toLowerCase() === 'self') {250 return { allowlist: [], allowAll: false, allowSelf: true, allowNone: false };251 }252 if (trimmed.toLowerCase() === 'none') {253 return { allowlist: [], allowAll: false, allowSelf: false, allowNone: true };254 }255 return { allowlist: [trimmed], allowAll: false, allowSelf: false, allowNone: false };256}257
258/* ---------------------------------------------------------------------------259 * Known sensitive browser features.260 * These are the features that security teams should explicitly restrict.261 * ponytail: curated list from the Permissions-Policy spec; upgrade path is262 * to pull from the live spec registry if it grows significantly.263 * ------------------------------------------------------------------------- */264
265const SENSITIVE_FEATURES = new Set([266 // Camera and microphone267 'camera', 'microphone', 'display-capture',268 // Geolocation269 'geolocation',270 // Sensors271 'accelerometer', 'gyroscope', 'magnetometer',272 // Clipboard273 'clipboard-read', 'clipboard-write',274 // Notifications275 'notifications', 'push',276 // Payment277 'payment',278 // USB / Bluetooth / NFC279 'usb', 'bluetooth', 'nfc', 'serial', 'hid',280 // Identity281 'identity-credentials-get',282 // Screen wake lock283 'screen-wake-lock',284 // Local fonts285 'local-fonts',286 // Web MIDI287 'midi',288 // Vibration289 'vibrate',290 // Fullscreen291 'fullscreen',292 // Picture-in-picture293 'picture-in-picture',294 // Web Share295 'web-share',296 // Gamepad297 'gamepad',298 // Crypto keys299 'publickey-credentials-get', 'publickey-credentials-create',300]);301
302// Features that are commonly restricted and should raise a warning if missing303// from the policy entirely (because their default allow behavior is permissive304// in the absence of a policy).305const HIGH_RISK_FEATURES = new Set([306 'camera', 'microphone', 'geolocation',307 'payment', 'usb', 'bluetooth', 'nfc',308 'clipboard-read', 'notifications', 'push',309 'midi', 'serial', 'hid', 'display-capture',310]);311
312export function classifyFeature(feature) {313 return {314 isSensitive: SENSITIVE_FEATURES.has(feature),315 isHighRisk: HIGH_RISK_FEATURES.has(feature),316 };317}318
319/* ---------------------------------------------------------------------------320 * Per-directive analysis.321 * ------------------------------------------------------------------------- */322
323export function analyzeDirective(directive) {324 const { isSensitive, isHighRisk } = classifyFeature(directive.feature);325 const issues = [];326
327 if (directive.allowAll) {328 if (isHighRisk) {329 issues.push({330 severity: 'error',331 message: `High-risk feature "${directive.feature}" is allowed for all origins (*); this permits any third-party iframe to use it.`,332 });333 } else if (isSensitive) {334 issues.push({335 severity: 'warn',336 message: `Sensitive feature "${directive.feature}" is allowed for all origins (*); consider restricting to self or specific origins.`,337 });338 }339 }340
341 if (directive.allowSelf && isHighRisk) {342 // self is fine but worth noting343 issues.push({344 severity: 'info',345 message: `High-risk feature "${directive.feature}" is restricted to self; this is a reasonable baseline.`,346 });347 }348
349 if (directive.allowNone && isHighRisk) {350 issues.push({351 severity: 'info',352 message: `High-risk feature "${directive.feature}" is fully denied; this is the safest posture if the feature is not needed.`,353 });354 }355
356 // Specific origins in allowlist for sensitive features357 if (directive.allowlist.length > 0 && isSensitive) {358 issues.push({359 severity: 'warn',360 message: `Sensitive feature "${directive.feature}" is allowed for specific origins: ${directive.allowlist.join(', ')}. Verify these are trusted.`,361 });362 }363
364 return {365 feature: directive.feature,366 allowlist: directive.allowlist,367 allowAll: directive.allowAll,368 allowSelf: directive.allowSelf,369 allowNone: directive.allowNone,370 raw: directive.raw,371 isSensitive,372 isHighRisk,373 issues,374 };375}376
377/* ---------------------------------------------------------------------------378 * Scoring and grading.379 * ------------------------------------------------------------------------- */380
381export function scorePolicy(analysis) {382 if (!analysis.hasPermissionsPolicy && !analysis.hasFeaturePolicy) {383 return {384 score: 0,385 grade: 'F',386 issues: ['No Permissions-Policy or Feature-Policy header is set. Browser features (camera, microphone, geolocation, payment, USB) are not restricted.'],387 recommendations: [388 'Set a Permissions-Policy header that explicitly denies or restricts sensitive browser features.',389 'At minimum, deny high-risk features: camera, microphone, geolocation, payment, usb.',390 'Example: Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()',391 ],392 };393 }394
395 let score = 100;396 const issues = [];397
398 // Penalize high-risk features allowed with *399 const highRiskAllowed = analysis.directives.filter(400 (d) => d.isHighRisk && d.allowAll,401 );402 if (highRiskAllowed.length > 0) {403 const penalty = Math.min(40, highRiskAllowed.length * 15);404 score -= penalty;405 issues.push(`${highRiskAllowed.length} high-risk feature(s) are allowed for all origins (*): ${highRiskAllowed.map((d) => d.feature).join(', ')}.`);406 }407
408 // Penalize sensitive features allowed with *409 const sensitiveAllowed = analysis.directives.filter(410 (d) => d.isSensitive && !d.isHighRisk && d.allowAll,411 );412 if (sensitiveAllowed.length > 0) {413 const penalty = Math.min(20, sensitiveAllowed.length * 5);414 score -= penalty;415 issues.push(`${sensitiveAllowed.length} sensitive feature(s) are allowed for all origins (*): ${sensitiveAllowed.map((d) => d.feature).join(', ')}.`);416 }417
418 // Penalize missing high-risk features (not in the policy at all)419 const managedFeatures = new Set(analysis.directives.map((d) => d.feature));420 const missingHighRisk = [...HIGH_RISK_FEATURES].filter((f) => !managedFeatures.has(f));421 if (missingHighRisk.length > 0) {422 const penalty = Math.min(25, missingHighRisk.length * 3);423 score -= penalty;424 issues.push(`${missingHighRisk.length} high-risk feature(s) are not mentioned in the policy (defaulting to allowed): ${missingHighRisk.join(', ')}.`);425 }426
427 // Penalize legacy Feature-Policy usage428 if (analysis.hasFeaturePolicy) {429 score -= 10;430 issues.push('Legacy Feature-Policy header is present; it is deprecated and replaced by Permissions-Policy. Migrate to the new syntax.');431 }432
433 // Penalize if Permissions-Policy present but Feature-Policy also present (conflict risk)434 if (analysis.hasPermissionsPolicy && analysis.hasFeaturePolicy) {435 score -= 5;436 issues.push('Both Permissions-Policy and Feature-Policy are set; browsers may apply conflicting rules. Remove the legacy Feature-Policy header.');437 }438
439 // Penalize sensitive features with specific third-party origins440 const thirdPartySensitive = analysis.directives.filter(441 (d) => d.isSensitive && d.allowlist.length > 0,442 );443 if (thirdPartySensitive.length > 0) {444 score -= Math.min(10, thirdPartySensitive.length * 3);445 issues.push(`${thirdPartySensitive.length} sensitive feature(s) are allowed for specific origins; verify trust: ${thirdPartySensitive.map((d) => d.feature).join(', ')}.`);446 }447
448 // Bonus: all high-risk features denied or self449 const allHighRiskManaged = [...HIGH_RISK_FEATURES].every((f) => managedFeatures.has(f));450 if (allHighRiskManaged) {451 const allRestricted = [...HIGH_RISK_FEATURES].every((f) => {452 const d = analysis.directives.find((dd) => dd.feature === f);453 return d && (d.allowNone || d.allowSelf);454 });455 if (allRestricted) {456 score = Math.min(100, score + 5);457 }458 }459
460 const bounded = Math.max(0, Math.min(100, score));461 const grade = bounded >= 95 ? 'A+'462 : bounded >= 85 ? 'A'463 : bounded >= 75 ? 'B'464 : bounded >= 65 ? 'C'465 : bounded >= 50 ? 'D'466 : bounded >= 30 ? 'E'467 : 'F';468
469 const recommendations = buildRecommendations(analysis, issues, bounded);470 return { score: bounded, grade, issues, recommendations };471}472
473function buildRecommendations(analysis, issues, score) {474 const recs = [...issues];475
476 const managedFeatures = new Set(analysis.directives.map((d) => d.feature));477 const missingHighRisk = [...HIGH_RISK_FEATURES].filter((f) => !managedFeatures.has(f));478
479 if (!analysis.hasPermissionsPolicy && !analysis.hasFeaturePolicy) {480 return recs; // already handled above481 }482
483 if (missingHighRisk.length > 0) {484 recs.push(`Add the following high-risk features to the Permissions-Policy: ${missingHighRisk.join(', ')}. Deny them with () if not needed.`);485 }486
487 const highRiskAllowed = analysis.directives.filter((d) => d.isHighRisk && d.allowAll);488 if (highRiskAllowed.length > 0) {489 recs.push(`Restrict high-risk features that are currently allowed for all origins: ${highRiskAllowed.map((d) => d.feature).join(', ')}. Use () to deny or (self) to restrict to same-origin.`);490 }491
492 if (analysis.hasFeaturePolicy) {493 recs.push('Remove the deprecated Feature-Policy header and consolidate all feature restrictions into a single Permissions-Policy header.');494 }495
496 if (score >= 95 && issues.length === 0) {497 recs.push('Permissions-Policy posture is strong; all high-risk features are restricted. Continue monitoring after deploys and CDN cutovers.');498 }499
500 return recs.length ? recs : ['No Permissions-Policy issues detected.'];501}502
503/* ---------------------------------------------------------------------------504 * Main audit pipeline.505 * ------------------------------------------------------------------------- */506
507export async function auditPermissionsPolicy(input) {508 const timeoutSeconds = Math.min(Math.max(Number(input.timeoutSeconds || DEFAULT_TIMEOUT_SECONDS), 3), 30);509
510 let startUrl;511 let fetched;512 try {513 startUrl = await normalizeAndValidateUrl(input.startUrl);514 fetched = await fetchHeaders(startUrl, timeoutSeconds);515 } catch (validationError) {516 return errorResult(input.startUrl, validationError.message);517 }518
519 if (fetched.error) {520 return errorResult(input.startUrl, fetched.error, fetched.finalUrl, fetched.https, fetched.status);521 }522
523 const rawPermissionsPolicy = fetched.headers['permissions-policy'] || null;524 const rawFeaturePolicy = fetched.headers['feature-policy'] || null;525
526 const ppDirectives = rawPermissionsPolicy ? parsePermissionsPolicy(rawPermissionsPolicy) : [];527 const fpDirectives = rawFeaturePolicy ? parseFeaturePolicy(rawFeaturePolicy) : [];528
529 const allDirectives = [...ppDirectives, ...fpDirectives];530 const analyzedDirectives = allDirectives.map(analyzeDirective);531
532 const analysis = {533 hasPermissionsPolicy: Boolean(rawPermissionsPolicy),534 hasFeaturePolicy: Boolean(rawFeaturePolicy),535 directives: analyzedDirectives,536 directiveCount: analyzedDirectives.length,537 };538
539 const scored = scorePolicy(analysis);540
541 return {542 inputUrl: input.startUrl,543 normalizedInputUrl: startUrl.href,544 finalUrl: fetched.finalUrl,545 https: fetched.https,546 ok: true,547 checkedAt: new Date().toISOString(),548 httpStatus: fetched.status,549 hasPermissionsPolicy: analysis.hasPermissionsPolicy,550 hasFeaturePolicy: analysis.hasFeaturePolicy,551 rawPermissionsPolicy,552 rawFeaturePolicy,553 directives: analyzedDirectives,554 directiveCount: analysis.directiveCount,555 highRiskFeaturesManaged: analyzedDirectives.filter((d) => d.isHighRisk).map((d) => d.feature),556 highRiskFeaturesMissing: [...HIGH_RISK_FEATURES].filter(557 (f) => !analyzedDirectives.some((d) => d.feature === f),558 ),559 highRiskFeaturesAllowedAll: analyzedDirectives.filter(560 (d) => d.isHighRisk && d.allowAll,561 ).map((d) => d.feature),562 score: scored.score,563 grade: scored.grade,564 issues: scored.issues,565 recommendations: scored.recommendations,566 error: null,567 };568}569
570function errorResult(inputUrl, errorMsg, finalUrl, https, httpStatus) {571 return {572 inputUrl,573 normalizedInputUrl: null,574 finalUrl: finalUrl || (typeof inputUrl === 'string' ? inputUrl : null),575 https: https ?? false,576 ok: false,577 checkedAt: new Date().toISOString(),578 httpStatus: httpStatus ?? null,579 hasPermissionsPolicy: false,580 hasFeaturePolicy: false,581 rawPermissionsPolicy: null,582 rawFeaturePolicy: null,583 directives: [],584 directiveCount: 0,585 highRiskFeaturesManaged: [],586 highRiskFeaturesMissing: [...HIGH_RISK_FEATURES],587 highRiskFeaturesAllowedAll: [],588 score: 0,589 grade: 'F',590 issues: ['The request failed before headers could be inspected. Verify the URL is reachable and try again.'],591 recommendations: ['Verify the URL is public, reachable, and returns a response.'],592 error: errorMsg,593 };594}595
596/* ---------------------------------------------------------------------------597 * Apify runtime entry point.598 * ------------------------------------------------------------------------- */599
600const isExecutedDirectly = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];601
602if (process.env.NODE_ENV !== 'test' && isExecutedDirectly) {603 await Actor.init();604 try {605 const input = await Actor.getInput();606 const result = await auditPermissionsPolicy(input || {});607 await Actor.pushData(result);608 await Actor.setValue('OUTPUT', result);609 Actor.log.info('Permissions-Policy audit complete', { finalUrl: result.finalUrl, score: result.score, grade: result.grade, directiveCount: result.directiveCount });610 } finally {611 await Actor.exit();612 }613}1import { test } from 'node:test';2import assert from 'node:assert/strict';3import {4 parsePermissionsPolicy,5 parseFeaturePolicy,6 analyzeDirective,7 scorePolicy,8 classifyFeature,9} from '../src/main.js';10
11test('parsePermissionsPolicy parses modern syntax with multiple directives', () => {12 const result = parsePermissionsPolicy('camera=(), microphone=(self), geolocation=("https://example.com"), payment=*');13 assert.equal(result.length, 4);14
15 assert.equal(result[0].feature, 'camera');16 assert.equal(result[0].allowNone, true);17 assert.equal(result[0].allowAll, false);18 assert.equal(result[0].allowSelf, false);19 assert.deepEqual(result[0].allowlist, []);20
21 assert.equal(result[1].feature, 'microphone');22 assert.equal(result[1].allowSelf, true);23 assert.equal(result[1].allowNone, false);24
25 assert.equal(result[2].feature, 'geolocation');26 assert.equal(result[2].allowNone, false);27 assert.deepEqual(result[2].allowlist, ['"https://example.com"']);28
29 assert.equal(result[3].feature, 'payment');30 assert.equal(result[3].allowAll, true);31});32
33test('parsePermissionsPolicy handles empty allowlist ()', () => {34 const result = parsePermissionsPolicy('camera=()');35 assert.equal(result.length, 1);36 assert.equal(result[0].feature, 'camera');37 assert.equal(result[0].allowNone, true);38});39
40test('parsePermissionsPolicy handles wildcard allowlist *', () => {41 const result = parsePermissionsPolicy('payment=*');42 assert.equal(result.length, 1);43 assert.equal(result[0].allowAll, true);44});45
46test('parsePermissionsPolicy handles bare * without parens', () => {47 const result = parsePermissionsPolicy('payment=*');48 assert.equal(result.length, 1);49 assert.equal(result[0].allowAll, true);50});51
52test('parsePermissionsPolicy handles self inside parens', () => {53 const result = parsePermissionsPolicy('microphone=(self)');54 assert.equal(result[0].allowSelf, true);55 assert.equal(result[0].allowAll, false);56 assert.equal(result[0].allowNone, false);57});58
59test('parsePermissionsPolicy handles multiple origins in allowlist', () => {60 const result = parsePermissionsPolicy('geolocation=(self "https://a.com" "https://b.com")');61 assert.equal(result[0].allowSelf, true);62 assert.deepEqual(result[0].allowlist, ['"https://a.com"', '"https://b.com"']);63});64
65test('parsePermissionsPolicy returns empty for null or empty input', () => {66 assert.deepEqual(parsePermissionsPolicy(null), []);67 assert.deepEqual(parsePermissionsPolicy(''), []);68 assert.deepEqual(parsePermissionsPolicy(undefined), []);69});70
71test('parsePermissionsPolicy skips malformed directives without =', () => {72 const result = parsePermissionsPolicy('camera=(), garbage, microphone=(self)');73 assert.equal(result.length, 2);74 assert.equal(result[0].feature, 'camera');75 assert.equal(result[1].feature, 'microphone');76});77
78test('parseFeaturePolicy parses legacy syntax with semicolons', () => {79 const result = parseFeaturePolicy("camera 'none'; microphone 'self'; geolocation https://example.com");80 assert.equal(result.length, 3);81
82 assert.equal(result[0].feature, 'camera');83 assert.equal(result[0].allowNone, true);84
85 assert.equal(result[1].feature, 'microphone');86 assert.equal(result[1].allowSelf, true);87
88 assert.equal(result[2].feature, 'geolocation');89 assert.deepEqual(result[2].allowlist, ['https://example.com']);90});91
92test('parseFeaturePolicy handles bare * token', () => {93 const result = parseFeaturePolicy('payment *');94 assert.equal(result.length, 1);95 assert.equal(result[0].allowAll, true);96});97
98test('parseFeaturePolicy returns empty for null input', () => {99 assert.deepEqual(parseFeaturePolicy(null), []);100 assert.deepEqual(parseFeaturePolicy(''), []);101});102
103test('classifyFeature identifies camera as high-risk and sensitive', () => {104 const cls = classifyFeature('camera');105 assert.equal(cls.isSensitive, true);106 assert.equal(cls.isHighRisk, true);107});108
109test('classifyFeature identifies fullscreen as sensitive but not high-risk', () => {110 const cls = classifyFeature('fullscreen');111 assert.equal(cls.isSensitive, true);112 assert.equal(cls.isHighRisk, false);113});114
115test('classifyFeature returns false for unknown features', () => {116 const cls = classifyFeature('unknown-feature');117 assert.equal(cls.isSensitive, false);118 assert.equal(cls.isHighRisk, false);119});120
121test('analyzeDirective flags high-risk feature allowed with *', () => {122 const directive = { feature: 'camera', allowAll: true, allowSelf: false, allowNone: false, allowlist: [], raw: 'camera=*' };123 const result = analyzeDirective(directive);124 assert.equal(result.isHighRisk, true);125 assert.equal(result.issues.length, 1);126 assert.equal(result.issues[0].severity, 'error');127 assert.match(result.issues[0].message, /camera.*all origins/);128});129
130test('analyzeDirective flags sensitive (non-high-risk) feature allowed with *', () => {131 const directive = { feature: 'fullscreen', allowAll: true, allowSelf: false, allowNone: false, allowlist: [], raw: 'fullscreen=*' };132 const result = analyzeDirective(directive);133 assert.equal(result.isSensitive, true);134 assert.equal(result.isHighRisk, false);135 assert.equal(result.issues.length, 1);136 assert.equal(result.issues[0].severity, 'warn');137});138
139test('analyzeDirective notes high-risk feature restricted to self', () => {140 const directive = { feature: 'microphone', allowAll: false, allowSelf: true, allowNone: false, allowlist: [], raw: 'microphone=(self)' };141 const result = analyzeDirective(directive);142 assert.equal(result.issues.length, 1);143 assert.equal(result.issues[0].severity, 'info');144});145
146test('analyzeDirective notes high-risk feature fully denied', () => {147 const directive = { feature: 'geolocation', allowAll: false, allowSelf: false, allowNone: true, allowlist: [], raw: 'geolocation=()' };148 const result = analyzeDirective(directive);149 assert.equal(result.issues.length, 1);150 assert.equal(result.issues[0].severity, 'info');151});152
153test('analyzeDirective warns on sensitive feature with specific origins', () => {154 const directive = { feature: 'camera', allowAll: false, allowSelf: false, allowNone: false, allowlist: ['"https://evil.com"'], raw: 'camera=("https://evil.com")' };155 const result = analyzeDirective(directive);156 const warnIssue = result.issues.find((i) => i.severity === 'warn');157 assert.ok(warnIssue, 'should have a warn-severity issue');158 assert.match(warnIssue.message, /specific origins/);159});160
161test('scorePolicy returns F for no policy', () => {162 const analysis = {163 hasPermissionsPolicy: false,164 hasFeaturePolicy: false,165 directives: [],166 directiveCount: 0,167 };168 const result = scorePolicy(analysis);169 assert.equal(result.score, 0);170 assert.equal(result.grade, 'F');171 assert.ok(result.issues.length > 0);172 assert.match(result.issues[0], /No Permissions-Policy/);173});174
175test('scorePolicy penalizes high-risk feature allowed for all', () => {176 const analysis = {177 hasPermissionsPolicy: true,178 hasFeaturePolicy: false,179 directives: [180 { feature: 'camera', allowAll: true, allowSelf: false, allowNone: false, allowlist: [], isHighRisk: true, isSensitive: true, issues: [] },181 ],182 directiveCount: 1,183 };184 const result = scorePolicy(analysis);185 assert.ok(result.score < 100, `score should be < 100, got ${result.score}`);186 assert.ok(result.grade !== 'A+', `grade should not be A+, got ${result.grade}`);187});188
189test('scorePolicy penalizes missing high-risk features', () => {190 const analysis = {191 hasPermissionsPolicy: true,192 hasFeaturePolicy: false,193 directives: [194 { feature: 'camera', allowAll: false, allowSelf: false, allowNone: true, allowlist: [], isHighRisk: true, isSensitive: true, issues: [] },195 ],196 directiveCount: 1,197 };198 const result = scorePolicy(analysis);199 // camera is managed, but microphone, geolocation, payment, etc. are missing200 assert.ok(result.score < 100, `score should be < 100 due to missing features, got ${result.score}`);201});202
203test('scorePolicy penalizes legacy Feature-Policy', () => {204 const analysis = {205 hasPermissionsPolicy: false,206 hasFeaturePolicy: true,207 directives: [208 { feature: 'camera', allowAll: false, allowSelf: false, allowNone: true, allowlist: [], isHighRisk: true, isSensitive: true, issues: [] },209 ],210 directiveCount: 1,211 };212 const result = scorePolicy(analysis);213 assert.ok(result.score < 100, `score should be < 100 due to legacy FP, got ${result.score}`);214});215
216test('scorePolicy penalizes both PP and FP present', () => {217 const analysis = {218 hasPermissionsPolicy: true,219 hasFeaturePolicy: true,220 directives: [221 { feature: 'camera', allowAll: false, allowSelf: false, allowNone: true, allowlist: [], isHighRisk: true, isSensitive: true, issues: [] },222 { feature: 'microphone', allowAll: false, allowSelf: false, allowNone: true, allowlist: [], isHighRisk: true, isSensitive: true, issues: [] },223 ],224 directiveCount: 2,225 };226 const result = scorePolicy(analysis);227 assert.ok(result.score < 100, `score should be < 100, got ${result.score}`);228});229
230test('scorePolicy gives high score when all high-risk features denied', () => {231 const allDenied = ['camera', 'microphone', 'geolocation', 'payment', 'usb', 'bluetooth', 'nfc', 'clipboard-read', 'notifications', 'push', 'midi', 'serial', 'hid', 'display-capture'].map((f) => ({232 feature: f,233 allowAll: false,234 allowSelf: false,235 allowNone: true,236 allowlist: [],237 isHighRisk: true,238 isSensitive: true,239 issues: [],240 }));241 const analysis = {242 hasPermissionsPolicy: true,243 hasFeaturePolicy: false,244 directives: allDenied,245 directiveCount: allDenied.length,246 };247 const result = scorePolicy(analysis);248 assert.ok(result.score >= 95, `score should be >= 95, got ${result.score}`);249 assert.equal(result.grade, 'A+');250});251
252test('scorePolicy recommendations include missing feature guidance', () => {253 const analysis = {254 hasPermissionsPolicy: true,255 hasFeaturePolicy: false,256 directives: [],257 directiveCount: 0,258 };259 const result = scorePolicy(analysis);260 // No directives but PP is "present" — all high-risk features are missing261 const missingRec = result.recommendations.find((r) => r.includes('high-risk features'));262 assert.ok(missingRec, 'should recommend adding missing high-risk features');263});264
265// SSRF boundary tests266test('normalizeAndValidateUrl rejects private IPv4', async () => {267 const { normalizeAndValidateUrl } = await import('../src/main.js');268 await assert.rejects(269 () => normalizeAndValidateUrl('http://192.168.1.1/'),270 /Private IPv4/,271 );272});273
274test('normalizeAndValidateUrl rejects localhost', async () => {275 const { normalizeAndValidateUrl } = await import('../src/main.js');276 await assert.rejects(277 () => normalizeAndValidateUrl('http://127.0.0.1/'),278 /Private IPv4/,279 );280});281
282test('normalizeAndValidateUrl rejects URL with credentials', async () => {283 const { normalizeAndValidateUrl } = await import('../src/main.js');284 await assert.rejects(285 () => normalizeAndValidateUrl('https://user:pass@example.com/'),286 /credentials/,287 );288});289
290test('normalizeAndValidateUrl rejects non-HTTP scheme', async () => {291 const { normalizeAndValidateUrl } = await import('../src/main.js');292 await assert.rejects(293 () => normalizeAndValidateUrl('ftp://example.com/'),294 /Only HTTP and HTTPS/,295 );296});297
298test('normalizeAndValidateUrl rejects missing input', async () => {299 const { normalizeAndValidateUrl } = await import('../src/main.js');300 await assert.rejects(301 () => normalizeAndValidateUrl(''),302 /required/,303 );304});