appsec-bot-challenge-detect-codecs

1name: crowdsecurity/appsec-bot-challenge-detect-codecs
2# Codec capability checks.
3#
4# The module reports what two different APIs say about H.264:
5# mediaCapabilities.decodingInfo() and RTCRtpSender.getCapabilities().
6data:
7  - source_url: https://hub-data.crowdsec.net/custom-bot-detections/codecs-v1.js
8    dest_file: challenge/codecs.js
9    type: challenge-js
10
11inband:
12  on_challenge_submit:
13    # Claims hardware-efficient H.264 playback while its own WebRTC stack
14    # offers no H264 codec at all.
15    #
16    # Guarded on cfRtcAvail: a client with WebRTC switched off has no sender to
17    # ask, and the module's sentinel then reports cfRtcH264 = false.
18    - filter: >-
19        fingerprint.Custom["cfRtcAvail"].Bool &&
20        fingerprint.Custom["cfH264Sup"].Bool &&
21        fingerprint.Custom["cfH264Eff"].Bool &&
22        !fingerprint.Custom["cfRtcH264"].Bool
23      apply:
24        - AddRequestScore(0, "h264_capability_mismatch", "detect-experimental-codecs")
25
26    # Firefox on Windows and macOS decodes H.264 through the OS. One that
27    # claims either and cannot is not running on what it claims.
28    - filter: >-
29        req.UserAgent() contains "Firefox/" &&
30        (req.UserAgent() contains "Windows NT" || req.UserAgent() contains "Mac OS X") &&
31        fingerprint.HasCustom("cfH264Sup") &&
32        !fingerprint.Custom["cfH264Sup"].Bool
33      apply:
34        - AddRequestScore(0, "gecko_no_h264_on_native_os", "detect-experimental-codecs")
35
36    # Also track skips.
37    - filter: '!fingerprint.HasCustom("cfH264Sup")'
38      apply:
39        - AddRequestScore(0, "missing_cf_h264_sup", "detect-experimental-codecs")
40    - filter: '!fingerprint.HasCustom("cfH264Eff")'