appsec-bot-challenge-detect-fonts

1name: crowdsecurity/appsec-bot-challenge-detect-fonts
2# Font evidence for the bot challenge.
3#
4# The shipped module measures text advances and reports numbers
5data:
6  - source_url: https://hub-data.crowdsec.net/custom-bot-detections/fonts-v1.js
7    dest_file: challenge/fonts.js
8    type: challenge-js
9
10inband:
11  on_challenge_submit:
12    - filter: >-
13        (req.UserAgent() contains "Windows NT" || req.UserAgent() contains "Mac OS X" ||
14         req.UserAgent() contains "X11") &&
15        !(req.UserAgent() contains "Android") &&
16        fingerprint.Custom["cfFontBase"].Number != -1 &&
17        fingerprint.Custom["cfFontResolved"].Number == 0
18      apply:
19        - AddRequestScore(0, "no_font_name_resolution_on_desktop", "detect-experimental-fonts")  # intended weight: 100
20
21    # --- the claimed platform's UI font does not resolve -------------------
22    - filter: >-
23        req.UserAgent() contains "Windows NT" &&
24        fingerprint.Custom["cfFontResolved"].Number > 0 &&
25        fingerprint.Custom["cfFontBase"].Number != -1 &&
26        fingerprint.Custom["cfFontSegoe"].Number == fingerprint.Custom["cfFontBase"].Number
27      apply:
28        - AddRequestScore(0, "os_font_missing_windows", "detect-experimental-fonts")
29
30    - filter: >-
31        (req.UserAgent() contains "Mac OS X" || req.UserAgent() contains "iPhone") &&
32        fingerprint.Custom["cfFontResolved"].Number > 0 &&
33        fingerprint.Custom["cfFontBase"].Number != -1 &&
34        fingerprint.Custom["cfFontHelv"].Number == fingerprint.Custom["cfFontBase"].Number
35      apply:
36        - AddRequestScore(0, "os_font_missing_apple", "detect-experimental-fonts")
37
38    - filter: >-
39        req.UserAgent() contains "Android" &&
40        fingerprint.Custom["cfFontResolved"].Number > 0 &&