jsdet_cli/

analysis.rs

/// Behavioral analysis engine — turns raw observations into intelligence.
///
/// Raw observations are data: "fetch was called with this URL."
/// Intelligence is: "This script exfiltrates cookies to an external server."
///
/// The analyzer:
/// 1. Classifies each observation by threat category
/// 2. Correlates observations into behavioral patterns
/// 3. Produces a human-readable summary with risk scoring
///
use jsdet_core::Observation;
use jsdet_core::observation::CookieOp;

/// Mutable state accumulated during observation analysis.
/// Extracted as a struct to keep the main analyze() function readable.
#[derive(Default)]
struct AnalysisState {
    findings: Vec<BehavioralFinding>,
    timeline: Vec<TimelineEntry>,
    // Network/cookie tracking
    has_cookie_read: bool,
    has_external_fetch: bool,
    has_storage_write: bool,
    external_urls: Vec<String>,
    cookie_read_idx: Option<usize>,
    fetch_indices: Vec<usize>,
    // Crypto wallet drainer state
    has_wallet_connect: bool,
    has_sign_transaction: bool,
    has_sign_message: bool,
    has_chain_switch: bool,
    wallet_connect_idx: Option<usize>,
    sign_indices: Vec<usize>,
    // Clipboard hijacking state
    has_clipboard_write: bool,
    has_clipboard_read: bool,
    clipboard_write_content: Option<String>,
}

/// High-level behavioral finding.
#[derive(Debug, Clone)]
#[allow(dead_code)]
pub struct BehavioralFinding {
    pub severity: Severity,
    pub category: Category,
    pub title: String,
    pub detail: String,
    /// Observation indices that contribute to this finding.
    pub evidence: Vec<usize>,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
#[allow(dead_code)]
pub enum Severity {
    Info,
    Low,
    Medium,
    High,
    Critical,
}

impl Severity {
    pub fn icon(self) -> &'static str {
        match self {
            Self::Critical => "!!!",
            Self::High => "!!",
            Self::Medium => "!",
            Self::Low => "~",
            Self::Info => "i",
        }
    }

    pub fn color_code(self) -> &'static str {
        match self {
            Self::Critical => "\x1b[91m", // bright red
            Self::High => "\x1b[31m",     // red
            Self::Medium => "\x1b[33m",   // yellow
            Self::Low => "\x1b[36m",      // cyan
            Self::Info => "\x1b[90m",     // gray
        }
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
#[allow(dead_code)]
pub enum Category {
    CredentialTheft,
    DataExfiltration,
    CodeInjection,
    Persistence,
    Fingerprinting,
    Evasion,
    NetworkActivity,
    PermissionAbuse,
    CookieAccess,
    DomManipulation,
    CryptoTheft,
    ClipboardHijack,
    PrivacyViolation,
}

impl Category {
    pub fn label(self) -> &'static str {
        match self {
            Self::CredentialTheft => "CREDENTIAL THEFT",
            Self::DataExfiltration => "DATA EXFILTRATION",
            Self::CodeInjection => "CODE INJECTION",
            Self::Persistence => "PERSISTENCE",
            Self::Fingerprinting => "FINGERPRINTING",
            Self::Evasion => "EVASION",
            Self::NetworkActivity => "NETWORK",
            Self::PermissionAbuse => "PERMISSION ABUSE",
            Self::CookieAccess => "COOKIE ACCESS",
            Self::DomManipulation => "DOM MUTATION",
            Self::CryptoTheft => "CRYPTO THEFT",
            Self::ClipboardHijack => "CLIPBOARD HIJACK",
            Self::PrivacyViolation => "PRIVACY VIOLATION",
        }
    }
}

/// Analyze observations and produce behavioral findings.
pub fn analyze(observations: &[Observation]) -> AnalysisReport {
    let mut s = AnalysisState::default();

    for (i, obs) in observations.iter().enumerate() {
        match obs {
            Observation::ApiCall { api, args, .. } => {
                let args_str = args
                    .iter()
                    .map(|a| a.to_string())
                    .collect::<Vec<_>>()
                    .join(", ");
                s.timeline.push(TimelineEntry {
                    index: i,
                    action: format!("{api}({args_str})"),
                    category: categorize_api(api),
                });

                if api.contains("cookie") && api.contains("get") {
                    s.has_cookie_read = true;
                    s.cookie_read_idx = Some(i);
                }

                if is_child_process_require(api, args) {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::High,
                        category: Category::CodeInjection,
                        title: "Node child_process module loaded".into(),
                        detail:
                            "Script imports child_process, enabling command execution primitives"
                                .into(),
                        evidence: vec![i],
                    });
                }

                if is_command_execution_api(api) {
                    let command = extract_first_string_arg(args)
                        .unwrap_or_else(|| args_str.chars().take(200).collect::<String>());
                    let title = if api == "child_process.spawn" {
                        "Process spawning via child_process.spawn"
                    } else {
                        "Command execution via child_process"
                    };
                    let detail = if command.is_empty() {
                        format!("Script invokes {api}, a direct host command execution sink")
                    } else {
                        format!(
                            "Script invokes {api} with command payload: {}",
                            command.chars().take(200).collect::<String>()
                        )
                    };
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Critical,
                        category: Category::CodeInjection,
                        title: title.into(),
                        detail,
                        evidence: vec![i],
                    });
                }

                // Redirect via location.href/assign/replace
                if api.contains("location.href.set")
                    || api.contains("location.assign")
                    || api.contains("location.replace")
                {
                    if let Some(url) = extract_first_string_arg(args) {
                        // Dangerous protocol redirects
                        if url.starts_with("javascript:") || url.starts_with("data:") {
                            s.findings.push(BehavioralFinding {
                                severity: Severity::Critical,
                                category: Category::CodeInjection,
                                title: format!(
                                    "Dangerous protocol redirect: {}...",
                                    url.chars().take(40).collect::<String>()
                                ),
                                detail: format!(
                                    "Script redirects via {}",
                                    if url.starts_with("javascript:") {
                                        "javascript: URI — code execution"
                                    } else {
                                        "data: URI — embedded payload"
                                    }
                                ),
                                evidence: vec![i],
                            });
                        }
                    }
                    if let Some(url) = extract_url_from_args(args)
                        && is_external_url(&url)
                    {
                        s.has_external_fetch = true;
                        s.external_urls.push(url.clone());
                        s.fetch_indices.push(i);
                        s.findings.push(BehavioralFinding {
                            severity: Severity::High,
                            category: Category::NetworkActivity,
                            title: format!(
                                "Redirect to external URL: {}",
                                &url.chars().take(60).collect::<String>()
                            ),
                            detail: format!("Script redirects the page to {url}"),
                            evidence: vec![i],
                        });
                    }
                }

                // sendBeacon — stealthy exfiltration (fires even on page unload)
                if api == "navigator.sendBeacon"
                    && let Some(url) = extract_url_from_args(args)
                    && is_external_url(&url)
                {
                    s.has_external_fetch = true;
                    s.external_urls.push(url.clone());
                    s.fetch_indices.push(i);
                    s.findings.push(BehavioralFinding {
                                severity: Severity::High,
                                category: Category::DataExfiltration,
                                title: format!("sendBeacon exfiltration to: {}", &url.chars().take(60).collect::<String>()),
                                detail: "navigator.sendBeacon fires even during page unload — stealthy data exfiltration".into(),
                                evidence: vec![i],
                            });
                }

                if (api == "fetch" || api.contains("xhr"))
                    && let Some(url) = extract_url_from_args(args)
                    && is_external_url(&url)
                {
                    s.has_external_fetch = true;
                    s.external_urls.push(url);
                    s.fetch_indices.push(i);
                }

                // innerHTML/document.write — scan injected HTML for credential forms.
                // This is how phishing kits inject credential harvesting into the page.
                if api.contains("setInnerHTML") || api.contains("document.write") {
                    let content = args_str.to_ascii_lowercase();
                    if content.contains("password") || content.contains("type=\"password") {
                        s.findings.push(BehavioralFinding {
                            severity: Severity::Critical,
                            category: Category::CredentialTheft,
                            title: "Credential form injected via innerHTML/document.write".into(),
                            detail: "Script injects HTML containing a password field".into(),
                            evidence: vec![i],
                        });
                    }
                    if content.contains("<form") && content.contains("action=") {
                        // Extract the form action URL
                        if let Some(start) = content.find("action=") {
                            let rest = &content[start + 7..];
                            let rest = rest.trim_start_matches('"').trim_start_matches('\'');
                            let end = rest.find(['"', '\'', ' ', '>']).unwrap_or(rest.len());
                            let action_url = &rest[..end];
                            if action_url.starts_with("http") {
                                s.has_external_fetch = true;
                                s.external_urls.push(action_url.to_string());
                                s.fetch_indices.push(i);
                            }
                        }
                    }
                }

                // setAttribute — track form actions and password inputs.
                if api.contains("setAttribute") {
                    let content = args_str.to_ascii_lowercase();

                    // Form action set to external URL — THIS is the credential theft signal.
                    if content.contains("action")
                        && let Some(url) = extract_url_from_args(args)
                        && is_external_url(&url)
                    {
                        s.findings.push(BehavioralFinding {
                            severity: Severity::Critical,
                            category: Category::CredentialTheft,
                            title: format!(
                                "Form submits to external URL: {}",
                                &url.chars().take(60).collect::<String>()
                            ),
                            detail: format!("Credential form sends data to {url}"),
                            evidence: vec![i],
                        });
                        s.has_external_fetch = true;
                        s.external_urls.push(url);
                        s.fetch_indices.push(i);
                    }
                }

                // Credential form detected by form probing.
                // Only flag when the form action is EXTERNAL (different domain).
                // A same-origin /login form is legitimate. A form posting to
                // https://evil.com/collect is credential theft.
                // TAINT SINK REACHED — user-controlled data reached a dangerous function.
                // This is a CONFIRMED vulnerability, not a heuristic.
                if api == "taint_sink_reached" {
                    let sink_name = extract_url_from_args(args).unwrap_or_else(|| "unknown".into());
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Critical,
                        category: Category::CodeInjection,
                        title: format!("CONFIRMED: Tainted data reached {sink_name}"),
                        detail: format!("User-controlled input flowed through string operations to {sink_name}() — this is a confirmed code injection vulnerability, not a heuristic guess."),
                        evidence: vec![i],
                    });
                }

                if api == "credential_form_detected" {
                    let action_url = extract_url_from_args(args).unwrap_or_default();
                    let has_password = args_str.contains("true");
                    let is_external_action = action_url.starts_with("http://")
                        || action_url.starts_with("https://")
                        || action_url.starts_with("//");
                    if has_password && is_external_action {
                        s.findings.push(BehavioralFinding {
                            severity: Severity::Critical,
                            category: Category::CredentialTheft,
                            title: format!(
                                "Credential form submits to: {}",
                                &action_url.chars().take(60).collect::<String>()
                            ),
                            detail: format!(
                                "Form with password field submits to external URL: {action_url}"
                            ),
                            evidence: vec![i],
                        });
                        s.has_external_fetch = true;
                        s.external_urls.push(action_url);
                        s.fetch_indices.push(i);
                    }
                }

                if api.contains("Storage.setItem") || api.contains("storage.set") {
                    s.has_storage_write = true;
                }

                if api.contains("executeScript") {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Critical,
                        category: Category::CodeInjection,
                        title: "Remote code execution via executeScript".into(),
                        detail: format!("Extension injects code into browser tabs via {api}"),
                        evidence: vec![i],
                    });
                }

                // WebSocket C2 channel detection
                if (api.contains("websocket.connect") || api.contains("websocket.send"))
                    && let Some(url) = extract_url_from_args(args).or_else(|| {
                        // WebSocket URLs start with ws:// or wss://
                        args.first().and_then(|a| a.as_str()).and_then(|s| {
                            if s.starts_with('[') {
                                serde_json::from_str::<Vec<serde_json::Value>>(s)
                                    .ok()
                                    .and_then(|arr| {
                                        arr.first().and_then(|v| v.as_str().map(|s| s.to_string()))
                                    })
                            } else if s.starts_with("ws://") || s.starts_with("wss://") {
                                Some(s.to_string())
                            } else {
                                None
                            }
                        })
                    })
                {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::High,
                        category: Category::NetworkActivity,
                        title: format!(
                            "WebSocket connection to: {}",
                            &url.chars().take(60).collect::<String>()
                        ),
                        detail: format!("Persistent C2 channel via WebSocket to {url}"),
                        evidence: vec![i],
                    });
                    s.has_external_fetch = true;
                    s.external_urls.push(url);
                    s.fetch_indices.push(i);
                }

                // Web Worker payload hiding
                if api.contains("worker.create") || api.contains("sharedworker.create") {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Medium,
                        category: Category::Evasion,
                        title: "Web Worker created — possible payload hiding".into(),
                        detail: "Script creates a Worker thread for background execution".into(),
                        evidence: vec![i],
                    });
                }

                // WASM module detection (crypto miner)
                if api.contains("wasm.instantiate") || api.contains("wasm.compile") {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::High,
                        category: Category::Evasion,
                        title: "WebAssembly module loaded — possible crypto miner".into(),
                        detail: "Script loads a WASM module, commonly used for hash computation in crypto miners".into(),
                        evidence: vec![i],
                    });
                }

                // ServiceWorker persistence
                if api.contains("serviceworker.register") {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::High,
                        category: Category::Persistence,
                        title: "ServiceWorker registration — persistent background execution".into(),
                        detail: "Script registers a ServiceWorker for persistent access even after tab closes".into(),
                        evidence: vec![i],
                    });
                }

                // ═══ Crypto Wallet Drainer Detection ═══
                if api == "ethereum.request" || api == "ethereum.on" {
                    let method = extract_first_string_arg(args).unwrap_or_default();
                    if method == "eth_requestAccounts" || method == "eth_accounts" {
                        s.has_wallet_connect = true;
                        s.wallet_connect_idx = Some(i);
                        s.findings.push(BehavioralFinding {
                            severity: Severity::High,
                            category: Category::CryptoTheft,
                            title: "Wallet connection requested".into(),
                            detail: format!(
                                "Script requests access to user's Ethereum wallet via {method}"
                            ),
                            evidence: vec![i],
                        });
                    }
                }
                if api == "crypto.sign_transaction" || api == "crypto.send_transaction" {
                    s.has_sign_transaction = true;
                    s.sign_indices.push(i);
                    let is_send = api == "crypto.send_transaction";
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Critical,
                        category: Category::CryptoTheft,
                        title: if is_send {
                            "DIRECT ETH TRANSFER requested".into()
                        } else {
                            "Transaction signing requested".into()
                        },
                        detail: format!(
                            "Script requests user {} a transaction: {}",
                            if is_send { "send" } else { "sign" },
                            args_str.chars().take(200).collect::<String>()
                        ),
                        evidence: vec![i],
                    });
                }
                if api == "crypto.sign_message" {
                    s.has_sign_message = true;
                    s.sign_indices.push(i);
                    let method = extract_first_string_arg(args).unwrap_or_default();
                    let severity = if method.contains("signTypedData") {
                        Severity::Critical // EIP-712 permit signatures can drain tokens
                    } else {
                        Severity::High
                    };
                    s.findings.push(BehavioralFinding {
                        severity,
                        category: Category::CryptoTheft,
                        title: format!("Message signing via {method}"),
                        detail: "Script requests cryptographic signature — EIP-712 permit signatures can authorize token transfers".into(),
                        evidence: vec![i],
                    });
                }
                if api == "crypto.chain_switch" {
                    s.has_chain_switch = true;
                    s.findings.push(BehavioralFinding {
                        severity: Severity::High,
                        category: Category::CryptoTheft,
                        title: "Chain switch requested".into(),
                        detail: "Script attempts to switch wallet to a different blockchain network — common drainer tactic to move to attacker-controlled chain".into(),
                        evidence: vec![i],
                    });
                }
                if api.starts_with("crypto.solana_sign") {
                    s.has_sign_transaction = true;
                    s.sign_indices.push(i);
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Critical,
                        category: Category::CryptoTheft,
                        title: format!("Solana transaction signing: {api}"),
                        detail: "Script requests Solana wallet to sign a transaction".into(),
                        evidence: vec![i],
                    });
                }
                if api == "solana.connect" {
                    s.has_wallet_connect = true;
                    s.wallet_connect_idx = Some(i);
                    s.findings.push(BehavioralFinding {
                        severity: Severity::High,
                        category: Category::CryptoTheft,
                        title: "Solana wallet connection requested".into(),
                        detail: "Script connects to user's Solana wallet".into(),
                        evidence: vec![i],
                    });
                }

                // ═══ Clipboard Hijacking Detection ═══
                if api == "clipboard.writeText" || api == "clipboard.write" {
                    s.has_clipboard_write = true;
                    s.clipboard_write_content = extract_url_from_args(args)
                        .or_else(|| args.first().and_then(|a| a.as_str()).map(|s| s.to_string()));
                    // Check if writing a crypto address (common clipboard hijack)
                    let content = s.clipboard_write_content.as_deref().unwrap_or("");
                    let is_crypto_addr =
                        // ETH: 0x + 40 hex chars
                        (content.starts_with("0x") && content.len() >= 42
                            && content[2..42].chars().all(|c| c.is_ascii_hexdigit()))
                        // BTC bech32: bc1 + 39-59 alphanumeric
                        || (content.starts_with("bc1") && content.len() >= 42 && content.len() <= 62)
                        // BTC legacy: 1 + 25-34 base58
                        || (content.starts_with('1') && content.len() >= 26 && content.len() <= 35
                            && content.chars().all(|c| c.is_ascii_alphanumeric()))
                        // TRC-20: T + 33 base58
                        || (content.starts_with('T') && content.len() == 34
                            && content.chars().all(|c| c.is_ascii_alphanumeric()));
                    let severity = if is_crypto_addr {
                        Severity::Critical
                    } else {
                        Severity::High
                    };
                    s.findings.push(BehavioralFinding {
                        severity,
                        category: Category::ClipboardHijack,
                        title: if is_crypto_addr {
                            "Clipboard hijacked with crypto address".into()
                        } else {
                            "Clipboard content overwritten".into()
                        },
                        detail: format!(
                            "Script writes to clipboard: {}...",
                            &content[..content.len().min(80)]
                        ),
                        evidence: vec![i],
                    });
                }
                if api == "clipboard.readText" || api == "clipboard.read" {
                    s.has_clipboard_read = true;
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Medium,
                        category: Category::ClipboardHijack,
                        title: "Clipboard content read".into(),
                        detail: "Script reads clipboard — may be harvesting copied passwords or crypto addresses".into(),
                        evidence: vec![i],
                    });
                }

                // ═══ Notification Abuse Detection ═══
                if api == "notification.requestPermission" {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Medium,
                        category: Category::PrivacyViolation,
                        title: "Push notification permission requested".into(),
                        detail: "Script requests notification permissions — used for persistent social engineering".into(),
                        evidence: vec![i],
                    });
                }

                // ═══ Payment Request Detection ═══
                if api == "payment.request" || api == "payment.show" {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Critical,
                        category: Category::CryptoTheft,
                        title: "Payment Request API invoked".into(),
                        detail: "Script triggers browser payment flow — may be attempting unauthorized payment".into(),
                        evidence: vec![i],
                    });
                }

                // ═══ History Manipulation ═══
                if (api == "history.pushState" || api == "history.replaceState")
                    && let Some(url) = extract_url_from_args(args)
                {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Medium,
                        category: Category::Evasion,
                        title: format!("URL bar manipulation via {api}"),
                        detail: format!(
                            "Script changes visible URL to {url} — may hide phishing URL"
                        ),
                        evidence: vec![i],
                    });
                }

                // ═══ Geolocation Tracking ═══
                if api.starts_with("geolocation.") {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::Medium,
                        category: Category::PrivacyViolation,
                        title: format!("Geolocation access: {api}"),
                        detail: "Script accesses user's physical location".into(),
                        evidence: vec![i],
                    });
                }

                if api.contains("webRequest") && api.contains("addListener") {
                    s.findings.push(BehavioralFinding {
                        severity: Severity::High,
                        category: Category::NetworkActivity,
                        title: "Web request interception".into(),
                        detail: "Extension intercepts and can modify all web requests".into(),
                        evidence: vec![i],
                    });
                }
            }

            Observation::CookieAccess {
                operation, name, ..
            } => {
                s.timeline.push(TimelineEntry {
                    index: i,
                    action: format!("cookie.{operation:?}({name})"),
                    category: Category::CookieAccess,
                });
                if matches!(operation, CookieOp::Read) {
                    s.has_cookie_read = true;
                    s.cookie_read_idx = Some(i);
                }
            }

            Observation::NetworkRequest { url, method, .. } => {
                s.timeline.push(TimelineEntry {
                    index: i,
                    action: format!("{method} {url}"),
                    category: Category::NetworkActivity,
                });
                if is_external_url(url) {
                    s.has_external_fetch = true;
                    s.external_urls.push(url.clone());
                    s.fetch_indices.push(i);
                }
            }

            Observation::DynamicCodeExec {
                source,
                code_preview,
            } => {
                // eval detected — finding already pushed above
                let preview = if code_preview.len() > 60 {
                    format!("{}...", &code_preview[..60])
                } else {
                    code_preview.clone()
                };
                s.timeline.push(TimelineEntry {
                    index: i,
                    action: format!("{source:?}: {preview}"),
                    category: Category::CodeInjection,
                });
                s.findings.push(BehavioralFinding {
                    severity: Severity::High,
                    category: Category::CodeInjection,
                    title: format!("Dynamic code execution via {source:?}"),
                    detail: format!("Code: {preview}"),
                    evidence: vec![i],
                });
            }

            // CSS keylogger/exfiltration detection
            Observation::CssExfiltration { selector, url, .. } => {
                s.findings.push(BehavioralFinding {
                    severity: Severity::Critical,
                    category: Category::DataExfiltration,
                    title: format!("CSS keylogger: {selector} → {url}"),
                    detail: format!(
                        "CSS rule exfiltrates input data via background-image URL: {url}"
                    ),
                    evidence: vec![i],
                });
                s.has_external_fetch = true;
                s.external_urls.push(url.clone());
                s.fetch_indices.push(i);
            }

            Observation::FingerprintAccess { api, .. } => {
                s.timeline.push(TimelineEntry {
                    index: i,
                    action: format!("fingerprint: {api}"),
                    category: Category::Fingerprinting,
                });
                s.findings.push(BehavioralFinding {
                    severity: Severity::Medium,
                    category: Category::Fingerprinting,
                    title: format!("Browser fingerprinting via {api}"),
                    detail: "Script probes browser identity APIs".into(),
                    evidence: vec![i],
                });
            }

            Observation::WasmInstantiation { module_size, .. } => {
                s.findings.push(BehavioralFinding {
                    severity: Severity::High,
                    category: Category::Evasion,
                    title: "WebAssembly module instantiation".into(),
                    detail: format!("Script loads a {module_size}-byte WASM module — may contain obfuscated logic"),
                    evidence: vec![i],
                });
            }

            Observation::DomMutation {
                kind,
                target,
                detail,
            } => {
                s.timeline.push(TimelineEntry {
                    index: i,
                    action: format!("DOM {kind:?} on <{target}>: {detail}"),
                    category: Category::DomManipulation,
                });
            }

            _ => {}
        }
    }

    // Correlate: cookie read + external fetch = data exfiltration.
    if s.has_cookie_read && s.has_external_fetch {
        let mut evidence = Vec::new();
        if let Some(idx) = s.cookie_read_idx {
            evidence.push(idx);
        }
        evidence.extend(&s.fetch_indices);
        s.findings.push(BehavioralFinding {
            severity: Severity::Critical,
            category: Category::DataExfiltration,
            title: "Cookie exfiltration to external server".into(),
            detail: format!(
                "Script reads cookies and sends data to: {}",
                s.external_urls.join(", ")
            ),
            evidence,
        });
    } else if s.has_cookie_read {
        s.findings.push(BehavioralFinding {
            severity: Severity::Medium,
            category: Category::CookieAccess,
            title: "Cookie access detected".into(),
            detail: "Script reads browser cookies".into(),
            evidence: s.cookie_read_idx.into_iter().collect(),
        });
    }

    if s.has_external_fetch && !s.has_cookie_read {
        s.findings.push(BehavioralFinding {
            severity: Severity::Medium,
            category: Category::NetworkActivity,
            title: "External network requests".into(),
            detail: format!("Requests to: {}", s.external_urls.join(", ")),
            evidence: s.fetch_indices.clone(),
        });
    }

    if s.has_storage_write {
        s.findings.push(BehavioralFinding {
            severity: Severity::Low,
            category: Category::Persistence,
            title: "Local storage persistence".into(),
            detail: "Script stores data in localStorage/sessionStorage".into(),
            evidence: Vec::new(),
        });
    }

    // Correlate: wallet connect + sign transaction = CONFIRMED crypto drainer.
    if s.has_wallet_connect && (s.has_sign_transaction || s.has_sign_message) {
        let mut evidence = Vec::new();
        if let Some(idx) = s.wallet_connect_idx {
            evidence.push(idx);
        }
        evidence.extend(&s.sign_indices);
        s.findings.push(BehavioralFinding {
            severity: Severity::Critical,
            category: Category::CryptoTheft,
            title: "CONFIRMED: Crypto wallet drainer".into(),
            detail: "Script connects to wallet AND requests transaction/message signing — this is a wallet drainer attack".into(),
            evidence,
        });
    }

    // Correlate: wallet connect + chain switch = drainer with chain manipulation
    if s.has_wallet_connect && s.has_chain_switch {
        s.findings.push(BehavioralFinding {
            severity: Severity::Critical,
            category: Category::CryptoTheft,
            title: "Wallet drainer with chain manipulation".into(),
            detail: "Script connects wallet and switches chain — drainers move victims to attacker-controlled networks".into(),
            evidence: s.wallet_connect_idx.into_iter().collect(),
        });
    }

    // Correlate: wallet connect + external fetch = C2 coordination
    if s.has_wallet_connect && s.has_external_fetch {
        let mut evidence = Vec::new();
        if let Some(idx) = s.wallet_connect_idx {
            evidence.push(idx);
        }
        evidence.extend(&s.fetch_indices);
        s.findings.push(BehavioralFinding {
            severity: Severity::High,
            category: Category::CryptoTheft,
            title: "Wallet drainer with C2 communication".into(),
            detail: format!(
                "Script connects wallet and communicates with external server: {}",
                s.external_urls.join(", ")
            ),
            evidence,
        });
    }

    // Correlate: clipboard read + clipboard write = clipboard swap attack
    if s.has_clipboard_read && s.has_clipboard_write {
        s.findings.push(BehavioralFinding {
            severity: Severity::Critical,
            category: Category::ClipboardHijack,
            title: "CONFIRMED: Clipboard swap attack".into(),
            detail: "Script reads clipboard content and writes replacement — classic crypto address swap attack".into(),
            evidence: Vec::new(),
        });
    }

    // Correlate: clipboard write + crypto wallet = address replacement drainer
    if s.has_clipboard_write && s.has_wallet_connect {
        s.findings.push(BehavioralFinding {
            severity: Severity::Critical,
            category: Category::CryptoTheft,
            title: "Clipboard + wallet combined attack".into(),
            detail:
                "Script manipulates clipboard AND connects to wallet — multi-vector crypto theft"
                    .into(),
            evidence: Vec::new(),
        });
    }

    // Sort findings by severity (critical first).
    s.findings.sort_by(|a, b| b.severity.cmp(&a.severity));

    // Compute risk score.
    let risk_score = compute_risk_score(&s.findings);

    AnalysisReport {
        findings: s.findings,
        timeline: s.timeline,
        risk_score,
        observation_count: observations.len(),
    }
}

/// Overall analysis report.
pub struct AnalysisReport {
    pub findings: Vec<BehavioralFinding>,
    pub timeline: Vec<TimelineEntry>,
    pub risk_score: u8, // 0-100
    pub observation_count: usize,
}

impl AnalysisReport {
    /// Format as a beautiful terminal report.
    pub fn format_text(&self, target: &str, duration_us: u64) -> String {
        let reset = "\x1b[0m";
        let bold = "\x1b[1m";
        let dim = "\x1b[2m";

        let mut out = String::new();

        out.push_str(&format!(
            "\n{bold}jsdet v0.1.0 — JavaScript Detonation Report{reset}\n"
        ));
        out.push_str(&"━".repeat(55));
        out.push('\n');
        out.push_str(&format!("Target:   {target}\n"));
        out.push_str(&format!(
            "Duration: {:.1}ms | Observations: {}\n",
            duration_us as f64 / 1000.0,
            self.observation_count
        ));

        let risk_color = if self.risk_score >= 80 {
            "\x1b[91m"
        } else if self.risk_score >= 50 {
            "\x1b[33m"
        } else if self.risk_score >= 20 {
            "\x1b[36m"
        } else {
            "\x1b[32m"
        };
        out.push_str(&format!(
            "Risk:     {risk_color}{bold}{}/100{reset}\n",
            self.risk_score
        ));
        out.push('\n');

        if self.findings.is_empty() {
            out.push_str(&format!("{dim}No behavioral findings.{reset}\n"));
        } else {
            out.push_str(&format!("{bold}Behavioral Summary:{reset}\n"));
            for finding in &self.findings {
                let color = finding.severity.color_code();
                let icon = finding.severity.icon();
                out.push_str(&format!(
                    "  {color}[{icon}] {}{reset} — {}\n",
                    finding.category.label(),
                    finding.title,
                ));
                out.push_str(&format!("       {dim}{}{reset}\n", finding.detail));
            }
            out.push('\n');
        }

        if !self.timeline.is_empty() {
            out.push_str(&format!("{bold}Timeline:{reset}\n"));
            for (i, entry) in self.timeline.iter().take(20).enumerate() {
                let color = entry.category.color_code();
                out.push_str(&format!(
                    "  {dim}{:>3}.{reset} {color}{}{reset}\n",
                    i + 1,
                    entry.action
                ));
            }
            if self.timeline.len() > 20 {
                out.push_str(&format!(
                    "  {dim}... and {} more{reset}\n",
                    self.timeline.len() - 20
                ));
            }
        }

        out
    }
}

impl Category {
    fn color_code(self) -> &'static str {
        match self {
            Self::CredentialTheft
            | Self::DataExfiltration
            | Self::CodeInjection
            | Self::CryptoTheft => "\x1b[31m",
            Self::PermissionAbuse | Self::NetworkActivity | Self::ClipboardHijack => "\x1b[33m",
            Self::Persistence
            | Self::CookieAccess
            | Self::Evasion
            | Self::Fingerprinting
            | Self::PrivacyViolation => "\x1b[36m",
            Self::DomManipulation => "\x1b[90m",
        }
    }
}

/// Timeline entry — one action in chronological order.
#[allow(dead_code)]
pub struct TimelineEntry {
    pub index: usize,
    pub action: String,
    pub category: Category,
}

fn categorize_api(api: &str) -> Category {
    if api.contains("ethereum")
        || api.contains("solana")
        || api.starts_with("crypto.sign")
        || api.starts_with("crypto.solana")
        || api.starts_with("crypto.chain")
    {
        Category::CryptoTheft
    } else if api.contains("clipboard") {
        Category::ClipboardHijack
    } else if api.contains("geolocation") || api.contains("notification") || api.contains("payment")
    {
        Category::PrivacyViolation
    } else if is_command_execution_api(api) {
        Category::CodeInjection
    } else if api.contains("cookie") {
        Category::CookieAccess
    } else if api.contains("fetch") || api.contains("xhr") || api.contains("Request") {
        Category::NetworkActivity
    } else if api.contains("eval") || api.contains("Function") || api.contains("executeScript") {
        Category::CodeInjection
    } else if api.contains("Storage") || api.contains("storage") {
        Category::Persistence
    } else if api.contains("fingerprint") || api.contains("canvas") || api.contains("webgl") {
        Category::Fingerprinting
    } else if api.contains("webRequest") {
        Category::NetworkActivity
    } else {
        Category::DomManipulation
    }
}

fn extract_url_from_args(args: &[jsdet_core::observation::Value]) -> Option<String> {
    for arg in args {
        if let jsdet_core::observation::Value::String(s, _) = arg {
            // Direct URL string.
            if s.starts_with("http://") || s.starts_with("https://") {
                return Some(s.clone());
            }
            // Parse JSON array: [6, "action", "https://evil.com"] or ["url", "method"]
            // Use serde_json::Value to handle mixed types (numbers + strings).
            if s.starts_with('[')
                && let Ok(arr) = serde_json::from_str::<Vec<serde_json::Value>>(s)
            {
                for item in arr {
                    if let Some(str_val) = item.as_str()
                        && (str_val.starts_with("http://") || str_val.starts_with("https://"))
                    {
                        return Some(str_val.to_string());
                    }
                }
            }
            // URL embedded in a longer string
            if let Some(pos) = s.find("https://").or_else(|| s.find("http://")) {
                let rest = &s[pos..];
                let end = rest.find(['"', '\'', ' ', '>', ']']).unwrap_or(rest.len());
                let url = &rest[..end];
                if url.len() > 10 {
                    return Some(url.to_string());
                }
            }
        }
    }
    None
}

fn is_external_url(url: &str) -> bool {
    url.starts_with("http://") || url.starts_with("https://")
}

/// Extract the first string value from args, parsing JSON arrays if needed.
/// Unlike extract_url_from_args, this doesn't filter for URLs.
fn extract_first_string_arg(args: &[jsdet_core::observation::Value]) -> Option<String> {
    for arg in args {
        if let jsdet_core::observation::Value::String(s, _) = arg {
            if s.starts_with('[') {
                if let Ok(arr) = serde_json::from_str::<Vec<serde_json::Value>>(s)
                    && let Some(first) = arr.first()
                    && let Some(s) = first.as_str()
                {
                    return Some(s.to_string());
                }
            } else {
                return Some(s.clone());
            }
        }
    }
    None
}

fn is_child_process_require(api: &str, args: &[jsdet_core::observation::Value]) -> bool {
    matches!(api, "require" | "node:require")
        && extract_first_string_arg(args)
            .is_some_and(|module| matches!(module.as_str(), "child_process" | "node:child_process"))
}

fn is_command_execution_api(api: &str) -> bool {
    matches!(
        api,
        "child_process.exec" | "child_process.execSync" | "child_process.spawn"
    )
}

fn compute_risk_score(findings: &[BehavioralFinding]) -> u8 {
    let mut score: u32 = 0;
    for finding in findings {
        let base: u32 = match finding.severity {
            Severity::Critical => 30,
            Severity::High => 20,
            Severity::Medium => 10,
            Severity::Low => 5,
            Severity::Info => 1,
        };
        // Weight multipliers:
        // - CONFIRMED behavioral chain correlations get 2x (proven multi-step attack)
        // - DIRECT ETH TRANSFER gets 2x (immediate financial theft)
        // - All other findings get 1x
        let multiplier: u32 = if finding.title.starts_with("CONFIRMED:")
            || finding.title.starts_with("DIRECT ETH TRANSFER")
        {
            2
        } else {
            1
        };
        // CRITICAL FIX: Use saturating_add to prevent overflow
        score = score.saturating_add(base.saturating_mul(multiplier));
    }
    score.min(100) as u8
}

#[cfg(test)]
mod tests {
    use super::*;
    use jsdet_core::observation::{DynamicCodeSource, Value};

    #[test]
    fn cookie_plus_fetch_is_exfiltration() {
        let observations = vec![
            Observation::ApiCall {
                api: "document.cookie.get".into(),
                args: vec![],
                result: Value::string("session=abc"),
            },
            Observation::ApiCall {
                api: "fetch".into(),
                args: vec![Value::string("[\"https://evil.com/exfil\",\"POST\"]")],
                result: Value::Undefined,
            },
        ];
        let report = analyze(&observations);
        assert!(
            report
                .findings
                .iter()
                .any(|f| f.category == Category::DataExfiltration),
            "should detect data exfiltration"
        );
        assert!(report.risk_score >= 30);
    }

    #[test]
    fn eval_is_code_injection() {
        let observations = vec![Observation::DynamicCodeExec {
            source: DynamicCodeSource::Eval,
            code_preview: "alert(1)".into(),
        }];
        let report = analyze(&observations);
        assert!(
            report
                .findings
                .iter()
                .any(|f| f.category == Category::CodeInjection)
        );
    }

    #[test]
    fn empty_observations_zero_risk() {
        let report = analyze(&[]);
        assert_eq!(report.risk_score, 0);
        assert!(report.findings.is_empty());
    }

    #[test]
    fn crypto_wallet_drainer_scores_critical() {
        // Simulate: wallet connect + EIP-712 sign + C2 fetch
        let observations = vec![
            Observation::ApiCall {
                api: "ethereum.request".into(),
                args: vec![Value::string("[\"eth_requestAccounts\",\"[]\"]")],
                result: Value::Undefined,
            },
            Observation::ApiCall {
                api: "crypto.sign_message".into(),
                args: vec![Value::string(
                    "[\"eth_signTypedData_v4\",\"[\\\"0xVICTIM\\\",\\\"{}\\\"]\"]",
                )],
                result: Value::Undefined,
            },
            Observation::ApiCall {
                api: "fetch".into(),
                args: vec![Value::string(
                    "[\"https://drainer-c2.evil/api/drain\",\"POST\"]",
                )],
                result: Value::Undefined,
            },
        ];
        let report = analyze(&observations);

        // Must have CONFIRMED crypto drainer finding
        assert!(
            report
                .findings
                .iter()
                .any(|f| f.category == Category::CryptoTheft && f.title.contains("CONFIRMED")),
            "must detect confirmed crypto drainer, findings: {:?}",
            report.findings.iter().map(|f| &f.title).collect::<Vec<_>>()
        );

        // Risk score must be >= 90 for a confirmed drainer
        assert!(
            report.risk_score >= 90,
            "crypto wallet drainer must score >= 90, got {}",
            report.risk_score
        );
    }

    #[test]
    fn clipboard_swap_detected() {
        let observations = vec![
            Observation::ApiCall {
                api: "clipboard.readText".into(),
                args: vec![],
                result: Value::Undefined,
            },
            Observation::ApiCall {
                api: "clipboard.writeText".into(),
                args: vec![Value::string("0x742d35Cc6634C0532925a3b844Bc9e7595f2bD38")],
                result: Value::Undefined,
            },
        ];
        let report = analyze(&observations);

        // Must detect clipboard swap
        assert!(
            report
                .findings
                .iter()
                .any(|f| f.category == Category::ClipboardHijack && f.title.contains("CONFIRMED")),
            "must detect confirmed clipboard swap"
        );

        // Must detect crypto address in clipboard
        assert!(
            report
                .findings
                .iter()
                .any(|f| f.title.contains("crypto address")),
            "must detect crypto address in clipboard write"
        );
    }

    #[test]
    fn multi_vector_attack_maxes_risk() {
        // wallet + clipboard + cookie steal + C2
        let observations = vec![
            Observation::ApiCall {
                api: "document.cookie.get".into(),
                args: vec![],
                result: Value::string("session=abc"),
            },
            Observation::ApiCall {
                api: "ethereum.request".into(),
                args: vec![Value::string("[\"eth_requestAccounts\",\"[]\"]")],
                result: Value::Undefined,
            },
            Observation::ApiCall {
                api: "clipboard.writeText".into(),
                args: vec![Value::string("0xATTACKER")],
                result: Value::Undefined,
            },
            Observation::ApiCall {
                api: "crypto.sign_transaction".into(),
                args: vec![Value::string("[{\"to\":\"0xATTACKER\"}]")],
                result: Value::Undefined,
            },
            Observation::ApiCall {
                api: "fetch".into(),
                args: vec![Value::string("[\"https://mega-c2.evil/harvest\",\"POST\"]")],
                result: Value::Undefined,
            },
        ];
        let report = analyze(&observations);
        assert_eq!(
            report.risk_score, 100,
            "multi-vector attack must score 100, got {}",
            report.risk_score
        );
    }

    #[test]
    fn child_process_exec_api_call_is_critical() {
        let observations = vec![
            Observation::ApiCall {
                api: "require".into(),
                args: vec![Value::string("child_process")],
                result: Value::Undefined,
            },
            Observation::ApiCall {
                api: "child_process.exec".into(),
                args: vec![Value::string("cat /etc/passwd")],
                result: Value::Undefined,
            },
        ];

        let report = analyze(&observations);

        assert!(
            report.findings.iter().any(|f| {
                f.severity == Severity::Critical
                    && f.category == Category::CodeInjection
                    && f.title.contains("Command execution")
            }),
            "expected critical command execution finding, got {:?}",
            report.findings.iter().map(|f| &f.title).collect::<Vec<_>>()
        );
        assert!(
            report.risk_score >= 50,
            "expected elevated risk, got {}",
            report.risk_score
        );
    }

    #[test]
    fn child_process_spawn_api_call_is_critical() {
        let observations = vec![Observation::ApiCall {
            api: "child_process.spawn".into(),
            args: vec![Value::string("[\"/bin/sh\",\"-c\",\"id\"]")],
            result: Value::Undefined,
        }];

        let report = analyze(&observations);

        assert!(report.findings.iter().any(|f| {
            f.severity == Severity::Critical
                && f.category == Category::CodeInjection
                && f.title.contains("spawn")
        }));
    }
}