microlinkhq / is-antibot / 28052335064

96%

push

github

fix(providers): eliminate bare vendor-word html false positives (#46)

* fix(threatmetrix): avoid false positive on config-key mentions

The html detection used a case-insensitive `contains: "ThreatMetrix"`,
which matched any mention of the word — including feature-flag config keys
embedded in page JSON (e.g. Netflix's "enable.threatmetrix.debug"). That
flagged fully-rendered 200 pages as antibot-protected, surfacing as a
spurious EPROXYNEEDED upgrade prompt.

ThreatMetrix is passive device profiling: the real signal is the JS API
invocation (ThreatMetrix.init()/.profile()), so match that pattern
case-sensitively instead. The fp/check.js URL rule is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(providers): tighten bare vendor-word html rules

Audit following the threatmetrix false positive surfaced seven more html
detections matching a bare vendor name (case-insensitive substring), which
fired on fully-served 200 pages that merely mention or integrate the vendor
(badges, config keys, comparison articles), not on an actual challenge.

Each rule is tightened to its active signal, matching the existing positive
fixtures and the pattern already used by recaptcha/hcaptcha/turnstile:

- shapesecurity, imperva/incapsula, meetrics, geetest, funcaptcha: the JS
  API invocation (vendor.method(...)), not the name
- sucuri, reblaze: the block-page text (Sucuri Website Firewall /
  Protected by Reblaze)
- aws-waf: the API call and the /awswaf/ challenge-script path

Adds a bare-mention regression test per provider. All real challenge
signals (headers, cookies, URLs, block pages) remain detected.

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

160 of 169 branches covered (94.67%)

Branch coverage included in aggregate %.

352 of 365 relevant lines covered (96.44%)

337.66 hits per line