Deno is a JavaScript

#!/usr/bin/env python3
# verify_cve_2025_21620.py
# Functional verifier for CVE-2025-21620 (Deno fetch Authorization leak on cross-origin redirect)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import shutil
import subprocess
import sys
import tempfile

EXIT_PATCHED = 0
EXIT_VULNERABLE = 1
EXIT_UNKNOWN = 2


def out(msg):
    print(msg)


def find_deno(arg_path=None):
    if arg_path:
        return arg_path
    return shutil.which("deno")


def parse_version(text):
    m = re.search(r"deno\s+(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def semver_lt(a, b):
    return a < b


def version_based_fallback(ver):
    if ver is None:
        return None
    major, minor, patch = ver
    if major == 1:
        return "VULNERABLE" if semver_lt(ver, (1, 46, 4)) else "PATCHED"
    if major == 2:
        return "VULNERABLE" if semver_lt(ver, (2, 1, 2)) else "PATCHED"
    if major > 2:
        return "PATCHED"
    return None


def get_version(deno):
    try:
        cp = subprocess.run([deno, "--version"], capture_output=True, text=True, timeout=10)
        text = (cp.stdout or "") + "\n" + (cp.stderr or "")
        return parse_version(text), text.strip()
    except Exception:
        return None, ""


def functional_test(deno):
    js = r'''
const ac = new AbortController();

const server1 = Deno.serve({ hostname: "127.0.0.1", port: 3001, signal: ac.signal }, (_req) => {
  return new Response(null, {
    status: 302,
    headers: { "location": "http://127.0.0.1:3002/redirected" },
  });
});

const server2 = Deno.serve({ hostname: "127.0.0.1", port: 3002, signal: ac.signal }, (req) => {
  const body = JSON.stringify({
    url: req.url,
    hasAuth: req.headers.has("authorization"),
    authValue: req.headers.get("authorization") || "",
  });
  return new Response(body, {
    status: 200,
    headers: { "content-type": "application/json" },
  });
});

async function main() {
  await new Promise((r) => setTimeout(r, 300));
  try {
    const response = await fetch("http://127.0.0.1:3001/", {
      headers: { authorization: "Bearer noisgate-test-token" },
    });
    const body = await response.json();
    console.log(JSON.stringify(body));
  } finally {
    ac.abort();
    setTimeout(() => Deno.exit(0), 50);
  }
}

main();
'''

    with tempfile.TemporaryDirectory() as td:
        path = os.path.join(td, "cve_2025_21620_check.ts")
        with open(path, "w", encoding="utf-8") as f:
            f.write(js)
        try:
            cp = subprocess.run(
                [deno, "run", "--quiet", "--allow-net=127.0.0.1:3001,127.0.0.1:3002", path],
                capture_output=True,
                text=True,
                timeout=20,
            )
        except Exception as e:
            return None, f"functional test execution failed: {e}"

        stdout = (cp.stdout or "").strip()
        stderr = (cp.stderr or "").strip()
        if cp.returncode != 0 and not stdout:
            return None, f"functional test failed rc={cp.returncode} stderr={stderr}"

        m = re.search(r'\{.*"hasAuth"\s*:\s*(true|false).*\}', stdout, re.S)
        if not m:
            return None, f"unable to parse functional test output: {stdout or stderr}"

        leaked = m.group(1) == "true"
        return ("VULNERABLE" if leaked else "PATCHED"), stdout


def main():
    deno = find_deno(sys.argv[1] if len(sys.argv) > 1 else None)
    if not deno:
        out("UNKNOWN: deno binary not found")
        sys.exit(EXIT_UNKNOWN)

    ver, raw_ver = get_version(deno)
    func_result, detail = functional_test(deno)

    if func_result == "VULNERABLE":
        out(f"VULNERABLE: functional test reproduced Authorization header leak ({raw_ver})")
        sys.exit(EXIT_VULNERABLE)
    if func_result == "PATCHED":
        out(f"PATCHED: functional test did not leak Authorization header ({raw_ver})")
        sys.exit(EXIT_PATCHED)

    fallback = version_based_fallback(ver)
    if fallback == "VULNERABLE":
        out(f"VULNERABLE: functional test inconclusive, but installed version appears vulnerable ({raw_ver})")
        sys.exit(EXIT_VULNERABLE)
    if fallback == "PATCHED":
        out(f"PATCHED: functional test inconclusive, but installed version is at/above known fixed baseline ({raw_ver})")
        sys.exit(EXIT_PATCHED)

    out(f"UNKNOWN: could not complete functional verification; detail={detail}; version={raw_ver}")
    sys.exit(EXIT_UNKNOWN)


if __name__ == "__main__":
    main()