crypto-js WordArray.random() Insufficient Entropy via Weak PRNG (Ill Bloom)

#!/usr/bin/env bash
# check_cryptojs.sh — Detect vulnerable crypto-js versions (CVE-2026-71851)
# Usage: bash check_cryptojs.sh /path/to/project
# Requires: node (any version), or just grep/jq

set -euo pipefail

PROJECT_DIR="${1:-.}"
RESULT="UNKNOWN"

if [ ! -d "$PROJECT_DIR" ]; then
  echo "ERROR: Directory $PROJECT_DIR does not exist."
  exit 2
fi

# Check for crypto-js in node_modules
PKG_JSON="$PROJECT_DIR/node_modules/crypto-js/package.json"

if [ ! -f "$PKG_JSON" ]; then
  # Also check lock files for transitive deps
  if grep -q '"crypto-js"' "$PROJECT_DIR/package-lock.json" 2>/dev/null || \
     grep -q 'crypto-js@' "$PROJECT_DIR/yarn.lock" 2>/dev/null; then
    echo "INFO: crypto-js found in lock file but not installed. Run npm install first."
    RESULT="UNKNOWN"
  else
    echo "PATCHED — crypto-js is not a dependency of this project."
    exit 0
  fi
else
  VERSION=$(node -e "console.log(require('$PKG_JSON').version)" 2>/dev/null || echo "")
  if [ -z "$VERSION" ]; then
    VERSION=$(grep '"version"' "$PKG_JSON" | head -1 | sed 's/.*"version".*"\(.*\)".*/\1/')
  fi

  if [ -z "$VERSION" ]; then
    echo "UNKNOWN — could not parse crypto-js version."
    exit 2
  fi

  echo "INFO: Found crypto-js version $VERSION"

  # Parse major version
  MAJOR=$(echo "$VERSION" | cut -d. -f1)

  if [ "$MAJOR" -ge 4 ] 2>/dev/null; then
    echo "PATCHED — crypto-js $VERSION is >= 4.0.0 (not affected by CVE-2026-71851)."
    exit 0
  else
    echo "VULNERABLE — crypto-js $VERSION is < 4.0.0 (affected by CVE-2026-71851)."
    # Additional check: see if WordArray.random is actually called
    echo ""
    echo "=== Checking for WordArray.random() usage in source code ==="
    HITS=$(grep -r -l 'WordArray\.random\|CryptoJS\.lib\.WordArray\.random' "$PROJECT_DIR/src" "$PROJECT_DIR/lib" "$PROJECT_DIR/app" 2>/dev/null | head -20 || true)
    if [ -n "$HITS" ]; then
      echo "WARNING: WordArray.random() calls found in application code:"
      echo "$HITS"
      echo ""
      echo "VULNERABLE — confirmed usage of the weak PRNG function."
    else
      echo "NOTE: No WordArray.random() calls found in src/lib/app directories."
      echo "VULNERABLE — version is affected, but exploitability depends on whether"
      echo "            WordArray.random() is called for security-sensitive generation."
      echo "            Check all code paths including bundled/transpiled files."
    fi
    exit 1
  fi
fi

echo "$RESULT"
exit 2