mirkoschubert/gdpr-cli

A command line tool for checking your website for GDPR compliance.

gdpr-cli's Issues

enable Travis CI

"Cannot read property 'hasTypekitJS' of undefined" when running just with -f

Describe the bug

--fonts does not initialize the JSParser as it needs it
To Reproduce
Steps to reproduce the behavior:

$ node index.js scan example.com -f
fonts
[21:04:54] Checking the URL ...
[21:04:54] Loading HTML file
[21:04:54] Setup additional content
[21:04:54] Loading CSS files

GENERAL INFORMATION

Title:              Example Domain
Description:
URL:                http://example.com/
Software:           Unknown
Cannot read property 'hasTypekitJS' of undefined

Expected behavior

fonts should be detected
Screenshots

Desktop:

• OS: [e.g. iOS]
• Node Version [e.g. 8.11.2 LTS] 10
• Version [e.g. 0.3.2] 0.3.4

Additional context

package name

I saw that you mentioned my reserved package name ;-)

Due to naming conventions in npmjs.com we changed our name from gdpr-check to gdpr-cli

Are still interested in using gdpr-check? I would be also interested in providing further checks, solutions and contribute to the project.

Unfortunately I did not get any email or contact request asking about the usage of gdpr-check. In general everyone can contact me and ask about unused package names and so on, I do not bite ;-)

proposal: puppeteer for more checks

I had the idea to create a similar tool but use puppeteer.

Puppeteer has a rich API for getting information about cookies, all requests, emulate languages, devices and much more.

exit checks early

The DNS checks and others run multiple regex match tests.
The check should be done after the first hit and return in this case or continue.
See getPrefetchingInformation

regex.match is evil, good ol' indexOf rules

http://jsben.ch/1wwBN
https://jsperf.com/substring-search2

const Benchmark = require('benchmark')
const suite = new Benchmark.Suite

suite.add('match', {
        setup: function () {
            var dns = [
                "23423423",
                "gravatar.com",
                "asdasdsd",
                "34534",
                "67867"
            ]
        },
        fn: function () {
            dns.forEach((u, i) => {
                let explanation;
                if (u.match(/fonts\.googleapis\.com/) !== null) explanation = 'Google Fonts';
                if (u.match(/gravatar\.com/) !== null) explanation = 'asdasd';
            });
        }
    })
    .add('indexOf', {
        setup: function () {
            var dns = [
                "23423423",
                "gravatar.com",
                "asdasdsd",
                "34534",
                "67867"
            ]
        },
        fn: function () {
            dns.forEach((u, i) => {
                let explanation;
                if (u.indexOf('fonts.googleapis.com') >= 0) explanation = 'Google Fonts';
                if (u.indexOf('gravatar.com') >= 0) explanation = 'asdasd';
            });
        }
    })
    .add('includes', {
        setup: function () {
            var dns = [
                "23423423",
                "gravatar.com",
                "asdasdsd",
                "34534",
                "67867"
            ]
        },
        fn: function () {

            dns.forEach((u, i) => {
                let explanation;
                if (u.includes('fonts.googleapis.com')) explanation = 'Google Fonts';
                if (u.includes('gravatar.com')) explanation = 'asdasd';
            });
        }
    })
    .on('cycle', function (event) {
        console.log(String(event.target));
    })
    .on('complete', function () {
        console.log('Fastest is ' + this.filter('fastest').map('name'))
    })
    .run({
        'async': false
    })

match x 3,490,973 ops/sec ±0.40% (96 runs sampled)
indexOf x 77,547,624 ops/sec ±1.18% (93 runs sampled)
includes x 11,250,688 ops/sec ±1.15% (90 runs sampled)
Fastest is indexOf

External embedded videos

We need to analyse websites against embedded videos usage

I have already implemented the needed feature

cf. https://github.com/betaglop/gdpr-cli/tree/dev

Additional context

I cannot propose a pull request as other pull requests are pending and needed for the patch I can propose...

URL is not defined

Hi,
Wenn ich eine Seite scannen möchte bekomme ich jedesmal:

Checking the URL ...
URL is not defined

Die Seiten die ich scanne gibt es natürlich.

Cannot read property 'slice' of undefined thrown if css or js file of the page cannot be downloaded

I'm submitting a

• bug report

Information

Scan fails with SyntaxError: Unexpected token ...

Describe the bug
Scan fails with SyntaxError: Unexpected token ...

To Reproduce
Steps to reproduce the behavior:

1. sudo npm install -g gdpr-cli
2. gdpr scan www.example.com

Expected behavior
gdpr-cli scans www.example.com

Desktop:

• OS: Ubuntu 16.04 LTS
• Node Version v4.2.6

Additional context

Stacktrace:

`$ gdpr scan www.example.com
/usr/local/lib/node_modules/gdpr-cli/lib/ui.js:59
cui.div(...data);
^^^

SyntaxError: Unexpected token ...
at exports.runInThisContext (vm.js:53:16)
at Module._compile (module.js:374:25)
at Object.Module._extensions..js (module.js:417:10)
at Module.load (module.js:344:32)
at Function.Module._load (module.js:301:12)
at Module.require (module.js:354:17)
at require (internal/module.js:12:17)
at Object. (/usr/local/lib/node_modules/gdpr-cli/lib/tasks.js:12:12)
at Module._compile (module.js:410:26)
at Object.Module._extensions..js (module.js:417:10)
`

"Check for Cookies (if it's even possible)"

I'd like to automate Cookies detection and GDPR compliance evaluation (record-keeping, eg. 13 month for Cookies in France).

I'd like to get back informations about cookies and cookies record-keeping policies on the targeted website. It's easy to do that using bash (I've already written something that way), so I'd like to see it in this tool, maybe by contributing...

Eg. using bash:

FILE=/path/to/cookies/file
wget --save-cookies $FILE [URL]
MONTH13=34164000  # nb of seconds in 13 month
for epoch in `cat $FILE | grep -v '^#' | grep -v '^$' | cut -d"  " -f5`
do
    if [ $epoch -gt `echo \`date +%s\` + $MONTH13 | bc` ]
    then
        DATE=`date --date=@$epoch`
        echo "- KO: $DATE"
        continue;
    fi
    
    echo -n "- OK: "
    date --date=@$epoch
done

Not detecting google analytics -- "Simple Google Analytics" WP plugin

Describe the bug

Scanning sites utilizing the Simple Google Analytics plugin return - No Analytics Tool has been found.
Reproduced on multiple sites
Below is the code with the analytics at the bottom of the page

--   | <script type="text/javascript">panopress.imagebox();</script>   |   | <script type="text/javascript">   | var _gaq = _gaq \|\| [];   | _gaq.push(['_setAccount','UA-123456-7']);   | _gaq.push(['_trackPageview']);   | (function() {   | var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;   | ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';   | var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);   | })();   | </script>   |   | <script type='text/javascript' src='http://www.site.com/wp-includes/js/wp-embed.min.js?ver=4.9.6'></script>   |

Plugin; https://wordpress.org/plugins/simple-google-analytics/

CDN detection, especially Cloudflare.

Is your feature request related to a problem? Please describe.

Your tool should be able to detect CDN connection.
Cloudflare is used by many non-professional users for free SSL and cache.
However, Cloudflare itself is very dangerous, government funded MITMed point.
Therefore your tool should notify the user - "Don't forget to write 'We also share your IP and posted data with Cloudflare'!."

Describe the solution you'd like

Detect any CDN connection.

Describe alternatives you've considered

Suggest non-CDN solution. Let's Encrypt for certificate, for example.

Additional context

https://trac.torproject.org/projects/tor/ticket/24351
https://trac.torproject.org/projects/tor/ticket/18361

ideas, proposals (functional programming)

Is your feature request related to a problem? Please describe.

Describe the solution you'd like
A more functional programming approach for better maintainability and readability.

Describe alternatives you've considered

Some ideas / modules which might be useful here:
https://github.com/DanielRuf/https-checks/blob/master/index.js
https://github.com/DanielRuf/symantecpkicerts/blob/master/index.js
https://github.com/DanielRuf/website-stack/blob/master/index.js
https://github.com/DanielRuf/website-checks/blob/master/index.js

Additional context

Google Analytics not detected

Describe the bug
Google Analytics is not detected

To Reproduce
Steps to reproduce the behavior:

1. gdpr scan https://www.ligatus.com/

Expected behavior
Google Analytics is detected

Desktop:

• OS: Ubuntu 16.04 LTS
• Node Version v10.3.0
• Version 0.3.4

Additional context

ANALYTICS

No Analytics Tool has been found.