0xray 4.0.11 → 4.0.13

package/dist/security/security-hardener.js

@@ -1,169 +0,0 @@
-/**
- * Security Hardening Module
- *
- * Implements additional security measures and hardening for the framework.
- * Addresses vulnerabilities identified during security audit.
- *
- * @since 2026-01-07
- */
-import { promises as fs } from "fs";
-export class SecurityHardener {
-    config;
-    constructor(config = {}) {
-        this.config = {
-            enableInputValidation: true,
-            enableRateLimiting: true,
-            enableAuditLogging: true,
-            enableSecureHeaders: true,
-            maxRequestSizeBytes: 1024 * 1024, // 1MB
-            rateLimitWindowMs: 60000, // 1 minute
-            rateLimitMaxRequests: 100,
-            ...config,
-        };
-    }
-    /**
-     * Apply security hardening based on audit results
-     */
-    async hardenSecurity(auditResult) {
-        const appliedFixes = [];
-        const remainingIssues = [];
-        for (const issue of auditResult.issues) {
-            const fix = await this.applyFixForIssue(issue);
-            if (fix.applied) {
-                appliedFixes.push(fix.description);
-            }
-            else {
-                remainingIssues.push(issue);
-            }
-        }
-        return { appliedFixes, remainingIssues };
-    }
-    async applyFixForIssue(issue) {
-        switch (issue.category) {
-            case "hardcoded-secrets":
-                return await this.fixHardcodedSecrets(issue);
-            case "file-permissions":
-                return await this.fixFilePermissions(issue);
-            case "dependency-management":
-                return await this.fixDependencyManagement(issue);
-            case "input-validation":
-                return await this.addInputValidation(issue);
-            default:
-                return {
-                    applied: false,
-                    description: `No automated fix available for ${issue.category}`,
-                };
-        }
-    }
-    async fixHardcodedSecrets(issue) {
-        // This would require manual intervention, but we can suggest the fix
-        return {
-            applied: false,
-            description: `Manual intervention required for hardcoded secrets in ${issue.file}`,
-        };
-    }
-    async fixFilePermissions(issue) {
-        try {
-            // Remove world-writable permissions
-            await fs.chmod(issue.file, 0o644);
-            return {
-                applied: true,
-                description: `Fixed file permissions for ${issue.file}`,
-            };
-        }
-        catch (error) {
-            return {
-                applied: false,
-                description: `Failed to fix permissions for ${issue.file}: ${error}`,
-            };
-        }
-    }
-    async fixDependencyManagement(issue) {
-        // This requires manual intervention for dependency updates
-        return {
-            applied: false,
-            description: `Manual intervention required for dependency management in ${issue.file}`,
-        };
-    }
-    async addInputValidation(issue) {
-        // This would require code analysis and modification
-        return {
-            applied: false,
-            description: `Code modification required for input validation in ${issue.file}`,
-        };
-    }
-    /**
-     * Add security headers to HTTP responses
-     */
-    addSecurityHeaders(headers) {
-        if (!this.config.enableSecureHeaders)
-            return headers;
-        return {
-            ...headers,
-            "X-Content-Type-Options": "nosniff",
-            "X-Frame-Options": "DENY",
-            "X-XSS-Protection": "1; mode=block",
-            "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
-            "Content-Security-Policy": "default-src 'self'",
-            "Referrer-Policy": "strict-origin-when-cross-origin",
-        };
-    }
-    /**
-     * Validate input data
-     */
-    validateInput(input, schema) {
-        if (!this.config.enableInputValidation) {
-            return { valid: true, errors: [] };
-        }
-        const errors = [];
-        // Basic validation - in production, use a proper validation library
-        if (schema.type === "string" && typeof input !== "string") {
-            errors.push("Expected string");
-        }
-        if (schema.maxLength &&
-            typeof input === "string" &&
-            input.length > schema.maxLength) {
-            errors.push(`String too long (max ${schema.maxLength})`);
-        }
-        if (schema.pattern &&
-            typeof input === "string" &&
-            !new RegExp(schema.pattern).test(input)) {
-            errors.push("String does not match required pattern");
-        }
-        return {
-            valid: errors.length === 0,
-            errors,
-        };
-    }
-    /**
-     * Check rate limiting
-     */
-    checkRateLimit(identifier, requests) {
-        if (!this.config.enableRateLimiting)
-            return true;
-        const now = Date.now();
-        const windowStart = now - this.config.rateLimitWindowMs;
-        const userRequests = requests.get(identifier) || [];
-        const recentRequests = userRequests.filter((time) => time > windowStart);
-        if (recentRequests.length >= this.config.rateLimitMaxRequests) {
-            return false;
-        }
-        recentRequests.push(now);
-        requests.set(identifier, recentRequests);
-        return true;
-    }
-    /**
-     * Log security events
-     */
-    logSecurityEvent(event) {
-        if (!this.config.enableAuditLogging)
-            return;
-        const logEntry = {
-            timestamp: new Date().toISOString(),
-            ...event,
-        };
-        // In production, this would write to secure audit logs
-    }
-}
-// Export singleton instance
-export const securityHardener = new SecurityHardener();

package/dist/security/security-hardening-system.d.ts

@@ -1,238 +0,0 @@
-/**
- * Security Hardening System
- *
- * Comprehensive security hardening implementation with OWASP compliance.
- * Implements defense-in-depth security architecture for enterprise applications.
- *
- * @since 2026-01-08
- */
-import { EventEmitter } from "events";
-import { IncomingMessage, ServerResponse } from "http";
-export declare const SECURITY_CONFIG: {
-    readonly headers: {
-        readonly "X-Content-Type-Options": "nosniff";
-        readonly "X-Frame-Options": "DENY";
-        readonly "X-XSS-Protection": "1; mode=block";
-        readonly "Strict-Transport-Security": "max-age=31536000; includeSubDomains";
-        readonly "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
-        readonly "Referrer-Policy": "strict-origin-when-cross-origin";
-        readonly "Permissions-Policy": "geolocation=(), microphone=(), camera=()";
-        readonly "Cross-Origin-Embedder-Policy": "require-corp";
-        readonly "Cross-Origin-Opener-Policy": "same-origin";
-        readonly "Cross-Origin-Resource-Policy": "same-origin";
-    };
-    readonly rateLimiting: {
-        readonly windowMs: number;
-        readonly maxRequests: 100;
-        readonly skipSuccessfulRequests: false;
-        readonly skipFailedRequests: false;
-    };
-    readonly inputValidation: {
-        readonly maxStringLength: 10000;
-        readonly maxArrayLength: 1000;
-        readonly maxObjectDepth: 10;
-        readonly allowedCharacters: RegExp;
-        readonly sqlInjectionPatterns: readonly [RegExp, RegExp];
-        readonly xssPatterns: readonly [RegExp, RegExp, RegExp, RegExp];
-    };
-    readonly encryption: {
-        readonly algorithm: "aes-256-gcm";
-        readonly keyLength: 32;
-        readonly ivLength: 16;
-        readonly saltRounds: 12;
-    };
-    readonly audit: {
-        readonly logLevel: "detailed";
-        readonly retentionDays: 90;
-        readonly sensitiveFields: readonly ["password", "token", "secret", "key", "authorization"];
-    };
-};
-export type SecurityEventType = "input_validation_failure" | "rate_limit_exceeded" | "authentication_failure" | "authorization_failure" | "suspicious_activity" | "sql_injection_attempt" | "xss_attempt" | "csrf_attempt" | "security_header_missing" | "encryption_failure" | "audit_log_failure";
-export type SecuritySeverity = "low" | "medium" | "high" | "critical";
-export interface SecurityEvent {
-    id: string;
-    type: SecurityEventType;
-    severity: SecuritySeverity;
-    message: string;
-    source: string;
-    userId?: string;
-    ipAddress?: string;
-    userAgent?: string;
-    timestamp: number;
-    metadata: Record<string, unknown>;
-    stackTrace?: string;
-}
-export interface ValidationResult {
-    isValid: boolean;
-    errors: string[];
-    sanitizedValue?: unknown;
-    securityEvents: SecurityEvent[];
-}
-export interface RateLimitEntry {
-    count: number;
-    resetTime: number;
-    lastRequest: number;
-}
-export interface SecurityMiddlewareOptions {
-    enableRateLimiting?: boolean;
-    enableInputValidation?: boolean;
-    enableSecurityHeaders?: boolean;
-    enableAuditLogging?: boolean;
-    enableCsrfProtection?: boolean;
-    enableHsts?: boolean;
-    customHeaders?: Record<string, string>;
-    trustedOrigins?: string[];
-    rateLimitOptions?: Partial<typeof SECURITY_CONFIG.rateLimiting>;
-}
-/**
- * Core security hardening system
- */
-export declare class SecurityHardeningSystem extends EventEmitter {
-    private rateLimitStore;
-    private securityEvents;
-    private encryptionKey;
-    private auditLogEnabled;
-    private started;
-    private pendingEncryptionKey;
-    private boundSecurityEvent;
-    private boundRateLimitExceeded;
-    private boundValidationFailure;
-    constructor(encryptionKey?: string);
-    start(): void;
-    /**
-     * Setup event handlers for security events
-     */
-    private setupEventHandlers;
-    destroy(): void;
-    /**
-     * Create security middleware for HTTP requests
-     */
-    createSecurityMiddleware(options?: SecurityMiddlewareOptions): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
-    /**
-     * Check rate limiting for requests
-     */
-    private checkRateLimit;
-    /**
-     * Apply security headers to response
-     */
-    private applySecurityHeaders;
-    /**
-     * Validate CSRF token
-     */
-    private validateCsrfToken;
-    /**
-     * Validate and sanitize input data
-     */
-    validateInput(input: unknown, context?: string): ValidationResult;
-    /**
-     * Validate string input
-     */
-    private validateString;
-    /**
-     * Validate object input
-     */
-    private validateObject;
-    /**
-     * Validate array input
-     */
-    private validateArray;
-    /**
-     * Check for security patterns in input
-     */
-    private checkSecurityPatterns;
-    /**
-     * Encrypt sensitive data using AES-256-GCM
-     * SECURITY: Proper encryption with random IV and authentication tag (H-001 fix)
-     *
-     * @param data - Plaintext data to encrypt
-     * @returns Base64-encoded string containing encrypted data + IV + auth tag
-     */
-    encryptData(data: string): string;
-    /**
-     * Decrypt sensitive data using AES-256-GCM
-     * SECURITY: Proper decryption with IV and auth tag verification (H-001 fix)
-     *
-     * @param encryptedData - Base64-encoded string containing encrypted data + IV + auth tag
-     * @returns Decrypted plaintext data
-     * @throws Error if decryption fails or authentication tag doesn't match
-     */
-    decryptData(encryptedData: string): string | null;
-    /**
-     * Hash password securely with unique salt
-     * SECURITY: Generates unique random salt for each password (H-003 fix)
-     */
-    hashPassword(password: string): Promise<{
-        hash: string;
-        salt: string;
-    }>;
-    /**
-     * Verify password hash
-     */
-    verifyPassword(password: string, hash: string, salt: string): Promise<boolean>;
-    /**
-     * Generate secure random token
-     */
-    generateSecureToken(length?: number): string;
-    /**
-     * Log audit event
-     */
-    private logAuditEvent;
-    /**
-     * Sanitize headers for audit logging
-     */
-    private sanitizeHeadersForAudit;
-    /**
-     * Emit security event
-     */
-    private emitSecurityEvent;
-    /**
-     * Handle security events
-     */
-    private handleSecurityEvent;
-    /**
-     * Handle rate limit exceeded
-     */
-    private handleRateLimitExceeded;
-    /**
-     * Handle validation failure
-     */
-    private handleValidationFailure;
-    /**
-     * Get client IP address
-     */
-    private getClientIP;
-    /**
-     * Get rate limit info for IP
-     */
-    private getRateLimitInfo;
-    /**
-     * Get object depth
-     */
-    private getObjectDepth;
-    /**
-     * Cleanup old rate limit entries
-     */
-    private cleanupRateLimitStore;
-    /**
-     * Get security events
-     */
-    getSecurityEvents(limit?: number): SecurityEvent[];
-    /**
-     * Clear security events
-     */
-    clearSecurityEvents(): void;
-    /**
-     * Get security statistics
-     */
-    getSecurityStats(): {
-        totalEvents: number;
-        eventsByType: Record<SecurityEventType, number>;
-        eventsBySeverity: Record<SecuritySeverity, number>;
-        recentEvents: SecurityEvent[];
-    };
-    /**
-     * Enable/disable audit logging
-     */
-    setAuditLogging(enabled: boolean): void;
-}
-export declare const securityHardeningSystem: SecurityHardeningSystem;