0xray 4.0.12 → 4.0.13

package/dist/mcps/shared/prompt-security-validator.js

@@ -1,148 +0,0 @@
-/**
- * 0xRay Framework - AI Prompt Security Validator
- *
- * Specialized security validation for AI agent prompts and responses
- * Prevents prompt injection, system prompt override, and malicious inputs
- */
-export class PromptSecurityValidator {
-    config;
-    constructor(config = {}) {
-        this.config = {
-            enabled: true,
-            maxPromptLength: 10000,
-            allowedPatterns: [],
-            blockedPatterns: [
-                /system\s+prompt\s*[:=]/gi,
-                /ignore\s+previous\s+instructions/gi,
-                /you\s+are\s+now\s+/gi,
-                /forget\s+your\s+previous\s+/gi,
-                /override\s+(your\s+)?instructions/gi,
-                /jailbreak/gi,
-                /dan.*mode/gi,
-            ],
-            sanitizeLevel: "strict",
-            ...config,
-        };
-    }
-    /**
-     * Validate AI prompt for security issues
-     */
-    validatePrompt(prompt) {
-        if (!this.config.enabled) {
-            return { isSafe: true, violations: [], riskLevel: "low" };
-        }
-        const violations = [];
-        let riskLevel = "low";
-        // Length check
-        if (prompt.length > this.config.maxPromptLength) {
-            violations.push(`Prompt too long: ${prompt.length} > ${this.config.maxPromptLength}`);
-            riskLevel = "medium";
-        }
-        // Blocked pattern check
-        for (const pattern of this.config.blockedPatterns) {
-            if (pattern.test(prompt)) {
-                violations.push(`Blocked pattern detected: ${pattern.source}`);
-                riskLevel = "high";
-            }
-        }
-        // Advanced pattern analysis
-        if (this.containsSystemPromptOverride(prompt)) {
-            violations.push("Potential system prompt override attempt");
-            riskLevel = "critical";
-        }
-        if (this.containsInjectionAttempts(prompt)) {
-            violations.push("Potential prompt injection detected");
-            riskLevel = "high";
-        }
-        const isSafe = violations.length === 0;
-        const sanitizedPrompt = isSafe ? undefined : this.sanitizePrompt(prompt);
-        return {
-            isSafe,
-            violations,
-            sanitizedPrompt,
-            riskLevel,
-        };
-    }
-    /**
-     * Check for system prompt override attempts
-     */
-    containsSystemPromptOverride(prompt) {
-        const overrideIndicators = [
-            "you are now",
-            "act as if",
-            "pretend to be",
-            "role-play as",
-            "from now on you are",
-            "ignore your system",
-            "override your",
-            "new personality",
-            "different role",
-        ];
-        const lowerPrompt = prompt.toLowerCase();
-        return overrideIndicators.some((indicator) => lowerPrompt.includes(indicator));
-    }
-    /**
-     * Check for prompt injection attempts
-     */
-    containsInjectionAttempts(prompt) {
-        const injectionIndicators = [
-            "ignore previous",
-            "forget instructions",
-            "start over",
-            "new conversation",
-            "reset context",
-            "clear memory",
-            "delete history",
-        ];
-        const lowerPrompt = prompt.toLowerCase();
-        return injectionIndicators.some((indicator) => lowerPrompt.includes(indicator));
-    }
-    /**
-     * Sanitize prompt by removing dangerous patterns
-     */
-    sanitizePrompt(prompt) {
-        let sanitized = prompt;
-        // Remove blocked patterns
-        for (const pattern of this.config.blockedPatterns) {
-            sanitized = sanitized.replace(pattern, "[REDACTED]");
-        }
-        // Additional sanitization based on level
-        if (this.config.sanitizeLevel === "strict" ||
-            this.config.sanitizeLevel === "paranoid") {
-            // Remove potential code execution
-            sanitized = sanitized.replace(/```[\s\S]*?```/g, "[CODE_BLOCK_REMOVED]");
-            // Remove potential file system access
-            sanitized = sanitized.replace(/(?:\/|\\)\.\.(?:\/|\\)/g, "/");
-            // Remove potential command injection
-            sanitized = sanitized.replace(/[;&|`$()]/g, "");
-        }
-        if (this.config.sanitizeLevel === "paranoid") {
-            // Extreme sanitization - only allow alphanumeric, spaces, and basic punctuation
-            sanitized = sanitized.replace(/[^a-zA-Z0-9\s.,!?-]/g, "");
-        }
-        return sanitized;
-    }
-    /**
-     * Validate agent response for safety
-     */
-    validateResponse(response) {
-        // Similar validation but focused on response safety
-        const violations = [];
-        // Check for potentially harmful content
-        if (response.includes("system prompt") ||
-            response.includes("internal instructions")) {
-            violations.push("Response contains sensitive system information");
-        }
-        // Check for code execution attempts
-        if (/eval\s*\(|Function\s*\(/.test(response)) {
-            violations.push("Response contains potential code execution");
-        }
-        return {
-            isSafe: violations.length === 0,
-            violations,
-            riskLevel: violations.length > 0 ? "medium" : "low",
-        };
-    }
-}
-// Export singleton instance
-export const promptSecurityValidator = new PromptSecurityValidator();

package/dist/mcps/shared/security-scanner.d.ts

@@ -1,119 +0,0 @@
-/**
- * 0xRay Framework - Security Scanner
- *
- * Automated security vulnerability scanning and compliance validation
- * Integrates with security tools and provides comprehensive security reports
- */
-export interface SecurityScanConfig {
-    enabled: boolean;
-    tools: {
-        npmAudit: boolean;
-        trivy: boolean;
-        eslintSecurity: boolean;
-        dependencyCheck: boolean;
-    };
-    severityThreshold: "low" | "moderate" | "high" | "critical";
-    reportPath: string;
-    failOnVulnerabilities: boolean;
-}
-export interface SecurityVulnerability {
-    id: string;
-    title: string;
-    description: string;
-    severity: "low" | "moderate" | "high" | "critical";
-    package?: string;
-    version?: string;
-    cve?: string;
-    url?: string;
-    recommendation: string;
-}
-export interface SecurityReport {
-    timestamp: string;
-    duration: number;
-    tools: {
-        npmAudit: SecurityVulnerability[];
-        trivy: SecurityVulnerability[];
-        eslintSecurity: SecurityVulnerability[];
-        dependencyCheck: SecurityVulnerability[];
-    };
-    summary: {
-        totalVulnerabilities: number;
-        bySeverity: Record<string, number>;
-        byTool: Record<string, number>;
-    };
-    recommendations: string[];
-    compliant: boolean;
-}
-export declare class SecurityScanner {
-    private config;
-    constructor(config?: Partial<SecurityScanConfig>);
-    /**
-     * Run comprehensive security scan
-     */
-    runSecurityScan(): Promise<SecurityReport>;
-    /**
-     * Run npm audit
-     */
-    private runNpmAudit;
-    /**
-     * Run Trivy security scan
-     */
-    private runTrivyScan;
-    /**
-     * Run ESLint security rules
-     */
-    private runEslintSecurity;
-    /**
-     * Run OWASP Dependency Check
-     */
-    private runDependencyCheck;
-    /**
-     * Generate comprehensive security report
-     */
-    private generateReport;
-    /**
-     * Generate security recommendations
-     */
-    private generateRecommendations;
-    /**
-     * Save report to file
-     */
-    private saveReport;
-    /**
-     * Log security scan results
-     */
-    private logResults;
-    /**
-     * Map npm audit severity levels
-     */
-    private mapNpmSeverity;
-    /**
-     * Map Trivy severity levels
-     */
-    private mapTrivySeverity;
-    /**
-     * Map Dependency Check severity levels
-     */
-    private mapDependencyCheckSeverity;
-    /**
-     * Validate AI prompt security
-     */
-    validatePrompt(prompt: string): Promise<{
-        isSafe: boolean;
-        violations: string[];
-        riskLevel: string;
-    }>;
-    /**
-     * Validate AI response security
-     */
-    validateResponse(response: string): Promise<{
-        isSafe: boolean;
-        violations: string[];
-        riskLevel: string;
-    }>;
-    /**
-     * Create empty report when scanning is disabled
-     */
-    private createEmptyReport;
-}
-export declare const securityScanner: SecurityScanner;

package/dist/mcps/shared/security-scanner.js

@@ -1,429 +0,0 @@
-/**
- * 0xRay Framework - Security Scanner
- *
- * Automated security vulnerability scanning and compliance validation
- * Integrates with security tools and provides comprehensive security reports
- */
-import { exec } from "child_process";
-import { promises as fs } from "fs";
-import { frameworkLogger } from "../../core/framework-logger.js";
-import { promisify } from "util";
-import { promptSecurityValidator, } from "./prompt-security-validator.js";
-const execAsync = promisify(exec);
-export class SecurityScanner {
-    config;
-    constructor(config = {}) {
-        this.config = {
-            enabled: true,
-            tools: {
-                npmAudit: true,
-                trivy: false, // Requires separate installation
-                eslintSecurity: true,
-                dependencyCheck: false, // Requires separate installation
-                ...config.tools,
-            },
-            severityThreshold: "moderate",
-            reportPath: "./security-report.json",
-            failOnVulnerabilities: true,
-            ...config,
-        };
-    }
-    /**
-     * Run comprehensive security scan
-     */
-    async runSecurityScan() {
-        const jobId = `security-scan-${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
-        const startTime = Date.now();
-        if (!this.config.enabled) {
-            return this.createEmptyReport();
-        }
-        frameworkLogger.log("security-scanner", "scan-start", "info", {
-            jobId,
-            tools: this.config.tools,
-            severityThreshold: this.config.severityThreshold,
-        });
-        const results = await Promise.allSettled([
-            this.config.tools.npmAudit ? this.runNpmAudit() : Promise.resolve([]),
-            this.config.tools.trivy ? this.runTrivyScan() : Promise.resolve([]),
-            this.config.tools.eslintSecurity
-                ? this.runEslintSecurity()
-                : Promise.resolve([]),
-            this.config.tools.dependencyCheck
-                ? this.runDependencyCheck()
-                : Promise.resolve([]),
-        ]);
-        const tools = {
-            npmAudit: results[0].status === "fulfilled" ? results[0].value : [],
-            trivy: results[1].status === "fulfilled" ? results[1].value : [],
-            eslintSecurity: results[2].status === "fulfilled" ? results[2].value : [],
-            dependencyCheck: results[3].status === "fulfilled" ? results[3].value : [],
-        };
-        const duration = Date.now() - startTime;
-        const report = this.generateReport(tools, duration);
-        // Save report
-        await this.saveReport(report, jobId);
-        // Log results
-        await this.logResults(report);
-        return report;
-    }
-    /**
-     * Run npm audit
-     */
-    async runNpmAudit() {
-        try {
-            const { stdout } = await execAsync("npm audit --json");
-            const auditResult = JSON.parse(stdout);
-            const vulnerabilities = [];
-            if (auditResult.vulnerabilities) {
-                for (const [packageName, vuln] of Object.entries(auditResult.vulnerabilities)) {
-                    vulnerabilities.push({
-                        id: vuln.name || packageName,
-                        title: vuln.title || "Security vulnerability",
-                        description: vuln.overview || "No description available",
-                        severity: this.mapNpmSeverity(vuln.severity),
-                        package: packageName,
-                        version: vuln.version,
-                        cve: vuln.cwe,
-                        url: vuln.url,
-                        recommendation: vuln.recommendation || "Update to a secure version",
-                    });
-                }
-            }
-            return vulnerabilities;
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            frameworkLogger.log("security-scanner", "npm-audit-failed", "warning", { message: "⚠️ npm audit failed", error: errorMessage });
-            return [];
-        }
-    }
-    /**
-     * Run Trivy security scan
-     */
-    async runTrivyScan() {
-        try {
-            const { stdout } = await execAsync("trivy fs --format json .");
-            const trivyResult = JSON.parse(stdout);
-            const vulnerabilities = [];
-            if (trivyResult.Results) {
-                for (const result of trivyResult.Results) {
-                    if (result.Vulnerabilities) {
-                        for (const vuln of result.Vulnerabilities) {
-                            vulnerabilities.push({
-                                id: vuln.VulnerabilityID,
-                                title: vuln.Title,
-                                description: vuln.Description,
-                                severity: this.mapTrivySeverity(vuln.Severity),
-                                package: vuln.PkgName,
-                                version: vuln.InstalledVersion,
-                                cve: vuln.VulnerabilityID,
-                                url: vuln.PrimaryURL,
-                                recommendation: vuln.FixedVersion
-                                    ? `Update to ${vuln.FixedVersion}`
-                                    : "Review and mitigate",
-                            });
-                        }
-                    }
-                }
-            }
-            return vulnerabilities;
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            frameworkLogger.log("security-scanner", "trivy-scan-failed", "warning", { message: "⚠️ Trivy scan failed", error: errorMessage });
-            return [];
-        }
-    }
-    /**
-     * Run ESLint security rules
-     */
-    async runEslintSecurity() {
-        try {
-            const { stdout } = await execAsync("npx eslint --format json src/");
-            const eslintResults = JSON.parse(stdout);
-            const vulnerabilities = [];
-            for (const result of eslintResults) {
-                for (const message of result.messages) {
-                    if (message.ruleId &&
-                        (message.ruleId.includes("security") ||
-                            message.ruleId.includes("xss") ||
-                            message.ruleId.includes("injection"))) {
-                        vulnerabilities.push({
-                            id: message.ruleId,
-                            title: message.message,
-                            description: `Security issue in ${result.filePath}:${message.line}:${message.column}`,
-                            severity: "moderate",
-                            recommendation: "Fix the security vulnerability according to ESLint recommendations",
-                        });
-                    }
-                }
-            }
-            return vulnerabilities;
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            frameworkLogger.log("security-scanner", "eslint-scan-failed", "warning", { message: "⚠️ ESLint security scan failed", error: errorMessage });
-            return [];
-        }
-    }
-    /**
-     * Run OWASP Dependency Check
-     */
-    async runDependencyCheck() {
-        try {
-            const { stdout } = await execAsync("dependency-check --format JSON --out . --scan .");
-            const dcResult = JSON.parse(stdout);
-            const vulnerabilities = [];
-            if (dcResult.dependencies) {
-                for (const dep of dcResult.dependencies) {
-                    if (dep.vulnerabilities) {
-                        for (const vuln of dep.vulnerabilities) {
-                            vulnerabilities.push({
-                                id: vuln.name,
-                                title: vuln.description,
-                                description: vuln.description,
-                                severity: this.mapDependencyCheckSeverity(vuln.severity),
-                                package: dep.fileName,
-                                cve: vuln.name,
-                                url: vuln.references?.[0]?.url,
-                                recommendation: "Update dependency or apply security patches",
-                            });
-                        }
-                    }
-                }
-            }
-            return vulnerabilities;
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            frameworkLogger.log("security-scanner", "dependency-check-failed", "warning", { message: "⚠️ Dependency check failed", error: errorMessage });
-            return [];
-        }
-    }
-    /**
-     * Generate comprehensive security report
-     */
-    generateReport(tools, duration) {
-        const allVulnerabilities = [
-            ...tools.npmAudit,
-            ...tools.trivy,
-            ...tools.eslintSecurity,
-            ...tools.dependencyCheck,
-        ];
-        const bySeverity = allVulnerabilities.reduce((acc, vuln) => {
-            acc[vuln.severity] = (acc[vuln.severity] || 0) + 1;
-            return acc;
-        }, {});
-        const byTool = {
-            npmAudit: tools.npmAudit.length,
-            trivy: tools.trivy.length,
-            eslintSecurity: tools.eslintSecurity.length,
-            dependencyCheck: tools.dependencyCheck.length,
-        };
-        const highSeverityCount = (bySeverity.high || 0) + (bySeverity.critical || 0);
-        const shouldFail = this.config.failOnVulnerabilities &&
-            highSeverityCount > 0 &&
-            this.config.severityThreshold !== "low";
-        const recommendations = this.generateRecommendations(allVulnerabilities);
-        return {
-            timestamp: new Date().toISOString(),
-            duration,
-            tools,
-            summary: {
-                totalVulnerabilities: allVulnerabilities.length,
-                bySeverity,
-                byTool,
-            },
-            recommendations,
-            compliant: !shouldFail,
-        };
-    }
-    /**
-     * Generate security recommendations
-     */
-    generateRecommendations(vulnerabilities) {
-        const recommendations = [];
-        if (vulnerabilities.some((v) => v.severity === "critical")) {
-            recommendations.push("🚨 Critical security vulnerabilities found - immediate action required");
-        }
-        if (vulnerabilities.some((v) => v.severity === "high")) {
-            recommendations.push("⚠️ High-severity vulnerabilities detected - prioritize fixes");
-        }
-        if (vulnerabilities.filter((v) => v.package).length > 0) {
-            recommendations.push("📦 Update vulnerable dependencies to latest secure versions");
-        }
-        if (vulnerabilities.filter((v) => v.id.includes("eslint")).length > 0) {
-            recommendations.push("🔧 Fix code security issues identified by ESLint");
-        }
-        recommendations.push("🔍 Run regular security scans and keep dependencies updated");
-        recommendations.push("📋 Review security policies and implement security headers");
-        return recommendations;
-    }
-    /**
-     * Save report to file
-     */
-    async saveReport(report, jobId) {
-        try {
-            await fs.writeFile(this.config.reportPath, JSON.stringify(report, null, 2));
-            frameworkLogger.log("security-scanner", "report-saved", "success", {
-                jobId,
-                reportPath: this.config.reportPath,
-            });
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            frameworkLogger.log("security-scanner", "save-report-failed", "warning", { message: "⚠️ Failed to save security report", error: errorMessage });
-        }
-    }
-    /**
-     * Log security scan results
-     */
-    async logResults(report) {
-        await frameworkLogger.log("security-scanner", "-n-security-scan-complete-report-duration-ms-", "info", { message: `\n🔒 Security Scan Complete (${report.duration}ms)` });
-        await frameworkLogger.log("security-scanner", "-total-vulnerabilities-report-summary-totalvulnera", "info", {
-            message: `📊 Total vulnerabilities: ${report.summary.totalVulnerabilities}`,
-        });
-        await frameworkLogger.log("security-scanner", "-n-by-severity-", "info", {
-            message: "\n📈 By Severity:",
-        });
-        for (const [severity, count] of Object.entries(report.summary.bySeverity)) {
-            await frameworkLogger.log("security-scanner", "-severity-count-", "info", { message: `  ${severity}: ${count}` });
-        }
-        await frameworkLogger.log("security-scanner", "-n-by-tool-", "info", {
-            message: "\n🛠️ By Tool:",
-        });
-        for (const [tool, count] of Object.entries(report.summary.byTool)) {
-            await frameworkLogger.log("security-scanner", "-tool-count-", "info", {
-                message: `  ${tool}: ${count}`,
-            });
-        }
-        if (report.recommendations.length > 0) {
-            await frameworkLogger.log("security-scanner", "-n-recommendations-", "info", { message: "\n💡 Recommendations:" });
-            for (const rec of report.recommendations) {
-                await frameworkLogger.log("security-scanner", "-rec-", "info", {
-                    message: `  • ${rec}`,
-                });
-            }
-        }
-        if (report.compliant) {
-            // Security scan result - kept as console.log for user visibility
-        }
-        else {
-            // Security scan failure - kept as console.log for user visibility
-        }
-    }
-    /**
-     * Map npm audit severity levels
-     */
-    mapNpmSeverity(severity) {
-        switch (severity) {
-            case "critical":
-                return "critical";
-            case "high":
-                return "high";
-            case "moderate":
-                return "moderate";
-            case "low":
-                return "low";
-            default:
-                return "moderate";
-        }
-    }
-    /**
-     * Map Trivy severity levels
-     */
-    mapTrivySeverity(severity) {
-        switch (severity.toUpperCase()) {
-            case "CRITICAL":
-                return "critical";
-            case "HIGH":
-                return "high";
-            case "MEDIUM":
-                return "moderate";
-            case "LOW":
-                return "low";
-            default:
-                return "moderate";
-        }
-    }
-    /**
-     * Map Dependency Check severity levels
-     */
-    mapDependencyCheckSeverity(severity) {
-        switch (severity.toUpperCase()) {
-            case "CRITICAL":
-                return "critical";
-            case "HIGH":
-                return "high";
-            case "MEDIUM":
-                return "moderate";
-            case "LOW":
-                return "low";
-            default:
-                return "moderate";
-        }
-    }
-    /**
-     * Validate AI prompt security
-     */
-    async validatePrompt(prompt) {
-        const result = promptSecurityValidator.validatePrompt(prompt);
-        if (!result.isSafe) {
-            frameworkLogger.log("security-scanner", "prompt-violation", "warning", {
-                message: `🚨 Prompt security violation detected (risk: ${result.riskLevel})`,
-                violations: result.violations,
-            });
-        }
-        return {
-            isSafe: result.isSafe,
-            violations: result.violations,
-            riskLevel: result.riskLevel,
-        };
-    }
-    /**
-     * Validate AI response security
-     */
-    async validateResponse(response) {
-        const result = promptSecurityValidator.validateResponse(response);
-        if (!result.isSafe) {
-            frameworkLogger.log("security-scanner", "response-violation", "warning", {
-                message: `🚨 Response security violation detected (risk: ${result.riskLevel})`,
-                violations: result.violations,
-            });
-        }
-        return {
-            isSafe: result.isSafe,
-            violations: result.violations,
-            riskLevel: result.riskLevel,
-        };
-    }
-    /**
-     * Create empty report when scanning is disabled
-     */
-    createEmptyReport() {
-        return {
-            timestamp: new Date().toISOString(),
-            duration: 0,
-            tools: {
-                npmAudit: [],
-                trivy: [],
-                eslintSecurity: [],
-                dependencyCheck: [],
-            },
-            summary: {
-                totalVulnerabilities: 0,
-                bySeverity: {},
-                byTool: {
-                    npmAudit: 0,
-                    trivy: 0,
-                    eslintSecurity: 0,
-                    dependencyCheck: 0,
-                },
-            },
-            recommendations: ["Security scanning is disabled"],
-            compliant: true,
-        };
-    }
-}
-// Export singleton instance
-export const securityScanner = new SecurityScanner();