0xray 4.0.13 → 4.0.14

package/dist/security/security-hardener.js

@@ -0,0 +1,169 @@
+/**
+ * Security Hardening Module
+ *
+ * Implements additional security measures and hardening for the framework.
+ * Addresses vulnerabilities identified during security audit.
+ *
+ * @since 2026-01-07
+ */
+import { promises as fs } from "fs";
+export class SecurityHardener {
+    config;
+    constructor(config = {}) {
+        this.config = {
+            enableInputValidation: true,
+            enableRateLimiting: true,
+            enableAuditLogging: true,
+            enableSecureHeaders: true,
+            maxRequestSizeBytes: 1024 * 1024, // 1MB
+            rateLimitWindowMs: 60000, // 1 minute
+            rateLimitMaxRequests: 100,
+            ...config,
+        };
+    }
+    /**
+     * Apply security hardening based on audit results
+     */
+    async hardenSecurity(auditResult) {
+        const appliedFixes = [];
+        const remainingIssues = [];
+        for (const issue of auditResult.issues) {
+            const fix = await this.applyFixForIssue(issue);
+            if (fix.applied) {
+                appliedFixes.push(fix.description);
+            }
+            else {
+                remainingIssues.push(issue);
+            }
+        }
+        return { appliedFixes, remainingIssues };
+    }
+    async applyFixForIssue(issue) {
+        switch (issue.category) {
+            case "hardcoded-secrets":
+                return await this.fixHardcodedSecrets(issue);
+            case "file-permissions":
+                return await this.fixFilePermissions(issue);
+            case "dependency-management":
+                return await this.fixDependencyManagement(issue);
+            case "input-validation":
+                return await this.addInputValidation(issue);
+            default:
+                return {
+                    applied: false,
+                    description: `No automated fix available for ${issue.category}`,
+                };
+        }
+    }
+    async fixHardcodedSecrets(issue) {
+        // This would require manual intervention, but we can suggest the fix
+        return {
+            applied: false,
+            description: `Manual intervention required for hardcoded secrets in ${issue.file}`,
+        };
+    }
+    async fixFilePermissions(issue) {
+        try {
+            // Remove world-writable permissions
+            await fs.chmod(issue.file, 0o644);
+            return {
+                applied: true,
+                description: `Fixed file permissions for ${issue.file}`,
+            };
+        }
+        catch (error) {
+            return {
+                applied: false,
+                description: `Failed to fix permissions for ${issue.file}: ${error}`,
+            };
+        }
+    }
+    async fixDependencyManagement(issue) {
+        // This requires manual intervention for dependency updates
+        return {
+            applied: false,
+            description: `Manual intervention required for dependency management in ${issue.file}`,
+        };
+    }
+    async addInputValidation(issue) {
+        // This would require code analysis and modification
+        return {
+            applied: false,
+            description: `Code modification required for input validation in ${issue.file}`,
+        };
+    }
+    /**
+     * Add security headers to HTTP responses
+     */
+    addSecurityHeaders(headers) {
+        if (!this.config.enableSecureHeaders)
+            return headers;
+        return {
+            ...headers,
+            "X-Content-Type-Options": "nosniff",
+            "X-Frame-Options": "DENY",
+            "X-XSS-Protection": "1; mode=block",
+            "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
+            "Content-Security-Policy": "default-src 'self'",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        };
+    }
+    /**
+     * Validate input data
+     */
+    validateInput(input, schema) {
+        if (!this.config.enableInputValidation) {
+            return { valid: true, errors: [] };
+        }
+        const errors = [];
+        // Basic validation - in production, use a proper validation library
+        if (schema.type === "string" && typeof input !== "string") {
+            errors.push("Expected string");
+        }
+        if (schema.maxLength &&
+            typeof input === "string" &&
+            input.length > schema.maxLength) {
+            errors.push(`String too long (max ${schema.maxLength})`);
+        }
+        if (schema.pattern &&
+            typeof input === "string" &&
+            !new RegExp(schema.pattern).test(input)) {
+            errors.push("String does not match required pattern");
+        }
+        return {
+            valid: errors.length === 0,
+            errors,
+        };
+    }
+    /**
+     * Check rate limiting
+     */
+    checkRateLimit(identifier, requests) {
+        if (!this.config.enableRateLimiting)
+            return true;
+        const now = Date.now();
+        const windowStart = now - this.config.rateLimitWindowMs;
+        const userRequests = requests.get(identifier) || [];
+        const recentRequests = userRequests.filter((time) => time > windowStart);
+        if (recentRequests.length >= this.config.rateLimitMaxRequests) {
+            return false;
+        }
+        recentRequests.push(now);
+        requests.set(identifier, recentRequests);
+        return true;
+    }
+    /**
+     * Log security events
+     */
+    logSecurityEvent(event) {
+        if (!this.config.enableAuditLogging)
+            return;
+        const logEntry = {
+            timestamp: new Date().toISOString(),
+            ...event,
+        };
+        // In production, this would write to secure audit logs
+    }
+}
+// Export singleton instance
+export const securityHardener = new SecurityHardener();

package/dist/security/security-hardening-system.d.ts

@@ -0,0 +1,238 @@
+/**
+ * Security Hardening System
+ *
+ * Comprehensive security hardening implementation with OWASP compliance.
+ * Implements defense-in-depth security architecture for enterprise applications.
+ *
+ * @since 2026-01-08
+ */
+import { EventEmitter } from "events";
+import { IncomingMessage, ServerResponse } from "http";
+export declare const SECURITY_CONFIG: {
+    readonly headers: {
+        readonly "X-Content-Type-Options": "nosniff";
+        readonly "X-Frame-Options": "DENY";
+        readonly "X-XSS-Protection": "1; mode=block";
+        readonly "Strict-Transport-Security": "max-age=31536000; includeSubDomains";
+        readonly "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
+        readonly "Referrer-Policy": "strict-origin-when-cross-origin";
+        readonly "Permissions-Policy": "geolocation=(), microphone=(), camera=()";
+        readonly "Cross-Origin-Embedder-Policy": "require-corp";
+        readonly "Cross-Origin-Opener-Policy": "same-origin";
+        readonly "Cross-Origin-Resource-Policy": "same-origin";
+    };
+    readonly rateLimiting: {
+        readonly windowMs: number;
+        readonly maxRequests: 100;
+        readonly skipSuccessfulRequests: false;
+        readonly skipFailedRequests: false;
+    };
+    readonly inputValidation: {
+        readonly maxStringLength: 10000;
+        readonly maxArrayLength: 1000;
+        readonly maxObjectDepth: 10;
+        readonly allowedCharacters: RegExp;
+        readonly sqlInjectionPatterns: readonly [RegExp, RegExp];
+        readonly xssPatterns: readonly [RegExp, RegExp, RegExp, RegExp];
+    };
+    readonly encryption: {
+        readonly algorithm: "aes-256-gcm";
+        readonly keyLength: 32;
+        readonly ivLength: 16;
+        readonly saltRounds: 12;
+    };
+    readonly audit: {
+        readonly logLevel: "detailed";
+        readonly retentionDays: 90;
+        readonly sensitiveFields: readonly ["password", "token", "secret", "key", "authorization"];
+    };
+};
+export type SecurityEventType = "input_validation_failure" | "rate_limit_exceeded" | "authentication_failure" | "authorization_failure" | "suspicious_activity" | "sql_injection_attempt" | "xss_attempt" | "csrf_attempt" | "security_header_missing" | "encryption_failure" | "audit_log_failure";
+export type SecuritySeverity = "low" | "medium" | "high" | "critical";
+export interface SecurityEvent {
+    id: string;
+    type: SecurityEventType;
+    severity: SecuritySeverity;
+    message: string;
+    source: string;
+    userId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    timestamp: number;
+    metadata: Record<string, unknown>;
+    stackTrace?: string;
+}
+export interface ValidationResult {
+    isValid: boolean;
+    errors: string[];
+    sanitizedValue?: unknown;
+    securityEvents: SecurityEvent[];
+}
+export interface RateLimitEntry {
+    count: number;
+    resetTime: number;
+    lastRequest: number;
+}
+export interface SecurityMiddlewareOptions {
+    enableRateLimiting?: boolean;
+    enableInputValidation?: boolean;
+    enableSecurityHeaders?: boolean;
+    enableAuditLogging?: boolean;
+    enableCsrfProtection?: boolean;
+    enableHsts?: boolean;
+    customHeaders?: Record<string, string>;
+    trustedOrigins?: string[];
+    rateLimitOptions?: Partial<typeof SECURITY_CONFIG.rateLimiting>;
+}
+/**
+ * Core security hardening system
+ */
+export declare class SecurityHardeningSystem extends EventEmitter {
+    private rateLimitStore;
+    private securityEvents;
+    private encryptionKey;
+    private auditLogEnabled;
+    private started;
+    private pendingEncryptionKey;
+    private boundSecurityEvent;
+    private boundRateLimitExceeded;
+    private boundValidationFailure;
+    constructor(encryptionKey?: string);
+    start(): void;
+    /**
+     * Setup event handlers for security events
+     */
+    private setupEventHandlers;
+    destroy(): void;
+    /**
+     * Create security middleware for HTTP requests
+     */
+    createSecurityMiddleware(options?: SecurityMiddlewareOptions): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    /**
+     * Check rate limiting for requests
+     */
+    private checkRateLimit;
+    /**
+     * Apply security headers to response
+     */
+    private applySecurityHeaders;
+    /**
+     * Validate CSRF token
+     */
+    private validateCsrfToken;
+    /**
+     * Validate and sanitize input data
+     */
+    validateInput(input: unknown, context?: string): ValidationResult;
+    /**
+     * Validate string input
+     */
+    private validateString;
+    /**
+     * Validate object input
+     */
+    private validateObject;
+    /**
+     * Validate array input
+     */
+    private validateArray;
+    /**
+     * Check for security patterns in input
+     */
+    private checkSecurityPatterns;
+    /**
+     * Encrypt sensitive data using AES-256-GCM
+     * SECURITY: Proper encryption with random IV and authentication tag (H-001 fix)
+     *
+     * @param data - Plaintext data to encrypt
+     * @returns Base64-encoded string containing encrypted data + IV + auth tag
+     */
+    encryptData(data: string): string;
+    /**
+     * Decrypt sensitive data using AES-256-GCM
+     * SECURITY: Proper decryption with IV and auth tag verification (H-001 fix)
+     *
+     * @param encryptedData - Base64-encoded string containing encrypted data + IV + auth tag
+     * @returns Decrypted plaintext data
+     * @throws Error if decryption fails or authentication tag doesn't match
+     */
+    decryptData(encryptedData: string): string | null;
+    /**
+     * Hash password securely with unique salt
+     * SECURITY: Generates unique random salt for each password (H-003 fix)
+     */
+    hashPassword(password: string): Promise<{
+        hash: string;
+        salt: string;
+    }>;
+    /**
+     * Verify password hash
+     */
+    verifyPassword(password: string, hash: string, salt: string): Promise<boolean>;
+    /**
+     * Generate secure random token
+     */
+    generateSecureToken(length?: number): string;
+    /**
+     * Log audit event
+     */
+    private logAuditEvent;
+    /**
+     * Sanitize headers for audit logging
+     */
+    private sanitizeHeadersForAudit;
+    /**
+     * Emit security event
+     */
+    private emitSecurityEvent;
+    /**
+     * Handle security events
+     */
+    private handleSecurityEvent;
+    /**
+     * Handle rate limit exceeded
+     */
+    private handleRateLimitExceeded;
+    /**
+     * Handle validation failure
+     */
+    private handleValidationFailure;
+    /**
+     * Get client IP address
+     */
+    private getClientIP;
+    /**
+     * Get rate limit info for IP
+     */
+    private getRateLimitInfo;
+    /**
+     * Get object depth
+     */
+    private getObjectDepth;
+    /**
+     * Cleanup old rate limit entries
+     */
+    private cleanupRateLimitStore;
+    /**
+     * Get security events
+     */
+    getSecurityEvents(limit?: number): SecurityEvent[];
+    /**
+     * Clear security events
+     */
+    clearSecurityEvents(): void;
+    /**
+     * Get security statistics
+     */
+    getSecurityStats(): {
+        totalEvents: number;
+        eventsByType: Record<SecurityEventType, number>;
+        eventsBySeverity: Record<SecuritySeverity, number>;
+        recentEvents: SecurityEvent[];
+    };
+    /**
+     * Enable/disable audit logging
+     */
+    setAuditLogging(enabled: boolean): void;
+}
+export declare const securityHardeningSystem: SecurityHardeningSystem;