0xray 4.0.36 → 4.0.38

package/dist/security/security-auditor.d.ts

@@ -30,11 +30,15 @@ export interface SecurityAuditResult {
 export declare class SecurityAuditor {
     private readonly dangerousPatterns;
     private readonly dangerousImports;
+    private readonly compiledImports;
+    private textCache;
     /**
      * Run comprehensive security audit
      */
     auditProject(projectPath?: string): Promise<SecurityAuditResult>;
     private getAllFiles;
+    private visitNamed;
+    private readText;
     private shouldSkipDirectory;
     private shouldAuditFile;
     private auditFile;

package/dist/security/security-auditor.js

@@ -9,6 +9,20 @@
 import { readFileSync, readdirSync, statSync } from "fs";
 import { join } from "path";
 import { frameworkLogger } from "../core/framework-logger.js";
+const RECOMMENDATIONS = {
+    "code-injection": "Use static code analysis and avoid dynamic code execution",
+    "command-injection": "Validate and sanitize all user inputs, use parameterized commands",
+    "sql-injection": "Use parameterized queries or ORM with built-in protection",
+    "path-traversal": "Validate paths, use allowlists, resolve to absolute paths",
+    "hardcoded-secrets": "Use environment variables or secure credential management",
+    "weak-cryptography": "Use cryptographically secure random number generators",
+    "information-disclosure": "Avoid logging sensitive information, use proper log levels",
+    "input-validation": "Implement comprehensive input validation and sanitization",
+    deserialization: "Validate serialized data, use safe deserialization libraries",
+    "race-conditions": "Use proper synchronization primitives",
+    "dangerous-imports": "Review usage and implement proper access controls",
+    "file-permissions": "Restrict file permissions to minimum required access",
+};
 export class SecurityAuditor {
     dangerousPatterns = [
         // Code injection
@@ -17,18 +31,21 @@ export class SecurityAuditor {
             severity: "critical",
             category: "code-injection",
             cwe: "CWE-95",
+            hints: ["eval"],
         },
         {
             pattern: /Function\s*\(/g,
             severity: "critical",
             category: "code-injection",
             cwe: "CWE-95",
+            hints: ["Function"],
         },
         {
             pattern: /new\s+Function\s*\(/g,
             severity: "critical",
             category: "code-injection",
             cwe: "CWE-95",
+            hints: ["Function"],
         },
         // Command injection
         {
@@ -36,18 +53,21 @@ export class SecurityAuditor {
             severity: "high",
             category: "command-injection",
             cwe: "CWE-78",
+            hints: ["child_process"],
         },
         {
             pattern: /child_process\.spawn\s*\(/g,
             severity: "high",
             category: "command-injection",
             cwe: "CWE-78",
+            hints: ["child_process"],
         },
         {
             pattern: /execSync\s*\(/g,
             severity: "high",
             category: "command-injection",
             cwe: "CWE-78",
+            hints: ["execSync"],
         },
         // SQL injection (if applicable)
         {
@@ -55,12 +75,14 @@ export class SecurityAuditor {
             severity: "high",
             category: "sql-injection",
             cwe: "CWE-89",
+            hints: ["SELECT", "+"],
         },
         {
             pattern: /INSERT.*\+/g,
             severity: "high",
             category: "sql-injection",
             cwe: "CWE-89",
+            hints: ["INSERT", "+"],
         },
         // Path traversal
         {
@@ -68,12 +90,14 @@ export class SecurityAuditor {
             severity: "high",
             category: "path-traversal",
             cwe: "CWE-22",
+            hints: [".."],
         },
         {
             pattern: /path\.join\s*\(\s*\.\./g,
             severity: "high",
             category: "path-traversal",
             cwe: "CWE-22",
+            hints: ["path.join", ".."],
         },
         // Hardcoded secrets
         {
@@ -81,18 +105,21 @@ export class SecurityAuditor {
             severity: "high",
             category: "hardcoded-secrets",
             cwe: "CWE-798",
+            hints: ["password"],
         },
         {
             pattern: /api[_-]?key\s*[:=]\s*['"][^'"]*['"]/gi,
             severity: "high",
             category: "hardcoded-secrets",
             cwe: "CWE-798",
+            hints: ["api"],
         },
         {
             pattern: /secret\s*[:=]\s*['"][^'"]*['"]/gi,
             severity: "high",
             category: "hardcoded-secrets",
             cwe: "CWE-798",
+            hints: ["secret"],
         },
         // Insecure random
         {
@@ -100,6 +127,7 @@ export class SecurityAuditor {
             severity: "medium",
             category: "weak-cryptography",
             cwe: "CWE-338",
+            hints: ["Math.random"],
         },
         // Console logging sensitive data
         {
@@ -107,12 +135,14 @@ export class SecurityAuditor {
             severity: "medium",
             category: "information-disclosure",
             cwe: "CWE-532",
+            hints: ["console" + ".log", "password"],
         },
         {
             pattern: /console\.log\s*\([^)]*secret[^)]*\)/gi,
             severity: "medium",
             category: "information-disclosure",
             cwe: "CWE-532",
+            hints: ["console" + ".log", "secret"],
         },
         // Missing input validation
         {
@@ -120,12 +150,14 @@ export class SecurityAuditor {
             severity: "medium",
             category: "input-validation",
             cwe: "CWE-20",
+            hints: ["req.body"],
         },
         {
             pattern: /req\.query\./g,
             severity: "medium",
             category: "input-validation",
             cwe: "CWE-20",
+            hints: ["req.query"],
         },
         // Insecure deserialization
         {
@@ -133,6 +165,7 @@ export class SecurityAuditor {
             severity: "medium",
             category: "deserialization",
             cwe: "CWE-502",
+            hints: ["JSON.parse"],
         },
         // Race conditions
         {
@@ -140,6 +173,7 @@ export class SecurityAuditor {
             severity: "low",
             category: "race-conditions",
             cwe: "CWE-362",
+            hints: ["setTimeout", "0"],
         },
         // Information disclosure in errors
         {
@@ -147,6 +181,7 @@ export class SecurityAuditor {
             severity: "low",
             category: "information-disclosure",
             cwe: "CWE-209",
+            hints: ["throw", "error", "stack"],
         },
     ];
     dangerousImports = [
@@ -161,55 +196,97 @@ export class SecurityAuditor {
         "worker_threads",
         "vm",
     ];
+    compiledImports = this.dangerousImports.map((name) => ({
+        name,
+        patterns: [
+            new RegExp(`import.*from.*['"]${name}['"]`),
+            new RegExp(`require\\s*\\(\\s*['"]${name}['"]\\s*\\)`),
+            new RegExp(`import.*${name}`),
+        ],
+    }));
+    textCache;
     /**
      * Run comprehensive security audit
      */
     async auditProject(projectPath = ".") {
         const jobId = `security-audit-${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
         const issues = [];
-        const files = this.getAllFiles(projectPath);
-        frameworkLogger.log("security-auditor", "scan-start", "info", {
-            jobId,
-            filesCount: files.length,
-            projectPath,
-        });
-        for (const file of files) {
-            if (this.shouldAuditFile(file)) {
-                const fileIssues = await this.auditFile(file);
-                issues.push(...fileIssues);
+        this.textCache = new Map();
+        try {
+            const files = this.getAllFiles(projectPath);
+            frameworkLogger.log("security-auditor", "scan-start", "info", {
+                jobId,
+                filesCount: files.length,
+                projectPath,
+            });
+            for (const file of files) {
+                if (this.shouldAuditFile(file)) {
+                    const fileIssues = await this.auditFile(file);
+                    issues.push(...fileIssues);
+                }
             }
+            // Additional checks
+            issues.push(...this.auditPackageJson(projectPath));
+            issues.push(...this.auditConfiguration(projectPath));
+            issues.push(...this.auditDependencies(projectPath));
+            const summary = this.generateSummary(issues);
+            const score = this.calculateSecurityScore(issues, files.length);
+            return {
+                totalFiles: files.length,
+                issues,
+                summary,
+                score,
+            };
+        }
+        finally {
+            this.textCache = undefined;
         }
-        // Additional checks
-        issues.push(...this.auditPackageJson(projectPath));
-        issues.push(...this.auditConfiguration(projectPath));
-        issues.push(...this.auditDependencies(projectPath));
-        const summary = this.generateSummary(issues);
-        const score = this.calculateSecurityScore(issues, files.length);
-        return {
-            totalFiles: files.length,
-            issues,
-            summary,
-            score,
-        };
     }
     getAllFiles(dirPath) {
         const files = [];
         const traverse = (currentPath) => {
-            const items = readdirSync(currentPath);
-            for (const item of items) {
-                const fullPath = join(currentPath, item);
-                const stat = statSync(fullPath);
-                if (stat.isDirectory() && !this.shouldSkipDirectory(item)) {
-                    traverse(fullPath);
+            // Dirent already knows file vs directory. Stat names and symlinks so the target type matches statSync.
+            const entries = readdirSync(currentPath, { withFileTypes: true });
+            for (const entry of entries) {
+                if (typeof entry === "string") {
+                    this.visitNamed(currentPath, entry, files, traverse);
+                    continue;
                 }
-                else if (stat.isFile()) {
-                    files.push(fullPath);
+                const fullPath = join(currentPath, entry.name);
+                if (typeof entry.isSymbolicLink === "function" && entry.isSymbolicLink()) {
+                    this.visitNamed(currentPath, entry.name, files, traverse);
+                    continue;
                 }
+                if (entry.isDirectory()) {
+                    if (!this.shouldSkipDirectory(entry.name))
+                        traverse(fullPath);
+                    continue;
+                }
+                if (entry.isFile())
+                    files.push(fullPath);
             }
         };
         traverse(dirPath);
         return files;
     }
+    visitNamed(currentPath, name, files, traverse) {
+        const fullPath = join(currentPath, name);
+        const stat = statSync(fullPath);
+        if (stat.isDirectory() && !this.shouldSkipDirectory(name)) {
+            traverse(fullPath);
+        }
+        else if (stat.isFile()) {
+            files.push(fullPath);
+        }
+    }
+    readText(filePath) {
+        const cached = this.textCache?.get(filePath);
+        if (cached !== undefined)
+            return cached;
+        const text = readFileSync(filePath, "utf-8");
+        this.textCache?.set(filePath, text);
+        return text;
+    }
     shouldSkipDirectory(dirName) {
         const skipDirs = [
             "node_modules",
@@ -234,14 +311,30 @@ export class SecurityAuditor {
     async auditFile(filePath) {
         const issues = [];
         try {
-            const content = readFileSync(filePath, "utf-8");
+            const content = this.readText(filePath);
             const lines = content.split("\n");
             // Pattern-based security checks
             for (let i = 0; i < lines.length; i++) {
                 const line = lines[i];
                 const lineNumber = i + 1;
-                for (const { pattern, severity, category, cwe } of this
+                let folded;
+                for (const { pattern, severity, category, cwe, hints } of this
                     .dangerousPatterns) {
+                    // lastIndex carries across lines. Skip only when the search would start at 0 and a hint is absent.
+                    if (line && pattern.lastIndex === 0) {
+                        const hay = pattern.flags.includes("i")
+                            ? (folded ??= line.toLowerCase())
+                            : line;
+                        let miss = false;
+                        for (const hint of hints) {
+                            if (!hay.includes(hint)) {
+                                miss = true;
+                                break;
+                            }
+                        }
+                        if (miss)
+                            continue;
+                    }
                     const matches = line?.match(pattern);
                     if (matches && line) {
                         // Skip false positives in security validation and test code
@@ -304,19 +397,15 @@ export class SecurityAuditor {
     }
     auditImports(content, filePath) {
         const issues = [];
-        for (const dangerousImport of this.dangerousImports) {
-            const importPatterns = [
-                new RegExp(`import.*from.*['"]${dangerousImport}['"]`, "g"),
-                new RegExp(`require\\s*\\(\\s*['"]${dangerousImport}['"]\\s*\\)`, "g"),
-                new RegExp(`import.*${dangerousImport}`, "g"),
-            ];
-            for (const pattern of importPatterns) {
+        for (const { name, patterns } of this.compiledImports) {
+            for (const pattern of patterns) {
+                pattern.lastIndex = 0;
                 if (pattern.test(content)) {
                     issues.push({
                         severity: "medium",
                         category: "dangerous-imports",
                         file: filePath,
-                        description: `Potentially dangerous import detected: ${dangerousImport}`,
+                        description: `Potentially dangerous import detected: ${name}`,
                         recommendation: "Review usage and ensure proper sandboxing/validation",
                         cwe: "CWE-350",
                     });
@@ -363,7 +452,7 @@ export class SecurityAuditor {
         const issues = [];
         try {
             const packagePath = join(projectPath, "package.json");
-            const packageJson = JSON.parse(readFileSync(packagePath, "utf-8"));
+            const packageJson = JSON.parse(this.readText(packagePath));
             // Check for vulnerable dependencies
             const allDeps = {
                 ...packageJson.dependencies,
@@ -411,7 +500,7 @@ export class SecurityAuditor {
         for (const configFile of configFiles) {
             const configPath = join(projectPath, configFile);
             try {
-                const content = readFileSync(configPath, "utf-8");
+                const content = this.readText(configPath);
                 // Check for hardcoded secrets
                 const secretPatterns = [
                     /password\s*[:=]\s*['"][^'"]*['"]/gi,
@@ -462,21 +551,7 @@ export class SecurityAuditor {
         return issues;
     }
     getRecommendationForCategory(category) {
-        const recommendations = {
-            "code-injection": "Use static code analysis and avoid dynamic code execution",
-            "command-injection": "Validate and sanitize all user inputs, use parameterized commands",
-            "sql-injection": "Use parameterized queries or ORM with built-in protection",
-            "path-traversal": "Validate paths, use allowlists, resolve to absolute paths",
-            "hardcoded-secrets": "Use environment variables or secure credential management",
-            "weak-cryptography": "Use cryptographically secure random number generators",
-            "information-disclosure": "Avoid logging sensitive information, use proper log levels",
-            "input-validation": "Implement comprehensive input validation and sanitization",
-            deserialization: "Validate serialized data, use safe deserialization libraries",
-            "race-conditions": "Use proper synchronization primitives",
-            "dangerous-imports": "Review usage and implement proper access controls",
-            "file-permissions": "Restrict file permissions to minimum required access",
-        };
-        return (recommendations[category] ||
+        return (RECOMMENDATIONS[category] ||
             "Review and implement appropriate security measures");
     }
     generateSummary(issues) {

package/dist/security/security-hardener.d.ts

@@ -18,6 +18,7 @@ export interface SecurityHardeningConfig {
 }
 export declare class SecurityHardener {
     private config;
+    private readonly patternCache;
     constructor(config?: Partial<SecurityHardeningConfig>);
     /**
      * Apply security hardening based on audit results
@@ -44,6 +45,7 @@ export declare class SecurityHardener {
         valid: boolean;
         errors: string[];
     };
+    private regexFor;
     /**
      * Check rate limiting
      */

package/dist/security/security-hardener.js

@@ -9,6 +9,7 @@
 import { promises as fs } from "fs";
 export class SecurityHardener {
     config;
+    patternCache = new Map();
     constructor(config = {}) {
         this.config = {
             enableInputValidation: true,
@@ -127,7 +128,7 @@ export class SecurityHardener {
         }
         if (schema.pattern &&
             typeof input === "string" &&
-            !new RegExp(schema.pattern).test(input)) {
+            !this.regexFor(String(schema.pattern)).test(input)) {
             errors.push("String does not match required pattern");
         }
         return {
@@ -135,6 +136,16 @@ export class SecurityHardener {
             errors,
         };
     }
+    regexFor(source) {
+        const cached = this.patternCache.get(source);
+        if (cached) {
+            cached.lastIndex = 0;
+            return cached;
+        }
+        const compiled = new RegExp(source);
+        this.patternCache.set(source, compiled);
+        return compiled;
+    }
     /**
      * Check rate limiting
      */
@@ -143,13 +154,27 @@ export class SecurityHardener {
             return true;
         const now = Date.now();
         const windowStart = now - this.config.rateLimitWindowMs;
-        const userRequests = requests.get(identifier) || [];
-        const recentRequests = userRequests.filter((time) => time > windowStart);
-        if (recentRequests.length >= this.config.rateLimitMaxRequests) {
+        const userRequests = requests.get(identifier);
+        if (!userRequests) {
+            requests.set(identifier, [now]);
+            return true;
+        }
+        let recent = 0;
+        for (let i = 0; i < userRequests.length; i++) {
+            const time = userRequests[i];
+            if (time !== undefined && time > windowStart)
+                recent++;
+        }
+        if (recent >= this.config.rateLimitMaxRequests)
             return false;
+        let write = 0;
+        for (let i = 0; i < userRequests.length; i++) {
+            const time = userRequests[i];
+            if (time !== undefined && time > windowStart)
+                userRequests[write++] = time;
         }
-        recentRequests.push(now);
-        requests.set(identifier, recentRequests);
+        userRequests.length = write;
+        userRequests.push(now);
         return true;
     }
     /**

package/dist/security/security-headers.d.ts

@@ -34,11 +34,13 @@ export interface SecurityHeadersConfig {
 }
 export declare class SecurityHeadersMiddleware {
     private config;
+    private headerPairs;
     constructor(config?: Partial<SecurityHeadersConfig>);
     /**
      * Apply security headers to HTTP response
      */
     applySecurityHeaders(response: HttpResponse): void;
+    private rebuildHeaders;
     /**
      * Express.js middleware function
      */

package/dist/security/security-headers.js

@@ -9,6 +9,7 @@
 import { frameworkLogger } from "../core/framework-logger.js";
 export class SecurityHeadersMiddleware {
     config;
+    headerPairs = [];
     constructor(config = {}) {
         this.config = {
             enableCSP: true,
@@ -23,6 +24,7 @@ export class SecurityHeadersMiddleware {
             hstsPreload: false,
             ...config,
         };
+        this.rebuildHeaders();
     }
     /**
      * Apply security headers to HTTP response
@@ -32,14 +34,19 @@ export class SecurityHeadersMiddleware {
             frameworkLogger.log("security-headers", "invalid-response-object", "warning", { warning: "SecurityHeadersMiddleware: Invalid response object" });
             return;
         }
-        const headers = {};
-        // Content Security Policy
+        for (const [key, value] of this.headerPairs) {
+            response.setHeader(key, value);
+        }
+    }
+    rebuildHeaders() {
+        const headers = [];
         if (this.config.enableCSP) {
-            headers["Content-Security-Policy"] =
+            headers.push([
+                "Content-Security-Policy",
                 this.config.customCSP ||
-                    "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'";
+                    "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'",
+            ]);
         }
-        // HTTP Strict Transport Security
         if (this.config.enableHSTS) {
             let hstsValue = `max-age=${this.config.hstsMaxAge}`;
             if (this.config.hstsIncludeSubdomains) {
@@ -48,33 +55,27 @@ export class SecurityHeadersMiddleware {
             if (this.config.hstsPreload) {
                 hstsValue += "; preload";
             }
-            headers["Strict-Transport-Security"] = hstsValue;
+            headers.push(["Strict-Transport-Security", hstsValue]);
         }
-        // X-Frame-Options
         if (this.config.enableFrameOptions) {
-            headers["X-Frame-Options"] = "DENY";
+            headers.push(["X-Frame-Options", "DENY"]);
         }
-        // X-XSS-Protection
         if (this.config.enableXSSProtection) {
-            headers["X-XSS-Protection"] = "1; mode=block";
+            headers.push(["X-XSS-Protection", "1; mode=block"]);
         }
-        // X-Content-Type-Options
         if (this.config.enableContentTypeOptions) {
-            headers["X-Content-Type-Options"] = "nosniff";
+            headers.push(["X-Content-Type-Options", "nosniff"]);
         }
-        // Referrer-Policy
         if (this.config.enableReferrerPolicy) {
-            headers["Referrer-Policy"] = "strict-origin-when-cross-origin";
+            headers.push(["Referrer-Policy", "strict-origin-when-cross-origin"]);
         }
-        // Permissions-Policy
         if (this.config.enablePermissionsPolicy) {
-            headers["Permissions-Policy"] =
-                "geolocation=(), microphone=(), camera=()";
+            headers.push([
+                "Permissions-Policy",
+                "geolocation=(), microphone=(), camera=()",
+            ]);
         }
-        // Set headers on response
-        Object.entries(headers).forEach(([key, value]) => {
-            response.setHeader(key, value);
-        });
+        this.headerPairs = headers;
     }
     /**
      * Express.js middleware function
@@ -105,6 +106,7 @@ export class SecurityHeadersMiddleware {
      */
     updateConfig(newConfig) {
         this.config = { ...this.config, ...newConfig };
+        this.rebuildHeaders();
     }
     /**
      * Get current configuration

package/dist/security/security-scanner.js

@@ -243,16 +243,30 @@ export class SecurityScanner {
      */
     generateRecommendations(vulnerabilities) {
         const recommendations = [];
-        if (vulnerabilities.some((v) => v.severity === "critical")) {
+        let critical = false;
+        let high = false;
+        let packaged = false;
+        let eslint = false;
+        for (const vuln of vulnerabilities) {
+            if (vuln.severity === "critical")
+                critical = true;
+            else if (vuln.severity === "high")
+                high = true;
+            if (vuln.package)
+                packaged = true;
+            if (vuln.id.includes("eslint"))
+                eslint = true;
+        }
+        if (critical) {
             recommendations.push("🚨 Critical security vulnerabilities found - immediate action required");
         }
-        if (vulnerabilities.some((v) => v.severity === "high")) {
+        if (high) {
             recommendations.push("⚠️ High-severity vulnerabilities detected - prioritize fixes");
         }
-        if (vulnerabilities.filter((v) => v.package).length > 0) {
+        if (packaged) {
             recommendations.push("📦 Update vulnerable dependencies to latest secure versions");
         }
-        if (vulnerabilities.filter((v) => v.id.includes("eslint")).length > 0) {
+        if (eslint) {
             recommendations.push("🔧 Fix code security issues identified by ESLint");
         }
         recommendations.push("🔍 Run regular security scans and keep dependencies updated");

package/dist/session/session-cleanup-manager.d.ts

@@ -37,6 +37,8 @@ export declare class SessionCleanupManager {
     private cleanupInterval?;
     private _sessionMetadata?;
     private _metadataLoaded;
+    /** Same object the store holds, so a one-field write does not clone every session. */
+    private metadataRecord;
     private sessionMonitor;
     constructor(stateManager: XrayStateManager, config?: Partial<CleanupConfig>, sessionMonitor?: SessionMonitor);
     /**