@arcis/node 1.3.0 → 1.4.0

package/dist/index.mjs

@@ -2838,12 +2838,14 @@ function getRequestToken(req, headerName, fieldName) {
   return void 0;
 }
 function csrfProtection(options = {}) {
-  const cookieName = options.cookieName ?? DEFAULTS.cookieName;
+  const baseCookieName = options.cookieName ?? DEFAULTS.cookieName;
+  const cookieName = options.useHostPrefix ? `__Host-${baseCookieName}` : baseCookieName;
   const headerName = options.headerName ?? DEFAULTS.headerName;
   const fieldName = options.fieldName ?? DEFAULTS.fieldName;
   const tokenLength = options.tokenLength ?? DEFAULTS.tokenLength;
   const protectedMethods = options.protectedMethods ?? [...DEFAULTS.protectedMethods];
   const excludePaths = options.excludePaths ?? [];
+  const skipCsrf = options.skipCsrf;
   const isProduction = process.env.NODE_ENV === "production";
   const cookieOpts = {
     path: options.cookie?.path ?? "/",
@@ -2863,6 +2865,9 @@ function csrfProtection(options = {}) {
   const protectedSet = new Set(protectedMethods.map((m) => m.toUpperCase()));
   return (req, res, next) => {
     const method = req.method.toUpperCase();
+    if (skipCsrf && skipCsrf(req)) {
+      return next();
+    }
     const requestPath = req.path || req.url;
     if (excludePaths.some((p) => requestPath === p || requestPath.startsWith(p + "/"))) {
       return next();
@@ -2919,6 +2924,54 @@ function escapeRegex(str) {
 }
 var createCsrf = csrfProtection;
 
+// src/middleware/hpp.ts
+function hpp(options = {}) {
+  const whitelist = new Set(options.whitelist ?? []);
+  const checkQuery = options.checkQuery ?? true;
+  const checkBody = options.checkBody ?? true;
+  return (req, _res, next) => {
+    if (checkQuery && req.query && typeof req.query === "object") {
+      const polluted = {};
+      const clean = {};
+      for (const [key, value] of Object.entries(req.query)) {
+        if (Array.isArray(value)) {
+          const strings = value.filter((v) => typeof v === "string");
+          if (whitelist.has(key)) {
+            clean[key] = strings;
+          } else {
+            polluted[key] = strings;
+            clean[key] = strings[strings.length - 1] ?? "";
+          }
+        } else {
+          clean[key] = value;
+        }
+      }
+      req.queryPolluted = polluted;
+      Object.defineProperty(req, "query", { value: clean, writable: true, configurable: true });
+    }
+    if (checkBody && req.body && typeof req.body === "object" && !Array.isArray(req.body)) {
+      const polluted = {};
+      const clean = {};
+      for (const [key, value] of Object.entries(req.body)) {
+        if (Array.isArray(value)) {
+          if (whitelist.has(key)) {
+            clean[key] = value;
+          } else {
+            polluted[key] = value;
+            clean[key] = value[value.length - 1];
+          }
+        } else {
+          clean[key] = value;
+        }
+      }
+      req.bodyPolluted = polluted;
+      Object.defineProperty(req, "body", { value: clean, writable: true, configurable: true });
+    }
+    next();
+  };
+}
+var createHpp = hpp;
+
 // src/utils/ip.ts
 var PLATFORM_HEADERS = {
   cloudflare: "cf-connecting-ip",
@@ -3039,7 +3092,7 @@ function fingerprint(req, options = {}) {
     components.push(`enc:${getHeader2(req, "accept-encoding")}`);
   }
   for (const c of custom) {
-    if (c != null) components.push(`custom:${c}`);
+    if (c !== null && c !== void 0) components.push(`custom:${c}`);
   }
   components.sort();
   const hash = createHash("sha256");
@@ -3182,6 +3235,6 @@ function createRedisStore(options) {
   return new RedisStore(options);
 }
 
-export { ArcisError, ValidationError as ArcisValidationError, BLOCKED, ERRORS, HEADERS, INPUT, InputTooLargeError, MemoryStore, RATE_LIMIT, REDACTION, RateLimitError, RedisStore, SanitizationError, SecurityThreatError, VALIDATION, arcis, arcisWithMethods as arcisFunction, botProtection, createCors, createCsrf, createErrorHandler, createHeaders, createRateLimiter, createRedactor, createRedisStore, createSafeLogger, createSanitizer, createSecureCookies, createSlidingWindowLimiter, createTokenBucketLimiter, createValidator, csrfProtection, main_default as default, detectBot, detectClientIp, detectCommandInjection, detectHeaderInjection, detectJsonpInjection, detectNoSqlInjection, detectPathTraversal, detectPii, detectPrototypePollution, detectSql, detectSsti, detectXss, detectXxe, encodeForAttribute, encodeForCss, encodeForHtml, encodeForJs, encodeForUrl, enforceSecureCookie, errorHandler, fingerprint, formatDuration, generateCsrfToken, isDangerousExtension, isDangerousNoSqlKey, isDangerousProtoKey, isPrivateIp, isRedirectSafe, isUrlSafe, isValidEmailSyntax, parseDuration, rateLimit, redactObjectPii, redactPii, safeCors, safeLog, sanitizeCommand, sanitizeFilename, sanitizeHeaderValue, sanitizeHeaders, sanitizeJsonpCallback, sanitizeObject, sanitizePath, sanitizeSql, sanitizeSsti, sanitizeString, sanitizeXss, sanitizeXxe, scanObjectPii, scanPii, secureCookieDefaults, securityHeaders, validate, validateCsrfToken, validateEmail, validateFile, validateRedirect, validateUrl, verifyEmailMx };
+export { ArcisError, ValidationError as ArcisValidationError, BLOCKED, ERRORS, HEADERS, INPUT, InputTooLargeError, MemoryStore, RATE_LIMIT, REDACTION, RateLimitError, RedisStore, SanitizationError, SecurityThreatError, VALIDATION, arcis, arcisWithMethods as arcisFunction, botProtection, createCors, createCsrf, createErrorHandler, createHeaders, createHpp, createRateLimiter, createRedactor, createRedisStore, createSafeLogger, createSanitizer, createSecureCookies, createSlidingWindowLimiter, createTokenBucketLimiter, createValidator, csrfProtection, main_default as default, detectBot, detectClientIp, detectCommandInjection, detectHeaderInjection, detectJsonpInjection, detectNoSqlInjection, detectPathTraversal, detectPii, detectPrototypePollution, detectSql, detectSsti, detectXss, detectXxe, encodeForAttribute, encodeForCss, encodeForHtml, encodeForJs, encodeForUrl, enforceSecureCookie, errorHandler, fingerprint, formatDuration, generateCsrfToken, hpp, isDangerousExtension, isDangerousNoSqlKey, isDangerousProtoKey, isPrivateIp, isRedirectSafe, isUrlSafe, isValidEmailSyntax, parseDuration, rateLimit, redactObjectPii, redactPii, safeCors, safeLog, sanitizeCommand, sanitizeFilename, sanitizeHeaderValue, sanitizeHeaders, sanitizeJsonpCallback, sanitizeObject, sanitizePath, sanitizeSql, sanitizeSsti, sanitizeString, sanitizeXss, sanitizeXxe, scanObjectPii, scanPii, secureCookieDefaults, securityHeaders, validate, validateCsrfToken, validateEmail, validateFile, validateRedirect, validateUrl, verifyEmailMx };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map