@arcis/node 1.3.0 → 1.4.2

package/dist/validation/file.d.ts

@@ -0,0 +1,90 @@
+/**
+ * @module @arcis/node/validation/file
+ * File upload validation and filename sanitization
+ */
+/** File upload validation options */
+export interface ValidateFileOptions {
+    /** Maximum file size in bytes. Default: 5MB */
+    maxSize?: number;
+    /** Allowed MIME types (e.g., ['image/jpeg', 'image/png']) */
+    allowedTypes?: string[];
+    /** Allowed file extensions (e.g., ['.jpg', '.png']). Includes dot. */
+    allowedExtensions?: string[];
+    /** Block dangerous/executable extensions. Default: true */
+    blockExecutables?: boolean;
+    /** Validate magic bytes match the claimed MIME type. Default: true */
+    validateMagicBytes?: boolean;
+    /** Block files with no extension. Default: true */
+    blockNoExtension?: boolean;
+    /** Block double extensions (e.g., file.php.jpg). Default: true */
+    blockDoubleExtensions?: boolean;
+}
+/** File metadata for validation */
+export interface FileInput {
+    /** Original filename */
+    filename: string;
+    /** MIME type (as claimed by client) */
+    mimetype: string;
+    /** File size in bytes */
+    size: number;
+    /** File content buffer (for magic byte validation) */
+    buffer?: Buffer;
+}
+/** File validation result */
+export interface ValidateFileResult {
+    /** Whether the file passed validation */
+    valid: boolean;
+    /** Validation errors (empty if valid) */
+    errors: string[];
+    /** Sanitized filename (safe for storage) */
+    sanitizedFilename: string;
+}
+/**
+ * Sanitize a filename for safe storage.
+ *
+ * Strips path traversal, null bytes, control characters, and special characters.
+ * Preserves the extension and converts to a filesystem-safe name.
+ *
+ * @param filename - The original filename
+ * @returns A sanitized filename safe for storage
+ *
+ * @example
+ * sanitizeFilename('../../etc/passwd')          // 'etc_passwd'
+ * sanitizeFilename('file<name>.jpg')            // 'filename.jpg'
+ * sanitizeFilename('photo (1).jpg')             // 'photo_1.jpg'
+ * sanitizeFilename('.htaccess')                 // 'htaccess'
+ */
+export declare function sanitizeFilename(filename: string): string;
+/**
+ * Validate a file upload for security.
+ *
+ * Checks file size, MIME type, extension, magic bytes, and dangerous patterns.
+ * Returns a result with validation errors and a sanitized filename.
+ *
+ * @param file - File metadata and optional content
+ * @param options - Validation options
+ * @returns Validation result
+ *
+ * @example
+ * const result = validateFile(
+ *   { filename: 'photo.jpg', mimetype: 'image/jpeg', size: 1024, buffer },
+ *   { allowedTypes: ['image/jpeg', 'image/png'], maxSize: 2 * 1024 * 1024 }
+ * );
+ * if (!result.valid) {
+ *   return res.status(400).json({ errors: result.errors });
+ * }
+ * // Use result.sanitizedFilename for storage
+ *
+ * @example
+ * // Block executables only (no whitelist)
+ * const result = validateFile(file, { blockExecutables: true });
+ */
+export declare function validateFile(file: FileInput, options?: ValidateFileOptions): ValidateFileResult;
+/**
+ * Check if a file extension is considered dangerous/executable.
+ *
+ * @param filename - Filename or extension to check
+ * @returns true if the extension is dangerous
+ */
+export declare function isDangerousExtension(filename: string): boolean;
+//# sourceMappingURL=file.d.ts.map

package/dist/validation/file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/validation/file.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuDH,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kEAAkE;IAClE,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,yCAAyC;IACzC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4CAA4C;IAC5C,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAqCzD;AAmDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,EACf,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CA6DpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG9D"}

package/dist/validation/index.d.ts

@@ -1,3 +1,10 @@
-export { g as createValidator, i as isDangerousExtension, h as isRedirectSafe, j as isUrlSafe, k as isValidEmailSyntax, s as sanitizeFilename, v as validate, l as validateEmail, m as validateFile, n as validateRedirect, o as validateUrl, p as verifyEmailMx } from '../index-BGNKspqH.js';
-import 'express';
-import '../types-BOkx5YJc.js';
+/**
+ * @module @arcis/node/validation
+ * Request validation for Arcis
+ */
+export { validate, createValidator } from './schema';
+export { validateFile, sanitizeFilename, isDangerousExtension } from './file';
+export { validateUrl, isUrlSafe } from './url';
+export { validateRedirect, isRedirectSafe } from './redirect';
+export { validateEmail, verifyEmailMx, isValidEmailSyntax } from './email';
+//# sourceMappingURL=index.d.ts.map

package/dist/validation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC"}

package/dist/validation/index.js

@@ -31,7 +31,15 @@ var XSS_REMOVE_PATTERNS = [
   /javascript\s*:/gi,
   /vbscript\s*:/gi,
   /** data: URIs with HTML/script content */
-  /data\s*:\s*text\/html[^>\s]*/gi
+  /data\s*:\s*text\/html[^>\s]*/gi,
+  /** form tag injection — phishing via action= redirection */
+  /<form[\s>][^>]*/gi,
+  /** meta tag injection — http-equiv refresh or CSP bypass */
+  /<meta[\s>][^>]*/gi,
+  /** base href hijacking */
+  /<base[\s>][^>]*/gi,
+  /** link tag injection — stylesheet or preload attacks */
+  /<link[\s>][^>]*/gi
 ];
 var SQL_PATTERNS = [
   /** SQL keywords */
@@ -95,8 +103,8 @@ var COMMAND_PATTERNS = [
   /[;&|`]/g,
   /** Command substitution: $( ... ) — matched as a pair to reduce false positives */
   /\$\(/g,
-  /** URL-encoded newline/carriage-return injection (%0a, %0d) */
-  /%0[ad]/gi
+  /** URL-encoded control characters (%00-%0F): null, tab, vtab, formfeed, LF, CR */
+  /%0[0-9a-f]/gi
 ];
 var VALIDATION = {
   /**
@@ -261,26 +269,31 @@ function sanitizePath(input, collectThreats = false) {
   const threats = [];
   let value = input;
   let wasSanitized = false;
-  for (const pattern of PATH_PATTERNS) {
-    pattern.lastIndex = 0;
-    if (pattern.test(value)) {
+  value = value.normalize("NFKC");
+  let prev;
+  do {
+    prev = value;
+    for (const pattern of PATH_PATTERNS) {
       pattern.lastIndex = 0;
-      if (collectThreats) {
-        const matches = value.match(pattern);
-        if (matches) {
-          for (const match of matches) {
-            threats.push({
-              type: "path_traversal",
-              pattern: pattern.source,
-              original: match
-            });
+      if (pattern.test(value)) {
+        pattern.lastIndex = 0;
+        if (collectThreats) {
+          const matches = value.match(pattern);
+          if (matches) {
+            for (const match of matches) {
+              threats.push({
+                type: "path_traversal",
+                pattern: pattern.source,
+                original: match
+              });
+            }
           }
         }
+        value = value.replace(pattern, "");
+        wasSanitized = true;
       }
-      value = value.replace(pattern, "");
-      wasSanitized = true;
     }
-  }
+  } while (value !== prev);
   if (collectThreats) {
     return { value, wasSanitized, threats };
   }
@@ -338,7 +351,7 @@ function sanitizeString(value, options = {}) {
   if (value.length > maxSize) {
     throw new InputTooLargeError(maxSize, value.length);
   }
-  const reject = options.mode !== "sanitize";
+  const reject = options.mode === "reject";
   let result = value;
   if (options.sql !== false) {
     if (reject) {
@@ -793,8 +806,12 @@ function checkPrivateIp(hostname) {
   if (hostname === "metadata.google.internal" || hostname === "metadata.internal" || hostname === "metadata.azure.internal") {
     return "cloud metadata endpoint";
   }
-  const ipv6 = hostname.replace(/^\[|\]$/g, "");
-  if (ipv6 === "::1" || ipv6 === "::" || ipv6.startsWith("fc") || ipv6.startsWith("fd") || ipv6.startsWith("fe80")) {
+  let ipv6 = hostname.replace(/^\[|\]$/g, "");
+  const zoneIdx = ipv6.indexOf("%");
+  if (zoneIdx !== -1) {
+    ipv6 = ipv6.slice(0, zoneIdx);
+  }
+  if (ipv6 === "::1" || ipv6 === "::" || /^fc[0-9a-f]{2}:/i.test(ipv6) || /^fd[0-9a-f]{2}:/i.test(ipv6) || /^fe80:/i.test(ipv6) || /^ff[0-9a-f]{2}:/i.test(ipv6)) {
     return "private IPv6 address";
   }
   const mappedDotted = ipv6.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);