@arcis/node 1.4.3 → 1.5.0

package/dist/sanitizers/encode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encode.d.ts","sourceRoot":"","sources":["../../src/sanitizers/encode.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAwBjD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAkBlD"}
+{"version":3,"file":"encode.d.ts","sourceRoot":"","sources":["../../src/sanitizers/encode.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBjD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAkBlD"}

package/dist/sanitizers/graphql.d.ts

@@ -0,0 +1,72 @@
+/**
+ * @module @arcis/node/sanitizers/graphql
+ * GraphQL injection prevention (sdk-vectors.md tier 1 #21).
+ *
+ * Two threats covered:
+ *
+ * 1. **Depth-bomb DoS** — nested-query payloads like
+ *    `query { x { x { x { ... } } } }` to ridiculous depth that explode
+ *    resolver work (each `{` typically maps to a database round-trip).
+ *    Even a 50-deep query against a real schema can hammer the
+ *    backend; 1000-deep crashes the resolver entirely.
+ *
+ * 2. **Introspection abuse** — `__schema` / `__type` / `__typename`
+ *    queries that let an attacker enumerate the entire schema, then
+ *    use that map to find sensitive fields, deprecated mutations,
+ *    or unprotected admin paths. Production GraphQL endpoints should
+ *    disable introspection by default.
+ *
+ * v1 is regex-based: count `{` / `}` for nesting depth (no escape
+ * handling — strings inside the query that contain `{` will
+ * over-count). False positives are an acceptable tradeoff for v1
+ * because (a) the depth threshold is well above legitimate query
+ * shapes, (b) a real GraphQL parser pulls in `graphql` as a runtime
+ * dep — significant for a sanitizer that ships in every Arcis
+ * install. Customers running queries near the threshold can either
+ * raise `maxDepth` or bring their own AST pre-pass.
+ *
+ * NOT included in v1:
+ * - Field-count limit (some servers have this; orthogonal to depth)
+ * - Alias-bomb detection (`q { f1: foo, f2: foo, ...}` — easier as
+ *   a length-check than a parse)
+ * - Variable rebinding attacks
+ *
+ * Each is a follow-up if customers ask. Documented inline.
+ */
+export interface GraphqlGuardOptions {
+    /** Maximum allowed nesting depth. Default: 10. Most legit queries are <8. */
+    maxDepth?: number;
+    /** Maximum query string length in characters. Default: 10000. */
+    maxLength?: number;
+    /**
+     * Block introspection queries (`__schema`, `__type`). Default: true.
+     * Set `false` in development if you rely on GraphiQL / Apollo
+     * Studio. Production should leave this on.
+     */
+    blockIntrospection?: boolean;
+}
+export type GraphqlViolation = 'depth' | 'length' | 'introspection';
+export interface GraphqlGuardResult {
+    /** True if the query violated any configured limit. */
+    blocked: boolean;
+    /** Which limit fired first (depth → introspection → length precedence). */
+    reason?: GraphqlViolation;
+    /** Observed nesting depth. Always returned, even on clean queries. */
+    depth: number;
+    /** Observed length. Always returned. */
+    length: number;
+}
+/**
+ * Inspect a GraphQL query against the configured limits. Returns a
+ * structured result; the middleware below uses this directly. Pure
+ * function — no I/O, no res handle.
+ */
+export declare function inspectGraphqlQuery(query: string, options?: GraphqlGuardOptions): GraphqlGuardResult;
+/**
+ * Detect-only API matching the rest of the sanitizer module surface
+ * (`detectXss` / `detectSql` / `detectXxe` / etc.). Returns a boolean
+ * for callers that just want a yes/no — use `inspectGraphqlQuery` if
+ * you need the structured reason.
+ */
+export declare function detectGraphqlAbuse(query: string, options?: GraphqlGuardOptions): boolean;
+//# sourceMappingURL=graphql.d.ts.map

package/dist/sanitizers/graphql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../../src/sanitizers/graphql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEpE,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AA2CD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CAwBpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAGT"}

package/dist/sanitizers/headers.d.ts

@@ -43,4 +43,22 @@ export declare function sanitizeHeaders(headers: Record<string, string>): Record
  * @returns True if header injection patterns detected
  */
 export declare function detectHeaderInjection(input: string): boolean;
+/**
+ * Email-header injection prevention. Same byte-level threat as HTTP
+ * header injection — `\r\n` in a user-controlled email field
+ * (`To`, `From`, `Subject`, etc.) lets an attacker inject extra headers
+ * (most commonly Bcc) and pivot a contact form into a spam relay.
+ *
+ * Aliased to the HTTP-header sanitizers because the wire-level fix is
+ * identical: strip CRLF + null bytes from the value before
+ * concatenating into the header. Use these in form-to-email handlers:
+ *
+ * ```ts
+ * const subject = sanitizeEmailHeader(req.body.subject);
+ * const to = sanitizeEmailHeader(req.body.to);
+ * if (detectEmailHeaderInjection(req.body.to)) reject(...);
+ * ```
+ */
+export declare const sanitizeEmailHeader: typeof sanitizeHeaderValue;
+export declare const detectEmailHeaderInjection: typeof detectHeaderInjection;
 //# sourceMappingURL=headers.d.ts.map

package/dist/sanitizers/headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/sanitizers/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,eAAe,CAAC;AAUhE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;AACnF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,GAAG,cAAc,CAAC;AAuCzF;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcvF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK5D"}
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/sanitizers/headers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,eAAe,CAAC;AAUhE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;AACnF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,GAAG,cAAc,CAAC;AAuCzF;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcvF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,4BAAsB,CAAC;AACvD,eAAO,MAAM,0BAA0B,8BAAwB,CAAC"}

package/dist/sanitizers/index.d.ts

@@ -2,7 +2,8 @@
  * @module @arcis/node/sanitizers
  * All sanitization functions for Arcis
  */
-export { sanitizeString, sanitizeObject, createSanitizer } from './sanitize';
+export { sanitizeString, sanitizeObject, createSanitizer, scanThreats } from './sanitize';
+export type { ThreatHit } from './sanitize';
 export { sanitizeXss, detectXss } from './xss';
 export { sanitizeSql, detectSql } from './sql';
 export { sanitizePath, detectPathTraversal } from './path';
@@ -12,9 +13,12 @@ export { isDangerousProtoKey, detectPrototypePollution, getDangerousProtoKeys }
 export { sanitizeSsti, detectSsti } from './ssti';
 export { sanitizeXxe, detectXxe } from './xxe';
 export { sanitizeJsonpCallback, detectJsonpInjection } from './jsonp';
-export { sanitizeHeaderValue, sanitizeHeaders, detectHeaderInjection } from './headers';
+export { sanitizeHeaderValue, sanitizeHeaders, detectHeaderInjection, sanitizeEmailHeader, detectEmailHeaderInjection, } from './headers';
 export { scanPii, detectPii, redactPii, scanObjectPii, redactObjectPii } from './pii';
 export { encodeForHtml, encodeForAttribute, encodeForJs, encodeForUrl, encodeForCss } from './encode';
 export { sanitizeLdapFilter, sanitizeLdapDn, detectLdapInjection } from './ldap';
+export { sanitizeXpath, detectXpathInjection } from './xpath';
+export { inspectGraphqlQuery, detectGraphqlAbuse, } from './graphql';
+export type { GraphqlGuardOptions, GraphqlGuardResult, GraphqlViolation, } from './graphql';
 export { encodeHtmlEntities, isPlainObject } from './utils';
 //# sourceMappingURL=index.d.ts.map

package/dist/sanitizers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sanitizers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAG3F,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGnG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGlD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAG/C,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAGtE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAGxF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAGtF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGtG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sanitizers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAG3F,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGnG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGlD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAG/C,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAGtE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAGtF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGtG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAGjF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAG9D,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC"}