@arcis/node 1.4.4 → 1.5.1

package/dist/sanitizers/index.mjs

@@ -65,8 +65,8 @@ var XSS_REMOVE_PATTERNS = [
   /** javascript: and vbscript: protocols (allow optional spaces before colon) */
   /javascript\s*:/gi,
   /vbscript\s*:/gi,
-  /** data: URIs with HTML/script content */
-  /data\s*:\s*text\/html[^>\s]*/gi,
+  /** data: URIs with HTML or SVG content (SVG can run JS via inline event handlers) */
+  /data\s*:\s*(?:text\/html|image\/svg)[^>\s]*/gi,
   /** form tag injection — phishing via action= redirection */
   /<form[\s>][^>]*/gi,
   /** meta tag injection — http-equiv refresh or CSP bypass */
@@ -591,6 +591,89 @@ function detectXxe(input) {
   return false;
 }
 
+// src/sanitizers/ldap.ts
+var LDAP_FILTER_CHARS = /[*()\\\x00]/g;
+var LDAP_DN_CHARS = /[,+<>;"=\/\\\x00*()\x00]/g;
+var LDAP_DETECT_PATTERN = /[*()\\\x00]/;
+var LDAP_INJECTION_PATTERN = /\)\s*\(|\*\s*\)\s*\(/;
+var escapeChar = (char) => "\\" + char.charCodeAt(0).toString(16).padStart(2, "0");
+function sanitizeLdapFilter(input) {
+  if (typeof input !== "string") return String(input);
+  return input.replace(LDAP_FILTER_CHARS, escapeChar);
+}
+function sanitizeLdapDn(input) {
+  if (typeof input !== "string") return String(input);
+  return input.replace(LDAP_DN_CHARS, escapeChar);
+}
+function detectLdapInjection(input) {
+  if (typeof input !== "string") return false;
+  return LDAP_DETECT_PATTERN.test(input) || LDAP_INJECTION_PATTERN.test(input);
+}
+
+// src/sanitizers/xpath.ts
+var XPATH_INJECTION_CHARS = /['"|,()]/;
+var XPATH_INJECTION_PATTERN = /('\s*(or|and)\s*'|"\s*(or|and)\s*"|\)\s*(or|and)\s*\(|\|\s*\/)/i;
+function detectXpathInjection(input) {
+  if (typeof input !== "string" || input.length === 0) return false;
+  if (!XPATH_INJECTION_CHARS.test(input)) return false;
+  return XPATH_INJECTION_PATTERN.test(input);
+}
+function sanitizeXpath(input) {
+  if (typeof input !== "string") return String(input);
+  return input.replace(/['"|,]/g, "");
+}
+
+// src/sanitizers/headers.ts
+var HEADER_INJECTION_PATTERN = /\r\n|\r|\n|\0/g;
+function sanitizeHeaderValue(input, collectThreats = false) {
+  if (typeof input !== "string") {
+    return collectThreats ? { value: String(input), wasSanitized: false, threats: [] } : String(input);
+  }
+  const threats = [];
+  let wasSanitized = false;
+  if (HEADER_INJECTION_PATTERN.test(input)) {
+    HEADER_INJECTION_PATTERN.lastIndex = 0;
+    wasSanitized = true;
+    if (collectThreats) {
+      const matches = input.match(HEADER_INJECTION_PATTERN);
+      if (matches) {
+        for (const match of matches) {
+          threats.push({
+            type: "header_injection",
+            pattern: HEADER_INJECTION_PATTERN.source,
+            original: match
+          });
+        }
+      }
+    }
+  }
+  HEADER_INJECTION_PATTERN.lastIndex = 0;
+  const value = input.replace(HEADER_INJECTION_PATTERN, "");
+  if (collectThreats) {
+    return { value, wasSanitized, threats };
+  }
+  return value;
+}
+function sanitizeHeaders(headers) {
+  if (!headers || typeof headers !== "object") {
+    return {};
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const sanitizedKey = sanitizeHeaderValue(String(key));
+    const sanitizedValue = sanitizeHeaderValue(String(value));
+    result[sanitizedKey] = sanitizedValue;
+  }
+  return result;
+}
+function detectHeaderInjection(input) {
+  if (typeof input !== "string") return false;
+  HEADER_INJECTION_PATTERN.lastIndex = 0;
+  return HEADER_INJECTION_PATTERN.test(input);
+}
+var sanitizeEmailHeader = sanitizeHeaderValue;
+var detectEmailHeaderInjection = detectHeaderInjection;
+
 // src/sanitizers/sanitize.ts
 function sanitizeString(value, options = {}) {
   if (typeof value !== "string") return value;
@@ -703,6 +786,15 @@ function scanThreats(data, depth = 0) {
   if (detectCommandInjection(data)) {
     return { vector: "command", rule: "command/match", matchedPattern: sample };
   }
+  if (detectLdapInjection(data)) {
+    return { vector: "ldap", rule: "ldap/match", matchedPattern: sample };
+  }
+  if (detectXpathInjection(data)) {
+    return { vector: "xpath", rule: "xpath/match", matchedPattern: sample };
+  }
+  if (detectHeaderInjection(data)) {
+    return { vector: "header", rule: "header/match", matchedPattern: sample };
+  }
   return null;
 }
 function createSanitizer(options = {}) {
@@ -837,55 +929,6 @@ function detectJsonpInjection(callback) {
   return false;
 }
 
-// src/sanitizers/headers.ts
-var HEADER_INJECTION_PATTERN = /\r\n|\r|\n|\0/g;
-function sanitizeHeaderValue(input, collectThreats = false) {
-  if (typeof input !== "string") {
-    return collectThreats ? { value: String(input), wasSanitized: false, threats: [] } : String(input);
-  }
-  const threats = [];
-  let wasSanitized = false;
-  if (HEADER_INJECTION_PATTERN.test(input)) {
-    HEADER_INJECTION_PATTERN.lastIndex = 0;
-    wasSanitized = true;
-    if (collectThreats) {
-      const matches = input.match(HEADER_INJECTION_PATTERN);
-      if (matches) {
-        for (const match of matches) {
-          threats.push({
-            type: "header_injection",
-            pattern: HEADER_INJECTION_PATTERN.source,
-            original: match
-          });
-        }
-      }
-    }
-  }
-  HEADER_INJECTION_PATTERN.lastIndex = 0;
-  const value = input.replace(HEADER_INJECTION_PATTERN, "");
-  if (collectThreats) {
-    return { value, wasSanitized, threats };
-  }
-  return value;
-}
-function sanitizeHeaders(headers) {
-  if (!headers || typeof headers !== "object") {
-    return {};
-  }
-  const result = {};
-  for (const [key, value] of Object.entries(headers)) {
-    const sanitizedKey = sanitizeHeaderValue(String(key));
-    const sanitizedValue = sanitizeHeaderValue(String(value));
-    result[sanitizedKey] = sanitizedValue;
-  }
-  return result;
-}
-function detectHeaderInjection(input) {
-  if (typeof input !== "string") return false;
-  HEADER_INJECTION_PATTERN.lastIndex = 0;
-  return HEADER_INJECTION_PATTERN.test(input);
-}
-
 // src/sanitizers/pii.ts
 var EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z]{2,})+/g;
 var PHONE_RE = /(?<!\d)(?:\+?1[-.\s]?)?\(?[2-9]\d{2}\)?[-.\s]?\d{3}[-.\s]?\d{4}(?!\d)/g;
@@ -1051,6 +1094,7 @@ function encodeForJs(value) {
   let result = "";
   for (const char of value) {
     const cp = char.codePointAt(0);
+    if (cp === void 0) continue;
     if (cp >= 48 && cp <= 57 || // 0-9
     cp >= 65 && cp <= 90 || // A-Z
     cp >= 97 && cp <= 122) {
@@ -1087,25 +1131,49 @@ function encodeForCss(value) {
   return result;
 }
 
-// src/sanitizers/ldap.ts
-var LDAP_FILTER_CHARS = /[*()\\\x00]/g;
-var LDAP_DN_CHARS = /[,+<>;"=\/\\\x00*()\x00]/g;
-var LDAP_DETECT_PATTERN = /[*()\\\x00]/;
-var LDAP_INJECTION_PATTERN = /\)\s*\(|\*\s*\)\s*\(/;
-var escapeChar = (char) => "\\" + char.charCodeAt(0).toString(16).padStart(2, "0");
-function sanitizeLdapFilter(input) {
-  if (typeof input !== "string") return String(input);
-  return input.replace(LDAP_FILTER_CHARS, escapeChar);
+// src/sanitizers/graphql.ts
+var DEFAULTS = {
+  maxDepth: 10,
+  maxLength: 1e4,
+  blockIntrospection: true
+};
+var INTROSPECTION_PATTERN = /\b__(schema|type|typeKind|directive)\b/;
+function computeDepth(query) {
+  let depth = 0;
+  let max = 0;
+  for (let i = 0; i < query.length; i++) {
+    const c = query.charCodeAt(i);
+    if (c === 123) {
+      depth++;
+      if (depth > max) max = depth;
+    } else if (c === 125) {
+      if (depth > 0) depth--;
+    }
+  }
+  return max;
 }
-function sanitizeLdapDn(input) {
-  if (typeof input !== "string") return String(input);
-  return input.replace(LDAP_DN_CHARS, escapeChar);
+function inspectGraphqlQuery(query, options = {}) {
+  const maxDepth = options.maxDepth ?? DEFAULTS.maxDepth;
+  const maxLength = options.maxLength ?? DEFAULTS.maxLength;
+  const blockIntrospection = options.blockIntrospection ?? DEFAULTS.blockIntrospection;
+  const length = query.length;
+  const depth = computeDepth(query);
+  if (depth > maxDepth) {
+    return { blocked: true, reason: "depth", depth, length };
+  }
+  if (blockIntrospection && INTROSPECTION_PATTERN.test(query)) {
+    return { blocked: true, reason: "introspection", depth, length };
+  }
+  if (length > maxLength) {
+    return { blocked: true, reason: "length", depth, length };
+  }
+  return { blocked: false, depth, length };
 }
-function detectLdapInjection(input) {
-  if (typeof input !== "string") return false;
-  return LDAP_DETECT_PATTERN.test(input) || LDAP_INJECTION_PATTERN.test(input);
+function detectGraphqlAbuse(query, options) {
+  if (typeof query !== "string" || query.length === 0) return false;
+  return inspectGraphqlQuery(query, options).blocked;
 }
 
-export { createSanitizer, detectCommandInjection, detectHeaderInjection, detectJsonpInjection, detectLdapInjection, detectNoSqlInjection, detectPathTraversal, detectPii, detectPrototypePollution, detectSql, detectSsti, detectXss, detectXxe, encodeForAttribute, encodeForCss, encodeForHtml, encodeForJs, encodeForUrl, encodeHtmlEntities, getDangerousOperators, getDangerousProtoKeys, isDangerousNoSqlKey, isDangerousProtoKey, isPlainObject, redactObjectPii, redactPii, sanitizeCommand, sanitizeHeaderValue, sanitizeHeaders, sanitizeJsonpCallback, sanitizeLdapDn, sanitizeLdapFilter, sanitizeObject, sanitizePath, sanitizeSql, sanitizeSsti, sanitizeString, sanitizeXss, sanitizeXxe, scanObjectPii, scanPii, scanThreats };
+export { createSanitizer, detectCommandInjection, detectEmailHeaderInjection, detectGraphqlAbuse, detectHeaderInjection, detectJsonpInjection, detectLdapInjection, detectNoSqlInjection, detectPathTraversal, detectPii, detectPrototypePollution, detectSql, detectSsti, detectXpathInjection, detectXss, detectXxe, encodeForAttribute, encodeForCss, encodeForHtml, encodeForJs, encodeForUrl, encodeHtmlEntities, getDangerousOperators, getDangerousProtoKeys, inspectGraphqlQuery, isDangerousNoSqlKey, isDangerousProtoKey, isPlainObject, redactObjectPii, redactPii, sanitizeCommand, sanitizeEmailHeader, sanitizeHeaderValue, sanitizeHeaders, sanitizeJsonpCallback, sanitizeLdapDn, sanitizeLdapFilter, sanitizeObject, sanitizePath, sanitizeSql, sanitizeSsti, sanitizeString, sanitizeXpath, sanitizeXss, sanitizeXxe, scanObjectPii, scanPii, scanThreats };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map