@chiranthmoger/fortifyjs 1.1.0

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Chiranth Janardhan Moger
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,186 @@
+<div align="center">
+
+# 🛡️ FortifyJS
+
+**The Zero-Dependency Web Application Firewall for Node.js**
+
+[![npm version](https://img.shields.io/npm/v/fortifyjs?color=blue&style=for-the-badge)](https://www.npmjs.com/package/fortifyjs)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg?style=for-the-badge)](https://opensource.org/licenses/MIT)
+[![TypeScript Ready](https://img.shields.io/badge/TypeScript-Ready-blue.svg?style=for-the-badge&logo=typescript)](https://www.typescriptlang.org/)
+[![Zero Dependencies](https://img.shields.io/badge/Dependencies-0-success.svg?style=for-the-badge)](https://www.npmjs.com/package/fortifyjs)
+
+*One-line protection against injection, XSS, CSRF, SSRF, and 10+ attack classes.*<br>
+*Replaces `helmet`, `cors`, `csurf`, and `express-rate-limit`.*
+
+</div>
+
+<hr>
+
+## 🚀 Why FortifyJS?
+
+Building secure Node.js applications used to mean juggling half a dozen middlewares, configuring complex rulesets, and hoping you didn't miss a critical vulnerability vector. 
+
+**Not anymore.** FortifyJS consolidates everything into a single, highly-optimized, zero-dependency engine.
+
+### 📉 What It Replaces
+
+| Legacy Package | FortifyJS Feature |
+| :--- | :--- |
+| 🐢 `helmet` | 🛡️ Security Headers Shield |
+| 🐢 `cors` | 🛡️ CORS Shield |
+| 🐢 `csurf` | 🛡️ CSRF Shield |
+| 🐢 `express-rate-limit` | 🛡️ Rate Limiting Shield |
+| 🐢 `express-mongo-sanitize` | 🛡️ NoSQLi Detector |
+| 🐢 `xss-clean` | 🛡️ XSS Detector |
+
+---
+
+## 📦 Quick Start
+
+```bash
+npm install fortifyjs
+```
+
+### ⚡ Express
+```javascript
+const express = require('express');
+const { shield } = require('fortifyjs');
+
+const app = express();
+app.use(shield('medium')); // That's it. You're protected.
+
+app.listen(3000, () => console.log('Server protected by FortifyJS 🛡️'));
+```
+
+### ⚡ Fastify
+```javascript
+const fastify = require('fastify')();
+const { fastifyPlugin } = require('fortifyjs/adapters/fastify');
+
+fastify.register(fastifyPlugin, { tier: 'medium' });
+fastify.listen({ port: 3000 });
+```
+
+---
+
+## 🛡️ The 4 Tiers of Protection
+
+FortifyJS provides predefined security profiles to match your application's risk profile. No complex configuration needed.
+
+| Tier | Detection Level | Headers | Rate Limit | CORS | CSRF | Bot Detection | Behavioral | File Upload | Dashboard |
+| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
+| **🟢 basic** | Balanced | ✅ | 100/15m | Same-origin | ❌ | Flag | Entropy | ❌ | ❌ |
+| **🟡 medium** | Balanced | ✅ | 200/15m | Same-origin | ❌ | Block | ✅ | ✅ | ❌ |
+| **🟠 hard** | Strict | ✅ | 100/15m | Same-origin | ✅ | Block | 5k reqs | ✅ | ❌ |
+| **🔴 advanced**| Strict | ✅ | 100/15m | Same-origin | ✅ | Block | 5k reqs | Scan | ✅ |
+
+---
+
+## 🔍 14 Advanced Detection Engines
+
+Under the hood, FortifyJS acts as a complete Web Application Firewall, actively analyzing payloads against 14 distinct attack vectors:
+
+1. 💉 **SQLi**: Identifies SQL injection attempts across popular SQL dialects.
+2. 🎭 **XSS**: Blocks cross-site scripting attacks including mutations and DOM-based vectors.
+3. 🍃 **NoSQLi**: Detects query operator injections tailored for MongoDB, CouchDB, and Elasticsearch.
+4. 💻 **CmdI**: Prevents operating system command injection across Unix and Windows platforms.
+5. 📂 **Path Traversal**: Stops directory traversal attempts aiming to read arbitrary files.
+6. 🌐 **SSRF**: Intercepts Server-Side Request Forgery attempts against internal infrastructure.
+7. 📄 **XXE**: Prevents XML External Entity processing attacks.
+8. 🧬 **Prototype Pollution**: Detects and stops JavaScript object prototype manipulation.
+9. 🔀 **HPP**: Mitigates HTTP Parameter Pollution vulnerabilities.
+10. ↪️ **Open Redirect**: Validates destination paths to prevent malicious redirection.
+11. ✂️ **CRLF**: Stops HTTP response splitting via carriage return and line feed characters.
+12. 🧩 **Template Injection**: Blocks server-side template injection (e.g., Jinja2, Twig, EJS).
+13. 📇 **LDAP Injection**: Identifies unauthorized LDAP query manipulation.
+14. 🕸️ **GraphQL Abuse**: Limits introspection, deep nesting, and alias batching.
+
+---
+
+## 🔌 Framework Support
+
+FortifyJS is framework-agnostic. We provide out-of-the-box adapters for the most popular Node.js web frameworks:
+
+<details>
+<summary><b>Koa</b></summary>
+
+```javascript
+const { koaMiddleware } = require('fortifyjs/adapters/koa');
+app.use(koaMiddleware({ tier: 'hard' }));
+```
+</details>
+
+<details>
+<summary><b>Hono</b></summary>
+
+```javascript
+import { honoMiddleware } from 'fortifyjs/adapters/hono';
+app.use('*', honoMiddleware({ tier: 'hard' }));
+```
+</details>
+
+<details>
+<summary><b>NestJS</b></summary>
+
+```typescript
+import { FortifyGuard } from 'fortifyjs/adapters/nestjs';
+@UseGuards(new FortifyGuard('hard'))
+export class AppController {}
+```
+</details>
+
+---
+
+## ⚙️ Advanced Configuration
+
+Need more control? You can easily override tier defaults by passing a configuration object.
+
+```javascript
+const { shield } = require('fortifyjs');
+
+app.use(shield('medium', {
+  cors: {
+    origin: ['https://myapp.com', 'https://admin.myapp.com']
+  },
+  rateLimit: {
+    max: 300,
+    windowMs: 10 * 60 * 1000
+  }
+}));
+```
+
+---
+
+## 🛠️ Offline CLI Testing
+
+FortifyJS includes a powerful command-line interface for testing payloads and scanning inputs offline in your CI/CD pipelines.
+
+Scan a specific string for malicious signatures:
+```bash
+fortifyjs scan "<test-input>"
+```
+
+Scan a file containing payloads and output results in CSV format:
+```bash
+fortifyjs scan-file payloads.txt --format csv
+```
+
+---
+
+## 📊 Security Dashboard
+
+The **Advanced tier** includes an interactive, built-in security dashboard for real-time monitoring of blocked requests, rate limits, and behavioral anomalies. 
+
+Served securely at `/admin/security` when enabled.
+
+---
+
+## 🤝 Contributing & License
+
+- 📖 Refer to [CONTRIBUTING.md](CONTRIBUTING.md) for development guidelines.
+- 🔒 Refer to [SECURITY.md](SECURITY.md) for reporting vulnerabilities.
+- 📜 FortifyJS is open-source software licensed under the [MIT License](LICENSE).
+
+<div align="center">
+  <i>Built with absolute security and zero bloat in mind.</i>
+</div>

package/bin/fortifyjs.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+const readline = require('readline');
+const util = require('util');
+const { DetectionEngine } = require('../src/index');
+
+const MAX_CLI_PAYLOAD_LENGTH = 50000;
+
+function printHelp() {
+  console.log(`
+fortifyjs (Heuristic Scanner)
+
+Usage:
+  fortifyjs scan <payload>              - Scan a single payload
+  fortifyjs scan-file <filepath>        - Scan a file with one payload per line
+  
+Options:
+  --format <json|csv>                    - Output format (default: json)
+`);
+}
+
+function csvCell(value) {
+  const text = String(value)
+    .replace(/\r/g, '\\r')
+    .replace(/\n/g, '\\n');
+  const formulaSafeText = /^[\t ]*[=+\-@]/.test(text) ? `'${text}` : text;
+  return `"${formulaSafeText.replace(/"/g, '""')}"`;
+}
+
+function payloadForOutput(payload) {
+  const text = String(payload);
+  if (text.length <= MAX_CLI_PAYLOAD_LENGTH) return text;
+  return `${text.slice(0, MAX_CLI_PAYLOAD_LENGTH)}...[truncated ${text.length - MAX_CLI_PAYLOAD_LENGTH} chars]`;
+}
+
+async function scanFile(filepath, format, detector) {
+  try {
+    await fs.promises.access(filepath, fs.constants.R_OK);
+  } catch (err) {
+    console.error(`Error: Failed to read file at ${filepath} (${err.message})`);
+    process.exit(1);
+  }
+
+  const stream = fs.createReadStream(filepath, { encoding: 'utf8' });
+  const lines = readline.createInterface({ input: stream, crlfDelay: Infinity });
+
+  if (format === 'csv') {
+    console.log('payload,label,confidence');
+  } else {
+    process.stdout.write('[\n');
+  }
+
+  let isFirstJsonRow = true;
+  try {
+    for await (const line of lines) {
+      if (line.trim().length === 0) continue;
+      const result = detector.detect(line);
+      const row = { payload: payloadForOutput(line), result };
+      if (format === 'csv') {
+        console.log(`${csvCell(row.payload)},${csvCell(result.label)},${result.confidence}`);
+      } else {
+        process.stdout.write(`${isFirstJsonRow ? '' : ',\n'}${JSON.stringify(row, null, 2)}`);
+        isFirstJsonRow = false;
+      }
+    }
+  } catch (err) {
+    console.error(`Error: Failed to read file at ${filepath} (${err.message})`);
+    process.exit(1);
+  }
+
+  if (format !== 'csv') {
+    process.stdout.write(isFirstJsonRow ? ']\n' : '\n]\n');
+  }
+}
+
+async function main() {
+  const { values, positionals } = util.parseArgs({ 
+    args: process.argv.slice(2), 
+    options: { 
+      format: { type: 'string', default: 'json' },
+      help: { type: 'boolean', short: 'h', default: false }
+    }, 
+    allowPositionals: true 
+  });
+  
+  if (values.help || positionals.length === 0) {
+    printHelp();
+    process.exit(0);
+  }
+  
+  const command = positionals[0];
+  const format = values.format;
+  const args = positionals; // For compatibility with rest of the code
+  
+  const detector = new DetectionEngine();
+  
+  if (command === 'scan') {
+    if (args.length < 2) {
+      console.error('Error: Missing payload string');
+      process.exit(1);
+    }
+    const payload = args.slice(1).join(' ');
+    const result = detector.detect(payload);
+    
+    if (format === 'csv') {
+      console.log('payload,label,confidence');
+      console.log(`${csvCell(payloadForOutput(payload))},${csvCell(result.label)},${result.confidence}`);
+    } else {
+      console.log(JSON.stringify({ payload: payloadForOutput(payload), result }, null, 2));
+    }
+    
+  } else if (command === 'scan-file') {
+    if (args.length < 2) {
+      console.error('Error: Missing filepath');
+      process.exit(1);
+    }
+    const filepath = path.resolve(args[1]);
+    
+    await scanFile(filepath, format, detector);
+    
+  } else {
+    console.error(`Unknown command: ${command}`);
+    printHelp();
+    process.exit(1);
+  }
+}
+
+main().catch(err => {
+  console.error(`Error: ${err.message}`);
+  process.exit(1);
+});
+
+

package/examples/fastify.js

@@ -0,0 +1,18 @@
+const fastify = require('fastify')({ logger: true });
+const { fastifyPlugin } = require('../src/index.js');
+
+fastify.register(fastifyPlugin, { tier: 'medium' });
+
+fastify.get('/', async (request, reply) => {
+  return { hello: 'world' };
+});
+
+const start = async () => {
+  try {
+    await fastify.listen({ port: 3000 });
+  } catch (err) {
+    fastify.log.error(err);
+    process.exit(1);
+  }
+};
+start();

package/examples/hono.js

@@ -0,0 +1,13 @@
+const { Hono } = require('hono');
+const { serve } = require('@hono/node-server');
+const { honoMiddleware } = require('../src/index.js');
+
+const app = new Hono();
+
+app.use('*', honoMiddleware({ tier: 'advanced' }));
+
+app.get('/', (c) => c.text('Hello Hono!'));
+
+serve({ fetch: app.fetch, port: 3000 }, (info) => {
+  console.log(`Listening on http://localhost:${info.port}`);
+});

package/examples/kitchen-sink.js

@@ -0,0 +1,50 @@
+const express = require('express');
+const { shield } = require('../src');
+
+const app = express();
+
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+
+// Enable all shields explicitly with hard preset options
+app.use(shield({
+  preset: 'hard',
+  shields: {
+    headers: true,
+    csrf: { cookieName: '_fortify_csrf_kitchen_sink', secret: 'supersecret_kitchen_sink' },
+    cors: { origin: 'http://localhost:3000' },
+    rateLimiter: { maxRequests: 50, windowMs: 60000 },
+    botDetector: { allowHeadless: false }
+  },
+  detectors: {
+    sqli: true,
+    xss: true,
+    nosqli: true,
+    cmdi: true,
+    pathTraversal: true,
+    ssrf: true,
+    xxe: true,
+    prototypePollution: true,
+    hpp: true,
+    openRedirect: true
+  },
+  behavioral: {
+    entropyThreshold: 4.0,
+    maxEncodingDepth: 2,
+    specialCharRatio: 0.5
+  },
+  action: 'block'
+}));
+
+app.post('/api/data', (req, res) => {
+  res.json({ message: 'Data received securely!' });
+});
+
+app.get('/', (req, res) => {
+  res.send('Kitchen Sink example running.');
+});
+
+const PORT = 3000;
+app.listen(PORT, () => {
+  console.log(`Kitchen sink server listening on port ${PORT}`);
+});

package/examples/koa.js

@@ -0,0 +1,14 @@
+const Koa = require('koa');
+const { koaMiddleware } = require('../src/index.js');
+
+const app = new Koa();
+
+app.use(koaMiddleware({ tier: 'basic' }));
+
+app.use(async ctx => {
+  ctx.body = 'Hello World';
+});
+
+app.listen(3000, () => {
+  console.log('Koa server listening on port 3000');
+});

package/examples/minimal-express.js

@@ -0,0 +1,13 @@
+'use strict';
+const express = require('express');
+const { shield } = require('../src/index');
+
+const app = express();
+
+app.use(shield('basic'));
+
+app.get('/', (req, res) => res.send('FortifyJS Protected'));
+
+if (require.main === module) {
+  app.listen(3000, () => console.log('Listening on port 3000'));
+}

package/examples/production-express.js

@@ -0,0 +1,20 @@
+'use strict';
+const express = require('express');
+const { shield } = require('../src/index');
+
+const app = express();
+
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+
+app.use(shield('hard', {
+  logRequests: true,
+  exposeLogs: true,
+  maxSuspiciousRequests: 2
+}));
+
+app.post('/api/data', (req, res) => res.json({ status: 'ok', received: req.body }));
+
+if (require.main === module) {
+  app.listen(3000, () => console.log('Listening on port 3000'));
+}

package/index.d.ts

@@ -0,0 +1,101 @@
+/// <reference types="node" />
+
+declare module 'fortifyjs' {
+  export type Tier = 'basic' | 'medium' | 'hard' | 'advanced';
+
+  export type DetectionLabel = 'sqli' | 'xss' | 'nosqli' | 'cmdi' | 'path-traversal' | 'ssrf' | 'xxe' | 'prototype-pollution' | 'hpp' | 'open-redirect' | 'crlf' | 'templateInjection' | 'ldap' | 'graphql' | 'benign' | 'anomaly' | string;
+  export type DetectorType = 'sqli' | 'xss' | 'nosqli' | 'cmdi' | 'path-traversal' | 'ssrf' | 'xxe' | 'prototype-pollution' | 'hpp' | 'open-redirect' | 'crlf' | 'templateInjection' | 'ldap' | 'graphql' | string;
+
+  export interface RateLimitOptions {
+    max?: number;
+    windowMs?: number;
+  }
+
+  export interface CorsOptions {
+    origin?: string | string[] | RegExp | ((origin: string, cb: (err: Error | null, allow?: boolean) => void) => void);
+    methods?: string | string[];
+    allowedHeaders?: string | string[];
+    exposedHeaders?: string | string[];
+    credentials?: boolean;
+    maxAge?: number;
+    optionsSuccessStatus?: number;
+  }
+
+  export interface CsrfOptions {
+    cookieName?: string;
+    cookieOptions?: {
+      httpOnly?: boolean;
+      secure?: boolean;
+      sameSite?: boolean | 'lax' | 'strict' | 'none';
+      path?: string;
+    };
+    ignoreMethods?: string[];
+  }
+
+  export interface BotDetectionOptions {
+    enabled?: boolean;
+    action?: 'flag' | 'block';
+    blockList?: string[];
+  }
+
+  export interface BehavioralOptions {
+    enabled?: boolean;
+    entropyOnly?: boolean;
+    learningRequests?: number;
+  }
+
+  export interface FileUploadOptions {
+    enabled?: boolean;
+    allowedExtensions?: string[];
+    blockedExtensions?: string[];
+    maxFilenameLength?: number;
+    blockDoubleExtensions?: boolean;
+    blockNullBytes?: boolean;
+    blockPathTraversal?: boolean;
+    blockDotFiles?: boolean;
+    validateMimeType?: boolean;
+    scanFilenameForInjection?: boolean;
+  }
+
+  export interface WhitelistOptions {
+    exact?: string[];
+    prefix?: string[];
+    pattern?: RegExp[];
+  }
+
+  export interface FortifyOptions {
+    tier?: Tier;
+    level?: 'strict' | 'balanced' | 'permissive';
+    headers?: boolean | Record<string, boolean | string>;
+    rateLimit?: boolean | RateLimitOptions;
+    cors?: boolean | CorsOptions;
+    csrf?: boolean | CsrfOptions;
+    botDetection?: boolean | BotDetectionOptions;
+    behavioral?: boolean | BehavioralOptions;
+    fileUpload?: boolean | FileUploadOptions;
+    dashboard?: boolean | { enabled?: boolean; path?: string };
+    whitelist?: WhitelistOptions;
+    mode?: 'input' | 'query';
+    logging?: { level?: 'silent' | 'error' | 'warn' | 'info' | 'debug'; format?: 'json' | 'text' };
+  }
+
+  export type ShieldOptions = FortifyOptions;
+
+  export function shield(tier?: Tier, overrides?: FortifyOptions): (req: any, res: any, next: any) => void;
+  export function shield(overrides?: FortifyOptions): (req: any, res: any, next: any) => void;
+
+  export function fastifyPlugin(fastify: any, options: FortifyOptions, done: () => void): void;
+  export function koaMiddleware(options?: FortifyOptions): (ctx: any, next: () => Promise<any>) => Promise<void>;
+  export function honoMiddleware(options?: FortifyOptions): (c: any, next: () => Promise<any>) => Promise<void>;
+  export function genericAdapter(options?: FortifyOptions): (req: any, res: any, next: any) => void;
+
+  export class DetectionEngine {
+    constructor(options?: any);
+    detect(payload: string, context?: { source?: 'query' | 'body' | 'header' | 'cookie' | 'path' | 'filename' | string; route?: string; [key: string]: any }): any;
+  }
+
+  export class Normalizer {
+    constructor(options?: any);
+    normalizePayload(payload: string | Buffer, options?: any): string;
+  }
+}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@chiranthmoger/fortifyjs",
+  "version": "1.1.0",
+  "description": "Complete web application firewall for Node.js. One-line protection against injection, XSS, CSRF, SSRF, and 10+ attack classes. Replaces helmet, cors, csurf, and express-rate-limit.",
+  "main": "src/index.js",
+  "types": "index.d.ts",
+  "bin": {
+    "fortifyjs": "bin/fortifyjs.js"
+  },
+  "keywords": [
+    "waf",
+    "firewall",
+    "security",
+    "middleware",
+    "sql-injection",
+    "xss",
+    "csrf",
+    "cors",
+    "ssrf",
+    "nosql-injection",
+    "command-injection",
+    "xxe",
+    "helmet",
+    "rate-limit",
+    "bot-detection",
+    "path-traversal",
+    "prototype-pollution",
+    "express",
+    "fastify",
+    "koa",
+    "hono",
+    "nestjs"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Chiranth-Janardhan-moger/fortifyjs.git"
+  },
+  "license": "MIT",
+  "files": [
+    "bin",
+    "src",
+    "examples",
+    "index.d.ts"
+  ],
+  "scripts": {
+    "test": "jest",
+    "benchmark": "node benchmarks/detection-speed.js && node benchmarks/throughput.js"
+  },
+  "devDependencies": {
+    "express": "^5.2.1",
+    "jest": "^30.4.2",
+    "supertest": "^7.2.2",
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "express": ">=4.18.0 || >=5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "express": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "bugs": {
+    "url": "https://github.com/Chiranth-Janardhan-moger/fortifyjs/issues"
+  },
+  "homepage": "https://github.com/Chiranth-Janardhan-moger/fortifyjs#readme"
+}