@chiranthmoger/fortifyjs 1.1.0 → 1.1.1

package/src/adapters/express.js

@@ -823,11 +823,16 @@ function expressMiddleware(options = {}) {
 
     if (schemaResult) {
       const attack = reportDetection(schemaResult.payload, schemaResult.detection);
-      if (!dryRun) return res.status(blockStatus).json({
-        error: 'Forbidden',
-        message: 'Malicious payload detected by fortifyjs',
-        details: { label: attack.label }
-      });
+      if (!dryRun) {
+        if (typeof options.onBlocked === 'function') {
+          return options.onBlocked(req, res, attack);
+        }
+        return res.status(blockStatus).json({
+          error: 'Forbidden',
+          message: 'Malicious payload detected by fortifyjs',
+          details: { label: attack.label }
+        });
+      }
     }
 
     const sources = [];
@@ -858,11 +863,16 @@ function expressMiddleware(options = {}) {
         reason: 'source_read_failed',
         matches: [{ id: 'source-read-failed', label: 'dos', confidence: 1 }]
       });
-      if (!dryRun) return res.status(blockStatus).json({
-        error: 'Forbidden',
-        message: 'Malicious payload detected by fortifyjs',
-        details: { label: attack.label }
-      });
+      if (!dryRun) {
+        if (typeof options.onBlocked === 'function') {
+          return options.onBlocked(req, res, attack);
+        }
+        return res.status(blockStatus).json({
+          error: 'Forbidden',
+          message: 'Malicious payload detected by fortifyjs',
+          details: { label: attack.label }
+        });
+      }
     }
 
     for (const [sourceName, source] of sources) {
@@ -871,19 +881,24 @@ function expressMiddleware(options = {}) {
       
       let attack = false;
       if (Buffer.isBuffer(source)) {
-         attack = await scanString(source.toString('utf8'), sourceName);
-      } else if (typeof source === 'string') {
-         attack = await scanString(source, sourceName);
-      } else if (typeof source === 'object') {
-         attack = await deepScan(source, sourceName);
-      }
+         attack = await scanString(source.toString('utf8'), sourceName);
+      } else if (typeof source === 'string') {
+         attack = await scanString(source, sourceName);
+      } else if (typeof source === 'object') {
+         attack = await deepScan(source, sourceName);
+      }
 
       if (attack) {
-        if (!dryRun) return res.status(blockStatus).json({
-          error: 'Forbidden',
-          message: 'Malicious payload detected by fortifyjs',
-          details: { label: attack.label }
-        });
+        if (!dryRun) {
+          if (typeof options.onBlocked === 'function') {
+            return options.onBlocked(req, res, attack);
+          }
+          return res.status(blockStatus).json({
+            error: 'Forbidden',
+            message: 'Malicious payload detected by fortifyjs',
+            details: { label: attack.label }
+          });
+        }
       }
       scannedSources.add(sourceName);
     }

package/src/core/engine.js

@@ -10,6 +10,7 @@ const nosqliDetector = require('../detectors/nosqli');
 const cmdiDetector = require('../detectors/cmdi');
 const pathTraversalDetector = require('../detectors/path-traversal');
 const ssrfDetector = require('../detectors/ssrf');
+const { isPrivateIpv4Number } = require('../detectors/ssrf');
 const xxeDetector = require('../detectors/xxe');
 const prototypePollutionDetector = require('../detectors/prototype-pollution');
 const hppDetector = require('../detectors/hpp');
@@ -18,6 +19,63 @@ const crlfDetector = require('../detectors/crlf');
 const templateInjectionDetector = require('../detectors/template-injection');
 const ldapDetector = require('../detectors/ldap');
 const graphqlDetector = require('../detectors/graphql');
+const promptInjectionDetector = require('../detectors/prompt-injection');
+
+const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+const EMAIL_REGEX = /^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$/;
+const ATOMIC_IDENTIFIER_REGEX = /^[a-zA-Z0-9_-]{1,64}$/;
+const NUMERIC_REGEX = /^-?\d+(?:\.\d+)?$/;
+
+const DANGEROUS_ATOMIC_IDENTIFIERS = new Set([
+  'SELECT', 'UNION', 'DROP', 'DELETE', 'INSERT', 'UPDATE', 'EXEC',
+  'TRUNCATE', 'ALTER', 'CREATE', 'MERGE', 'GRANT', 'REVOKE',
+  '__PROTO__', 'CONSTRUCTOR', 'PROTOTYPE',
+  '__SCHEMA', '__TYPE', '__TYPENAME',
+  'INFORMATION_SCHEMA', 'SQLITE_MASTER', 'SYSOBJECTS',
+  'LOCALHOST', 'SCRIPT', 'JAVASCRIPT', 'ALERT', 'EVAL'
+]);
+
+function isTriviallySafe(payload) {
+  if (typeof payload === 'number' || typeof payload === 'boolean') return true;
+  if (typeof payload !== 'string') return false;
+  if (payload.length === 0) return true;
+  if (payload.length > 128) return false;
+
+  // Single word identifier / slug
+  if (ATOMIC_IDENTIFIER_REGEX.test(payload)) {
+    const upper = payload.toUpperCase();
+    if (DANGEROUS_ATOMIC_IDENTIFIERS.has(upper)) {
+      return false;
+    }
+    // Check if hex integer (e.g. 0x7f000001)
+    if (/^0x[0-9a-fA-F]+$/i.test(payload)) {
+      return false;
+    }
+    // Check if decimal IP representation in private range
+    if (/^\d{8,10}$/.test(payload)) {
+      const num = Number(payload);
+      if (Number.isFinite(num) && isPrivateIpv4Number(num)) return false;
+    }
+    return true;
+  }
+
+  // Pure numeric
+  if (NUMERIC_REGEX.test(payload)) {
+    if (/^\d{8,10}$/.test(payload)) {
+      const num = Number(payload);
+      if (Number.isFinite(num) && isPrivateIpv4Number(num)) return false;
+    }
+    return true;
+  }
+
+  // Standard UUID
+  if (payload.length === 36 && UUID_REGEX.test(payload)) return true;
+
+  // Standard Email
+  if (payload.includes('@') && EMAIL_REGEX.test(payload)) return true;
+
+  return false;
+}
 
 function classifyInputType(payload) {
   const str = String(payload).trim();
@@ -52,7 +110,8 @@ class DetectionEngine {
       crlfDetector,
       templateInjectionDetector,
       ldapDetector,
-      graphqlDetector
+      graphqlDetector,
+      promptInjectionDetector
     ];
     this.behavioralAnalyzer = new BehavioralAnalyzer(options.behavioral || {});
     this.whitelist = new Whitelist();
@@ -73,6 +132,9 @@ class DetectionEngine {
     if (this.whitelist.isWhitelisted(payload)) {
       return { label: 'benign', confidence: 0, whitelisted: true };
     }
+    if (this.detectors.length === 15 && this.options.fastPath !== false && isTriviallySafe(payload) && !context.source && this.options.mode !== 'query') {
+      return { label: 'benign', confidence: 0, scores: {}, matches: [], fastPath: true };
+    }
     const variants = Normalizer.payloadVariants(payload, this.options);
     let allMatches = [];
     let maxConfidence = 0;

package/src/core/normalizer.js

@@ -68,9 +68,9 @@ class Normalizer {
         .replace(/\\x([0-9a-fA-F]{2})/g, decodeCodePoint)
         .replace(/&#x([0-9a-fA-F]+);?|&#(\d+);?/g, decodeEntity)
         .replace(NAMED_ENTITY_PATTERN, (match, name) => NAMED_ENTITIES[name.toLowerCase()] ?? match)
-        .replace(/[\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]/g, ' ')
+        .replace(/[\x0B\x0C\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]/g, ' ')
         .replace(/[\u200b-\u200d\ufeff]/g, '')
-        .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
+        .replace(/[\x00-\x08\x0E-\x1F\x7F]/g, '');
       try {
         normalized = normalized.normalize('NFKC');
       } catch (e) {}

package/src/core/sinks.js

@@ -0,0 +1,214 @@
+'use strict';
+
+const path = require('path');
+const { DetectionEngine } = require('./engine');
+const { isPrivateIP } = require('../detectors/ssrf');
+const { scanPrompt, assertSafePrompt, FortifyPromptError } = require('../shields/llm-guard');
+
+class FortifySinkError extends Error {
+  constructor(message, sinkType, result = null) {
+    super(`FortifyJS Sink Violation [${sinkType}]: ${message}`);
+    this.name = 'FortifySinkError';
+    this.sinkType = sinkType;
+    this.status = 403;
+    this.code = `FORTIFY_SINK_${sinkType.toUpperCase()}`;
+    this.result = result;
+  }
+}
+
+/**
+ * Asserts that an OS command string is safe from command injection.
+ * @param {string} command 
+ * @param {Object} options 
+ * @returns {Object} detection result
+ */
+function assertSafeCommand(command, options = {}) {
+  if (typeof command !== 'string') {
+    throw new TypeError('command must be a string');
+  }
+
+  const detector = options.detector || new DetectionEngine({ mode: 'command' });
+  const result = detector.detect(command);
+  const threshold = options.threshold !== undefined ? options.threshold : 0.45;
+
+  if (result.label === 'cmdi' && result.confidence >= threshold) {
+    throw new FortifySinkError('Unsafe OS command injection pattern detected', 'COMMAND', result);
+  }
+
+  return result;
+}
+
+/**
+ * Asserts that a file path is safe and contained within an allowed root directory.
+ * @param {string} userPath 
+ * @param {Object} options { rootDir: string }
+ * @returns {string} normalized resolved safe path
+ */
+function assertSafePath(userPath, options = {}) {
+  if (typeof userPath !== 'string') {
+    throw new TypeError('path must be a string');
+  }
+
+  const detector = options.detector || new DetectionEngine();
+  const result = detector.detect(userPath, { source: 'filename' });
+  const threshold = options.threshold !== undefined ? options.threshold : 0.45;
+
+  // Check traversal patterns and anomaly detections
+  if ((result.label === 'path-traversal' || result.label === 'anomaly') && result.confidence >= threshold) {
+    throw new FortifySinkError('Path traversal sequence detected in file path', 'PATH', result);
+  }
+
+  // Check for raw traversal patterns (including single ..)
+  if (/(?:^|[\\\/])\.\.(?:[\\\/]|$)/.test(userPath) || userPath.includes('..')) {
+    throw new FortifySinkError('Path traversal sequence (..) detected in file path', 'PATH');
+  }
+
+  // Check for null-byte injection
+  if (userPath.includes('\0') || userPath.includes('%00')) {
+    throw new FortifySinkError('Null byte injection detected in path', 'PATH');
+  }
+
+  // Check root containment if rootDir is provided
+  if (options.rootDir) {
+    const resolvedRoot = path.resolve(options.rootDir);
+    const resolvedTarget = path.resolve(resolvedRoot, userPath);
+    if (!resolvedTarget.startsWith(resolvedRoot + path.sep) && resolvedTarget !== resolvedRoot) {
+      throw new FortifySinkError(`Path '${userPath}' escapes root directory '${options.rootDir}'`, 'PATH');
+    }
+    return resolvedTarget;
+  }
+
+  return userPath;
+}
+
+/**
+ * Asserts that a URL is safe from SSRF and does not target private IP subnets or cloud metadata.
+ * @param {string} targetUrl 
+ * @param {Object} options { allowPrivate: boolean, allowedProtocols: string[] }
+ * @returns {Object} parsed URL object
+ */
+function assertSafeUrl(targetUrl, options = {}) {
+  if (typeof targetUrl !== 'string') {
+    throw new TypeError('url must be a string');
+  }
+
+  const allowedProtocols = options.allowedProtocols || ['http:', 'https:'];
+  let parsed;
+  try {
+    parsed = new URL(targetUrl);
+  } catch (e) {
+    throw new FortifySinkError(`Invalid URL format: ${targetUrl}`, 'URL');
+  }
+
+  if (!allowedProtocols.includes(parsed.protocol)) {
+    throw new FortifySinkError(`Dangerous or disallowed URL protocol '${parsed.protocol}'`, 'URL');
+  }
+
+  if (options.allowPrivate !== true) {
+    const hostname = parsed.hostname;
+    if (isPrivateIP(hostname)) {
+      throw new FortifySinkError(`Blocked access to private network / cloud metadata address: ${hostname}`, 'URL');
+    }
+  }
+
+  const detector = options.detector || new DetectionEngine();
+  const result = detector.detect(targetUrl);
+  if (result.label === 'ssrf' && result.confidence >= (options.threshold || 0.5)) {
+    throw new FortifySinkError(`SSRF attack pattern detected in target URL`, 'URL', result);
+  }
+
+  return parsed;
+}
+
+/**
+ * Asserts that a MongoDB / NoSQL query object does not contain operator injection ($where, $gt, etc.).
+ * @param {Object} query 
+ * @param {Object} options 
+ * @returns {Object} query
+ */
+function assertSafeNoSql(query, options = {}) {
+  if (!query || typeof query !== 'object') return query;
+
+  const forbiddenOperators = options.forbiddenOperators || ['$where', '$regex', '$expr', '$function', '$accumulator'];
+  const visited = new WeakSet();
+
+  function inspectNode(node) {
+    if (!node || typeof node !== 'object') return;
+    if (visited.has(node)) return;
+    visited.add(node);
+
+    if (Array.isArray(node)) {
+      for (const item of node) inspectNode(item);
+      return;
+    }
+
+    for (const key of Object.keys(node)) {
+      if (forbiddenOperators.includes(key)) {
+        throw new FortifySinkError(`Forbidden NoSQL query operator '${key}' detected`, 'NOSQL');
+      }
+      if (typeof key === 'string' && key.startsWith('$') && options.disallowAllOperators) {
+        throw new FortifySinkError(`Disallowed query operator '${key}' detected`, 'NOSQL');
+      }
+      inspectNode(node[key]);
+    }
+  }
+
+  inspectNode(query);
+  return query;
+}
+
+/**
+ * Asserts that a redirect destination is safe from Open Redirect vulnerabilities.
+ * @param {string} destination 
+ * @param {Object} options { allowedHosts: string[], allowRelative: boolean }
+ * @returns {string} destination
+ */
+function assertSafeRedirect(destination, options = {}) {
+  if (typeof destination !== 'string') {
+    throw new TypeError('destination must be a string');
+  }
+
+  const allowRelative = options.allowRelative !== false;
+  const allowedHosts = (options.allowedHosts || []).map(h => h.toLowerCase());
+
+  // Check for protocol-relative bypass (//evil.com)
+  if (destination.startsWith('//') || destination.startsWith('\\\\')) {
+    throw new FortifySinkError('Protocol-relative URL redirect forbidden', 'REDIRECT');
+  }
+
+  // Relative paths
+  if (destination.startsWith('/') && !destination.startsWith('/\\')) {
+    if (allowRelative) return destination;
+    throw new FortifySinkError('Relative redirect forbidden by policy', 'REDIRECT');
+  }
+
+  // Absolute URL validation
+  let parsed;
+  try {
+    parsed = new URL(destination);
+  } catch (e) {
+    throw new FortifySinkError(`Invalid redirect destination: ${destination}`, 'REDIRECT');
+  }
+
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new FortifySinkError(`Disallowed redirect protocol: ${parsed.protocol}`, 'REDIRECT');
+  }
+
+  if (allowedHosts.length > 0 && !allowedHosts.includes(parsed.hostname.toLowerCase())) {
+    throw new FortifySinkError(`Redirect domain '${parsed.hostname}' is not in allowedHosts list`, 'REDIRECT');
+  }
+
+  return destination;
+}
+
+module.exports = {
+  FortifySinkError,
+  FortifyPromptError,
+  assertSafeCommand,
+  assertSafePath,
+  assertSafeUrl,
+  assertSafeNoSql,
+  assertSafeRedirect,
+  assertSafePrompt,
+  scanPrompt
+};

package/src/detectors/cmdi.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const DANGEROUS_COMMANDS = 'rm|cat|wget|curl|nc|bash|sh|cmd|powershell|python|perl|ruby|node|php';
+const DANGEROUS_COMMANDS = 'rm|cat|wget|curl|nc|bash|sh|cmd|powershell|python|perl|ruby|node|php|id|whoami|ls|uname|hostname|awk|sed|find|socat|ncat|xargs|dd|env|tee';
 
 module.exports = {
   name: 'cmdi',
@@ -75,7 +75,12 @@ module.exports = {
       {
         id: 'pipe-operator-command',
         confidence: 0.80,
-        pattern: /\|\s*(?:ls|cat|whoami|id|pwd|dir|type)\b/i
+        pattern: /\|\s*(?:ls|cat|whoami|id|pwd|dir|type|nc|ncat|socat|tee)(?:\s|$)/i
+      },
+      {
+        id: 'pipe-to-dangerous-binary',
+        confidence: 0.75,
+        pattern: new RegExp(`\\|\\s*(?:${DANGEROUS_COMMANDS})(?:\\s|$)`, 'i')
       }
     ];
   }

package/src/detectors/open-redirect.js

@@ -36,6 +36,16 @@ module.exports = {
         id: 'javascript-uri-redirect',
         confidence: 0.85,
         pattern: new RegExp(`(?:\\?|&)(?:${REDIRECT_PARAMS})=javascript:`, 'i')
+      },
+      {
+        id: 'bare-protocol-relative-url',
+        confidence: 0.70,
+        pattern: /^\/\/[a-zA-Z0-9][a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/
+      },
+      {
+        id: 'bare-external-redirect',
+        confidence: 0.65,
+        pattern: /^https?:\/\/[a-zA-Z0-9][a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/
       }
     ];
   }

package/src/detectors/path-traversal.js

@@ -8,32 +8,42 @@ module.exports = {
       {
         id: 'dot-dot-slash',
         confidence: 0.75,
-        pattern: /(?:\.\.[\\\/]){2,}/
+        pattern: /(?:\.\.[\\\/])+/
       },
       {
         id: 'windows-backslash-traversal',
         confidence: 0.75,
-        pattern: /(?:\.\.\\){2,}/
+        pattern: /(?:\.\.\\)+/
       },
       {
         id: 'url-encoded-traversal',
         confidence: 0.80,
-        pattern: /(?:%2e%2e%2f|%252e%252e%252f|%2e%2e%5c|%252e%252e%255c){2,}/i
+        pattern: /(?:%2e%2e%2f|%252e%252e%252f|%2e%2e%5c|%252e%252e%255c)+/i
       },
       {
         id: 'overlong-utf8-traversal',
         confidence: 0.85,
-        pattern: /(?:%c0%ae%c0%ae%c0%af|%e0%40%ae%e0%40%ae%e0%40%af){2,}/i
+        pattern: /(?:%c0%ae%c0%ae%c0%af|%e0%40%ae%e0%40%ae%e0%40%af)+/i
       },
       {
         id: 'double-dot-slash',
         confidence: 0.75,
-        pattern: /(?:\.\.\.\.\/\/)+/
+        pattern: /(?:\.{2,}[\\\/]+)+/
       },
       {
         id: 'null-byte-injection',
         confidence: 0.85,
-        pattern: /\x00/
+        pattern: /\x00|%00/i
+      },
+      {
+        id: 'ntfs-alternate-data-stream',
+        confidence: 0.85,
+        pattern: /::\$DATA\b/i
+      },
+      {
+        id: 'windows-unc-path',
+        confidence: 0.80,
+        pattern: /(?:^|[\\\/])\\\\\?\\/
       },
       {
         id: 'sensitive-unix-file',
@@ -43,7 +53,7 @@ module.exports = {
       {
         id: 'sensitive-windows-file',
         confidence: 0.80,
-        pattern: /(?:\\SAM|\\boot\.ini|\\win\.ini|\\system32\\config)/i
+        pattern: /(?:\\SAM|\\boot\.ini|\\win\.ini|[\\\/]system32(?:[\\\/]|$))/i
       },
       {
         id: 'dotfile-access',

package/src/detectors/prompt-injection.js

@@ -0,0 +1,110 @@
+'use strict';
+
+/**
+ * AI & LLM Prompt Injection Detector for FortifyJS
+ * Detects direct instruction overrides, jailbreaks (DAN, Dev Mode),
+ * system prompt exfiltration, delimiter hijacking, and adversarial roleplay.
+ */
+
+function isAdversarialPromptStructure(text) {
+  if (!text || typeof text !== 'string') return false;
+  const lower = text.toLowerCase();
+  // Collapsed version for punctuation-separated token obfuscation (i.g.n.o.r.e -> ignore)
+  const collapsed = lower.replace(/(?<=[a-z0-9])[.\-_/|\\]+(?=[a-z0-9])/gi, '');
+
+  const checkText = (t) => {
+    // English & Multilingual overrides
+    const hasOverride = /(?:ignore|disregard|forget|bypass|override|drop|ignora|ignorez|ignoriere|игнорируй|忽略)\s+(?:(?:all|your|the|todas\s+las|toutes\s+les|alle|все|之前的所有)\s+)*(?:previous|prior|above|preceding|system|initial|core|first|earlier|anteriores|précédentes|vorherigen|предыдущие|之前)?\s*(?:instructions|prompts|rules|guidelines|directives|constraints|instrucciones|anweisungen|инструкции|指令|提示词)/i.test(t);
+    const hasNewDirective = /(?:now\s+you|you\s+are\s+now|instead|reply\s+with|act\s+as|output|tell\s+me|print|ahora|maintenant|jetzt|сейчас|现在|输出)/i.test(t);
+    if (hasOverride && hasNewDirective) return true;
+
+    // Multilingual & structural system exfiltration
+    const hasExfiltrationAction = /(?:repeat|output|print|show|dump|reveal|leak|display|echo|verbatim|write\s+out|muestra|affichez|zeige|покажи|输出|显示)\s+(?:the\s+|your\s+|el\s+|les\s+|die\s+|весь\s+)?(?:entire\s+|full\s+|exact\s+|original\s+|iniciales\s+|initial\s+)?(?:system\s+prompt|initial\s+instructions|system\s+instructions|developer\s+message|secret\s+instructions|hidden\s+prompt|prompt\s+del\s+sistema|instructions\s+initiales|системный\s+промпт|系统提示词|系统指令)/i.test(t);
+    if (hasExfiltrationAction) return true;
+
+    // Encoding exfiltration
+    const hasEncodedExfiltration = /(?:encode|convert|translate|format)\s+(?:the\s+|your\s+)?(?:system\s+prompt|initial\s+instructions|secret\s+prompt)\s+(?:into|as|in|to)\s+(?:base64|hex|rot13|json|binary|morse|url)/i.test(t);
+    if (hasEncodedExfiltration) return true;
+
+    return false;
+  };
+
+  return checkText(lower) || checkText(collapsed);
+}
+
+module.exports = {
+  name: 'prompt-injection',
+  label: 'prompt-injection',
+
+  isAdversarialPromptStructure,
+
+  getSignals() {
+    return [
+      {
+        id: 'prompt-instruction-override',
+        confidence: 0.90,
+        pattern: /(?:ignore|disregard|forget|bypass|override|drop|ignora|ignorez|ignoriere|игнорируй|忽略)\s+(?:(?:all|your|the|todas\s+las|toutes\s+les|alle|все|之前的所有)\s+)*(?:previous|prior|above|preceding|system|initial|core|first|earlier|anteriores|précédentes|vorherigen|предыдущие|之前)?\s*(?:instructions|prompts|rules|guidelines|directives|constraints|instrucciones|anweisungen|инструкции|指令|提示词)/i
+      },
+      {
+        id: 'prompt-adversarial-structure',
+        confidence: 0.85,
+        test: isAdversarialPromptStructure
+      },
+      {
+        id: 'prompt-multilingual-jailbreak',
+        confidence: 0.90,
+        pattern: /(?:ignora\s+todas\s+las\s+instrucciones|ignor(?:ez|er)\s+toutes\s+les\s+instructions|ignoriere\s+alle\s+anweisungen|忽略之前的所有指令|игнорируй\s+все\s+предыдущие\s+инструкции)/i
+      },
+      {
+        id: 'prompt-jailbreak-persona',
+        confidence: 0.90,
+        pattern: /\b(?:DAN\s+mode|do\s+anything\s+now|developer\s+mode\s+enabled|jailbreak(?:ed)?\s+mode|unfiltered\s+mode|never\s+refuse\s+any\s+request|stay\s+in\s+character\s+as\s+(?:evil|unrestricted|unfiltered)|unrestricted\s+AI)\b/i
+      },
+      {
+        id: 'prompt-system-exfiltration',
+        confidence: 0.90,
+        pattern: /(?:output|print|repeat|show|dump|reveal|leak|display|muestra|affichez|zeige|покажи|输出|显示)\s+(?:your\s+|the\s+|el\s+|les\s+|die\s+)?(?:exact\s+|entire\s+|full\s+|complete\s+)?(?:system\s+prompt|initial\s+instructions|developer\s+prompt|hidden\s+instructions|prompt\s+del\s+sistema|instructions\s+initiales|系统提示词)/i
+      },
+      {
+        id: 'prompt-control-tokens',
+        confidence: 0.95,
+        pattern: /(?:<\|(?:im_start|im_end|endoftext|system|user|assistant|fim_prefix|fim_suffix)\||---BEGIN\s+(?:SYSTEM|PROMPT|INSTRUCTIONS)---)/i
+      },
+      {
+        id: 'prompt-delimiter-hijack',
+        confidence: 0.85,
+        pattern: /(?:\[\s*(?:SYSTEM|SYS|INST|SYSTEM_PROMPT|DEVELOPER_INSTRUCTIONS)\s*\]|<\s*(?:system|instruction|developer)\s*>|###\s*(?:System|Instruction|Assistant|Human)\s*:|<<SYS>>|<\/SYS>)/i
+      },
+      {
+        id: 'prompt-safety-bypass-directive',
+        confidence: 0.85,
+        pattern: /(?:bypass|disable|turn\s+off|remove|ignore)\s+(?:your\s+)?(?:content\s+filters?|safety\s+filters?|moderation|guardrails|ethical\s+guidelines|safety\s+protocols?)/i
+      },
+      {
+        id: 'prompt-markdown-exfiltration',
+        confidence: 0.80,
+        pattern: /!\[.*?\]\(https?:\/\/[^\s)]+\?[^\s)]*(?:prompt|token|key|secret|system|data)=/i
+      },
+      {
+        id: 'prompt-format-coercion',
+        confidence: 0.85,
+        pattern: /(?:you\s+must\s+respond\s+only\s+with|respond\s+in\s+json\s+with\s+the\s+fields?\s*:\s*["']?system_prompt["']?)/i
+      },
+      {
+        id: 'prompt-translation-smuggle',
+        confidence: 0.85,
+        pattern: /(?:translate\s+(?:the\s+following|this)\s+(?:from\s+[a-z]+\s+to\s+[a-z]+|into\s+[a-z]+)\s+and\s+execute|decode\s+(?:base64|rot13|hex)\s+and\s+follow\s+instructions)/i
+      },
+      {
+        id: 'prompt-hypothetical-override',
+        confidence: 0.85,
+        pattern: /(?:in\s+a\s+hypothetical\s+scenario\s+where\s+safety\s+rules\s+do\s+not\s+apply|for\s+educational\s+and\s+research\s+purposes\s+only,\s+bypass\s+all\s+guidelines)/i
+      },
+      {
+        id: 'prompt-token-split-smuggle',
+        confidence: 0.85,
+        pattern: /(?:I\s*G\s*N\s*O\s*R\s*E\s+P\s*R\s*E\s*V\s*I\s*O\s*U\s*S|D\s*A\s*N\s+M\s*O\s*D\s*E)/i
+      }
+    ];
+  }
+};

package/src/detectors/prototype-pollution.js

@@ -35,10 +35,20 @@ module.exports = {
 
   getSignals() {
     return [
+      {
+        id: 'proto-key-exact',
+        confidence: 0.90,
+        pattern: /^(?:__proto__|prototype)$/i
+      },
+      {
+        id: 'constructor-key-exact',
+        confidence: 0.70,
+        pattern: /^constructor$/i
+      },
       {
         id: 'proto-key',
         confidence: 0.90,
-        pattern: /"__proto__"\s*:/
+        pattern: /(?:"|')?__proto__(?:"|')?\s*[:=]/i
       },
       {
         id: 'constructor-prototype',
@@ -48,7 +58,7 @@ module.exports = {
       {
         id: 'constructor-key',
         confidence: 0.70,
-        pattern: /"constructor"\s*:/
+        pattern: /(?:"|')?constructor(?:"|')?\s*[:=]/i
       },
       {
         id: 'proto-in-url',

package/src/detectors/sqli.js

@@ -441,6 +441,16 @@ module.exports = {
         id: 'sql-structural-metadata-query',
         confidence: 0.65,
         test: hasStructuralSqlMetadataQuery
+      },
+      {
+        id: 'case-when-conditional',
+        confidence: 0.70,
+        pattern: /\bCASE\s+WHEN\s+\(?\s*\d+\s*[=<>!]+\s*\d+\s*\)?\s+THEN\b/i
+      },
+      {
+        id: 'select-case-expression',
+        confidence: 0.70,
+        pattern: /\(\s*SELECT\s+CASE\s+WHEN\b/i
       }
     ];
   }