@chiranthmoger/fortifyjs 1.1.0 → 1.1.1

package/src/detectors/ssrf.js

@@ -1,8 +1,189 @@
 'use strict';
 
+function parseIpv4ToNumber(ipStr) {
+  if (!ipStr || typeof ipStr !== 'string') return null;
+  const trimmed = ipStr.trim();
+  
+  // Single hex integer (e.g. 0x7f000001)
+  if (/^0x[0-9a-fA-F]+$/i.test(trimmed)) {
+    const num = parseInt(trimmed, 16);
+    return num >= 0 && num <= 0xFFFFFFFF ? num : null;
+  }
+
+  // Single octal integer (e.g. 017700000001)
+  if (/^0[0-7]+$/.test(trimmed)) {
+    const num = parseInt(trimmed, 8);
+    return num >= 0 && num <= 0xFFFFFFFF ? num : null;
+  }
+
+  // Single decimal integer (e.g. 2130706433)
+  if (/^\d+$/.test(trimmed)) {
+    const num = Number(trimmed);
+    return num >= 0 && num <= 0xFFFFFFFF ? num : null;
+  }
+
+  // Dotted parts (can be 1 to 4 parts, hex/octal/decimal)
+  const parts = trimmed.split('.');
+  if (parts.length < 1 || parts.length > 4) return null;
+
+  const parsedParts = [];
+  for (const part of parts) {
+    if (!part) return null;
+    let val;
+    if (/^0x[0-9a-fA-F]+$/i.test(part)) {
+      val = parseInt(part, 16);
+    } else if (/^0\d+$/.test(part)) {
+      val = parseInt(part, 8);
+    } else if (/^\d+$/.test(part)) {
+      val = parseInt(part, 10);
+    } else {
+      return null;
+    }
+    if (isNaN(val) || val < 0) return null;
+    parsedParts.push(val);
+  }
+
+  if (parsedParts.length === 4) {
+    if (parsedParts.some(p => p > 255)) return null;
+    return ((parsedParts[0] << 24) >>> 0) + ((parsedParts[1] << 16) >>> 0) + ((parsedParts[2] << 8) >>> 0) + parsedParts[3];
+  } else if (parsedParts.length === 3) {
+    if (parsedParts[0] > 255 || parsedParts[1] > 255 || parsedParts[2] > 0xFFFF) return null;
+    return ((parsedParts[0] << 24) >>> 0) + ((parsedParts[1] << 16) >>> 0) + parsedParts[2];
+  } else if (parsedParts.length === 2) {
+    if (parsedParts[0] > 255 || parsedParts[1] > 0xFFFFFF) return null;
+    return ((parsedParts[0] << 24) >>> 0) + parsedParts[1];
+  } else if (parsedParts.length === 1) {
+    if (parsedParts[0] > 0xFFFFFFFF) return null;
+    return parsedParts[0] >>> 0;
+  }
+
+  return null;
+}
+
+function isPrivateIpv4Number(num) {
+  if (num === null || num === undefined) return false;
+  // 0.0.0.0/8
+  if (((num & 0xFF000000) >>> 0) === 0x00000000) return true;
+  // 10.0.0.0/8
+  if (((num & 0xFF000000) >>> 0) === 0x0A000000) return true;
+  // 127.0.0.0/8 Loopback
+  if (((num & 0xFF000000) >>> 0) === 0x7F000000) return true;
+  // 100.64.0.0/10 Carrier-grade NAT
+  if (((num & 0xFFC00000) >>> 0) === 0x64400000) return true;
+  // 169.254.0.0/16 Link-local / Cloud Metadata
+  if (((num & 0xFFFF0000) >>> 0) === 0xA9FE0000) return true;
+  // 172.16.0.0/12 Private
+  if (((num & 0xFFF00000) >>> 0) === 0xAC100000) return true;
+  // 192.0.0.0/24 IETF Protocol
+  if (((num & 0xFFFFFF00) >>> 0) === 0xC0000000) return true;
+  // 192.168.0.0/16 Private
+  if (((num & 0xFFFF0000) >>> 0) === 0xC0A80000) return true;
+  // 198.18.0.0/15 Benchmarking
+  if (((num & 0xFFFE0000) >>> 0) === 0xC6120000) return true;
+  // 224.0.0.0/4 Multicast
+  if (((num & 0xF0000000) >>> 0) === 0xE0000000) return true;
+  // 240.0.0.0/4 Reserved
+  if (((num & 0xF0000000) >>> 0) === 0xF0000000) return true;
+  // 255.255.255.255 Broadcast
+  if ((num >>> 0) === 0xFFFFFFFF) return true;
+
+  return false;
+}
+
+function isPrivateIPv6(ipStr) {
+  if (!ipStr || typeof ipStr !== 'string') return false;
+  let clean = ipStr.trim().toLowerCase();
+  if (clean.startsWith('[') && clean.endsWith(']')) {
+    clean = clean.slice(1, -1);
+  }
+
+  // Canonicalize hextet leading zeros
+  const parts = clean.split(':');
+  const normalizedHextets = parts.map(p => {
+    if (!p) return '';
+    if (p.includes('.')) return p; // IPv4 dotted part
+    return p.replace(/^0+/, '') || '0';
+  }).join(':');
+
+  // Loopback ::1 or 0:0:0:0:0:0:0:1
+  if (clean === '::1' || normalizedHextets === '0:0:0:0:0:0:0:1' || normalizedHextets === '::1' || /^0*(?::0*)*:1$/.test(clean)) return true;
+  // Unspecified :: or 0:0:0:0:0:0:0:0
+  if (clean === '::' || normalizedHextets === '0:0:0:0:0:0:0:0' || normalizedHextets === '::' || /^0*(?::0*)*:0*$/.test(clean)) return true;
+
+  // IPv4 mapped IPv6 (e.g. ::ffff:127.0.0.1, ::ffff:7f00:1, ::127.0.0.1, 0000:0000:0000:0000:0000:ffff:127.0.0.1)
+  if (
+    clean.startsWith('::ffff:') ||
+    clean.startsWith('0:0:0:0:0:ffff:') ||
+    normalizedHextets.startsWith('0:0:0:0:0:ffff:') ||
+    clean.startsWith('::')
+  ) {
+    let v4Part = clean.replace(/^(?:::ffff:|0:0:0:0:0:ffff:|0000:0000:0000:0000:0000:ffff:|::)/, '');
+    if (v4Part.includes('.')) {
+      const v4Num = parseIpv4ToNumber(v4Part);
+      if (v4Num !== null && isPrivateIpv4Number(v4Num)) return true;
+    } else if (v4Part.includes(':')) {
+      const v4SubParts = v4Part.split(':');
+      if (v4SubParts.length === 2) {
+        const high = parseInt(v4SubParts[0], 16);
+        const low = parseInt(v4SubParts[1], 16);
+        if (!isNaN(high) && !isNaN(low)) {
+          const v4Num = ((high << 16) >>> 0) + low;
+          if (isPrivateIpv4Number(v4Num)) return true;
+        }
+      }
+    }
+  }
+
+  // Unique Local (fc00::/7 -> fc00 to fdff)
+  if (/^f[cd][0-9a-f]{0,2}:/i.test(normalizedHextets) || /^f[cd][0-9a-f]{2}:/i.test(clean)) return true;
+  // Link-Local (fe80::/10 -> fe80 to febf)
+  if (/^fe[89ab][0-9a-f]{0,2}:/i.test(normalizedHextets) || /^fe[89ab][0-9a-f]:/i.test(clean)) return true;
+  // AWS IMDS IPv6 (fd00:ec2::254)
+  if (clean.startsWith('fd00:ec2:') || normalizedHextets.startsWith('fd00:ec2:')) return true;
+
+  return false;
+}
+
 function isPrivateIP(ipString) {
-  if (!ipString) return false;
-  // This is a placeholder that can be fleshed out, but currently the regex handles it.
+  if (!ipString || typeof ipString !== 'string') return false;
+  let clean = ipString.trim();
+  if (clean.startsWith('[') && clean.endsWith(']')) {
+    clean = clean.slice(1, -1);
+  }
+  const lower = clean.toLowerCase();
+  if (lower === 'localhost' || lower.endsWith('.localhost')) return true;
+
+  // Try IPv4
+  const v4Num = parseIpv4ToNumber(clean);
+  if (v4Num !== null) {
+    return isPrivateIpv4Number(v4Num);
+  }
+
+  // Try IPv6
+  return isPrivateIPv6(clean);
+}
+
+function extractHostFromUrlString(urlString) {
+  if (!urlString || typeof urlString !== 'string') return null;
+  try {
+    const match = urlString.match(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^@\/\?#]+@)?(\[[^\]]+\]|[^/?#:]+)/);
+    if (match) {
+      let host = match[1];
+      if (host.startsWith('[') && host.endsWith(']')) {
+        host = host.slice(1, -1);
+      }
+      return host;
+    }
+  } catch (_) {}
+  return null;
+}
+
+function hasPrivateHostInUrl(payload) {
+  if (!payload || typeof payload !== 'string') return false;
+  const host = extractHostFromUrlString(payload);
+  if (host) {
+    if (isPrivateIP(host)) return true;
+  }
   return false;
 }
 
@@ -11,48 +192,56 @@ module.exports = {
   label: 'ssrf',
   
   isPrivateIP,
+  parseIpv4ToNumber,
+  isPrivateIpv4Number,
+  isPrivateIPv6,
 
   getSignals() {
     return [
       {
         id: 'private-ip-access',
         confidence: 0.85,
-        pattern: /(?:https?|ftp):\/\/(?:127\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+|\[?::1\]?|\[?::ffff:127\.0\.0\.1\]?|0\.0\.0\.0)(?::\d+)?(?:[\/\?#]|$)/i
+        pattern: /(?:https?|ftp):\/\/(?:[^@\/\?#]+@)?(?:127\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+|172\.(?:1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+|192\.168\.\d+\.\d+|\[?::1\]?|\[?::ffff:127\.0\.0\.1\]?|0\.0\.0\.0)(?::\d+)?(?:[\/\?#]|$)/i
+      },
+      {
+        id: 'bitwise-private-ip',
+        confidence: 0.85,
+        test: hasPrivateHostInUrl
       },
       {
         id: 'cloud-metadata-access',
         confidence: 0.90,
-        pattern: /(?:https?|ftp):\/\/(?:169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200|fd00:ec2::254|192\.0\.0\.192)/i
+        pattern: /(?:https?|ftp):\/\/(?:[^@\/\?#]+@)?(?:169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200|fd00:ec2::254|192\.0\.0\.192|instance-data)(?::\d+)?(?:[\/\?#]|$)/i
       },
       {
         id: 'dangerous-url-scheme',
         confidence: 0.80,
-        pattern: /^(?:file|gopher|dict|ldap|tftp):\/\//i
+        pattern: /^(?:file|gopher|dict|ldap|tftp|php|data):\/\//i
       },
       {
         id: 'decimal-ip',
-        confidence: 0.70,
-        pattern: /(?:https?|ftp):\/\/(?:2130706433|3232235520)(?::\d+)?(?:[\/\?#]|$)/i
+        confidence: 0.75,
+        pattern: /(?:https?|ftp):\/\/(?:[^@\/\?#]+@)?(?:2130706433|3232235520|167772160|2886729728|2851995648|0)(?::\d+)?(?:[\/\?#]|$)/i
       },
       {
         id: 'hex-ip',
-        confidence: 0.70,
-        pattern: /(?:https?|ftp):\/\/(?:0x7f000001|0x7f\.0x00\.0x00\.0x01|0x7f\.0\.0\.1)(?::\d+)?(?:[\/\?#]|$)/i
+        confidence: 0.75,
+        pattern: /(?:https?|ftp):\/\/(?:[^@\/\?#]+@)?(?:0x7f000001|0x7f\.0x00\.0x00\.0x01|0x7f\.0\.0\.1|0x0a000001|0xc0a80001)(?::\d+)?(?:[\/\?#]|$)/i
       },
       {
         id: 'octal-ip',
-        confidence: 0.70,
-        pattern: /(?:https?|ftp):\/\/(?:0177\.0000\.0000\.0001|0177\.0\.0\.1)(?::\d+)?(?:[\/\?#]|$)/i
+        confidence: 0.75,
+        pattern: /(?:https?|ftp):\/\/(?:[^@\/\?#]+@)?(?:017700000001|0[0-7]{9,11}|0177\.0000\.0000\.0001|0177\.0\.0\.1|0012\.0\.0\.1|0300\.0250\.0\.1)(?::\d+)?(?:[\/\?#]|$)/i
       },
       {
         id: 'dns-rebinding-localhost',
         confidence: 0.75,
-        pattern: /(?:https?|ftp):\/\/(?:localhost|0\.0\.0\.0|\[0:0:0:0:0:0:0:1\])(?::\d+)?(?:[\/\?#]|$)/i
+        pattern: /(?:https?|ftp):\/\/(?:[^@\/\?#]+@)?(?:localhost|[a-zA-Z0-9.-]+\.localhost|0\.0\.0\.0|\[0:0:0:0:0:0:0:1\]|\[0000:0000:0000:0000:0000:0000:0000:0001\]|\[::1\]|\[::\])(?::\d+)?(?:[\/\?#]|$)/i
       },
       {
         id: 'dns-rebinding-service',
         confidence: 0.80,
-        pattern: /(?:https?|ftp):\/\/(?:[a-zA-Z0-9.-]+\.(?:nip\.io|xip\.io|1u\.ms|sslip\.io)|spoofed\.com)/i
+        pattern: /(?:https?|ftp):\/\/(?:[^@\/\?#]+@)?(?:[a-zA-Z0-9.-]+\.(?:nip\.io|xip\.io|1u\.ms|sslip\.io)|spoofed\.com)/i
       },
       {
         id: 'short-url-ssrf',

package/src/detectors/template-injection.js

@@ -12,7 +12,7 @@ module.exports = {
       {
         id: 'ssti-dangerous-sink',
         confidence: 0.90,
-        pattern: new RegExp('(?:{{|\\\\$\\\\{|<%=\\s*|#{\\s*)[^}]*?' + DANGEROUS_SINKS + '.*?(?:}}|}|%>|})', 'i')
+        pattern: new RegExp('(?:{{|\\$\\{|<%=\\s*|#{\\s*)[^}]*?' + DANGEROUS_SINKS + '.*?(?:}}|}|%>|})', 'i')
       },
       {
         id: 'ssti-jinja-dangerous',
@@ -22,7 +22,7 @@ module.exports = {
       {
         id: 'ssti-arithmetic-probe',
         confidence: 0.70,
-        pattern: new RegExp('(?:{{|\\\\$\\\\{|<%=\\s*|#{\\s*).*?' + ARITHMETIC + '.*?(?:}}|}|%>|})')
+        pattern: new RegExp('(?:{{|\\$\\{|<%=\\s*|#{\\s*).*?' + ARITHMETIC + '.*?(?:}}|}|%>|})')
       },
       {
         id: 'ssti-template-syntax-alone',

package/src/detectors/xss.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const JS_EXECUTION_SINKS = new Set(['alert', 'confirm', 'prompt', 'eval', 'fetch', 'function', 'settimeout', 'setinterval']);
+const JS_EXECUTION_SINKS = new Set(['alert', 'confirm', 'prompt', 'eval', 'fetch', 'function', 'settimeout', 'setinterval', 'location', 'navigate', 'assign', 'replace', 'write', 'writeln']);
 const JS_GLOBAL_OBJECTS = new Set(['window', 'globalthis', 'self', 'top', 'parent']);
 function isAsciiLetter(ch) {
   return /[A-Za-z]/.test(ch);
@@ -105,22 +105,27 @@ module.exports = {
   name: 'xss',
   label: 'xss',
   getSignals() {
-    return     [
-      {
-        id: 'script-tag',
-        confidence: 0.85,
-        pattern: /<\s*script\b/i
-      },
-      {
-        id: 'html-event-attribute',
-        confidence: 0.75,
-        pattern: /<[^>]+\bon\w+\s*=/i
-      },
-      {
-        id: 'event-handler-payload',
-        confidence: 0.75,
-        pattern: /\bon\w+\s*=\s*["']?[^"'>]*(?:alert|confirm|prompt|document\.|window\.|eval|fetch|Function\s*\()/i
-      },
+    return [
+      {
+        id: 'script-tag',
+        confidence: 0.85,
+        pattern: /<\s*script\b/i
+      },
+      {
+        id: 'html-event-attribute',
+        confidence: 0.75,
+        pattern: /<[^>]+\bon\w+\s*=/i
+      },
+      {
+        id: 'event-handler-payload',
+        confidence: 0.75,
+        pattern: /\bon\w+\s*=\s*(?:["'][^"'>]*|[^"'\s>]*)(?:(?:alert|confirm|prompt|eval|fetch|location|write)\s*\(|(?:window|globalThis|self|top|parent|document)(?:\.|\[)|Function\s*\()/i
+      },
+      {
+        id: 'js-bracket-execution-sink',
+        confidence: 0.75,
+        pattern: /(?:window|globalThis|self|top|parent|document)\s*\[\s*['"][^'"]+['"]\s*\]\s*(?:\(|=)/i
+      },
       {
         id: 'javascript-url-with-sink',
         confidence: 0.75,

package/src/index.js

@@ -1,5 +1,5 @@
 'use strict';
-const { shield } = require('./presets');
+const { shield, PRESETS } = require('./presets');
 const { DetectionEngine } = require('./core/engine');
 const { Normalizer } = require('./core/normalizer');
 const { expressMiddleware, fortifyjs, secureRouter } = require('./adapters/express');
@@ -9,6 +9,22 @@ const { koaMiddleware } = require('./adapters/koa');
 const { honoMiddleware } = require('./adapters/hono');
 const { genericAdapter } = require('./adapters/generic');
 const nextjsAdapter = require('./adapters/nextjs');
+const {
+  FortifySinkError,
+  FortifyPromptError,
+  assertSafeCommand,
+  assertSafePath,
+  assertSafeUrl,
+  assertSafeNoSql,
+  assertSafeRedirect,
+  assertSafePrompt,
+  scanPrompt
+} = require('./core/sinks');
+const { llmGuard } = require('./shields/llm-guard');
+const { sanitizerFactory, sanitizeObject } = require('./shields/sanitizer');
+const { isPrivateIP } = require('./detectors/ssrf');
+const { MemoryStore, BaseStore } = require('./shields/store');
+
 const DEFAULT_THRESHOLD = 0.5;
 
 function samplePayload(sample) {
@@ -57,6 +73,7 @@ function assertSafeSqlQuery(query, options = {}) {
   }
   return result;
 }
+
 function evaluatePayloads(samples, options = {}) {
   if (!Array.isArray(samples)) {
     throw new TypeError('samples must be an array');
@@ -112,10 +129,13 @@ function evaluatePayloads(samples, options = {}) {
 
 module.exports = {
   shield,
+  PRESETS,
   DetectionEngine,
   Normalizer,
   evaluatePayloads,
   fortifyjsQueryError,
+  FortifySinkError,
+  FortifyPromptError,
   expressMiddleware,
   createNestMiddleware,
   fortifyjs,
@@ -123,7 +143,19 @@ module.exports = {
   nestjsMiddleware,
   scanSqlQuery,
   assertSafeSqlQuery,
-  evaluatePayloads,
+  assertSafeCommand,
+  assertSafePath,
+  assertSafeUrl,
+  assertSafeNoSql,
+  assertSafeRedirect,
+  assertSafePrompt,
+  scanPrompt,
+  llmGuard,
+  sanitizerFactory,
+  sanitizeObject,
+  isPrivateIP,
+  MemoryStore,
+  BaseStore,
   fastifyPlugin,
   koaMiddleware,
   honoMiddleware,

package/src/presets.js

@@ -144,10 +144,21 @@ function shield(tier = 'basic', overrides = {}) {
     stack.push(dashboardFactory(config.dashboard, logger));
   }
 
+  if (config.sanitize) {
+    const { sanitizerFactory } = require('./shields/sanitizer');
+    stack.push(sanitizerFactory(typeof config.sanitize === 'object' ? config.sanitize : {}));
+  }
+
   // Build detector
   const detectorOptions = {
     level: config.level,
-    behavioral: config.behavioral
+    behavioral: config.behavioral,
+    onBlocked: config.onBlocked,
+    allowRoutes: config.allowRoutes,
+    allowParams: config.allowParams,
+    routeLevels: config.routeLevels,
+    whitelist: config.whitelist,
+    mode: config.mode
   };
   
   // Note: We use expressMiddleware factory here
@@ -162,6 +173,13 @@ function shield(tier = 'basic', overrides = {}) {
   stack.push(detectorMiddleware);
 
   return function fortifyjsStack(req, res, next) {
+    if (config.allowRoutes && Array.isArray(config.allowRoutes)) {
+      const pathname = req.path || (req.url ? req.url.split('?')[0] : '');
+      if (config.allowRoutes.includes(pathname)) {
+        return next();
+      }
+    }
+
     let index = 0;
     function runNext(err) {
       if (err) return next(err);

package/src/shields/csrf.js

@@ -9,7 +9,7 @@ const crypto = require('crypto');
  */
 module.exports = function createCsrfShield(options = {}) {
   const secret = options.secret || crypto.randomBytes(32).toString('hex');
-  if (!options.secret) {
+  if (!options.secret && process.env.NODE_ENV !== 'test' && !options.silent) {
     console.warn('fortifyjs: CSRF secret not provided. A random secret was generated, but it will not persist across restarts.');
   }
 
@@ -59,9 +59,15 @@ module.exports = function createCsrfShield(options = {}) {
     // We assume cookie-parser might not be present, so we do basic parsing
     let cookies = req.cookies || {};
     if (!req.cookies && req.headers.cookie) {
-      cookies = Object.fromEntries(
-        req.headers.cookie.split('; ').map(c => c.split('='))
-      );
+      cookies = {};
+      const pairs = req.headers.cookie.split(';');
+      for (const pair of pairs) {
+        const trimmed = pair.trim();
+        const idx = trimmed.indexOf('=');
+        if (idx !== -1) {
+          cookies[trimmed.slice(0, idx).trim()] = trimmed.slice(idx + 1).trim();
+        }
+      }
     }
 
     const currentSignedToken = cookies[cookieName];

package/src/shields/file-upload.js

@@ -80,6 +80,11 @@ function fileUploadShieldFactory(options = {}) {
       return false;
     }
 
+    if (filename.includes(':') || filename.includes('::$DATA')) {
+      block(res, next, 'Alternate Data Stream syntax or forbidden character in filename');
+      return false;
+    }
+
     const parts = filename.split('.');
     const ext = parts.length > 1 ? '.' + parts[parts.length - 1].toLowerCase() : '';