@chiranthmoger/fortifyjs 1.1.0

package/src/adapters/fastify.js

@@ -0,0 +1,56 @@
+'use strict';
+
+const { shield } = require('../presets');
+
+/**
+ * Fastify plugin for fortifyjs
+ * @param {Object} fastify 
+ * @param {Object} options 
+ * @param {Function} done 
+ */
+function fastifyPlugin(fastify, options, done) {
+  // We use the shield factory to get an Express-style middleware stack
+  // Fastify can consume Express middleware using @fastify/middie or fastify-express,
+  // but since we want zero dependencies, we will wrap the Express middleware pattern manually.
+  
+  const middlewareStack = shield(options.tier || 'basic', options);
+
+  fastify.addHook('onRequest', (request, reply, next) => {
+    // Mimic the req/res interface for our middleware
+    const req = request.raw;
+    const res = reply.raw;
+    
+    // Polyfill properties that Express adds which our shields might expect
+    req.ip = request.ip;
+    req.path = request.routeOptions.url || request.raw.url.split('?')[0];
+    req.query = request.query || {};
+    req.body = request.body || {};
+    req.cookies = request.cookies || {};
+    req.params = request.params || {};
+
+    // For sending responses from middleware (e.g., blocking)
+    const originalSend = res.end;
+    res.status = function(code) {
+      reply.code(code);
+      return res;
+    };
+    res.send = function(body) {
+      reply.send(body);
+    };
+    res.json = function(body) {
+      reply.send(body);
+    };
+
+    middlewareStack(req, res, (err) => {
+      if (err) return next(err);
+      next();
+    });
+  });
+
+  done();
+}
+
+// Support fastify-plugin syntax
+fastifyPlugin[Symbol.for('skip-override')] = true;
+
+module.exports = fastifyPlugin;

package/src/adapters/generic.js

@@ -0,0 +1,15 @@
+'use strict';
+
+const { shield } = require('../presets');
+
+/**
+ * Generic Node.js http.Server adapter
+ * @param {Object} options 
+ * @returns {Function} (req, res, next)
+ */
+function genericAdapter(options = {}) {
+  // Directly returns the standard connect-style middleware (req, res, next)
+  return shield(options.tier || 'basic', options);
+}
+
+module.exports = { genericAdapter };

package/src/adapters/hono.js

@@ -0,0 +1,77 @@
+'use strict';
+
+const { shield } = require('../presets');
+
+/**
+ * Hono middleware for fortifyjs
+ * @param {Object} options 
+ * @returns {Function}
+ */
+function honoMiddleware(options = {}) {
+  const middlewareStack = shield(options.tier || 'basic', options);
+
+  return async (c, next) => {
+    // Create an express-like mock object for the request
+    const req = {
+      ip: c.env?.remoteAddress || '127.0.0.1',
+      path: c.req.path,
+      method: c.req.method,
+      query: c.req.query(),
+      headers: c.req.header(),
+      body: {}, // We'll try to parse JSON if applicable
+      cookies: {}
+    };
+
+    // Parse cookies from headers
+    if (req.headers.cookie) {
+      req.headers.cookie.split(';').forEach(cookie => {
+        const parts = cookie.split('=');
+        req.cookies[parts.shift().trim()] = decodeURI(parts.join('='));
+      });
+    }
+
+    // Try to safely parse body
+    if (req.headers['content-type'] && req.headers['content-type'].includes('application/json')) {
+      try {
+        req.body = await c.req.json();
+      } catch (e) {
+        // ignore
+      }
+    }
+
+    let blockedResponse = null;
+
+    // Create a mock response object
+    const res = {
+      statusCode: 200,
+      headers: {},
+      setHeader(key, value) {
+        this.headers[key.toLowerCase()] = value;
+      },
+      status(code) {
+        this.statusCode = code;
+        return this;
+      },
+      send(body) {
+        blockedResponse = c.body(body, this.statusCode, this.headers);
+      },
+      json(body) {
+        this.headers['content-type'] = 'application/json';
+        blockedResponse = c.json(body, this.statusCode, this.headers);
+      }
+    };
+
+    return new Promise((resolve, reject) => {
+      middlewareStack(req, res, async (err) => {
+        if (err) return reject(err);
+        if (blockedResponse) return resolve(blockedResponse);
+        
+        // Pass to next Hono middleware
+        await next();
+        resolve();
+      });
+    });
+  };
+}
+
+module.exports = { honoMiddleware };

package/src/adapters/koa.js

@@ -0,0 +1,58 @@
+'use strict';
+
+const { shield } = require('../presets');
+
+/**
+ * Koa middleware for fortifyjs
+ * @param {Object} options 
+ * @returns {Function}
+ */
+function koaMiddleware(options = {}) {
+  const middlewareStack = shield(options.tier || 'basic', options);
+
+  return async function(ctx, next) {
+    // Mimic the req/res interface for our middleware
+    const req = ctx.req;
+    const res = ctx.res;
+
+    // Polyfill properties
+    req.ip = ctx.ip;
+    req.path = ctx.path;
+    req.query = ctx.query;
+    req.body = ctx.request.body || {};
+    req.cookies = {}; // Koa uses ctx.cookies.get(), but we can do a simple parse of headers
+    if (ctx.headers.cookie) {
+      ctx.headers.cookie.split(';').forEach(cookie => {
+        const parts = cookie.split('=');
+        req.cookies[parts.shift().trim()] = decodeURI(parts.join('='));
+      });
+    }
+
+    // Override res methods used by middleware
+    const originalEnd = res.end;
+    let blocked = false;
+
+    res.status = function(code) {
+      ctx.status = code;
+      return res;
+    };
+    res.send = function(body) {
+      ctx.body = body;
+      blocked = true;
+    };
+    res.json = function(body) {
+      ctx.body = body;
+      blocked = true;
+    };
+
+    return new Promise((resolve, reject) => {
+      middlewareStack(req, res, (err) => {
+        if (err) return reject(err);
+        if (blocked) return resolve();
+        resolve(next());
+      });
+    });
+  };
+}
+
+module.exports = { koaMiddleware };

package/src/adapters/nestjs.js

@@ -0,0 +1,15 @@
+'use strict';
+const { expressMiddleware } = require('./express');
+function nestjsMiddleware(options = {}) {
+  return expressMiddleware(options);
+}
+
+function createNestMiddleware(options = {}) {
+  const middleware = nestjsMiddleware(options);
+  return class fortifyjsNestMiddleware {
+    use(req, res, next) {
+      return middleware(req, res, next);
+    }
+  };
+}
+module.exports = { nestjsMiddleware, createNestMiddleware };

package/src/adapters/nextjs.js

@@ -0,0 +1,84 @@
+'use strict';
+
+const { DetectionEngine } = require('../core/engine');
+
+/**
+ * Creates a Next.js middleware and API route wrapper for FortifyJS.
+ * 
+ * @param {Object} options - FortifyJS configuration options
+ * @returns {Object} { middleware, withFortify }
+ */
+function nextjsAdapter(options = {}) {
+  const engine = new DetectionEngine(options);
+
+  // 1. Next.js Middleware (Edge Runtime compatible)
+  // Usage: export const middleware = fortify.middleware;
+  const middleware = async (request) => {
+    // NextRequest uses standard Web Request API
+    const url = new URL(request.url);
+    const path = url.pathname;
+    
+    // Scan Path
+    let result = engine.detect(path, { source: 'path' });
+    if (result.label !== 'benign' && result.label !== 'anomaly') {
+      return new Response(JSON.stringify({ error: 'Forbidden' }), { status: 403, headers: { 'Content-Type': 'application/json' } });
+    }
+
+    // Scan Query Params
+    for (const [key, value] of url.searchParams.entries()) {
+      result = engine.detect(value, { source: 'query' });
+      if (result.label !== 'benign' && result.label !== 'anomaly') {
+        return new Response(JSON.stringify({ error: 'Forbidden' }), { status: 403, headers: { 'Content-Type': 'application/json' } });
+      }
+    }
+
+    // Scan Headers (excluding safe/standard headers to save time/false positives)
+    const safeHeaders = ['host', 'connection', 'accept', 'accept-encoding', 'content-length'];
+    for (const [key, value] of request.headers.entries()) {
+      if (!safeHeaders.includes(key.toLowerCase())) {
+        result = engine.detect(value, { source: 'header' });
+        if (result.label !== 'benign' && result.label !== 'anomaly') {
+          return new Response(JSON.stringify({ error: 'Forbidden' }), { status: 403, headers: { 'Content-Type': 'application/json' } });
+        }
+      }
+    }
+
+    // We don't read the body in middleware by default as it consumes the stream,
+    // which breaks subsequent route handlers. Body scanning is handled in API routes.
+
+    return null; // Signals Next.js to continue to the next middleware/route
+  };
+
+  // 2. Next.js API Route Wrapper (Pages Router)
+  // Usage: export default fortify.withFortify(async (req, res) => { ... })
+  const withFortify = (handler) => {
+    return async (req, res) => {
+      // Check query
+      if (req.query) {
+        for (const key in req.query) {
+          const value = req.query[key];
+          const valStr = typeof value === 'string' ? value : JSON.stringify(value);
+          const result = engine.detect(valStr, { source: 'query' });
+          if (result.label !== 'benign' && result.label !== 'anomaly') {
+            return res.status(403).json({ error: 'Forbidden' });
+          }
+        }
+      }
+
+      // Check body
+      if (req.body) {
+        const bodyStr = typeof req.body === 'string' ? req.body : JSON.stringify(req.body);
+        const result = engine.detect(bodyStr, { source: 'body' });
+        if (result.label !== 'benign' && result.label !== 'anomaly') {
+          return res.status(403).json({ error: 'Forbidden' });
+        }
+      }
+
+      return handler(req, res);
+    };
+  };
+
+  return { middleware, withFortify, engine };
+}
+
+module.exports = nextjsAdapter;

package/src/analyzers/adaptive.js

@@ -0,0 +1,92 @@
+'use strict';
+
+class AdaptiveBlocker {
+  constructor(options = {}) {
+    this.windowMs = options.windowMs || 60000;
+    this.threshold = options.threshold || 5;
+    this.blockDurationMs = options.blockDurationMs || 300000;
+    this.anomalies = new Map();
+    this.blocks = new Map();
+  }
+
+  recordAnomaly(ip) {
+    const now = Date.now();
+    this.cleanup(now);
+
+    if (this.isBlocked(ip, now)) {
+      return true;
+    }
+
+    if (!this.anomalies.has(ip)) {
+      this.anomalies.set(ip, []);
+    }
+
+    const timestamps = this.anomalies.get(ip);
+    timestamps.push(now);
+
+    const windowStart = now - this.windowMs;
+    while (timestamps.length > 0 && timestamps[0] < windowStart) {
+      timestamps.shift();
+    }
+
+    if (timestamps.length > this.threshold) {
+      this.blocks.set(ip, now + this.blockDurationMs);
+      this.anomalies.delete(ip);
+      return true;
+    }
+
+    return false;
+  }
+
+  isBlocked(ip, now = Date.now()) {
+    const expiry = this.blocks.get(ip);
+    if (!expiry) return false;
+    
+    if (now >= expiry) {
+      this.blocks.delete(ip);
+      return false;
+    }
+    
+    return true;
+  }
+
+  cleanup(now = Date.now()) {
+    for (const [ip, expiry] of this.blocks.entries()) {
+      if (now >= expiry) {
+        this.blocks.delete(ip);
+      }
+    }
+    const windowStart = now - this.windowMs;
+    for (const [ip, timestamps] of this.anomalies.entries()) {
+      while (timestamps.length > 0 && timestamps[0] < windowStart) {
+        timestamps.shift();
+      }
+      if (timestamps.length === 0) {
+        this.anomalies.delete(ip);
+      }
+    }
+  }
+
+  middleware() {
+    return (req, res, next) => {
+      const ip = req.ip || (req.connection && req.connection.remoteAddress) || 'unknown';
+      
+      if (this.isBlocked(ip)) {
+        return res.status(429).json({ error: 'IP temporarily blocked due to repeated anomalies' });
+      }
+
+      res.on('finish', () => {
+        const detections = req.fortifyjsDetections || [];
+        // We consider it an anomaly if there are any detections that are malicious (detected = true) or labeled anomaly.
+        const hasAnomaly = detections.some(d => d.detected || d.label === 'anomaly');
+        if (hasAnomaly) {
+          this.recordAnomaly(ip);
+        }
+      });
+
+      next();
+    };
+  }
+}
+
+module.exports = { AdaptiveBlocker };

package/src/analyzers/behavioral.js

@@ -0,0 +1,264 @@
+'use strict';
+
+/**
+ * Calculates Shannon entropy of a string
+ * @param {string} str 
+ * @returns {number}
+ */
+function shannonEntropy(str) {
+  const freq = {};
+  for (const ch of str) freq[ch] = (freq[ch] || 0) + 1;
+  const len = str.length;
+  let entropy = 0;
+  for (const count of Object.values(freq)) {
+    const p = count / len;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+
+class BehavioralAnalyzer {
+  /**
+   * @param {Object} options 
+   */
+  constructor(options = {}) {
+    this.options = {
+      entropyThreshold: 4.5,
+      maxEncodingDepth: 3,
+      specialCharRatio: 0.5,
+      learningRequests: 1000,
+      onAnomaly: null,
+      ...options
+    };
+    
+    this.learningData = {
+      requestCount: 0,
+      routes: {} 
+    };
+  }
+
+  /**
+   * Analyzes payload for anomalies
+   * @param {string} normalizedPayload 
+   * @param {Object} context 
+   * @returns {Array<Object>}
+   */
+  analyze(normalizedPayload, context = {}) {
+    const signals = [];
+    const {
+      decodingIterations = 0,
+      paramName = '',
+      source = 'query',
+      contentType = '',
+      route = '',
+      method = 'GET'
+    } = context;
+
+    const payload = normalizedPayload || '';
+    const len = payload.length;
+
+    // 6.1 Entropy
+    if (len > 5) {
+      const entropy = shannonEntropy(payload);
+      if (entropy > this.options.entropyThreshold) {
+        signals.push({ id: 'high-entropy-payload', confidence: 0.40, label: 'anomaly' });
+      }
+    }
+
+    // 6.2 Encoding Depth
+    if (decodingIterations >= 5) {
+      signals.push({ id: 'extreme-encoding', confidence: 0.70, label: 'anomaly' });
+    } else if (decodingIterations >= 3) {
+      signals.push({ id: 'deep-encoding', confidence: 0.50, label: 'anomaly' });
+    }
+
+    // 6.3 Structural Anomaly
+    if (len > 0) {
+      let specialChars = 0;
+      let hasNullByte = false;
+      let hasControlChar = false;
+      let hasUnusualUnicode = false;
+
+      for (let i = 0; i < len; i++) {
+        const code = payload.charCodeAt(i);
+        if (code === 0) hasNullByte = true;
+        else if (code > 0 && code < 32 && code !== 9 && code !== 10 && code !== 13) hasControlChar = true;
+        
+        if (!(code >= 48 && code <= 57) && !(code >= 65 && code <= 90) && !(code >= 97 && code <= 122) && code !== 32) {
+          specialChars++;
+        }
+
+        if (code >= 0x0400 && code <= 0x04FF) hasUnusualUnicode = true; // Cyrillic
+        if (code >= 0x2200 && code <= 0x22FF) hasUnusualUnicode = true; // Math Operators
+        if (code >= 0xFF00 && code <= 0xFFEF) hasUnusualUnicode = true; // Fullwidth
+      }
+
+      if (specialChars / len > this.options.specialCharRatio) {
+        signals.push({ id: 'high-special-char-ratio', confidence: 0.35, label: 'anomaly' });
+      }
+      if (hasNullByte) {
+        signals.push({ id: 'null-bytes-present', confidence: 0.50, label: 'anomaly' });
+      }
+      if (hasControlChar) {
+        signals.push({ id: 'control-chars-present', confidence: 0.40, label: 'anomaly' });
+      }
+      if (hasUnusualUnicode) {
+        signals.push({ id: 'unusual-unicode', confidence: 0.45, label: 'anomaly' });
+      }
+    }
+
+    // 6.4 Payload Length
+    if (source === 'query' && len > 500) {
+      signals.push({ id: 'oversized-query-param', confidence: 0.30, label: 'anomaly' });
+    }
+    if (source === 'cookie' && len > 4096) {
+      signals.push({ id: 'oversized-cookie', confidence: 0.35, label: 'anomaly' });
+    }
+    if (source === 'header' && len > 8192) {
+      signals.push({ id: 'oversized-header', confidence: 0.35, label: 'anomaly' });
+    }
+
+    // Excessively deep JSON nesting (>10 levels)
+    if (source === 'body' && contentType && contentType.includes('application/json')) {
+      let maxDepth = 0;
+      let currentDepth = 0;
+      for (let i = 0; i < len; i++) {
+        if (payload[i] === '{' || payload[i] === '[') {
+          currentDepth++;
+          if (currentDepth > maxDepth) maxDepth = currentDepth;
+        } else if (payload[i] === '}' || payload[i] === ']') {
+          currentDepth--;
+        }
+      }
+      if (maxDepth > 10) {
+        signals.push({ id: 'excessively-deep-json', confidence: 0.80, label: 'anomaly' });
+      }
+    }
+
+    // Abnormal content-length vs actual body size
+    if (source === 'body' && context.contentLengthHeader) {
+      const declaredLen = parseInt(context.contentLengthHeader, 10);
+      if (!isNaN(declaredLen)) {
+        // Flag if difference is more than 50% or minimum 50 bytes
+        if (Math.abs(declaredLen - len) > Math.max(50, declaredLen * 0.5)) {
+          signals.push({ id: 'abnormal-content-length', confidence: 0.60, label: 'anomaly' });
+        }
+      }
+    }
+
+    // Unusually high entropy strings (encoded shellcode)
+    if (len > 20) {
+      const entropy = shannonEntropy(payload);
+      if (entropy > this.options.entropyThreshold + 1.5) { // e.g. > 6.0
+        signals.push({ id: 'high-entropy-shellcode', confidence: 0.70, label: 'anomaly' });
+      } else if (entropy > this.options.entropyThreshold) {
+        // Prevent duplicate high-entropy-payload signal if we already pushed one in 6.1
+        if (!signals.some(s => s.id === 'high-entropy-payload')) {
+          signals.push({ id: 'high-entropy-payload', confidence: 0.40, label: 'anomaly' });
+        }
+      }
+    }
+
+    // 6.5 Content-Type Mismatch
+    if (source === 'body' && contentType) {
+      const isJson = contentType.includes('application/json');
+      const isForm = contentType.includes('application/x-www-form-urlencoded') || contentType.includes('text/plain');
+      
+      const looksLikeJson = (payload.startsWith('{') && payload.endsWith('}')) || (payload.startsWith('[') && payload.endsWith(']'));
+      if (looksLikeJson && isForm) {
+        signals.push({ id: 'content-type-mismatch', confidence: 0.55, label: 'anomaly' });
+      }
+
+      const looksLikeXml = payload.includes('<!DOCTYPE') || payload.includes('<?xml');
+      if (looksLikeXml && isJson) {
+        signals.push({ id: 'xml-in-json-endpoint', confidence: 0.60, label: 'anomaly' });
+      }
+    }
+
+    // 6.6 Request Fingerprinting
+    if (route) {
+      const routeKey = `${method} ${route}`;
+      if (!this.learningData.routes[routeKey]) {
+        this.learningData.routes[routeKey] = {
+          params: new Set(),
+          maxLengths: {},
+          contentTypes: new Set()
+        };
+      }
+      
+      const rData = this.learningData.routes[routeKey];
+      
+      if (this.learningData.requestCount < this.options.learningRequests) {
+        // Learning Mode
+        if (paramName) {
+          rData.params.add(paramName);
+          rData.maxLengths[paramName] = Math.max(rData.maxLengths[paramName] || 0, len);
+        }
+        if (contentType) rData.contentTypes.add(contentType);
+      } else {
+        // Enforcement Mode
+        if (paramName && !rData.params.has(paramName)) {
+          signals.push({ id: 'unknown-parameter', confidence: 0.30, label: 'anomaly' });
+        }
+        if (paramName && rData.maxLengths[paramName] && len > (rData.maxLengths[paramName] * 3)) {
+          signals.push({ id: 'value-length-deviation', confidence: 0.35, label: 'anomaly' });
+        }
+        if (contentType && rData.contentTypes.size > 0 && !rData.contentTypes.has(contentType)) {
+          signals.push({ id: 'unexpected-content-type', confidence: 0.40, label: 'anomaly' });
+        }
+      }
+    }
+
+    // Repeated rapid requests from same fingerprint and Scanner fingerprints
+    const fingerprint = context.ip ? (context.userAgent ? `${context.ip}|${context.userAgent}` : context.ip) : null;
+    
+    if (fingerprint) {
+      if (!this.learningData.fingerprints) {
+        this.learningData.fingerprints = {};
+      }
+      const now = Date.now();
+      const fpData = this.learningData.fingerprints[fingerprint] || { count: 0, firstSeen: now, routes: new Set() };
+      
+      // Time window of 10 seconds for rapid requests
+      if (now - fpData.firstSeen > 10000) {
+        fpData.count = 1;
+        fpData.firstSeen = now;
+        fpData.routes.clear();
+      } else {
+        fpData.count++;
+      }
+      
+      if (route) {
+        fpData.routes.add(route);
+      }
+      
+      this.learningData.fingerprints[fingerprint] = fpData;
+
+      if (fpData.count > 50) {
+        signals.push({ id: 'repeated-rapid-requests', confidence: 0.75, label: 'anomaly' });
+      }
+      
+      if (fpData.routes.size > 15) {
+        signals.push({ id: 'scanner-fingerprint', confidence: 0.80, label: 'anomaly' });
+      }
+    }
+    
+    if (signals.length > 0 && typeof this.options.onAnomaly === 'function') {
+      try {
+        this.options.onAnomaly(signals, context);
+      } catch (e) {
+        // ignore callback errors
+      }
+    }
+
+    return signals;
+  }
+  
+  incrementRequestCount() {
+    if (this.learningData.requestCount < this.options.learningRequests) {
+      this.learningData.requestCount++;
+    }
+  }
+}
+
+module.exports = { BehavioralAnalyzer };

package/src/core/confidence.js

@@ -0,0 +1,23 @@
+'use strict';
+
+function matchSignals(variants, signalDefinitions, label) {
+    const matchesById = new Map();
+    for (const variant of variants) {
+      for (const signal of signalDefinitions) {
+        const matched = signal.pattern ? signal.pattern.test(variant) : signal.test(variant);
+        if (!matched || matchesById.has(signal.id)) continue;
+        matchesById.set(signal.id, {
+          id: signal.id,
+          label,
+          confidence: signal.confidence
+        });
+      }
+    }
+    return [...matchesById.values()];
+}
+
+function combineConfidence(matches) {
+    return matches.reduce((total, match) => total + match.confidence * (1 - total), 0);
+}
+
+module.exports = { matchSignals, combineConfidence };