@chiranthmoger/fortifyjs 1.1.0

package/src/core/engine.js

@@ -0,0 +1,162 @@
+'use strict';
+
+const { Normalizer } = require('./normalizer');
+const { matchSignals, combineConfidence } = require('./confidence');
+const { Whitelist } = require('./whitelist');
+const { BehavioralAnalyzer } = require('../analyzers/behavioral');
+const sqliDetector = require('../detectors/sqli');
+const xssDetector = require('../detectors/xss');
+const nosqliDetector = require('../detectors/nosqli');
+const cmdiDetector = require('../detectors/cmdi');
+const pathTraversalDetector = require('../detectors/path-traversal');
+const ssrfDetector = require('../detectors/ssrf');
+const xxeDetector = require('../detectors/xxe');
+const prototypePollutionDetector = require('../detectors/prototype-pollution');
+const hppDetector = require('../detectors/hpp');
+const openRedirectDetector = require('../detectors/open-redirect');
+const crlfDetector = require('../detectors/crlf');
+const templateInjectionDetector = require('../detectors/template-injection');
+const ldapDetector = require('../detectors/ldap');
+const graphqlDetector = require('../detectors/graphql');
+
+function classifyInputType(payload) {
+  const str = String(payload).trim();
+  const upper = str.toUpperCase();
+  
+  const startsWithSqlKeyword = /^(?:SELECT|INSERT|UPDATE|DELETE|WITH|CREATE|ALTER)\b/.test(upper);
+  
+  // Simple heuristic for quote breakouts
+  const hasUnmatchedQuote = (str.match(/'/g) || []).length % 2 !== 0;
+  const hasCommentBreakout = /'--|'\/\*/.test(str);
+  
+  if (startsWithSqlKeyword && !hasUnmatchedQuote && !hasCommentBreakout) {
+    return 'complete-statement';
+  }
+  return 'fragment';
+}
+
+class DetectionEngine {
+  constructor(options = {}) {
+    this.options = options;
+    this.detectors = [
+      sqliDetector, 
+      xssDetector, 
+      nosqliDetector, 
+      cmdiDetector, 
+      pathTraversalDetector, 
+      ssrfDetector, 
+      xxeDetector, 
+      prototypePollutionDetector, 
+      hppDetector, 
+      openRedirectDetector,
+      crlfDetector,
+      templateInjectionDetector,
+      ldapDetector,
+      graphqlDetector
+    ];
+    this.behavioralAnalyzer = new BehavioralAnalyzer(options.behavioral || {});
+    this.whitelist = new Whitelist();
+    if (options.whitelist) {
+      if (Array.isArray(options.whitelist.exact)) {
+        options.whitelist.exact.forEach(e => this.whitelist.addExact(e));
+      }
+      if (Array.isArray(options.whitelist.prefix)) {
+        options.whitelist.prefix.forEach(p => this.whitelist.addPrefix(p));
+      }
+      if (Array.isArray(options.whitelist.pattern)) {
+        options.whitelist.pattern.forEach(r => this.whitelist.addPattern(r));
+      }
+    }
+  }
+
+  detect(payload, context = {}) {
+    if (this.whitelist.isWhitelisted(payload)) {
+      return { label: 'benign', confidence: 0, whitelisted: true };
+    }
+    const variants = Normalizer.payloadVariants(payload, this.options);
+    let allMatches = [];
+    let maxConfidence = 0;
+    let maxLabel = 'benign';
+    let scores = {};
+
+    let activeDetectors = this.detectors;
+    if (context && context.source) {
+      if (context.source === 'filename') {
+        activeDetectors = this.detectors.filter(d => ['path-traversal', 'file-upload'].includes(d.name));
+      } else if (context.source === 'header') {
+        const headerChecks = ['crlf', 'xss', 'sqli', 'nosqli', 'cmdi', 'template-injection', 'ldap', 'graphql'];
+        activeDetectors = this.detectors.filter(d => headerChecks.includes(d.name));
+      }
+    }
+
+    const classification = classifyInputType(payload);
+    const isQueryMode = this.options.mode === 'query';
+
+    for (const detector of activeDetectors) {
+      let signals = detector.getSignals();
+      if (isQueryMode && detector.name === 'sqli') {
+        signals = signals.filter(s => s.id !== 'sql-structural-boolean');
+      }
+
+      const matches = matchSignals(variants, signals, detector.label);
+      const confidence = combineConfidence(matches);
+      allMatches.push(...matches);
+      scores[detector.name] = matches.length;
+      if (confidence > maxConfidence) {
+        maxConfidence = confidence;
+        maxLabel = detector.label;
+      }
+    }
+
+    const primaryVariant = variants.length > 0 ? variants[0] : payload;
+    const anomalySignals = this.behavioralAnalyzer.analyze(primaryVariant, context);
+    
+    if (anomalySignals.length > 0) {
+      const anomalyConfidence = combineConfidence(anomalySignals);
+      allMatches.push(...anomalySignals);
+      scores['behavioral'] = anomalySignals.length;
+      
+      if (anomalyConfidence > maxConfidence) {
+        maxConfidence = anomalyConfidence;
+        maxLabel = 'anomaly';
+      }
+    }
+
+    if (context.route) {
+      this.behavioralAnalyzer.incrementRequestCount();
+    }
+
+    let totalConfidence = Math.min(1.0, combineConfidence(allMatches));
+
+    if (isQueryMode) {
+      if (classification === 'complete-statement') {
+        totalConfidence = totalConfidence * 0.3;
+        maxConfidence = maxConfidence * 0.3;
+      }
+    }
+
+    const blockThreshold = this.options.blockThreshold !== undefined ? this.options.blockThreshold : 0.5;
+    const minimumSignals = this.options.minimumSignals !== undefined ? this.options.minimumSignals : 1;
+
+    let finalLabel = totalConfidence === 0 ? 'benign' : maxLabel;
+
+    if (finalLabel !== 'benign' && finalLabel !== 'anomaly') {
+      let requiredSignals = minimumSignals;
+      if (finalLabel === 'path-traversal') {
+        requiredSignals = Math.max(requiredSignals, 2);
+      }
+
+      if (maxConfidence < blockThreshold || allMatches.length < requiredSignals) {
+        finalLabel = 'anomaly';
+      }
+    }
+
+    return {
+      label: finalLabel,
+      confidence: totalConfidence,
+      scores,
+      matches: allMatches
+    };
+  }
+}
+module.exports = { DetectionEngine };

package/src/core/normalizer.js

@@ -0,0 +1,149 @@
+'use strict';
+
+const SQL_IDENTIFIER = '(?:`[^`]+`|"[^"]+"|\\[[^\\]]+\\]|[A-Za-z_][\\w$]*)';
+const SQL_WORD_BOOLEAN_OPERATOR = '(?:OR|AND|XOR)';
+const SQL_SYMBOL_BOOLEAN_OPERATOR = '(?:\\|\\||&&)';
+const SQL_BOOLEAN_OPERATOR = `(?:(?:\\b${SQL_WORD_BOOLEAN_OPERATOR}\\b)|${SQL_SYMBOL_BOOLEAN_OPERATOR})`;
+const SQL_COMPARISON_OPERATOR = '(?:=|LIKE|!=|<>|<=|>=|<|>)';
+const SQL_FUNCTION_CALL = `${SQL_IDENTIFIER}\\s*\\((?:[^()]|\\([^()]{0,120}\\)){0,240}\\)`;
+const SQL_CONSTANT_VALUE = `(?:${SQL_FUNCTION_CALL}|\\d+(?:\\.\\d+)?|N?[\'"][^\'"]{0,80}[\'"]?|NULL)`;
+const SQL_VALUE = `(?:${SQL_FUNCTION_CALL}|\\d+(?:\\.\\d+)?|N?[\'"][^\'"]{0,80}[\'"]?|[A-Za-z_][\\w.]*|NULL)`;
+const SQL_CONSTANT_COMPARISON_EXPRESSION = `${SQL_CONSTANT_VALUE}\\s*${SQL_COMPARISON_OPERATOR}\\s*${SQL_CONSTANT_VALUE}`;
+const SQL_COMPARISON_EXPRESSION = `${SQL_VALUE}\\s*${SQL_COMPARISON_OPERATOR}\\s*${SQL_VALUE}`;
+const SQL_BETWEEN_EXPRESSION = `${SQL_VALUE}\\s+BETWEEN\\s+${SQL_VALUE}\\s+AND\\s+${SQL_VALUE}`;
+const SQL_IS_EXPRESSION = `${SQL_VALUE}\\s+IS\\s+(?:NOT\\s+)?NULL`;
+const SQL_EXISTS_EXPRESSION = `EXISTS\\s*\\(\\s*SELECT\\b`;
+const SQL_BOOLEAN_LITERAL_EXPRESSION = '(?:TRUE|FALSE|UNKNOWN|NULL)';
+const SQL_BOOLEAN_EXPRESSION = `(?:${SQL_COMPARISON_EXPRESSION}|${SQL_BETWEEN_EXPRESSION}|${SQL_IS_EXPRESSION}|${SQL_EXISTS_EXPRESSION}|${SQL_BOOLEAN_LITERAL_EXPRESSION})`;
+const SQL_CONSTANT_BOOLEAN_EXPRESSION = `(?:${SQL_CONSTANT_COMPARISON_EXPRESSION}|${SQL_BETWEEN_EXPRESSION}|${SQL_IS_EXPRESSION}|${SQL_EXISTS_EXPRESSION}|${SQL_BOOLEAN_LITERAL_EXPRESSION})`;
+const SQL_STACKED_STATEMENT_KEYWORD = '(?:SELECT|WITH|UNION|DROP|INSERT|UPDATE|DELETE|ALTER|CREATE|EXEC|EXECUTE|CALL|MERGE|TRUNCATE)';
+const SQL_METADATA_OBJECT = '(?:information_schema(?:\\.[A-Za-z_][\\w$]*)?|sysobjects|sys\\.(?:tables|columns|objects|databases|schemas|indexes|all_columns)|sqlite_master|sqlite_schema|pg_catalog(?:\\.[A-Za-z_][\\w$]*)?|pg_(?:class|tables|namespace|attribute|database|user)|mysql\\.(?:innodb_table_stats|innodb_index_stats|user|db|tables_priv|columns_priv|proc|tables)|(?:all|user|dba)_(?:tables|tab_columns|objects|users|catalog|constraints|cons_columns|views))';
+const SQL_METADATA_QUERY_CONTEXT = '(?:SELECT|FROM|JOIN|WHERE|COUNT\\s*\\(|EXISTS\\s*\\(|SHOW\\s+(?:FULL\\s+)?(?:TABLES|COLUMNS)|DESCRIBE|DESC)';
+const HTTP_METHODS = ['all', 'get', 'post', 'put', 'patch', 'delete', 'head', 'options'];
+const DEFAULT_REDACT_KEYS = ['password', 'passwd', 'pwd', 'token', 'secret', 'authorization', 'cookie', 'api_key', 'apikey'];
+const NAMED_ENTITIES = {
+  lt: '<',
+  gt: '>',
+  quot: '"',
+  apos: "'",
+  amp: '&',
+  colon: ':',
+  sol: '/',
+  equals: '=',
+  lpar: '(',
+  rpar: ')',
+  tab: '\t',
+  newline: '\n',
+  grave: '`'
+};
+const NAMED_ENTITY_PATTERN = new RegExp(`&(${Object.keys(NAMED_ENTITIES).sort((a, b) => b.length - a.length).join('|')});?`, 'gi');
+const sqlWord = (word) => word.split('').join('[\\s\\u00a0]*');
+class Normalizer {
+  static decodeDeeply(payload, maxPayloadLength = 50000, maxDecodeIterations = 8) {
+    return Normalizer.normalizePayload(payload, { sqlCommentMode: 'space' });
+  }
+
+  static normalizePayload(payload, { sqlCommentMode = 'space', maxPayloadLength = 50000, maxDecodeIterations = 8 } = {}) {
+    if (Buffer.isBuffer(payload)) payload = payload.toString('utf8');
+    if (typeof payload !== 'string') return '';
+    if (payload.length > maxPayloadLength) {
+      const headLength = Math.ceil(maxPayloadLength / 2);
+      const tailLength = Math.floor(maxPayloadLength / 2);
+      payload = `${payload.slice(0, headLength)}\nfortifyjs_TRUNCATED\n${tailLength > 0 ? payload.slice(-tailLength) : ''}`;
+    }
+    const decodeEntity = (match, hex, dec) => {
+      const code = parseInt(hex || dec, hex ? 16 : 10);
+      return Number.isFinite(code) && code <= 0x10ffff ? String.fromCodePoint(code) : match;
+    };
+    const decodeCodePoint = (match, hex) => {
+      const code = parseInt(hex, 16);
+      return Number.isFinite(code) && code <= 0x10ffff ? String.fromCodePoint(code) : match;
+    };
+
+    const normalize = (value) => {
+      let normalized = value
+        .replace(/%u([0-9a-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+        .replace(/\\u\{([0-9a-fA-F]{1,6})\}/g, decodeCodePoint)
+        .replace(/\\u([0-9a-fA-F]{4})/g, decodeCodePoint)
+        .replace(/\\x([0-9a-fA-F]{2})/g, decodeCodePoint)
+        .replace(/&#x([0-9a-fA-F]+);?|&#(\d+);?/g, decodeEntity)
+        .replace(NAMED_ENTITY_PATTERN, (match, name) => NAMED_ENTITIES[name.toLowerCase()] ?? match)
+        .replace(/[\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]/g, ' ')
+        .replace(/[\u200b-\u200d\ufeff]/g, '')
+        .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
+      try {
+        normalized = normalized.normalize('NFKC');
+      } catch (e) {}
+      return normalized;
+    };
+    const decodePrintableBase64 = (candidate) => {
+      try {
+        const b64Decoded = Buffer.from(candidate, 'base64').toString('utf8');
+        const nonPrintableCount = b64Decoded.replace(/[\t\r\n\x20-\x7E]/g, '').length;
+        const isMostlyPrintable = b64Decoded.length > 0 && nonPrintableCount / b64Decoded.length < 0.1;
+        return isMostlyPrintable && b64Decoded !== candidate ? b64Decoded : null;
+      } catch (e) {
+        return null;
+      }
+    };
+
+    // Iterate decoding to catch multi-layer encoding
+    let decoded = normalize(payload);
+    let previous = "";
+    let iterations = 0;
+    while (decoded !== previous && iterations < maxDecodeIterations) {
+      previous = decoded;
+      try { 
+        decoded = normalize(decodeURIComponent(decoded)); 
+      } catch (e) { 
+        decoded = normalize(decoded.replace(/%([0-9a-fA-F]{2})/g, (match, hex) => {
+          try {
+            return decodeURIComponent(match);
+          } catch {
+            return String.fromCharCode(parseInt(hex, 16));
+          }
+        }));
+      }
+      iterations++;
+    }
+    const base64Candidate = decoded;
+    decoded = decoded.replace(/\bdata\s*:\s*([a-z0-9.+-]+\/[a-z0-9.+-]+)(?:;[a-z0-9=.+-]+)*;base64\s*,([A-Za-z0-9+/]+={0,2})/ig, (match, mimeType, data) => {
+      if (!/^(?:text\/html|image\/svg\+xml|application\/xhtml\+xml)$/i.test(mimeType)) return match;
+      const dataDecoded = decodePrintableBase64(data);
+      const marker = /^image\/svg\+xml$/i.test(mimeType) ? '\nSVG_DATA_URI' : '';
+      return dataDecoded ? `${match}${marker}\n${normalize(dataDecoded).replace(/\+/g, ' ')}` : match;
+    });
+    decoded = decoded.replace(/\+/g, ' ');
+    if (/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(base64Candidate)) {
+      const b64Decoded = decodePrintableBase64(base64Candidate);
+      if (b64Decoded) decoded += `\n${normalize(b64Decoded).replace(/\+/g, ' ')}`;
+    }
+    if (sqlCommentMode === 'preserve') return decoded;
+    // Preserve SQL block comments as separators so UNION/**/SELECT stays tokenized.
+    // Detection also checks a removal variant to catch mid-keyword comment splits.
+    decoded = decoded.replace(/\/\*!\d{0,6}\s*([\s\S]*?)\*\//g, (_, inner) => {
+      const executableSql = inner.trim();
+      if (sqlCommentMode === 'remove') return executableSql;
+      return executableSql ? ` MYSQL_VERSIONED_COMMENT ${executableSql} ` : ' MYSQL_VERSIONED_COMMENT ';
+    });
+    decoded = decoded.replace(/\/\*[\s\S]*?\*\//g, sqlCommentMode === 'remove' ? '' : ' ');
+    decoded = decoded.replace(/--[^\r\n]*(?=\r?\n|$)/g, ' ');
+    decoded = decoded.replace(/#[^\r\n]*(?=\r?\n|$)/g, ' ');
+    return decoded;
+  }
+
+  static payloadVariants(payload, options = {}) {
+    const variants = [
+      Normalizer.normalizePayload(payload, { sqlCommentMode: 'preserve' }),
+      Normalizer.normalizePayload(payload, { sqlCommentMode: 'space' }),
+      Normalizer.normalizePayload(payload, { sqlCommentMode: 'remove' })
+    ];
+    return [...new Set(variants.filter(Boolean))];
+  }
+}
+module.exports = {
+  Normalizer,
+  SQL_IDENTIFIER,
+  NAMED_ENTITIES,
+  sqlWord
+};

package/src/core/whitelist.js

@@ -0,0 +1,40 @@
+'use strict';
+
+class Whitelist {
+  constructor() {
+    this.patterns = [];
+    this.exacts = new Set();
+    this.prefixes = [];
+  }
+
+  addPattern(regex) {
+    this.patterns.push(regex);
+  }
+
+  addExact(str) {
+    this.exacts.add(str);
+  }
+
+  addPrefix(str) {
+    this.prefixes.push(str);
+  }
+
+  isWhitelisted(payload) {
+    if (this.exacts.has(payload)) {
+      return true;
+    }
+    for (const prefix of this.prefixes) {
+      if (payload.startsWith(prefix)) {
+        return true;
+      }
+    }
+    for (const pattern of this.patterns) {
+      if (pattern.test(payload)) {
+        return true;
+      }
+    }
+    return false;
+  }
+}
+
+module.exports = { Whitelist };

package/src/dashboard/handler.js

@@ -0,0 +1,307 @@
+'use strict';
+
+/**
+ * Creates the dashboard middleware
+ * @param {Object} options 
+ * @param {Object} logger Instance of Logger
+ * @returns {Function} Express/Connect middleware
+ */
+function createDashboardHandler(options = {}, logger) {
+  const path = options.path || '/__fortifyjs/dashboard';
+  const apiEventsPath = `${path}/api/events`;
+  const apiStatsPath = `${path}/api/stats`;
+  
+  const authMiddleware = options.auth || ((req, res, next) => {
+    logger.warn('Dashboard accessed without authentication configured!');
+    next();
+  });
+
+  const htmlTemplate = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>FortifyJS Dashboard</title>
+  <style>
+    :root {
+      --bg: #0f172a;
+      --card-bg: rgba(30, 41, 59, 0.7);
+      --border: rgba(255, 255, 255, 0.1);
+      --text: #f8fafc;
+      --text-muted: #94a3b8;
+      --accent: #38bdf8;
+      --danger: #f43f5e;
+      --warning: #fbbf24;
+      --success: #10b981;
+    }
+    body {
+      margin: 0;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+      background: var(--bg);
+      color: var(--text);
+      min-height: 100vh;
+      display: flex;
+      flex-direction: column;
+    }
+    .glass {
+      background: var(--card-bg);
+      backdrop-filter: blur(10px);
+      -webkit-backdrop-filter: blur(10px);
+      border: 1px solid var(--border);
+      border-radius: 12px;
+    }
+    header {
+      padding: 1rem 2rem;
+      border-bottom: 1px solid var(--border);
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+    }
+    header h1 {
+      margin: 0;
+      font-size: 1.5rem;
+      display: flex;
+      align-items: center;
+      gap: 0.5rem;
+    }
+    .badge {
+      padding: 0.25rem 0.5rem;
+      border-radius: 999px;
+      font-size: 0.75rem;
+      font-weight: bold;
+      text-transform: uppercase;
+    }
+    .badge-danger { background: rgba(244, 63, 94, 0.2); color: var(--danger); }
+    .badge-warning { background: rgba(251, 191, 36, 0.2); color: var(--warning); }
+    .badge-success { background: rgba(16, 185, 129, 0.2); color: var(--success); }
+    main {
+      padding: 2rem;
+      flex: 1;
+      display: grid;
+      grid-template-columns: 1fr 1fr;
+      gap: 1.5rem;
+      max-width: 1400px;
+      margin: 0 auto;
+      width: 100%;
+      box-sizing: border-box;
+    }
+    .panel {
+      padding: 1.5rem;
+      display: flex;
+      flex-direction: column;
+    }
+    .panel h2 {
+      margin-top: 0;
+      font-size: 1.25rem;
+      border-bottom: 1px solid var(--border);
+      padding-bottom: 0.75rem;
+    }
+    .full-width { grid-column: 1 / -1; }
+    table {
+      width: 100%;
+      border-collapse: collapse;
+      text-align: left;
+    }
+    th, td {
+      padding: 0.75rem 1rem;
+      border-bottom: 1px solid var(--border);
+    }
+    th {
+      color: var(--text-muted);
+      font-weight: 600;
+      font-size: 0.875rem;
+    }
+    tbody tr:hover {
+      background: rgba(255, 255, 255, 0.05);
+    }
+    .empty-state {
+      padding: 3rem;
+      text-align: center;
+      color: var(--text-muted);
+    }
+    .stat-grid {
+      display: grid;
+      grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+      gap: 1rem;
+      margin-bottom: 1.5rem;
+    }
+    .stat-card {
+      padding: 1.5rem;
+      text-align: center;
+    }
+    .stat-value {
+      font-size: 2.5rem;
+      font-weight: bold;
+      margin: 0.5rem 0;
+    }
+    .stat-label {
+      color: var(--text-muted);
+      font-size: 0.875rem;
+      text-transform: uppercase;
+    }
+  </style>
+</head>
+<body>
+  <header class="glass">
+    <h1>🛡️ FortifyJS</h1>
+    <div>
+      <span class="badge badge-success">Live Monitoring</span>
+    </div>
+  </header>
+  
+  <main>
+    <div class="full-width stat-grid" id="stats">
+      <!-- Stats will load here -->
+    </div>
+
+    <div class="panel glass full-width">
+      <h2>Recent Threats Feed</h2>
+      <div style="overflow-x: auto;">
+        <table id="events-table">
+          <thead>
+            <tr>
+              <th>Time</th>
+              <th>Threat</th>
+              <th>Action</th>
+              <th>IP / Actor</th>
+              <th>Route</th>
+              <th>Details</th>
+            </tr>
+          </thead>
+          <tbody>
+            <!-- Events load here -->
+          </tbody>
+        </table>
+      </div>
+    </div>
+  </main>
+
+  <script>
+    async function loadData() {
+      try {
+        const eventsRes = await fetch('${apiEventsPath}');
+        const events = await eventsRes.json();
+        
+        const statsRes = await fetch('${apiStatsPath}');
+        const stats = await statsRes.json();
+
+        renderStats(stats);
+        renderEvents(events);
+      } catch (err) {
+        console.error('Failed to load dashboard data', err);
+      }
+    }
+
+    function renderStats(stats) {
+      document.getElementById('stats').innerHTML = \`
+        <div class="stat-card glass">
+          <div class="stat-label">Total Blocked</div>
+          <div class="stat-value" style="color: var(--danger)">\${stats.blocked}</div>
+        </div>
+        <div class="stat-card glass">
+          <div class="stat-label">Total Allowed</div>
+          <div class="stat-value" style="color: var(--success)">\${stats.allowed}</div>
+        </div>
+        <div class="stat-card glass">
+          <div class="stat-label">Top Threat</div>
+          <div class="stat-value" style="color: var(--warning); font-size: 1.5rem; line-height: 2.5rem;">
+            \${stats.topThreat || 'None'}
+          </div>
+        </div>
+      \`;
+    }
+
+    function renderEvents(events) {
+      const tbody = document.querySelector('#events-table tbody');
+      if (!events || events.length === 0) {
+        tbody.innerHTML = '<tr><td colspan="6"><div class="empty-state">No threats detected yet.</div></td></tr>';
+        return;
+      }
+
+      tbody.innerHTML = events.map(e => {
+        const date = new Date(e.timestamp).toLocaleTimeString();
+        const badgeClass = e.meta?.action === 'block' ? 'badge-danger' : (e.level === 'warn' ? 'badge-warning' : 'badge-success');
+        const action = e.meta?.action || 'observe';
+        const label = e.meta?.label || 'unknown';
+        const ip = e.meta?.ip || 'unknown';
+        const route = e.meta?.route || 'unknown';
+        
+        return \`
+          <tr>
+            <td style="color: var(--text-muted)">\${date}</td>
+            <td><span class="badge \${badgeClass}">\${label}</span></td>
+            <td>\${action.toUpperCase()}</td>
+            <td><code>\${ip}</code></td>
+            <td><code>\${route}</code></td>
+            <td style="font-size: 0.875rem; color: var(--text-muted); max-width: 300px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis;" title='\${e.message}'>
+              \${e.message}
+            </td>
+          </tr>
+        \`;
+      }).join('');
+    }
+
+    // Refresh every 5 seconds
+    loadData();
+    setInterval(loadData, 5000);
+  </script>
+</body>
+</html>`;
+
+  return function dashboardMiddleware(req, res, next) {
+    if (req.path === path || req.path === path + '/') {
+      return authMiddleware(req, res, (err) => {
+        if (err) return next(err);
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.end(htmlTemplate);
+      });
+    }
+
+    if (req.path === apiEventsPath) {
+      return authMiddleware(req, res, (err) => {
+        if (err) return next(err);
+        const logs = logger.getLogs(100).filter(l => l.level === 'warn' || l.level === 'error');
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify(logs));
+      });
+    }
+
+    if (req.path === apiStatsPath) {
+      return authMiddleware(req, res, (err) => {
+        if (err) return next(err);
+        const allLogs = logger.getLogs(1000);
+        const stats = {
+          blocked: 0,
+          allowed: 0,
+          threatCounts: {}
+        };
+
+        allLogs.forEach(l => {
+          if (l.meta?.action === 'block') stats.blocked++;
+          else stats.allowed++;
+
+          if (l.meta?.label) {
+            stats.threatCounts[l.meta.label] = (stats.threatCounts[l.meta.label] || 0) + 1;
+          }
+        });
+
+        let topThreat = null;
+        let maxCount = 0;
+        for (const [threat, count] of Object.entries(stats.threatCounts)) {
+          if (count > maxCount) {
+            maxCount = count;
+            topThreat = threat;
+          }
+        }
+        stats.topThreat = topThreat;
+
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify(stats));
+      });
+    }
+
+    next();
+  };
+}
+
+module.exports = { createDashboardHandler };