@chiranthmoger/fortifyjs 1.1.0

package/src/detectors/xss.js

@@ -0,0 +1,191 @@
+'use strict';
+
+const JS_EXECUTION_SINKS = new Set(['alert', 'confirm', 'prompt', 'eval', 'fetch', 'function', 'settimeout', 'setinterval']);
+const JS_GLOBAL_OBJECTS = new Set(['window', 'globalthis', 'self', 'top', 'parent']);
+function isAsciiLetter(ch) {
+  return /[A-Za-z]/.test(ch);
+}
+
+function isAsciiDigit(ch) {
+  return /[0-9]/.test(ch);
+}
+
+function isSqlWordStart(ch) {
+  return isAsciiLetter(ch) || ch === '_' || ch === '$';
+}
+
+function isSqlWordPart(ch) {
+  return isSqlWordStart(ch) || isAsciiDigit(ch);
+}
+
+function tokenizeJsFragment(value) {
+  const text = String(value);
+  const tokens = [];
+  let i = 0;
+
+  while (i < text.length && tokens.length < 800) {
+    const ch = text[i];
+    if (/\s/.test(ch)) {
+      i++;
+      continue;
+    }
+    if (isSqlWordStart(ch)) {
+      const start = i;
+      i++;
+      while (i < text.length && isSqlWordPart(text[i])) i++;
+      tokens.push({ type: 'word', value: text.slice(start, i).toLowerCase() });
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === '`') {
+      const quote = ch;
+      let valueText = '';
+      i++;
+      while (i < text.length) {
+        if (text[i] === '\\') {
+          valueText += text[i + 1] || '';
+          i += 2;
+          continue;
+        }
+        if (text[i] === quote) {
+          i++;
+          break;
+        }
+        valueText += text[i];
+        i++;
+      }
+      tokens.push({ type: 'string', value: valueText.toLowerCase() });
+      continue;
+    }
+    if ('[]().,:;+-*/%{}='.includes(ch)) {
+      tokens.push({ type: 'punct', value: ch });
+    }
+    i++;
+  }
+
+  return tokens;
+}
+
+function javascriptUrlBodies(value) {
+  const text = String(value);
+  const bodies = [];
+  const protocol = /javascript\s*:/ig;
+  let match;
+
+  while ((match = protocol.exec(text)) !== null) {
+    bodies.push(text.slice(protocol.lastIndex, protocol.lastIndex + 300));
+  }
+
+  return bodies;
+}
+
+function hasStructuralJavascriptUrlSink(value) {
+  for (const body of javascriptUrlBodies(value)) {
+    const tokens = tokenizeJsFragment(body);
+    let constructorReferences = 0;
+    let hasCall = false;
+
+    for (let i = 0; i < tokens.length; i++) {
+      const token = tokens[i];
+      if (token.type === 'punct' && token.value === '(') hasCall = true;
+      if ((token.type === 'word' || token.type === 'string') && token.value === 'constructor') constructorReferences++;
+
+      if (token.type !== 'word') continue;
+      if (JS_EXECUTION_SINKS.has(token.value) && tokens.slice(i + 1, i + 4).some(next => next.value === '(')) return true;
+      if (token.value === 'document' && tokens.slice(i + 1, i + 3).some(next => next.value === '.')) return true;
+      if (JS_GLOBAL_OBJECTS.has(token.value) && tokens.slice(i + 1, i + 3).some(next => next.value === '.' || next.value === '[')) return true;
+    }
+
+    if (constructorReferences >= 2 && hasCall) return true;
+  }
+
+  return false;
+}
+
+module.exports = {
+  name: 'xss',
+  label: 'xss',
+  getSignals() {
+    return     [
+      {
+        id: 'script-tag',
+        confidence: 0.85,
+        pattern: /<\s*script\b/i
+      },
+      {
+        id: 'html-event-attribute',
+        confidence: 0.75,
+        pattern: /<[^>]+\bon\w+\s*=/i
+      },
+      {
+        id: 'event-handler-payload',
+        confidence: 0.75,
+        pattern: /\bon\w+\s*=\s*["']?[^"'>]*(?:alert|confirm|prompt|document\.|window\.|eval|fetch|Function\s*\()/i
+      },
+      {
+        id: 'javascript-url-with-sink',
+        confidence: 0.75,
+        pattern: /\bjavascript\s*:[\s\S]{0,240}(?:(?:alert|confirm|prompt|eval|fetch|Function|setTimeout|setInterval)\s*\(|document\s*\.|(?:window|globalThis|self|top|parent)\s*(?:\.|\[)|(?:\[\s*["']constructor["']\s*\]\s*){2})/i
+      },
+      {
+        id: 'javascript-url-structural-sink',
+        confidence: 0.75,
+        test: hasStructuralJavascriptUrlSink
+      },
+      {
+        id: 'javascript-url-attribute',
+        confidence: 0.75,
+        pattern: /\b(?:href|src|xlink:href|formaction|action)\s*=\s*["']?\s*javascript\s*:/i
+      },
+      {
+        id: 'javascript-url',
+        confidence: 0.3,
+        pattern: /\bjavascript\s*:/i
+      },
+      {
+        id: 'dangerous-html-container',
+        confidence: 0.7,
+        pattern: /<\s*(?:iframe|object|embed|applet)\b/i
+      },
+      {
+        id: 'srcdoc-html',
+        confidence: 0.65,
+        pattern: /\bsrcdoc\s*=/i
+      },
+      {
+        id: 'html-data-url',
+        confidence: 0.65,
+        pattern: /\bdata\s*:\s*text\/html/i
+      },
+      {
+        id: 'svg-data-url',
+        confidence: 0.65,
+        pattern: /(?:\bdata\s*:\s*image\/svg\+xml|SVG_DATA_URI)/i
+      },
+      {
+        id: 'mathml-xss-container',
+        confidence: 0.7,
+        pattern: /<\s*(?:math|mtext|mglyph|annotation-xml)\b/i
+      },
+      {
+        id: 'svg-xss-container',
+        confidence: 0.7,
+        pattern: /<\s*foreignObject\b/i
+      },
+      {
+        id: 'css-injection',
+        confidence: 0.8,
+        pattern: /(?:<\s*style[^>]*>[\s\S]*?|\bstyle\s*=\s*["']?[^"'>]*)(?:expression\s*\(|url\s*\(\s*["']?\s*javascript\s*:)/i
+      },
+      {
+        id: 'autofocus-event-bypass',
+        confidence: 0.8,
+        pattern: /<\s*[^>]*\bonfocus\b[^>]*\bautofocus\b|<\s*[^>]*\bautofocus\b[^>]*\bonfocus\b/i
+      },
+      {
+        id: 'media-error-bypass',
+        confidence: 0.8,
+        pattern: /<\s*(?:video|audio|picture)[^>]*>[\s\S]*?<\s*source[^>]*\bonerror\s*=/i
+      }
+    ]
+  }
+};

package/src/detectors/xxe.js

@@ -0,0 +1,45 @@
+'use strict';
+
+module.exports = {
+  name: 'xxe',
+  label: 'xxe',
+  getSignals() {
+    return [
+      {
+        id: 'xml-entity-declaration',
+        confidence: 0.85,
+        pattern: /<!ENTITY\s+/i
+      },
+      {
+        id: 'xml-system-entity',
+        confidence: 0.90,
+        pattern: /<!ENTITY\s+[^>]+SYSTEM\s+["'](?:file|http|https|expect):\/\//i
+      },
+      {
+        id: 'xml-public-entity',
+        confidence: 0.80,
+        pattern: /<!ENTITY\s+[^>]+PUBLIC\s+["']/i
+      },
+      {
+        id: 'xml-parameter-entity',
+        confidence: 0.80,
+        pattern: /<!ENTITY\s+%\s+[^>]+>/i
+      },
+      {
+        id: 'xml-entity-expansion',
+        confidence: 0.85,
+        pattern: /<!ENTITY\s+[^>]+>\s*<!ENTITY\s+[^>]+&(?:[a-zA-Z0-9_]+);/i
+      },
+      {
+        id: 'xml-doctype',
+        confidence: 0.50,
+        pattern: /<!DOCTYPE\s+/i
+      },
+      {
+        id: 'xml-cdata-injection',
+        confidence: 0.60,
+        pattern: /<!\[CDATA\[.*(?:<script|javascript:|on[a-z]+(?:=>|=)).*]]>/i
+      }
+    ];
+  }
+};

package/src/forensics/reporter.js

@@ -0,0 +1,74 @@
+'use strict';
+
+class ForensicsReporter {
+  constructor(maxSize = 1000) {
+    this.maxSize = maxSize;
+    this.buffer = [];
+    this.pointer = 0;
+  }
+
+  logBlock(details = {}) {
+    const {
+      ip = 'unknown',
+      method = 'UNKNOWN',
+      path = '/',
+      detector = 'unknown',
+      confidence = 0,
+      payload = '',
+      matchedStrings = []
+    } = details;
+
+    let sanitizedPayload = typeof payload === 'string' ? payload : String(payload);
+
+    if (Array.isArray(matchedStrings) && matchedStrings.length > 0) {
+      matchedStrings.forEach(str => {
+        if (str && typeof str === 'string') {
+          sanitizedPayload = sanitizedPayload.split(str).join('*'.repeat(str.length));
+        }
+      });
+    } else {
+      // Basic fallback masking if no specific matched strings provided but payload contains typical patterns
+      sanitizedPayload = sanitizedPayload.replace(/(<script>|UNION SELECT|DROP TABLE|--|;)/gi, '***');
+    }
+
+    // truncate to 200 chars
+    if (sanitizedPayload.length > 200) {
+      sanitizedPayload = sanitizedPayload.substring(0, 200) + '...';
+    }
+
+    const entry = {
+      timestamp: new Date().toISOString(),
+      ip,
+      method,
+      path,
+      detector,
+      confidence,
+      payloadPreview: sanitizedPayload
+    };
+
+    if (this.buffer.length < this.maxSize) {
+      this.buffer.push(entry);
+    } else {
+      this.buffer[this.pointer] = entry;
+      this.pointer = (this.pointer + 1) % this.maxSize;
+    }
+  }
+
+  getReport() {
+    if (this.buffer.length < this.maxSize) {
+      return [...this.buffer];
+    }
+    const result = [];
+    for (let i = 0; i < this.maxSize; i++) {
+      result.push(this.buffer[(this.pointer + i) % this.maxSize]);
+    }
+    return result;
+  }
+  
+  clear() {
+    this.buffer = [];
+    this.pointer = 0;
+  }
+}
+
+module.exports = { ForensicsReporter };

package/src/index.js

@@ -0,0 +1,132 @@
+'use strict';
+const { shield } = require('./presets');
+const { DetectionEngine } = require('./core/engine');
+const { Normalizer } = require('./core/normalizer');
+const { expressMiddleware, fortifyjs, secureRouter } = require('./adapters/express');
+const { createNestMiddleware, nestjsMiddleware } = require('./adapters/nestjs');
+const fastifyPlugin = require('./adapters/fastify');
+const { koaMiddleware } = require('./adapters/koa');
+const { honoMiddleware } = require('./adapters/hono');
+const { genericAdapter } = require('./adapters/generic');
+const nextjsAdapter = require('./adapters/nextjs');
+const DEFAULT_THRESHOLD = 0.5;
+
+function samplePayload(sample) {
+  if (typeof sample === 'string') return sample;
+  if (sample && typeof sample === 'object') {
+    return sample.payload !== undefined ? sample.payload : (sample.query !== undefined ? sample.query : JSON.stringify(sample));
+  }
+  return String(sample);
+}
+
+function expectedMaliciousLabel(label) {
+  if (typeof label === 'boolean') return label;
+  const str = String(label).toLowerCase();
+  return str !== 'benign' && str !== 'safe' && str !== 'false' && str !== '0';
+}
+
+function resolveDetectionSettings(options) {
+  const threshold = typeof options.threshold === 'number' ? options.threshold : DEFAULT_THRESHOLD;
+  return { threshold };
+}
+
+class fortifyjsQueryError extends Error {
+  constructor(result) {
+    super(`fortifyjs detected a SQL injection attempt (confidence: ${result.confidence.toFixed(2)})`);
+    this.name = 'fortifyjsQueryError';
+    this.result = result;
+  }
+}
+
+function scanSqlQuery(query, options = {}) {
+  if (typeof query !== 'string') {
+    throw new TypeError('query must be a string');
+  }
+  const detector = options.detector || new DetectionEngine({
+    maxPayloadLength: options.maxPayloadLength,
+    maxDecodeIterations: options.maxDecodeIterations
+  });
+  return detector.detect(query);
+}
+
+function assertSafeSqlQuery(query, options = {}) {
+  const result = scanSqlQuery(query, options);
+  const { threshold } = resolveDetectionSettings(options);
+  if (result.label === 'sqli' && result.confidence >= threshold) {
+    throw new fortifyjsQueryError(result);
+  }
+  return result;
+}
+function evaluatePayloads(samples, options = {}) {
+  if (!Array.isArray(samples)) {
+    throw new TypeError('samples must be an array');
+  }
+
+  const detector = options.detector || new DetectionEngine({
+    maxPayloadLength: options.maxPayloadLength,
+    maxDecodeIterations: options.maxDecodeIterations
+  });
+  const { threshold } = resolveDetectionSettings(options);
+  const results = [];
+  const summary = {
+    total: samples.length,
+    blocked: 0,
+    allowed: 0,
+    labeled: 0,
+    falsePositives: 0,
+    falseNegatives: 0,
+    truePositives: 0,
+    trueNegatives: 0,
+    falsePositiveRate: 0,
+    falseNegativeRate: 0
+  };
+
+  for (const sample of samples) {
+    const payload = String(samplePayload(sample));
+    const expectedMalicious = typeof sample === 'object' && sample !== null
+      ? expectedMaliciousLabel(sample.label ?? sample.expected ?? sample.kind)
+      : null;
+    const result = detector.detect(payload);
+    const blocked = result.label !== 'benign' && result.confidence >= threshold;
+    if (blocked) summary.blocked++;
+    else summary.allowed++;
+
+    if (expectedMalicious !== null) {
+      summary.labeled++;
+      if (blocked && expectedMalicious) summary.truePositives++;
+      else if (blocked && !expectedMalicious) summary.falsePositives++;
+      else if (!blocked && expectedMalicious) summary.falseNegatives++;
+      else summary.trueNegatives++;
+    }
+
+    results.push({ payload, expectedMalicious, blocked, result });
+  }
+
+  const benignCount = summary.trueNegatives + summary.falsePositives;
+  const maliciousCount = summary.truePositives + summary.falseNegatives;
+  summary.falsePositiveRate = benignCount === 0 ? 0 : summary.falsePositives / benignCount;
+  summary.falseNegativeRate = maliciousCount === 0 ? 0 : summary.falseNegatives / maliciousCount;
+
+  return { threshold, summary, results };
+}
+
+module.exports = {
+  shield,
+  DetectionEngine,
+  Normalizer,
+  evaluatePayloads,
+  fortifyjsQueryError,
+  expressMiddleware,
+  createNestMiddleware,
+  fortifyjs,
+  secureRouter,
+  nestjsMiddleware,
+  scanSqlQuery,
+  assertSafeSqlQuery,
+  evaluatePayloads,
+  fastifyPlugin,
+  koaMiddleware,
+  honoMiddleware,
+  genericAdapter,
+  nextjsAdapter
+};

package/src/logger.js

@@ -0,0 +1,110 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+const LOG_LEVELS = {
+  silent: 0,
+  error: 1,
+  warn: 2,
+  info: 3,
+  debug: 4
+};
+
+class Logger {
+  constructor(options = {}) {
+    this.level = LOG_LEVELS[options.level || 'info'];
+    this.format = options.format || 'json'; // json, text
+    this.maxLogs = options.maxLogs || 500;
+    this.transport = options.transport || null;
+    
+    // Rate limiting: max N logs per second
+    this.rateLimit = options.rateLimit || { max: 100, windowMs: 1000 };
+    this.logCounts = new Map();
+
+    this.inMemoryLogs = [];
+  }
+
+  _checkRateLimit(category) {
+    const now = Date.now();
+    const windowStart = now - this.rateLimit.windowMs;
+    
+    // Cleanup old entries
+    for (const [key, data] of this.logCounts.entries()) {
+      if (data.timestamp < windowStart) {
+        this.logCounts.delete(key);
+      }
+    }
+
+    let record = this.logCounts.get(category);
+    if (!record) {
+      record = { count: 0, timestamp: now };
+      this.logCounts.set(category, record);
+    } else if (record.timestamp < windowStart) {
+      record.count = 0;
+      record.timestamp = now;
+    }
+
+    record.count++;
+    return record.count <= this.rateLimit.max;
+  }
+
+  log(levelName, message, meta = {}) {
+    const levelVal = LOG_LEVELS[levelName];
+    if (this.level < levelVal || this.level === 0) return;
+
+    if (!this._checkRateLimit('global')) {
+      return; // Rate limited
+    }
+
+    const event = {
+      timestamp: new Date().toISOString(),
+      id: crypto.randomBytes(8).toString('hex'),
+      level: levelName,
+      message,
+      ...meta
+    };
+
+    this.inMemoryLogs.unshift(event);
+    if (this.inMemoryLogs.length > this.maxLogs) {
+      this.inMemoryLogs.pop();
+    }
+
+    if (this.transport && typeof this.transport === 'function') {
+      try {
+        this.transport(event);
+      } catch (e) {
+        // ignore transport errors
+      }
+    } else if (!this.transport && this.format === 'json') {
+      if (levelName === 'error') {
+        console.error(JSON.stringify(event));
+      } else if (levelName === 'warn') {
+        console.warn(JSON.stringify(event));
+      } else {
+        console.log(JSON.stringify(event));
+      }
+    } else if (!this.transport && this.format === 'text') {
+      const msg = `[${event.timestamp}] ${levelName.toUpperCase()}: ${message} ${Object.keys(meta).length ? JSON.stringify(meta) : ''}`;
+      if (levelName === 'error') console.error(msg);
+      else if (levelName === 'warn') console.warn(msg);
+      else console.log(msg);
+    }
+  }
+
+  error(message, meta) { this.log('error', message, meta); }
+  warn(message, meta) { this.log('warn', message, meta); }
+  info(message, meta) { this.log('info', message, meta); }
+  debug(message, meta) { this.log('debug', message, meta); }
+
+  getLogs(limit = 100) {
+    return this.inMemoryLogs.slice(0, limit);
+  }
+
+  clearLogs() {
+    this.inMemoryLogs = [];
+  }
+}
+
+module.exports = { Logger };