@chiranthmoger/fortifyjs 1.1.0

package/src/presets.js

@@ -0,0 +1,183 @@
+'use strict';
+
+const { DetectionEngine } = require('./core/engine');
+const { expressMiddleware } = require('./adapters/express');
+const { Logger } = require('./logger');
+
+const PRESETS = {
+  basic: {
+    level: 'balanced',
+    headers: true,
+    rateLimit: { max: 100, windowMs: 15 * 60 * 1000 },
+    cors: { origin: 'same-origin' },
+    csrf: false,
+    botDetection: { enabled: true, action: 'flag' },
+    behavioral: { enabled: true, entropyOnly: true },
+    dashboard: false,
+    logging: { level: 'info', format: 'text' }
+  },
+  medium: {
+    level: 'balanced',
+    headers: true,
+    rateLimit: { max: 200, windowMs: 15 * 60 * 1000 },
+    cors: { origin: 'same-origin' }, // user overrides this typically
+    csrf: false,
+    botDetection: { enabled: true, action: 'block', blockList: ['scrapy', 'python-requests'] },
+    behavioral: { enabled: true },
+    fileUpload: { enabled: true },
+    dashboard: false,
+    logging: { level: 'warn', format: 'json' }
+  },
+  hard: {
+    level: 'strict',
+    headers: true,
+    rateLimit: { max: 100, windowMs: 15 * 60 * 1000 },
+    cors: { origin: 'same-origin' },
+    csrf: { cookieName: '_fortify_csrf' },
+    botDetection: { enabled: true, action: 'block' },
+    behavioral: { enabled: true, learningRequests: 5000 },
+    adaptive: { enabled: true },
+    fileUpload: { enabled: true },
+    dashboard: { enabled: false }, // available but off by default
+    logging: { level: 'warn', format: 'json' }
+  },
+  advanced: {
+    level: 'strict',
+    headers: true,
+    rateLimit: { max: 100, windowMs: 15 * 60 * 1000 },
+    cors: { origin: 'same-origin' },
+    csrf: { cookieName: '_fortify_csrf' },
+    botDetection: { enabled: true, action: 'block' },
+    behavioral: { enabled: true, learningRequests: 5000 },
+    adaptive: { enabled: true },
+    fileUpload: { enabled: true, scanFilenameForInjection: true },
+    dashboard: { enabled: true, path: '/admin/security' },
+    logging: { level: 'debug', format: 'json' }
+  }
+};
+
+function isObject(item) {
+  return (item && typeof item === 'object' && !Array.isArray(item));
+}
+
+function deepMerge(target, source) {
+  let output = Object.assign({}, target);
+  if (isObject(target) && isObject(source)) {
+    Object.keys(source).forEach(key => {
+      if (isObject(source[key])) {
+        if (!(key in target)) Object.assign(output, { [key]: source[key] });
+        else output[key] = deepMerge(target[key], source[key]);
+      } else {
+        Object.assign(output, { [key]: source[key] });
+      }
+    });
+  }
+  return output;
+}
+
+/**
+ * Main factory for fortifyjs middleware
+ * @param {string|Object} tier 
+ * @param {Object} overrides 
+ * @returns {Function} Express middleware stack
+ */
+function shield(tier = 'basic', overrides = {}) {
+  if (typeof tier === 'object') {
+    overrides = tier;
+    tier = 'basic';
+  }
+
+  const preset = PRESETS[tier];
+  if (!preset) {
+    throw new Error(`Unknown tier: "${tier}". Use: basic, medium, hard, advanced`);
+  }
+
+  const config = deepMerge(preset, overrides);
+  
+  // Create shared logger
+  const loggerOptions = typeof config.logging === 'object' ? config.logging : {};
+  const logger = new Logger(loggerOptions);
+
+  // Load shields (lazy load to avoid circular deps if needed)
+  const { rateLimiterFactory } = require('./shields/rate-limiter');
+  const headersFactory = require('./shields/headers');
+  const corsFactory = require('./shields/cors');
+  const csrfFactory = require('./shields/csrf');
+  const botFactory = require('./shields/bot-detector');
+  const { fileUploadShieldFactory } = require('./shields/file-upload');
+  const dashboardFactory = require('./dashboard/handler').createDashboardHandler;
+  const { AdaptiveBlocker } = require('./analyzers/adaptive');
+
+  // Build the stack
+  const stack = [];
+
+  if (config.rateLimit) {
+    stack.push(rateLimiterFactory(typeof config.rateLimit === 'object' ? config.rateLimit : {}));
+  }
+
+  if (config.headers) {
+    stack.push(headersFactory(typeof config.headers === 'object' ? config.headers : {}));
+  }
+
+  if (config.cors) {
+    stack.push(corsFactory(typeof config.cors === 'object' ? config.cors : {}));
+  }
+
+  if (config.csrf) {
+    stack.push(csrfFactory(typeof config.csrf === 'object' ? config.csrf : {}));
+  }
+
+  if (config.botDetection && config.botDetection.enabled) {
+    stack.push(botFactory(config.botDetection));
+  }
+
+  if (config.adaptive && config.adaptive.enabled) {
+    const adaptiveBlocker = new AdaptiveBlocker(typeof config.adaptive === 'object' ? config.adaptive : {});
+    stack.push(adaptiveBlocker.middleware());
+  }
+
+  if (config.fileUpload && config.fileUpload.enabled) {
+    stack.push(fileUploadShieldFactory(config.fileUpload));
+  }
+
+  if (config.dashboard && config.dashboard.enabled) {
+    stack.push(dashboardFactory(config.dashboard, logger));
+  }
+
+  // Build detector
+  const detectorOptions = {
+    level: config.level,
+    behavioral: config.behavioral
+  };
+  
+  // Note: We use expressMiddleware factory here
+  // For other frameworks, this `shield()` factory would need to return the respective adapter's composition
+  // To keep it simple for v1, `shield()` returns Express middleware, and Fastify users use `fastifyPlugin` directly
+  
+  const detectorMiddleware = expressMiddleware({
+    ...detectorOptions,
+    logAttacks: (msg, evt) => logger.warn(msg, { meta: evt })
+  });
+  
+  stack.push(detectorMiddleware);
+
+  return function fortifyjsStack(req, res, next) {
+    let index = 0;
+    function runNext(err) {
+      if (err) return next(err);
+      if (index >= stack.length) return next();
+      const middleware = stack[index++];
+      try {
+        const result = middleware(req, res, runNext);
+        if (result && typeof result.catch === 'function') {
+          result.catch(next);
+        }
+      } catch (e) {
+        next(e);
+      }
+    }
+    runNext();
+  };
+}
+
+module.exports = { shield, PRESETS };

package/src/shields/bot-detector.js

@@ -0,0 +1,88 @@
+'use strict';
+
+const KNOWN_GOOD_BOTS = [
+  'googlebot',
+  'bingbot',
+  'slurp',
+  'duckduckbot',
+  'baiduspider'
+];
+
+const KNOWN_BAD_BOTS = [
+  'scrapy',
+  'python-requests',
+  'go-http-client',
+  'java/',
+  'libwww-perl',
+  'wget',
+  'curl'
+];
+
+/**
+ * Creates the bot detection shield middleware
+ * @param {Object} options - Shield configuration
+ * @returns {Function} middleware(req, res, next)
+ */
+module.exports = function createBotDetectorShield(options = {}) {
+  const enabled = options.enabled !== false;
+  const allowSearchEngines = options.allowSearchEngines !== false;
+  const blockList = options.blockList || KNOWN_BAD_BOTS;
+  const allowList = options.allowList || [];
+  const action = options.action || 'block'; // 'block' or 'flag'
+
+  return function botDetectorShield(req, res, next) {
+    if (!enabled) return next();
+
+    const ua = req.headers['user-agent'] || '';
+    const uaLower = ua.toLowerCase();
+    
+    let isBot = false;
+    let botReason = '';
+
+    // 1. Check allow list
+    if (ua && allowList.some(b => uaLower.includes(b.toLowerCase()))) {
+      return next();
+    }
+
+    // 2. Check search engines
+    if (ua && allowSearchEngines && KNOWN_GOOD_BOTS.some(b => uaLower.includes(b))) {
+      return next();
+    }
+
+    // 3. Empty User-Agent
+    if (!ua || ua.trim() === '') {
+      isBot = true;
+      botReason = 'empty-user-agent';
+    }
+    // 4. Check blocklist
+    else if (blockList.some(b => uaLower.includes(b.toLowerCase()))) {
+      isBot = true;
+      botReason = 'known-bad-bot';
+    }
+    // 5. Headless browsers
+    else if (uaLower.includes('headless') || uaLower.includes('phantomjs') || uaLower.includes('puppeteer')) {
+      isBot = true;
+      botReason = 'headless-browser';
+    }
+    // 6. Missing typical browser headers combined with suspicious UA
+    else if (!req.headers['accept'] && !req.headers['accept-language'] && !req.headers['accept-encoding']) {
+      isBot = true;
+      botReason = 'missing-browser-headers';
+    }
+
+    if (isBot) {
+      req.isBot = true;
+      req.botReason = botReason;
+
+      if (action === 'block') {
+        const err = new Error('Bot traffic detected');
+        err.status = 403;
+        err.code = 'EBOTBLOCKED';
+        err.reason = botReason;
+        return next(err);
+      }
+    }
+
+    next();
+  };
+};

package/src/shields/cors.js

@@ -0,0 +1,95 @@
+'use strict';
+
+/**
+ * Creates the CORS engine shield middleware
+ * @param {Object} options - Shield configuration
+ * @returns {Function} middleware(req, res, next)
+ */
+module.exports = function createCorsShield(options = {}) {
+  const allowOrigin = options.origin || '*';
+  const allowMethods = options.methods || 'GET,HEAD,PUT,PATCH,POST,DELETE';
+  const allowedHeaders = options.allowedHeaders;
+  const exposedHeaders = options.exposedHeaders;
+  const credentials = options.credentials || false;
+  const maxAge = options.maxAge;
+
+  if (credentials === true && allowOrigin === '*') {
+    throw new Error('CORS: Cannot use credentials=true with origin="*"');
+  }
+
+  function handleOrigin(reqOrigin, originConfig, cb) {
+    if (typeof originConfig === 'function') {
+      originConfig(reqOrigin, cb);
+    } else if (Array.isArray(originConfig)) {
+      cb(null, originConfig.includes(reqOrigin) ? reqOrigin : false);
+    } else if (originConfig === '*') {
+      cb(null, '*');
+    } else if (typeof originConfig === 'string') {
+      cb(null, originConfig === reqOrigin ? reqOrigin : false);
+    } else if (originConfig instanceof RegExp) {
+      cb(null, originConfig.test(reqOrigin) ? reqOrigin : false);
+    } else {
+      cb(null, false);
+    }
+  }
+
+  return function corsShield(req, res, next) {
+    const origin = req.headers.origin;
+
+    // Set Vary header for dynamic origin
+    if (allowOrigin !== '*') {
+      res.setHeader('Vary', 'Origin');
+    }
+
+    if (!origin) {
+      return next(); // Not a CORS request
+    }
+
+    handleOrigin(origin, allowOrigin, (err, matchedOrigin) => {
+      if (err) return next(err);
+
+      if (!matchedOrigin) {
+        if (req.method === 'OPTIONS') {
+          res.statusCode = 204;
+          return res.end();
+        }
+        return next();
+      }
+
+      res.setHeader('Access-Control-Allow-Origin', matchedOrigin);
+
+      if (credentials) {
+        res.setHeader('Access-Control-Allow-Credentials', 'true');
+      }
+
+      if (exposedHeaders) {
+        const exposed = Array.isArray(exposedHeaders) ? exposedHeaders.join(',') : exposedHeaders;
+        res.setHeader('Access-Control-Expose-Headers', exposed);
+      }
+
+      if (req.method === 'OPTIONS') {
+        res.setHeader('Access-Control-Allow-Methods', Array.isArray(allowMethods) ? allowMethods.join(',') : allowMethods);
+        
+        let requestHeaders = allowedHeaders;
+        if (!requestHeaders && req.headers['access-control-request-headers']) {
+          requestHeaders = req.headers['access-control-request-headers'];
+        }
+        
+        if (requestHeaders) {
+          const headersStr = Array.isArray(requestHeaders) ? requestHeaders.join(',') : requestHeaders;
+          res.setHeader('Access-Control-Allow-Headers', headersStr);
+        }
+
+        if (maxAge !== undefined) {
+          res.setHeader('Access-Control-Max-Age', maxAge.toString());
+        }
+
+        res.statusCode = 204;
+        res.setHeader('Content-Length', '0');
+        return res.end();
+      }
+
+      next();
+    });
+  };
+};

package/src/shields/csrf.js

@@ -0,0 +1,120 @@
+'use strict';
+
+const crypto = require('crypto');
+
+/**
+ * Creates the CSRF protection shield middleware
+ * @param {Object} options - Shield configuration
+ * @returns {Function} middleware(req, res, next)
+ */
+module.exports = function createCsrfShield(options = {}) {
+  const secret = options.secret || crypto.randomBytes(32).toString('hex');
+  if (!options.secret) {
+    console.warn('fortifyjs: CSRF secret not provided. A random secret was generated, but it will not persist across restarts.');
+  }
+
+  const cookieName = options.cookieName || '_fortify_csrf';
+  const headerName = options.headerName || 'x-csrf-token';
+  const bodyField = options.bodyField || '_csrf';
+  const sameSite = options.sameSite || 'Lax';
+  const secure = options.secure !== undefined ? options.secure : process.env.NODE_ENV === 'production';
+  const ignoreMethods = options.ignoreMethods || ['GET', 'HEAD', 'OPTIONS'];
+  const ignoreRoutes = options.ignoreRoutes || [];
+
+  function signToken(token) {
+    const hmac = crypto.createHmac('sha256', secret);
+    hmac.update(token);
+    return `${token}.${hmac.digest('hex')}`;
+  }
+
+  function verifyToken(signedToken) {
+    if (!signedToken || typeof signedToken !== 'string') return false;
+    const parts = signedToken.split('.');
+    if (parts.length !== 2) return false;
+    const [token, signature] = parts;
+    const expectedSigned = signToken(token);
+    if (expectedSigned.length !== signedToken.length) return false;
+    return crypto.timingSafeEqual(Buffer.from(expectedSigned), Buffer.from(signedToken));
+  }
+
+  function matchRoute(path, patterns) {
+    for (const pattern of patterns) {
+      if (pattern.endsWith('/*')) {
+        const prefix = pattern.slice(0, -2);
+        if (path.startsWith(prefix)) return true;
+      } else if (path === pattern) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  return function csrfShield(req, res, next) {
+    // Basic route ignore (e.g. webhooks)
+    if (ignoreRoutes.length > 0 && req.path && matchRoute(req.path, ignoreRoutes)) {
+      return next();
+    }
+
+    // Parse cookies if not already parsed
+    // We assume cookie-parser might not be present, so we do basic parsing
+    let cookies = req.cookies || {};
+    if (!req.cookies && req.headers.cookie) {
+      cookies = Object.fromEntries(
+        req.headers.cookie.split('; ').map(c => c.split('='))
+      );
+    }
+
+    const currentSignedToken = cookies[cookieName];
+
+    // Expose csrfToken generator for views
+    req.csrfToken = function() {
+      const newToken = crypto.randomBytes(16).toString('hex');
+      const newSignedToken = signToken(newToken);
+      
+      let cookieHeader = `${cookieName}=${newSignedToken}; Path=/; HttpOnly; SameSite=${sameSite}`;
+      if (secure) cookieHeader += '; Secure';
+      
+      res.setHeader('Set-Cookie', cookieHeader);
+      return newSignedToken;
+    };
+
+    // If method is safe, we don't enforce, just optionally generate/refresh token if missing
+    if (ignoreMethods.includes(req.method)) {
+      if (!currentSignedToken) {
+        req.csrfToken(); // trigger generation
+      }
+      return next();
+    }
+
+    // Mutation method: Enforce token
+    let incomingToken = null;
+    
+    // Check header
+    if (req.headers[headerName.toLowerCase()]) {
+      incomingToken = req.headers[headerName.toLowerCase()];
+    } else if (req.headers['x-xsrf-token']) {
+      incomingToken = req.headers['x-xsrf-token'];
+    }
+    
+    // Check body
+    if (!incomingToken && req.body && typeof req.body === 'object') {
+      incomingToken = req.body[bodyField];
+    }
+
+    if (!incomingToken) {
+      const err = new Error('CSRF token missing');
+      err.status = 403;
+      err.code = 'EBADCSRFTOKEN';
+      return next(err);
+    }
+
+    if (!currentSignedToken || currentSignedToken !== incomingToken || !verifyToken(incomingToken)) {
+      const err = new Error('CSRF token invalid');
+      err.status = 403;
+      err.code = 'EBADCSRFTOKEN';
+      return next(err);
+    }
+
+    next();
+  };
+};

package/src/shields/file-upload.js

@@ -0,0 +1,160 @@
+'use strict';
+
+const { DetectionEngine } = require('../core/engine');
+
+const defaultOptions = {
+  enabled: true,
+  allowedExtensions: ['.jpg', '.jpeg', '.png', '.gif', '.pdf', '.docx'],
+  blockedExtensions: ['.php', '.asp', '.aspx', '.jsp', '.exe', '.sh', '.bat', '.cmd'],
+  maxFilenameLength: 255,
+  blockDoubleExtensions: true,
+  blockNullBytes: true,
+  blockPathTraversal: true,
+  blockDotFiles: true,
+  validateMimeType: true,
+  scanFilenameForInjection: true,
+};
+
+const mimeMap = {
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.png': 'image/png',
+  '.gif': 'image/gif',
+  '.pdf': 'application/pdf',
+  '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  '.doc': 'application/msword',
+  '.xls': 'application/vnd.ms-excel',
+  '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  '.txt': 'text/plain',
+  '.csv': 'text/csv',
+  '.json': 'application/json',
+  '.xml': 'application/xml',
+  '.zip': 'application/zip',
+  '.tar': 'application/x-tar',
+  '.gz': 'application/gzip',
+  '.mp4': 'video/mp4',
+  '.mp3': 'audio/mpeg'
+};
+
+function fileUploadShieldFactory(options = {}) {
+  const config = Object.assign({}, defaultOptions, options);
+
+  if (!config.enabled) {
+    return (req, res, next) => next();
+  }
+
+  let engine = null;
+  if (config.scanFilenameForInjection) {
+    engine = new DetectionEngine();
+  }
+
+  function block(res, next, reason) {
+    res.status(403).json({ error: 'File upload blocked', reason });
+  }
+
+  function validateFile(file, res, next) {
+    if (!file) return true;
+
+    // multer-style file has originalname, some others might have name or filename
+    const filename = file.originalname || file.name || file.filename || (typeof file === 'string' ? file : '');
+
+    if (!filename) return true; // Could not determine filename, skip or block? We skip if we can't tell.
+
+    if (config.maxFilenameLength && filename.length > config.maxFilenameLength) {
+      block(res, next, 'Filename too long');
+      return false;
+    }
+
+    if (config.blockNullBytes && filename.indexOf('\0') !== -1) {
+      block(res, next, 'Null byte detected in filename');
+      return false;
+    }
+
+    if (config.blockPathTraversal && (filename.includes('../') || filename.includes('..\\') || filename.includes('/') || filename.includes('\\'))) {
+      block(res, next, 'Path traversal detected in filename');
+      return false;
+    }
+
+    if (config.blockDotFiles && filename.startsWith('.')) {
+      block(res, next, 'Dot files are not allowed');
+      return false;
+    }
+
+    const parts = filename.split('.');
+    const ext = parts.length > 1 ? '.' + parts[parts.length - 1].toLowerCase() : '';
+
+    if (config.blockDoubleExtensions && parts.length > 2) {
+      block(res, next, 'Double extensions are not allowed');
+      return false;
+    }
+
+    if (config.blockedExtensions && config.blockedExtensions.length > 0) {
+      if (config.blockedExtensions.includes(ext)) {
+        block(res, next, 'File extension is blocked');
+        return false;
+      }
+    }
+
+    if (config.allowedExtensions && config.allowedExtensions.length > 0) {
+      if (!config.allowedExtensions.includes(ext)) {
+        block(res, next, 'File extension is not allowed');
+        return false;
+      }
+    }
+
+    if (config.validateMimeType && file.mimetype && ext) {
+      const expectedMime = mimeMap[ext];
+      if (expectedMime && !file.mimetype.toLowerCase().startsWith(expectedMime.split('/')[0])) {
+         // Relaxed checking, e.g. application/pdf could be exact, but just compare what we have roughly
+         // Or strict comparison:
+         if (file.mimetype.toLowerCase() !== expectedMime) {
+             block(res, next, 'MIME type does not match file extension');
+             return false;
+         }
+      }
+    }
+
+    if (config.scanFilenameForInjection && engine) {
+      const result = engine.detect(filename, { source: 'filename' });
+      if (result.label && result.label !== 'benign') {
+        block(res, next, 'Filename contains malicious payload');
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  return function fileUploadShield(req, res, next) {
+    let filesToScan = [];
+
+    if (req.file) {
+      filesToScan.push(req.file);
+    }
+
+    if (req.files) {
+      if (Array.isArray(req.files)) {
+        filesToScan = filesToScan.concat(req.files);
+      } else if (typeof req.files === 'object') {
+        Object.keys(req.files).forEach(key => {
+          const field = req.files[key];
+          if (Array.isArray(field)) {
+            filesToScan = filesToScan.concat(field);
+          } else {
+            filesToScan.push(field);
+          }
+        });
+      }
+    }
+
+    for (let i = 0; i < filesToScan.length; i++) {
+      if (!validateFile(filesToScan[i], res, next)) {
+        return; // Response already sent
+      }
+    }
+
+    next();
+  };
+}
+
+module.exports = { fileUploadShieldFactory };