@j3r3mcdev/oast-server 1.1.6 → 1.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (97) hide show
  1. package/.github/workflows/ci.yml +29 -29
  2. package/.github/workflows/publish.yml +31 -31
  3. package/README.md +192 -192
  4. package/dist/core/router.d.ts +1 -0
  5. package/dist/core/router.js +3 -3
  6. package/dist/index.d.ts +1 -0
  7. package/dist/index.js +16 -1
  8. package/jest.config.js +14 -14
  9. package/package.json +45 -45
  10. package/sadmin list shadows +9 -9
  11. package/src/api/controllers/__tests__/tasks.controller.test.ts +74 -74
  12. package/src/api/controllers/events.controller.ts +10 -10
  13. package/src/api/controllers/health.controller.ts +7 -7
  14. package/src/api/controllers/tasks.controller.ts +41 -41
  15. package/src/api/dto/__tests__/create-task.dto.test.ts +41 -41
  16. package/src/api/dto/__tests__/filter-tasks.dto.test.ts +35 -35
  17. package/src/api/dto/create-task.dto.ts +33 -33
  18. package/src/api/dto/filter-tasks.dto.ts +33 -33
  19. package/src/api/services/__tests__/events.service.test.ts +41 -41
  20. package/src/api/services/__tests__/tasks.service.test.ts +41 -41
  21. package/src/api/services/events.service.ts +17 -17
  22. package/src/api/services/tasks.service.ts +79 -79
  23. package/src/api/sse/events.stream.ts +90 -90
  24. package/src/bootstrap.ts +89 -89
  25. package/src/core/__tests__/core-router.test.ts +30 -30
  26. package/src/core/__tests__/core-server.test.ts +44 -44
  27. package/src/core/__tests__/event.normalizer.test.ts +56 -56
  28. package/src/core/__tests__/event.router.test.ts +89 -89
  29. package/src/core/__tests__/logger.test.ts +32 -32
  30. package/src/core/__tests__/storage-manager.test.ts +74 -74
  31. package/src/core/event.normalizer.ts +147 -147
  32. package/src/core/event.router.ts +13 -13
  33. package/src/core/http/__tests__/adapter-node.test.ts +52 -52
  34. package/src/core/http/__tests__/body-parser-multipart.test.ts +41 -41
  35. package/src/core/http/__tests__/body-parser-raw.test.ts +28 -28
  36. package/src/core/http/__tests__/body-parser-text.test.ts +28 -28
  37. package/src/core/http/__tests__/compile-path.test.ts +39 -39
  38. package/src/core/http/__tests__/middleware-pipeline.test.ts +51 -51
  39. package/src/core/http/__tests__/request.test.ts +34 -34
  40. package/src/core/http/__tests__/response.test.ts +35 -35
  41. package/src/core/http/__tests__/router-match.test.ts +171 -171
  42. package/src/core/http/adapter-node.ts +51 -51
  43. package/src/core/http/buildRequest.ts +18 -18
  44. package/src/core/http/compile-path.ts +32 -32
  45. package/src/core/http/errors.ts +37 -37
  46. package/src/core/http/http-server.ts +52 -52
  47. package/src/core/http/middleware.ts +160 -160
  48. package/src/core/http/request.ts +55 -55
  49. package/src/core/http/response.ts +93 -93
  50. package/src/core/http/router.ts +138 -138
  51. package/src/core/id-generator.ts +8 -8
  52. package/src/core/logger.ts +113 -113
  53. package/src/core/router.ts +44 -44
  54. package/src/core/server.ts +85 -85
  55. package/src/core/storage.ts +64 -64
  56. package/src/index.ts +14 -14
  57. package/src/listeners/api/__tests__/api.controller.test.ts +116 -116
  58. package/src/listeners/api/__tests__/api.extractor.test.ts +46 -46
  59. package/src/listeners/api/__tests__/api.listener.test.ts +82 -82
  60. package/src/listeners/api/__tests__/api.routes.test.ts +155 -155
  61. package/src/listeners/api/__tests__/api.sse.test.ts +105 -105
  62. package/src/listeners/api/api.controllers.ts +67 -67
  63. package/src/listeners/api/api.extractor.ts +43 -43
  64. package/src/listeners/api/api.listener.ts +50 -50
  65. package/src/listeners/api/api.routes.ts +76 -76
  66. package/src/listeners/api/api.sse.ts +38 -38
  67. package/src/listeners/dns/__tests__/dns.test.ts +118 -118
  68. package/src/listeners/dns/dns.extractor.ts +14 -14
  69. package/src/listeners/dns/dns.listener.ts +61 -61
  70. package/src/listeners/http/__tests__/http.extractor.test.ts +59 -59
  71. package/src/listeners/http/__tests__/http.listener.test.ts +133 -133
  72. package/src/listeners/http/http.extractor.ts +15 -15
  73. package/src/listeners/http/http.listener.ts +110 -110
  74. package/src/listeners/listener.interface.ts +4 -4
  75. package/src/listeners/smtp/__tests__/smtp.extractor.test.ts +69 -69
  76. package/src/listeners/smtp/__tests__/smtp.listener.test.ts +150 -150
  77. package/src/listeners/smtp/smtp.extractor.ts +18 -18
  78. package/src/listeners/smtp/smtp.listener.ts +60 -60
  79. package/src/listeners/ssrf/__tests__/ssrf.extractor.test.ts +41 -41
  80. package/src/listeners/ssrf/__tests__/ssrf.listener.test.ts +87 -87
  81. package/src/listeners/ssrf/ssrf.extractor.ts +14 -14
  82. package/src/listeners/ssrf/ssrf.listener.ts +37 -37
  83. package/src/listeners/tcp/tcp.extractor.ts +16 -16
  84. package/src/listeners/tcp/tcp.listener.ts +61 -61
  85. package/src/listeners/webhook/__tests__/webhook.extractor.test.ts +35 -35
  86. package/src/listeners/webhook/__tests__/webhook.listener.test.ts +122 -122
  87. package/src/listeners/webhook/webhook.extractor.ts +12 -12
  88. package/src/listeners/webhook/webhook.listener.ts +58 -58
  89. package/src/listeners/websocket/__tests__/websocket.extractor.test.ts +33 -33
  90. package/src/listeners/websocket/__tests__/websocket.listener.test.ts +90 -90
  91. package/src/listeners/websocket/websocket.extractor.ts +11 -11
  92. package/src/listeners/websocket/websocket.listener.ts +40 -40
  93. package/src/storage-adapters/adapters/__tests__/memory.storage.test.ts +75 -75
  94. package/src/storage-adapters/adapters/memory.storage.ts +64 -64
  95. package/src/storage-adapters/storage.interface.ts +26 -26
  96. package/src/types/event.types.ts +147 -147
  97. package/tsconfig.json +20 -21
@@ -1,14 +1,14 @@
1
- export class DnsExtractor {
2
- static extract(packet: any) {
3
- if (!packet?.questions?.[0]) {
4
- throw new Error("Invalid DNS packet");
5
- }
6
-
7
- return {
8
- ip: packet.client?.address ?? "",
9
- query: packet.questions[0].name ?? "",
10
- type: packet.questions[0].type ?? "",
11
- raw: packet,
12
- };
13
- }
14
- }
1
+ export class DnsExtractor {
2
+ static extract(packet: any) {
3
+ if (!packet?.questions?.[0]) {
4
+ throw new Error("Invalid DNS packet");
5
+ }
6
+
7
+ return {
8
+ ip: packet.client?.address ?? "",
9
+ query: packet.questions[0].name ?? "",
10
+ type: packet.questions[0].type ?? "",
11
+ raw: packet,
12
+ };
13
+ }
14
+ }
@@ -1,61 +1,61 @@
1
- import { Logger } from "../../core/logger";
2
- import { CoreRouter } from "../../core/router";
3
- import { EventNormalizer } from "../../core/event.normalizer";
4
-
5
- export interface DnsListenerOptions {
6
- server: any; // instance dns2 ou autre
7
- logger?: Logger;
8
- }
9
-
10
- export class DnsListener {
11
- private logger: Logger;
12
-
13
- constructor(
14
- private router: CoreRouter,
15
- private options: DnsListenerOptions,
16
- ) {
17
- this.logger = options.logger ?? new Logger({ context: "DnsListener" });
18
- }
19
-
20
- async start(): Promise<void> {
21
- this.options.server.on("request", async (req: any, send: any) => {
22
- await this.handleQuery(req, send);
23
- });
24
-
25
- this.logger.info("DNS Listener started");
26
- }
27
-
28
- async stop(): Promise<void> {
29
- if (this.options.server.close) {
30
- this.options.server.close();
31
- }
32
- this.logger.info("DNS Listener stopped");
33
- }
34
-
35
- private async handleQuery(packet: any, send: any) {
36
- try {
37
- const rawEvent = {
38
- ip: packet?.client?.address ?? "",
39
- query: packet?.questions?.[0]?.name ?? "",
40
- recordType: packet?.questions?.[0]?.type ?? "",
41
- raw: packet,
42
- };
43
-
44
- const normalized = EventNormalizer.normalizeDns(rawEvent);
45
-
46
- await this.router.dispatch(normalized);
47
-
48
- send({
49
- success: true,
50
- eventId: normalized.id,
51
- });
52
- } catch (err: any) {
53
- this.logger.error("DNS Listener error", { error: err.message });
54
-
55
- send({
56
- success: false,
57
- error: err.message,
58
- });
59
- }
60
- }
61
- }
1
+ import { Logger } from "../../core/logger";
2
+ import { CoreRouter } from "../../core/router";
3
+ import { EventNormalizer } from "../../core/event.normalizer";
4
+
5
+ export interface DnsListenerOptions {
6
+ server: any; // instance dns2 ou autre
7
+ logger?: Logger;
8
+ }
9
+
10
+ export class DnsListener {
11
+ private logger: Logger;
12
+
13
+ constructor(
14
+ private router: CoreRouter,
15
+ private options: DnsListenerOptions,
16
+ ) {
17
+ this.logger = options.logger ?? new Logger({ context: "DnsListener" });
18
+ }
19
+
20
+ async start(): Promise<void> {
21
+ this.options.server.on("request", async (req: any, send: any) => {
22
+ await this.handleQuery(req, send);
23
+ });
24
+
25
+ this.logger.info("DNS Listener started");
26
+ }
27
+
28
+ async stop(): Promise<void> {
29
+ if (this.options.server.close) {
30
+ this.options.server.close();
31
+ }
32
+ this.logger.info("DNS Listener stopped");
33
+ }
34
+
35
+ private async handleQuery(packet: any, send: any) {
36
+ try {
37
+ const rawEvent = {
38
+ ip: packet?.client?.address ?? "",
39
+ query: packet?.questions?.[0]?.name ?? "",
40
+ recordType: packet?.questions?.[0]?.type ?? "",
41
+ raw: packet,
42
+ };
43
+
44
+ const normalized = EventNormalizer.normalizeDns(rawEvent);
45
+
46
+ await this.router.dispatch(normalized);
47
+
48
+ send({
49
+ success: true,
50
+ eventId: normalized.id,
51
+ });
52
+ } catch (err: any) {
53
+ this.logger.error("DNS Listener error", { error: err.message });
54
+
55
+ send({
56
+ success: false,
57
+ error: err.message,
58
+ });
59
+ }
60
+ }
61
+ }
@@ -1,59 +1,59 @@
1
- import { describe, it, expect } from "@jest/globals";
2
- import { HttpExtractor } from "../http.extractor";
3
-
4
- describe("HttpExtractor", () => {
5
- it("extrait correctement un RawEvent complet", () => {
6
- const req: any = {
7
- ip: "1.1.1.1",
8
- method: "POST",
9
- path: "/login",
10
- url: "/login",
11
- headers: {
12
- "x-forwarded-for": "2.2.2.2",
13
- host: "localhost",
14
- },
15
- query: { a: 1 },
16
- body: { user: "admin" },
17
- };
18
-
19
- const extracted = HttpExtractor.extract(req);
20
-
21
- expect(extracted).toEqual({
22
- ip: "1.1.1.1", // priorité à req.ip
23
- method: "POST",
24
- path: "/login",
25
- headers: req.headers,
26
- query: { a: 1 },
27
- body: { user: "admin" },
28
- raw: req,
29
- });
30
- });
31
-
32
- it("utilise x-forwarded-for si req.ip est absent", () => {
33
- const req: any = {
34
- method: "GET",
35
- url: "/",
36
- headers: { "x-forwarded-for": "9.9.9.9" },
37
- };
38
-
39
- const extracted = HttpExtractor.extract(req);
40
-
41
- expect(extracted.ip).toBe("9.9.9.9");
42
- });
43
-
44
- it("retourne une structure complète même si des champs manquent", () => {
45
- const req: any = {};
46
-
47
- const extracted = HttpExtractor.extract(req);
48
-
49
- expect(extracted).toEqual({
50
- ip: "",
51
- method: undefined,
52
- path: undefined,
53
- headers: {},
54
- query: {},
55
- body: null,
56
- raw: req,
57
- });
58
- });
59
- });
1
+ import { describe, it, expect } from "@jest/globals";
2
+ import { HttpExtractor } from "../http.extractor";
3
+
4
+ describe("HttpExtractor", () => {
5
+ it("extrait correctement un RawEvent complet", () => {
6
+ const req: any = {
7
+ ip: "1.1.1.1",
8
+ method: "POST",
9
+ path: "/login",
10
+ url: "/login",
11
+ headers: {
12
+ "x-forwarded-for": "2.2.2.2",
13
+ host: "localhost",
14
+ },
15
+ query: { a: 1 },
16
+ body: { user: "admin" },
17
+ };
18
+
19
+ const extracted = HttpExtractor.extract(req);
20
+
21
+ expect(extracted).toEqual({
22
+ ip: "1.1.1.1", // priorité à req.ip
23
+ method: "POST",
24
+ path: "/login",
25
+ headers: req.headers,
26
+ query: { a: 1 },
27
+ body: { user: "admin" },
28
+ raw: req,
29
+ });
30
+ });
31
+
32
+ it("utilise x-forwarded-for si req.ip est absent", () => {
33
+ const req: any = {
34
+ method: "GET",
35
+ url: "/",
36
+ headers: { "x-forwarded-for": "9.9.9.9" },
37
+ };
38
+
39
+ const extracted = HttpExtractor.extract(req);
40
+
41
+ expect(extracted.ip).toBe("9.9.9.9");
42
+ });
43
+
44
+ it("retourne une structure complète même si des champs manquent", () => {
45
+ const req: any = {};
46
+
47
+ const extracted = HttpExtractor.extract(req);
48
+
49
+ expect(extracted).toEqual({
50
+ ip: "",
51
+ method: undefined,
52
+ path: undefined,
53
+ headers: {},
54
+ query: {},
55
+ body: null,
56
+ raw: req,
57
+ });
58
+ });
59
+ });
@@ -1,133 +1,133 @@
1
- import {
2
- describe,
3
- it,
4
- expect,
5
- jest,
6
- beforeEach,
7
- afterEach,
8
- } from "@jest/globals";
9
- import http from "http";
10
- import { HttpListener } from "../http.listener";
11
- import { EventNormalizer } from "../../../core/event.normalizer";
12
-
13
- // Mock EventNormalizer
14
- jest.mock("../../../core/event.normalizer", () => ({
15
- EventNormalizer: {
16
- normalizeHttp: jest.fn(),
17
- },
18
- }));
19
-
20
- // Helper pour requêtes HTTP
21
- async function makeRequest(port: number, path: string): Promise<string> {
22
- return new Promise((resolve) => {
23
- const req = http.request(
24
- {
25
- hostname: "localhost",
26
- port,
27
- path,
28
- method: "GET",
29
- },
30
- (res) => {
31
- let data = "";
32
- res.on("data", (chunk) => (data += chunk));
33
- res.on("end", () => resolve(data));
34
- },
35
- );
36
-
37
- req.end();
38
- });
39
- }
40
-
41
- describe("HttpListener (PRO)", () => {
42
- let listener: HttpListener;
43
- let router: { dispatch: jest.Mock };
44
- let port: number;
45
-
46
- beforeEach(() => {
47
- router = {
48
- dispatch: jest.fn(),
49
- };
50
-
51
- port = 10000 + Math.floor(Math.random() * 5000);
52
- });
53
-
54
- afterEach(async () => {
55
- if (listener) {
56
- await listener.stop();
57
- }
58
- });
59
-
60
- it("normalise, dispatch et renvoie un eventId", async () => {
61
- listener = new HttpListener(router as any, { port });
62
- await listener.start();
63
-
64
- // NormalizedHttpEvent VALIDE
65
- (EventNormalizer.normalizeHttp as jest.Mock).mockReturnValue({
66
- id: "evt-123",
67
- type: "http",
68
- timestamp: Date.now(),
69
- sourceIp: "127.0.0.1",
70
- request: {
71
- method: "GET",
72
- path: "/test",
73
- headers: {},
74
- query: {},
75
- body: "",
76
- },
77
- });
78
-
79
- const response = await makeRequest(port, "/test");
80
- const json = JSON.parse(response);
81
-
82
- expect(EventNormalizer.normalizeHttp).toHaveBeenCalled();
83
- expect(router.dispatch).toHaveBeenCalled();
84
- expect(json).toEqual({
85
- success: true,
86
- eventId: "evt-123",
87
- });
88
- });
89
-
90
- it("renvoie 500 si normalizeHttp lance une erreur", async () => {
91
- listener = new HttpListener(router as any, { port });
92
- await listener.start();
93
-
94
- (EventNormalizer.normalizeHttp as jest.Mock).mockImplementation(() => {
95
- throw new Error("bad request");
96
- });
97
-
98
- const response = await makeRequest(port, "/err");
99
- const json = JSON.parse(response);
100
-
101
- expect(json.success).toBe(false);
102
- expect(json.error).toBe("bad request");
103
- });
104
-
105
- it("renvoie 500 si router.dispatch rejette une erreur", async () => {
106
- listener = new HttpListener(router as any, { port });
107
- await listener.start();
108
-
109
- (EventNormalizer.normalizeHttp as jest.Mock).mockReturnValue({
110
- id: "evt-999",
111
- type: "http",
112
- timestamp: Date.now(),
113
- sourceIp: "127.0.0.1",
114
- request: {
115
- method: "GET",
116
- path: "/dispatch-error",
117
- headers: {},
118
- query: {},
119
- body: "",
120
- },
121
- });
122
-
123
- (router.dispatch as any).mockRejectedValueOnce(
124
- new Error("dispatch failed"),
125
- );
126
-
127
- const response = await makeRequest(port, "/dispatch-error");
128
- const json = JSON.parse(response);
129
-
130
- expect(json.success).toBe(false);
131
- expect(json.error).toBe("dispatch failed");
132
- });
133
- });
1
+ import {
2
+ describe,
3
+ it,
4
+ expect,
5
+ jest,
6
+ beforeEach,
7
+ afterEach,
8
+ } from "@jest/globals";
9
+ import http from "http";
10
+ import { HttpListener } from "../http.listener";
11
+ import { EventNormalizer } from "../../../core/event.normalizer";
12
+
13
+ // Mock EventNormalizer
14
+ jest.mock("../../../core/event.normalizer", () => ({
15
+ EventNormalizer: {
16
+ normalizeHttp: jest.fn(),
17
+ },
18
+ }));
19
+
20
+ // Helper pour requêtes HTTP
21
+ async function makeRequest(port: number, path: string): Promise<string> {
22
+ return new Promise((resolve) => {
23
+ const req = http.request(
24
+ {
25
+ hostname: "localhost",
26
+ port,
27
+ path,
28
+ method: "GET",
29
+ },
30
+ (res) => {
31
+ let data = "";
32
+ res.on("data", (chunk) => (data += chunk));
33
+ res.on("end", () => resolve(data));
34
+ },
35
+ );
36
+
37
+ req.end();
38
+ });
39
+ }
40
+
41
+ describe("HttpListener (PRO)", () => {
42
+ let listener: HttpListener;
43
+ let router: { dispatch: jest.Mock };
44
+ let port: number;
45
+
46
+ beforeEach(() => {
47
+ router = {
48
+ dispatch: jest.fn(),
49
+ };
50
+
51
+ port = 10000 + Math.floor(Math.random() * 5000);
52
+ });
53
+
54
+ afterEach(async () => {
55
+ if (listener) {
56
+ await listener.stop();
57
+ }
58
+ });
59
+
60
+ it("normalise, dispatch et renvoie un eventId", async () => {
61
+ listener = new HttpListener(router as any, { port });
62
+ await listener.start();
63
+
64
+ // NormalizedHttpEvent VALIDE
65
+ (EventNormalizer.normalizeHttp as jest.Mock).mockReturnValue({
66
+ id: "evt-123",
67
+ type: "http",
68
+ timestamp: Date.now(),
69
+ sourceIp: "127.0.0.1",
70
+ request: {
71
+ method: "GET",
72
+ path: "/test",
73
+ headers: {},
74
+ query: {},
75
+ body: "",
76
+ },
77
+ });
78
+
79
+ const response = await makeRequest(port, "/test");
80
+ const json = JSON.parse(response);
81
+
82
+ expect(EventNormalizer.normalizeHttp).toHaveBeenCalled();
83
+ expect(router.dispatch).toHaveBeenCalled();
84
+ expect(json).toEqual({
85
+ success: true,
86
+ eventId: "evt-123",
87
+ });
88
+ });
89
+
90
+ it("renvoie 500 si normalizeHttp lance une erreur", async () => {
91
+ listener = new HttpListener(router as any, { port });
92
+ await listener.start();
93
+
94
+ (EventNormalizer.normalizeHttp as jest.Mock).mockImplementation(() => {
95
+ throw new Error("bad request");
96
+ });
97
+
98
+ const response = await makeRequest(port, "/err");
99
+ const json = JSON.parse(response);
100
+
101
+ expect(json.success).toBe(false);
102
+ expect(json.error).toBe("bad request");
103
+ });
104
+
105
+ it("renvoie 500 si router.dispatch rejette une erreur", async () => {
106
+ listener = new HttpListener(router as any, { port });
107
+ await listener.start();
108
+
109
+ (EventNormalizer.normalizeHttp as jest.Mock).mockReturnValue({
110
+ id: "evt-999",
111
+ type: "http",
112
+ timestamp: Date.now(),
113
+ sourceIp: "127.0.0.1",
114
+ request: {
115
+ method: "GET",
116
+ path: "/dispatch-error",
117
+ headers: {},
118
+ query: {},
119
+ body: "",
120
+ },
121
+ });
122
+
123
+ (router.dispatch as any).mockRejectedValueOnce(
124
+ new Error("dispatch failed"),
125
+ );
126
+
127
+ const response = await makeRequest(port, "/dispatch-error");
128
+ const json = JSON.parse(response);
129
+
130
+ expect(json.success).toBe(false);
131
+ expect(json.error).toBe("dispatch failed");
132
+ });
133
+ });
@@ -1,15 +1,15 @@
1
- export class HttpExtractor {
2
- static extract(req: any) {
3
- const headers = req.headers ?? {};
4
-
5
- return {
6
- ip: req.ip ?? headers["x-forwarded-for"] ?? "",
7
- method: req.method, // ← PAS de fallback ""
8
- path: req.path ?? req.url, // ← PAS de fallback ""
9
- headers,
10
- query: req.query ?? {},
11
- body: req.body ?? null,
12
- raw: req,
13
- };
14
- }
15
- }
1
+ export class HttpExtractor {
2
+ static extract(req: any) {
3
+ const headers = req.headers ?? {};
4
+
5
+ return {
6
+ ip: req.ip ?? headers["x-forwarded-for"] ?? "",
7
+ method: req.method, // ← PAS de fallback ""
8
+ path: req.path ?? req.url, // ← PAS de fallback ""
9
+ headers,
10
+ query: req.query ?? {},
11
+ body: req.body ?? null,
12
+ raw: req,
13
+ };
14
+ }
15
+ }