@midwayjs/security 3.11.5 → 3.11.7

package/dist/config/config.default.d.ts

@@ -1,3 +1,3 @@
-import { SecurityOptions } from '../interface';
+import type { SecurityOptions } from '../interface';
 export declare const security: Partial<SecurityOptions>;
 //# sourceMappingURL=config.default.d.ts.map

package/dist/configuration.js

@@ -13,12 +13,12 @@ exports.SecurityConfiguration = void 0;
 const core_1 = require("@midwayjs/core");
 const DefaultConfig = require("./config/config.default");
 const csrf_middleware_1 = require("./middleware/csrf.middleware");
-const xframe_1 = require("./middleware/xframe");
-const hsts_1 = require("./middleware/hsts");
-const noopen_1 = require("./middleware/noopen");
+const xframe_middleware_1 = require("./middleware/xframe.middleware");
+const hsts_middleware_1 = require("./middleware/hsts.middleware");
+const noopen_middleware_1 = require("./middleware/noopen.middleware");
 const _1 = require(".");
-const xssProtection_1 = require("./middleware/xssProtection");
-const csp_1 = require("./middleware/csp");
+const xssProtection_middleware_1 = require("./middleware/xssProtection.middleware");
+const csp_middleware_1 = require("./middleware/csp.middleware");
 const helper_1 = require("./middleware/helper");
 let SecurityConfiguration = class SecurityConfiguration {
     async onReady() {
@@ -28,25 +28,25 @@ let SecurityConfiguration = class SecurityConfiguration {
             var _a, _b, _c, _d, _e, _f, _g;
             app.useMiddleware(helper_1.SecurityHelper);
             if ((_a = this.security.csrf) === null || _a === void 0 ? void 0 : _a.enable) {
-                app.useMiddleware(csrf_middleware_1.CSRFMiddleware);
+                app.useMiddleware(csrf_middleware_1.CsrfMiddleware);
             }
             if ((_b = this.security.csp) === null || _b === void 0 ? void 0 : _b.enable) {
-                app.useMiddleware(csp_1.CSPMiddleware);
+                app.useMiddleware(csp_middleware_1.CSPMiddleware);
             }
             if ((_c = this.security.xframe) === null || _c === void 0 ? void 0 : _c.enable) {
-                app.useMiddleware(xframe_1.XFrameMiddleware);
+                app.useMiddleware(xframe_middleware_1.XFrameMiddleware);
             }
             if ((_d = this.security.hsts) === null || _d === void 0 ? void 0 : _d.enable) {
-                app.useMiddleware(hsts_1.HSTSMiddleware);
+                app.useMiddleware(hsts_middleware_1.HSTSMiddleware);
             }
             if ((_e = this.security.noopen) === null || _e === void 0 ? void 0 : _e.enable) {
-                app.useMiddleware(noopen_1.NoOpenMiddleware);
+                app.useMiddleware(noopen_middleware_1.NoOpenMiddleware);
             }
             if ((_f = this.security.nosniff) === null || _f === void 0 ? void 0 : _f.enable) {
                 app.useMiddleware(_1.NoSniffMiddleware);
             }
             if ((_g = this.security.xssProtection) === null || _g === void 0 ? void 0 : _g.enable) {
-                app.useMiddleware(xssProtection_1.XSSProtectionMiddleware);
+                app.useMiddleware(xssProtection_middleware_1.XSSProtectionMiddleware);
             }
         });
     }

package/dist/index.d.ts

@@ -1,11 +1,11 @@
 export { SecurityConfiguration as Configuration } from './configuration';
 export * from './interface';
 export * from './middleware/csrf.middleware';
-export * from './middleware/xframe';
-export * from './middleware/hsts';
-export * from './middleware/noopen';
-export * from './middleware/nosniff';
-export * from './middleware/xssProtection';
-export * from './middleware/csp';
+export * from './middleware/xframe.middleware';
+export * from './middleware/hsts.middleware';
+export * from './middleware/noopen.middleware';
+export * from './middleware/nosniff.middleware';
+export * from './middleware/xssProtection.middleware';
+export * from './middleware/csp.middleware';
 export * from './middleware/helper';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -19,11 +19,11 @@ var configuration_1 = require("./configuration");
 Object.defineProperty(exports, "Configuration", { enumerable: true, get: function () { return configuration_1.SecurityConfiguration; } });
 __exportStar(require("./interface"), exports);
 __exportStar(require("./middleware/csrf.middleware"), exports);
-__exportStar(require("./middleware/xframe"), exports);
-__exportStar(require("./middleware/hsts"), exports);
-__exportStar(require("./middleware/noopen"), exports);
-__exportStar(require("./middleware/nosniff"), exports);
-__exportStar(require("./middleware/xssProtection"), exports);
-__exportStar(require("./middleware/csp"), exports);
+__exportStar(require("./middleware/xframe.middleware"), exports);
+__exportStar(require("./middleware/hsts.middleware"), exports);
+__exportStar(require("./middleware/noopen.middleware"), exports);
+__exportStar(require("./middleware/nosniff.middleware"), exports);
+__exportStar(require("./middleware/xssProtection.middleware"), exports);
+__exportStar(require("./middleware/csp.middleware"), exports);
 __exportStar(require("./middleware/helper"), exports);
 //# sourceMappingURL=index.js.map

package/dist/interface.d.ts

@@ -1,23 +1,69 @@
+import { IgnoreMatcher } from '@midwayjs/core';
 export interface SecurityOptions {
+    /**
+     * whether defend csrf attack
+     * default enable and use cookie
+     */
     csrf: Partial<SecurityCSRFOptions>;
+    /**
+     * content security policy config
+     * default not enable
+     */
     csp: Partial<SecurityCSPOptions>;
+    /**
+     * whether enable X-Frame-Options response header
+     * default enable and value equals SAMEORIGIN
+     */
     xframe: Partial<SecurityXFrameOptions>;
+    /**
+     * whether enable Strict-Transport-Security response header
+     * default not enable and maxAge equals one year
+     */
     hsts: Partial<SecurityHSTSOptions>;
+    /**
+     * whether enable IE automaticlly download open
+     * default not enable
+     */
     noopen: Partial<SecurityEnableOptions>;
+    /**
+     * whether enable IE8 automaticlly dedect mime
+     * default not enable
+     */
     nosniff: Partial<SecurityEnableOptions>;
+    /**
+     * whether enable IE8 XSS Filter, default is open
+     * default enable
+     */
     xssProtection: Partial<SecurityXSSProtectionOptions>;
 }
 export interface SecurityCSRFOptions extends SecurityEnableOptions {
     type: SecurityCSRFType;
+    /**
+     * If set to true, the secret will be stored in the session instead of the cookie.
+     */
     useSession: boolean;
+    /**
+     * The key name stored in the cookie by the token of csrf
+     */
     cookieName: string | string[];
+    /**
+     * The key name of the CSRF token stored in the session.
+     */
     sessionName: string;
+    /**
+     * The name of the csrf token in the header
+     */
     headerName: string;
+    /**
+     * The name of the csrf token in the body.
+     */
     bodyName: string;
+    /**
+     * The name of the csrf token in the query.
+     */
     queryName: string;
     refererWhiteList: string[];
     cookieDomain: (context: any) => string;
-    matching: (context: any) => boolean;
 }
 export interface SecurityXFrameOptions extends SecurityEnableOptions {
     value: string;
@@ -38,6 +84,8 @@ export interface SecurityCSPOptions extends SecurityEnableOptions {
 }
 export interface SecurityEnableOptions {
     enable: boolean;
+    match?: IgnoreMatcher<any> | IgnoreMatcher<any>[];
+    ignore?: IgnoreMatcher<any> | IgnoreMatcher<any>[];
 }
 export type SecurityCSRFType = 'all' | 'any' | 'ctoken' | 'referer';
 //# sourceMappingURL=interface.d.ts.map

package/dist/middleware/base.d.ts

@@ -1,8 +1,12 @@
-import { IMiddleware } from '@midwayjs/core';
+import { IMiddleware, IgnoreMatcher } from '@midwayjs/core';
 import { SecurityOptions } from '../interface';
 export declare abstract class BaseMiddleware implements IMiddleware<any, any> {
     security: SecurityOptions;
+    match: IgnoreMatcher<any>[];
+    ignore: IgnoreMatcher<any>[];
+    init(): Promise<void>;
     resolve(app: any): (req: any, res: any, next: any) => Promise<any>;
     abstract compatibleMiddleware(context: any, req: any, res: any, next: any): any;
+    abstract securityName(): string;
 }
 //# sourceMappingURL=base.d.ts.map

package/dist/middleware/base.js

@@ -12,6 +12,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMiddleware = void 0;
 const core_1 = require("@midwayjs/core");
 class BaseMiddleware {
+    async init() {
+        var _a, _b, _c, _d;
+        // 动态合并一些规则
+        if ((_b = (_a = this.security) === null || _a === void 0 ? void 0 : _a[this.securityName()]) === null || _b === void 0 ? void 0 : _b.match) {
+            this.match = this.security[this.securityName()].match;
+        }
+        else if ((_d = (_c = this.security) === null || _c === void 0 ? void 0 : _c[this.securityName()]) === null || _d === void 0 ? void 0 : _d.ignore) {
+            this.ignore = this.security[this.securityName()].ignore;
+        }
+    }
     resolve(app) {
         if (app.getFrameworkType() === core_1.MidwayFrameworkType.WEB_EXPRESS) {
             return async (req, res, next) => {
@@ -29,5 +39,11 @@ __decorate([
     (0, core_1.Config)('security'),
     __metadata("design:type", Object)
 ], BaseMiddleware.prototype, "security", void 0);
+__decorate([
+    (0, core_1.Init)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BaseMiddleware.prototype, "init", null);
 exports.BaseMiddleware = BaseMiddleware;
 //# sourceMappingURL=base.js.map

package/dist/middleware/{csp.d.ts → csp.middleware.d.ts}

@@ -1,5 +1,6 @@
 import { BaseMiddleware } from './base';
 export declare class CSPMiddleware extends BaseMiddleware {
     compatibleMiddleware(context: any, req: any, res: any, next: any): Promise<any>;
+    securityName(): string;
 }
-//# sourceMappingURL=csp.d.ts.map
+//# sourceMappingURL=csp.middleware.d.ts.map

package/dist/middleware/{csp.js → csp.middleware.js}

@@ -73,9 +73,12 @@ let CSPMiddleware = class CSPMiddleware extends base_1.BaseMiddleware {
         res.set('x-csp-nonce', context.nonce);
         return result;
     }
+    securityName() {
+        return 'csp';
+    }
 };
 CSPMiddleware = __decorate([
     (0, core_1.Middleware)()
 ], CSPMiddleware);
 exports.CSPMiddleware = CSPMiddleware;
-//# sourceMappingURL=csp.js.map
+//# sourceMappingURL=csp.middleware.js.map

package/dist/middleware/csrf.middleware.d.ts

@@ -1,5 +1,5 @@
 import { BaseMiddleware } from './base';
-export declare class CSRFMiddleware extends BaseMiddleware {
+export declare class CsrfMiddleware extends BaseMiddleware {
     compatibleMiddleware(context: any, req: any, res: any, next: any): Promise<any>;
     assertCsrf(context: any, request: any): void;
     getCSRFSecret(context: any): any;
@@ -7,5 +7,6 @@ export declare class CSRFMiddleware extends BaseMiddleware {
     private checkCSRFToken;
     private checkCSRFReferer;
     private ensureCsrfSecret;
+    securityName(): string;
 }
 //# sourceMappingURL=csrf.middleware.d.ts.map

package/dist/middleware/csrf.middleware.js

@@ -6,7 +6,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CSRFMiddleware = void 0;
+exports.CsrfMiddleware = void 0;
 const core_1 = require("@midwayjs/core");
 const error_1 = require("../error");
 const CsrfTokens = require("csrf");
@@ -15,7 +15,7 @@ const base_1 = require("./base");
 const _CSRF_SECRET = Symbol('midway-security#_CSRF_SECRET');
 const NEW_CSRF_SECRET = Symbol('midway-security#NEW_CSRF_SECRET');
 const tokens = new CsrfTokens();
-let CSRFMiddleware = class CSRFMiddleware extends base_1.BaseMiddleware {
+let CsrfMiddleware = class CsrfMiddleware extends base_1.BaseMiddleware {
     async compatibleMiddleware(context, req, res, next) {
         context.assertCsrf = () => {
             this.assertCsrf(context, req);
@@ -153,9 +153,12 @@ let CSRFMiddleware = class CSRFMiddleware extends base_1.BaseMiddleware {
             }
         }
     }
+    securityName() {
+        return 'csrf';
+    }
 };
-CSRFMiddleware = __decorate([
+CsrfMiddleware = __decorate([
     (0, core_1.Middleware)()
-], CSRFMiddleware);
-exports.CSRFMiddleware = CSRFMiddleware;
+], CsrfMiddleware);
+exports.CsrfMiddleware = CsrfMiddleware;
 //# sourceMappingURL=csrf.middleware.js.map

package/dist/middleware/helper.d.ts

@@ -1,5 +1,6 @@
-import { BaseMiddleware } from './base';
-export declare class SecurityHelper extends BaseMiddleware {
+import { IMiddleware } from '@midwayjs/core';
+export declare class SecurityHelper implements IMiddleware<any, any> {
+    resolve(app: any): (req: any, res: any, next: any) => Promise<any>;
     compatibleMiddleware(context: any, req: any, res: any, next: any): Promise<any>;
 }
 //# sourceMappingURL=helper.d.ts.map

package/dist/middleware/helper.js

@@ -8,14 +8,25 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityHelper = void 0;
 const core_1 = require("@midwayjs/core");
-const base_1 = require("./base");
 const escape = require("escape-html");
 const xss_1 = require("xss");
-let SecurityHelper = class SecurityHelper extends base_1.BaseMiddleware {
+let SecurityHelper = class SecurityHelper {
+    resolve(app) {
+        if (app.getFrameworkType() === core_1.MidwayFrameworkType.WEB_EXPRESS) {
+            return async (req, res, next) => {
+                return this.compatibleMiddleware(req, req, res, next);
+            };
+        }
+        else {
+            return async (ctx, next) => {
+                return this.compatibleMiddleware(ctx, ctx.request, ctx, next);
+            };
+        }
+    }
     async compatibleMiddleware(context, req, res, next) {
         context.security = {
             escape,
-            html: (htmlCode) => (0, xss_1.default)(htmlCode),
+            html: (htmlCode) => (0, xss_1.filterXSS)(htmlCode),
             js: safeJS,
             json: safeJSON,
         };

package/dist/middleware/{hsts.d.ts → hsts.middleware.d.ts}

@@ -1,5 +1,6 @@
 import { BaseMiddleware } from './base';
 export declare class HSTSMiddleware extends BaseMiddleware {
     compatibleMiddleware(context: any, req: any, res: any, next: any): Promise<any>;
+    securityName(): string;
 }
-//# sourceMappingURL=hsts.d.ts.map
+//# sourceMappingURL=hsts.middleware.d.ts.map

package/dist/middleware/{hsts.js → hsts.middleware.js}

@@ -19,9 +19,12 @@ let HSTSMiddleware = class HSTSMiddleware extends base_1.BaseMiddleware {
         res.set('strict-transport-security', val);
         return result;
     }
+    securityName() {
+        return 'hsts';
+    }
 };
 HSTSMiddleware = __decorate([
     (0, core_1.Middleware)()
 ], HSTSMiddleware);
 exports.HSTSMiddleware = HSTSMiddleware;
-//# sourceMappingURL=hsts.js.map
+//# sourceMappingURL=hsts.middleware.js.map

package/dist/middleware/{noopen.d.ts → noopen.middleware.d.ts}

@@ -1,5 +1,6 @@
 import { BaseMiddleware } from './base';
 export declare class NoOpenMiddleware extends BaseMiddleware {
     compatibleMiddleware(context: any, req: any, res: any, next: any): Promise<any>;
+    securityName(): string;
 }
-//# sourceMappingURL=noopen.d.ts.map
+//# sourceMappingURL=noopen.middleware.d.ts.map

package/dist/middleware/{noopen.js → noopen.middleware.js}

@@ -15,9 +15,12 @@ let NoOpenMiddleware = class NoOpenMiddleware extends base_1.BaseMiddleware {
         res.set('x-download-options', 'noopen');
         return result;
     }
+    securityName() {
+        return 'noopen';
+    }
 };
 NoOpenMiddleware = __decorate([
     (0, core_1.Middleware)()
 ], NoOpenMiddleware);
 exports.NoOpenMiddleware = NoOpenMiddleware;
-//# sourceMappingURL=noopen.js.map
+//# sourceMappingURL=noopen.middleware.js.map

package/dist/middleware/{nosniff.d.ts → nosniff.middleware.d.ts}

@@ -1,5 +1,6 @@
 import { BaseMiddleware } from './base';
 export declare class NoSniffMiddleware extends BaseMiddleware {
     compatibleMiddleware(context: any, req: any, res: any, next: any): Promise<any>;
+    securityName(): string;
 }
-//# sourceMappingURL=nosniff.d.ts.map
+//# sourceMappingURL=nosniff.middleware.d.ts.map

package/dist/middleware/{nosniff.js → nosniff.middleware.js}

@@ -18,9 +18,12 @@ let NoSniffMiddleware = class NoSniffMiddleware extends base_1.BaseMiddleware {
         res.set('x-content-type-options', 'nosniff');
         return result;
     }
+    securityName() {
+        return 'nosniff';
+    }
 };
 NoSniffMiddleware = __decorate([
     (0, core_1.Middleware)()
 ], NoSniffMiddleware);
 exports.NoSniffMiddleware = NoSniffMiddleware;
-//# sourceMappingURL=nosniff.js.map
+//# sourceMappingURL=nosniff.middleware.js.map

package/dist/middleware/{xframe.d.ts → xframe.middleware.d.ts}

@@ -1,5 +1,6 @@
 import { BaseMiddleware } from './base';
 export declare class XFrameMiddleware extends BaseMiddleware {
     compatibleMiddleware(context: any, req: any, res: any, next: any): Promise<any>;
+    securityName(): string;
 }
-//# sourceMappingURL=xframe.d.ts.map
+//# sourceMappingURL=xframe.middleware.d.ts.map

package/dist/middleware/{xframe.js → xframe.middleware.js}

@@ -17,9 +17,12 @@ let XFrameMiddleware = class XFrameMiddleware extends base_1.BaseMiddleware {
         res.set('x-frame-options', value);
         return result;
     }
+    securityName() {
+        return 'xframe';
+    }
 };
 XFrameMiddleware = __decorate([
     (0, core_1.Middleware)()
 ], XFrameMiddleware);
 exports.XFrameMiddleware = XFrameMiddleware;
-//# sourceMappingURL=xframe.js.map
+//# sourceMappingURL=xframe.middleware.js.map

package/dist/middleware/{xssProtection.d.ts → xssProtection.middleware.d.ts}

@@ -1,5 +1,6 @@
 import { BaseMiddleware } from './base';
 export declare class XSSProtectionMiddleware extends BaseMiddleware {
     compatibleMiddleware(context: any, req: any, res: any, next: any): Promise<any>;
+    securityName(): string;
 }
-//# sourceMappingURL=xssProtection.d.ts.map
+//# sourceMappingURL=xssProtection.middleware.d.ts.map

package/dist/middleware/{xssProtection.js → xssProtection.middleware.js}

@@ -15,9 +15,12 @@ let XSSProtectionMiddleware = class XSSProtectionMiddleware extends base_1.BaseM
         res.set('x-xss-protection', this.security.xssProtection.value);
         return result;
     }
+    securityName() {
+        return 'xssProtection';
+    }
 };
 XSSProtectionMiddleware = __decorate([
     (0, core_1.Middleware)()
 ], XSSProtectionMiddleware);
 exports.XSSProtectionMiddleware = XSSProtectionMiddleware;
-//# sourceMappingURL=xssProtection.js.map
+//# sourceMappingURL=xssProtection.middleware.js.map

package/index.d.ts

@@ -6,3 +6,47 @@ declare module '@midwayjs/core/dist/interface' {
     security?: Partial<SecurityOptions>;
   }
 }
+
+declare module '@midwayjs/koa/dist/interface' {
+  interface Context {
+    security: {
+      escape: (content: string) => string;
+      html: (htmlCode: string) => string;
+      js: (jsCode: string) => string;
+      json: (obj: any) => string;
+    };
+  }
+}
+
+declare module '@midwayjs/web/dist/interface' {
+  interface Context {
+    security: {
+      escape: (content: string) => string;
+      html: (htmlCode: string) => string;
+      js: (jsCode: string) => string;
+      json: (obj: any) => string;
+    };
+  }
+}
+
+declare module '@midwayjs/faas/dist/interface' {
+  interface Context {
+    security: {
+      escape: (content: string) => string;
+      html: (htmlCode: string) => string;
+      js: (jsCode: string) => string;
+      json: (obj: any) => string;
+    };
+  }
+}
+
+declare module '@midwayjs/express/dist/interface' {
+  interface Context {
+    security: {
+      escape: (content: string) => string;
+      html: (htmlCode: string) => string;
+      js: (jsCode: string) => string;
+      json: (obj: any) => string;
+    };
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@midwayjs/security",
-  "version": "3.11.5",
+  "version": "3.11.7",
   "description": "Midway Security Component",
   "main": "dist/index.js",
   "typings": "index.d.ts",
@@ -23,20 +23,20 @@
   "license": "MIT",
   "dependencies": {
     "csrf": "3.1.0",
-    "escape-html": "^1.0.3",
+    "escape-html": "1.0.3",
     "nanoid": "3.3.6",
     "picomatch": "2.3.1",
     "platform": "1.3.6",
-    "xss": "^1.0.11"
+    "xss": "1.0.14"
   },
   "devDependencies": {
-    "@midwayjs/core": "^3.11.4",
-    "@midwayjs/express": "^3.11.5",
-    "@midwayjs/faas": "^3.11.5",
-    "@midwayjs/koa": "^3.11.5",
-    "@midwayjs/mock": "^3.11.5",
-    "@midwayjs/serverless-app": "^3.11.5",
-    "@midwayjs/web": "^3.11.5"
+    "@midwayjs/core": "^3.11.6",
+    "@midwayjs/express": "^3.11.6",
+    "@midwayjs/faas": "^3.11.6",
+    "@midwayjs/koa": "^3.11.6",
+    "@midwayjs/mock": "^3.11.6",
+    "@midwayjs/serverless-app": "^3.11.6",
+    "@midwayjs/web": "^3.11.6"
   },
-  "gitHead": "a2c3b25f840a2e9dc01bfb7ef4bef82c3a4b0dcf"
+  "gitHead": "1a67449223f9cf513dafda6319989e67a338f122"
 }