@mocoto/mahoraga 0.14.0

package/dist/app/github/middleware/autenticacao.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autenticacao.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/autenticacao.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAMjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAEvD,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,2BAA2B,GAAG,OAAO,CAAC;AAI5C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwE,CAAC;AACrG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE5C,SAAS,oBAAoB;IAC3B,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YAC5B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,oBAAoB,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAY;QACvB,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB;QAC3C,EAAE;KACH,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,oBAAoB,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACpD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEvC,IAAI,CAAC,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;QACtE,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;QAC7C,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,WAAW,CAAC,WAAW,IAAI,GAAG,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gEAAgE,EAAE,CAAC,CAAC;QACjG,OAAO;IACT,CAAC;IAED,IAAI,WAAW,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;QAC7C,WAAW,CAAC,WAAW,GAAG,GAAG,GAAG,2BAA2B,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gEAAgE,EAAE,CAAC,CAAC;QACjG,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM;QACpC,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAClB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC1C,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAElB,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAElE,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC;QACtB,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAClC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CACxB,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC;gBACtB,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,EAAE;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACpD,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;IACH,CAAC;IAED,WAAW,CAAC,KAAK,EAAE,CAAC;IAEpB,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpD,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACzB,CAAC","sourcesContent":["import crypto from 'node:crypto';\n\nimport type { NextFunction, Request, Response } from 'express';\n\nimport type { SessionData } from '../../../types/github/app.js';\n\nconst _IS_PROD = process.env.NODE_ENV === 'production';\n\nconst AUTH_FAIL_DELAY_MS = 1000;\nconst MAX_ATTEMPTS_PER_IP = 10;\nconst ATTEMPT_WINDOW_MS = 300_000;\nconst SESSION_DURATION_MS = 86_400_000;\nconst ACCOUNT_LOCKOUT_DURATION_MS = 900_000;\n\ntype Session = SessionData;\n\nconst authAttempts = new Map<string, { count: number; windowStart: number; lockedUntil?: number }>();\nconst sessions = new Map<string, Session>();\n\nfunction generateSessionToken(): string {\n  return crypto.randomBytes(32).toString('hex');\n}\n\nfunction cleanExpiredSessions(): void {\n  const now = Date.now();\n  for (const [token, session] of sessions) {\n    if (session.expiresAt < now) {\n      sessions.delete(token);\n    }\n  }\n}\n\nexport function createSession(ip: string): Session {\n  cleanExpiredSessions();\n  const token = generateSessionToken();\n  const session: Session = {\n    token,\n    createdAt: Date.now(),\n    expiresAt: Date.now() + SESSION_DURATION_MS,\n    ip,\n  };\n  sessions.set(token, session);\n  return session;\n}\n\nexport function getSession(token: string): Session | undefined {\n  cleanExpiredSessions();\n  const session = sessions.get(token);\n  if (session && session.expiresAt < Date.now()) {\n    sessions.delete(token);\n    return undefined;\n  }\n  return session;\n}\n\nexport function destroySession(token: string): void {\n  sessions.delete(token);\n}\n\nconst MENSAGEM_GENERICA = 'Nao autorizado.';\n\nexport function exigeAutenticacao(req: Request, res: Response, next: NextFunction): void {\n  const adminToken = process.env.MAHORAGA_ADMIN_TOKEN;\n  if (!adminToken) {\n    res.status(401).json({ erro: MENSAGEM_GENERICA });\n    return;\n  }\n\n  const ip = req.ip || req.socket.remoteAddress || 'unknown';\n  const now = Date.now();\n  let attemptData = authAttempts.get(ip);\n\n  if (!attemptData || now > attemptData.windowStart + ATTEMPT_WINDOW_MS) {\n    attemptData = { count: 0, windowStart: now };\n    authAttempts.set(ip, attemptData);\n  }\n\n  if (attemptData.lockedUntil && now < attemptData.lockedUntil) {\n    res.status(429).json({ erro: 'Muitas tentativas de autenticacao. Tente novamente mais tarde.' });\n    return;\n  }\n\n  if (attemptData.count >= MAX_ATTEMPTS_PER_IP) {\n    attemptData.lockedUntil = now + ACCOUNT_LOCKOUT_DURATION_MS;\n    res.status(429).json({ erro: 'Muitas tentativas de autenticacao. Tente novamente mais tarde.' });\n    return;\n  }\n\n  const authHeader = req.headers.authorization;\n  const cookieToken = req.headers.cookie\n    ?.split(';')\n    .map(c => c.trim())\n    .find(c => c.startsWith('session_token='))\n    ?.split('=')[1];\n\n  const session = cookieToken ? getSession(cookieToken) : undefined;\n\n  if (session && session.ip === ip) {\n    attemptData.count = 0;\n    next();\n    return;\n  }\n\n  if (authHeader && authHeader.startsWith('Bearer ')) {\n    const providedToken = authHeader.slice(7);\n    try {\n      const match = crypto.timingSafeEqual(\n        Buffer.from(providedToken),\n        Buffer.from(adminToken)\n      );\n      if (match) {\n        attemptData.count = 0;\n        next();\n        return;\n      }\n    } catch {\n      attemptData.count++;\n      setTimeout(() => {\n        res.status(401).json({ erro: MENSAGEM_GENERICA });\n      }, AUTH_FAIL_DELAY_MS);\n      return;\n    }\n  }\n\n  attemptData.count++;\n\n  setTimeout(() => {\n    res.status(401).json({ erro: MENSAGEM_GENERICA });\n  }, AUTH_FAIL_DELAY_MS);\n}\n"]}

package/dist/app/github/middleware/bloqueio-pentest.d.ts

@@ -0,0 +1,3 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare function bloquearPentestUrl(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=bloqueio-pentest.d.ts.map

package/dist/app/github/middleware/bloqueio-pentest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bloqueio-pentest.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/bloqueio-pentest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAuR/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA4GxF"}

package/dist/app/github/middleware/bloqueio-pentest.js

@@ -0,0 +1,382 @@
+import { reportAttack } from './security-store.js';
+const ROTAS_PUBLICAS = new Set([
+    '/app-info',
+    '/health',
+    '/webhooks',
+    '/ping',
+    '/setup',
+    '/setup-info',
+]);
+function isRotaPublica(path) {
+    if (ROTAS_PUBLICAS.has(path))
+        return true;
+    if (path.startsWith('/setup'))
+        return true;
+    return false;
+}
+const PENTEST_AGENTS = [
+    /burpsuite/i,
+    /owasp/i,
+    /zap/i,
+    /nikto/i,
+    /nmap/i,
+    /sqlmap/i,
+    /wpscan/i,
+    /acunetix/i,
+    /netsparker/i,
+    /nessus/i,
+    /openvas/i,
+    /appscan/i,
+    /webinspect/i,
+    /golismero/i,
+    /w3af/i,
+    /arachni/i,
+    /masscan/i,
+    /hydra/i,
+    /medusa/i,
+    /aircrack/i,
+    /metasploit/i,
+    /fiddler/i,
+    /postmanruntime/i,
+    /^curl\//i,
+    /^wget\//i,
+    /^python-requests\//i,
+    /^go-http-client\//i,
+    /^aiohttp\//i,
+    /^httpx\//i,
+    /^httpie/i,
+    /^Java\//i,
+    /^libwww-perl/i,
+    /^WWW-Mechanize/i,
+    /^perl\//i,
+    /^Ruby\//i,
+    /^Scrapy/i,
+    /^Lynx/i,
+    /^Wget\//i,
+    /^axios\//i,
+    /^node-fetch\//i,
+    /^fetch\//i,
+    /^Mozilla\/5\.0\s*\((?!.*Windows|Mac|Linux|iPhone|Android).*\)/i,
+];
+const SUSPICIOUS_HEADERS = [
+    'x-pentest-auth',
+    'x-pentest',
+    'x-scanner',
+    'x-attack',
+    'x-cve',
+    'x-vuln',
+    'x-security-test',
+    'x-rce',
+    'x-lfi',
+    'x-rfi',
+    'x-sqli',
+    'x-xss',
+    'x-ssrf',
+];
+const SQL_INJECTION_PATTERNS = [
+    /(\bSELECT\b.*\bFROM\b)/is,
+    /(\bUNION\b.*\bSELECT\b)/is,
+    /(\bINSERT\b.*\bINTO\b)/is,
+    /(\bDELETE\b.*\bFROM\b)/is,
+    /(\bDROP\b.*\bTABLE\b)/is,
+    /(\bALTER\b.*\bTABLE\b)/is,
+    /(\bCREATE\b.*\bTABLE\b)/is,
+    /(\bTRUNCATE\b.*\bTABLE\b)/is,
+    /(\bEXEC\b.*\bXP_)/is,
+    /(\bOR\b\s+\d+\s*=\s*\d+)/is,
+    /(\bAND\b\s+\d+\s*=\s*\d+)/is,
+    /(\bUNION\b\s+\d+\s*#)/is,
+    /(\bWAITFOR\b.*\bDELAY\b)/is,
+    /(\bSLEEP\b\s*\()/is,
+    /(\bBENCHMARK\b\s*\()/is,
+    /(\bLOAD_FILE\b)/is,
+    /(\bINTO\s+(OUT|DUMP)FILE\b)/is,
+    /(\bCHAR\b\s*\()/is,
+    /(\bCONVERT\b\s*\()/is,
+    /(\bCAST\b\s*\()/is,
+    /(')|(")--/,
+    /(\/\*!\d+)/,
+    /(\b0x[0-9a-f]{4,})\b/is,
+];
+const XSS_PATTERNS = [
+    /<script[\s>]/i,
+    /<img[^>]*onerror\s*=/i,
+    /<svg[^>]*onload\s*=/i,
+    /<body[^>]*onload\s*=/i,
+    /<iframe[\s>]/i,
+    /<object[\s>]/i,
+    /<embed[\s>]/i,
+    /<form[^>]*action\s*=\s*["']javascript/i,
+    /onerror\s*=\s*["'][^"']*["']/i,
+    /onload\s*=\s*["'][^"']*["']/i,
+    /onclick\s*=\s*["'][^"']*["']/i,
+    /onmouseover\s*=\s*["'][^"']*["']/i,
+    /onfocus\s*=\s*["'][^"']*["']/i,
+    /onblur\s*=\s*["'][^"']*["']/i,
+    /onchange\s*=\s*["'][^"']*["']/i,
+    /onsubmit\s*=\s*["'][^"']*["']/i,
+    /onreset\s*=\s*["'][^"']*["']/i,
+    /javascript\s*:/i,
+    /eval\s*\(/i,
+    /alert\s*\(/i,
+    /confirm\s*\(/i,
+    /prompt\s*\(/i,
+    /document\s*\.\s*(cookie|write|writeln|location|domain|referrer)/i,
+    /window\s*\.\s*(location|name|status)/i,
+    /String\s*\.\s*fromCharCode/i,
+    /\\x[0-9a-f]{2,}/i,
+    /&#\d{2,};/i,
+    /&#x[0-9a-f]{2,};/i,
+    /data\s*:\s*text\/html/i,
+    /data\s*:\s*application\/x-javascript/i,
+    /vbscript\s*:/i,
+    /expression\s*\(/i,
+    /@import\s/i,
+    /behavior\s*:/i,
+    /-moz-binding\s*:/i,
+];
+const PATH_TRAVERSAL = [
+    /\.\.\//,
+    /\.\.\\\\/,
+    /%2e%2e\//i,
+    /%2e%2e%5c/i,
+    /%c0%ae%c0%ae\//i,
+    /\.\.%00/i,
+    /\.\.\\u[0-9a-f]{4}/i,
+    /\.\.\\0/i,
+    /~root/,
+    /~\./,
+    /\.php\?/i,
+    /\.asp\?/i,
+    /\.aspx\?/i,
+    /\.jsp\?/i,
+    /\.cgi\?/i,
+];
+const KNOWN_VULN_PATHS = [
+    /\/\.env/i,
+    /\/\.git\//i,
+    /\/\.gitconfig/i,
+    /\/\.gitignore/i,
+    /\/\.svn\//i,
+    /\/\.htaccess/i,
+    /\/\.htpasswd/i,
+    /\/wp-admin\//i,
+    /\/wp-content\//i,
+    /\/wp-config\.php/i,
+    /\/xmlrpc\.php/i,
+    /\/admin\/?$/i,
+    /\/config\.json/i,
+    /\/config\.php/i,
+    /\/config\.xml/i,
+    /\/database\.yml/i,
+    /\/dump\.sql/i,
+    /\/phpinfo\.php/i,
+    /\/server-status/i,
+    /\/server-info/i,
+    /\/\.aws\//i,
+    /\/\.ssh\//i,
+    /\/id_rsa/i,
+    /\/composer\.json/i,
+    /\/package\.json$/i,
+    /\/npm-shrinkwrap\.json/i,
+    /\/yarn\.lock/i,
+    /\/package-lock\.json/i,
+    /\/credentials/i,
+    /\/secrets/i,
+    /\/tokens/i,
+    /\/api-docs/i,
+    /\/swagger/i,
+    /\/openapi\.json/i,
+    /\/graphql/i,
+    /\/actuator\//i,
+    /\/heapdump/i,
+    /\/threaddump/i,
+    /\/logfile/i,
+    /\/debug\//i,
+    /\/console\//i,
+    /\/jmx\//i,
+    /\/hystrix/i,
+    /\/turbine/i,
+    /\/proxy\//i,
+    /\/..%5c/i,
+    /\/\.\.;/i,
+    /\/cgi-bin\//i,
+    /\/\.well-known\/security\.txt/i,
+    /\/sitemap\.xml/i,
+    /\/robots\.txt$/i,
+    /\/crossdomain\.xml/i,
+    /\/clientaccesspolicy\.xml/i,
+    /\/\.hg\//i,
+    /\/\.bzr\//i,
+    /\/\.DS_Store/i,
+    /\/Thumbs\.db/i,
+    /\/web\.config/i,
+    /\/\.npmrc/i,
+    /\/\.dockerenv/i,
+    /\/Dockerfile/i,
+    /\/docker-compose\.yml/i,
+    /\/\.terraform\//i,
+    /\/\.kube\//i,
+    /\/kubeconfig/i,
+    /\/\.pgpass/i,
+    /\/\.netrc/i,
+    /\/\.bash_history/i,
+    /\/\.mysql_history/i,
+    /\/\.psql_history/i,
+    /\/\.rediscli_history/i,
+];
+const CVE_SCAN_PATTERNS = [
+    /CVE-\d{4}-\d{4,}/i,
+    /CVE-\d{4}-\d+/i,
+];
+const THRESHOLD_SUSPICIOUS_PARAMS = 10;
+const SUSPICIOUS_WINDOW_MS = 600_000;
+const pentestScore = new Map();
+function incrementarScoreSuspenso(ip) {
+    const now = Date.now();
+    let entry = pentestScore.get(ip);
+    if (!entry || now > entry.resetAt) {
+        entry = { score: 1, resetAt: now + SUSPICIOUS_WINDOW_MS };
+    }
+    else {
+        entry.score++;
+    }
+    pentestScore.set(ip, entry);
+}
+function estaPontuacaoSuspensa(ip) {
+    const entry = pentestScore.get(ip);
+    if (!entry)
+        return false;
+    if (Date.now() > entry.resetAt) {
+        pentestScore.delete(ip);
+        return false;
+    }
+    return entry.score >= 20;
+}
+function verificarValor(valor) {
+    for (const pattern of SQL_INJECTION_PATTERNS) {
+        if (pattern.test(valor))
+            return 'sql_injection';
+    }
+    for (const pattern of XSS_PATTERNS) {
+        if (pattern.test(valor))
+            return 'xss';
+    }
+    for (const pattern of PATH_TRAVERSAL) {
+        if (pattern.test(valor))
+            return 'path_traversal';
+    }
+    return null;
+}
+export function bloquearPentestUrl(req, res, next) {
+    if (isRotaPublica(req.path)) {
+        next();
+        return;
+    }
+    const ip = req.ip || req.socket.remoteAddress || 'unknown';
+    const fullPath = req.originalUrl || req.url;
+    if (estaPontuacaoSuspensa(ip)) {
+        reportAttack('pentest_score', ip, fullPath);
+        res.status(403).json({ erro: 'Acesso negado.' });
+        return;
+    }
+    const userAgent = req.headers['user-agent'] || '';
+    for (const pattern of PENTEST_AGENTS) {
+        if (pattern.test(userAgent)) {
+            incrementarScoreSuspenso(ip);
+            reportAttack('pentest_agent', ip, fullPath);
+            res.status(403).json({ erro: 'Acesso negado.' });
+            return;
+        }
+    }
+    for (const header of SUSPICIOUS_HEADERS) {
+        if (req.headers[header]) {
+            incrementarScoreSuspenso(ip);
+            reportAttack('pentest_header', ip, fullPath);
+            res.status(403).json({ erro: 'Acesso negado.' });
+            return;
+        }
+    }
+    for (const pattern of KNOWN_VULN_PATHS) {
+        if (pattern.test(fullPath)) {
+            incrementarScoreSuspenso(ip);
+            reportAttack('vuln_scan', ip, fullPath);
+            res.status(404).json({ erro: 'Nao encontrado.' });
+            return;
+        }
+    }
+    for (const pattern of CVE_SCAN_PATTERNS) {
+        if (pattern.test(fullPath)) {
+            incrementarScoreSuspenso(ip);
+            reportAttack('cve_scan', ip, fullPath);
+            res.status(404).json({ erro: 'Nao encontrado.' });
+            return;
+        }
+    }
+    const valuesToCheck = [];
+    if (req.query) {
+        const queryKeys = Object.keys(req.query);
+        if (queryKeys.length > THRESHOLD_SUSPICIOUS_PARAMS) {
+            incrementarScoreSuspenso(ip);
+            reportAttack('excess_params', ip, fullPath);
+            res.status(400).json({ erro: 'Muitos parametros.' });
+            return;
+        }
+        for (const val of Object.values(req.query)) {
+            if (typeof val === 'string')
+                valuesToCheck.push(val);
+            if (Array.isArray(val)) {
+                for (const v of val) {
+                    if (typeof v === 'string')
+                        valuesToCheck.push(v);
+                }
+            }
+        }
+    }
+    if (req.params) {
+        for (const val of Object.values(req.params)) {
+            if (typeof val === 'string')
+                valuesToCheck.push(val);
+        }
+    }
+    for (const value of valuesToCheck) {
+        if (value.length > 2000 || value.includes('\0')) {
+            incrementarScoreSuspenso(ip);
+            reportAttack('invalid_param', ip, fullPath);
+            res.status(400).json({ erro: 'Parametro invalido.' });
+            return;
+        }
+        const attackType = verificarValor(value);
+        if (attackType) {
+            incrementarScoreSuspenso(ip);
+            reportAttack(attackType, ip, fullPath);
+            res.status(400).json({ erro: 'Parametro invalido.' });
+            return;
+        }
+    }
+    const contentLength = req.headers['content-length'];
+    if (contentLength) {
+        const len = parseInt(contentLength, 10);
+        if (!Number.isNaN(len) && len > 500_000) {
+            incrementarScoreSuspenso(ip);
+            reportAttack('oversized_payload', ip, fullPath);
+            res.status(413).json({ erro: 'Payload muito grande.' });
+            return;
+        }
+    }
+    next();
+}
+const CLEANUP_INTERVAL = 300_000;
+const cleanupTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [ip, entry] of pentestScore) {
+        if (now > entry.resetAt) {
+            pentestScore.delete(ip);
+        }
+    }
+}, CLEANUP_INTERVAL);
+cleanupTimer.unref();
+process.on('SIGTERM', () => { clearInterval(cleanupTimer); });
+process.on('SIGINT', () => { clearInterval(cleanupTimer); });
+process.on('beforeExit', () => { clearInterval(cleanupTimer); });
+//# sourceMappingURL=bloqueio-pentest.js.map

package/dist/app/github/middleware/bloqueio-pentest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bloqueio-pentest.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/bloqueio-pentest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,WAAW;IACX,SAAS;IACT,WAAW;IACX,OAAO;IACP,QAAQ;IACR,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,cAAc,GAAG;IACrB,YAAY;IACZ,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,SAAS;IACT,UAAU;IACV,UAAU;IACV,aAAa;IACb,YAAY;IACZ,OAAO;IACP,UAAU;IACV,UAAU;IACV,QAAQ;IACR,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,qBAAqB;IACrB,oBAAoB;IACpB,aAAa;IACb,WAAW;IACX,UAAU;IACV,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,UAAU;IACV,QAAQ;IACR,UAAU;IACV,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,gEAAgE;CACjE,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,gBAAgB;IAChB,WAAW;IACX,WAAW;IACX,UAAU;IACV,OAAO;IACP,QAAQ;IACR,iBAAiB;IACjB,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,0BAA0B;IAC1B,2BAA2B;IAC3B,0BAA0B;IAC1B,0BAA0B;IAC1B,yBAAyB;IACzB,0BAA0B;IAC1B,2BAA2B;IAC3B,6BAA6B;IAC7B,qBAAqB;IACrB,4BAA4B;IAC5B,6BAA6B;IAC7B,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,wBAAwB;IACxB,mBAAmB;IACnB,+BAA+B;IAC/B,mBAAmB;IACnB,sBAAsB;IACtB,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,wBAAwB;CACzB,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,eAAe;IACf,uBAAuB;IACvB,sBAAsB;IACtB,uBAAuB;IACvB,eAAe;IACf,eAAe;IACf,cAAc;IACd,wCAAwC;IACxC,+BAA+B;IAC/B,8BAA8B;IAC9B,+BAA+B;IAC/B,mCAAmC;IACnC,+BAA+B;IAC/B,8BAA8B;IAC9B,gCAAgC;IAChC,gCAAgC;IAChC,+BAA+B;IAC/B,iBAAiB;IACjB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,cAAc;IACd,kEAAkE;IAClE,uCAAuC;IACvC,6BAA6B;IAC7B,kBAAkB;IAClB,YAAY;IACZ,mBAAmB;IACnB,wBAAwB;IACxB,uCAAuC;IACvC,eAAe;IACf,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,mBAAmB;CACpB,CAAC;AAEF,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,UAAU;IACV,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,qBAAqB;IACrB,UAAU;IACV,OAAO;IACP,KAAK;IACL,UAAU;IACV,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;CACX,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,gBAAgB;IAChB,YAAY;IACZ,eAAe;IACf,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,mBAAmB;IACnB,mBAAmB;IACnB,yBAAyB;IACzB,eAAe;IACf,uBAAuB;IACvB,gBAAgB;IAChB,YAAY;IACZ,WAAW;IACX,aAAa;IACb,YAAY;IACZ,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,aAAa;IACb,eAAe;IACf,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,UAAU;IACV,cAAc;IACd,gCAAgC;IAChC,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB;IACrB,4BAA4B;IAC5B,WAAW;IACX,YAAY;IACZ,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,gBAAgB;IAChB,eAAe;IACf,wBAAwB;IACxB,kBAAkB;IAClB,aAAa;IACb,eAAe;IACf,aAAa;IACb,YAAY;IACZ,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,uBAAuB;CACxB,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACxB,mBAAmB;IACnB,gBAAgB;CACjB,CAAC;AAEF,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8C,CAAC;AAE3E,SAAS,wBAAwB,CAAC,EAAU;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,EAAU;IACvC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/B,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,eAAe,CAAC;IAClD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,gBAAgB,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAChF,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,CAAC;IAE5C,IAAI,qBAAqB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9B,YAAY,CAAC,eAAe,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAY,IAAI,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC7B,YAAY,CAAC,eAAe,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC7B,YAAY,CAAC,gBAAgB,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC7B,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC7B,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,SAAS,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YACnD,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC7B,YAAY,CAAC,eAAe,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;oBACpB,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC7B,YAAY,CAAC,eAAe,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,UAAU,EAAE,CAAC;YACf,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC7B,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC;YACxC,wBAAwB,CAAC,EAAE,CAAC,CAAC;YAC7B,YAAY,CAAC,mBAAmB,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YACxB,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACrB,YAAY,CAAC,KAAK,EAAE,CAAC;AAErB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { reportAttack } from './security-store.js';\n\nconst ROTAS_PUBLICAS = new Set([\n  '/app-info',\n  '/health',\n  '/webhooks',\n  '/ping',\n  '/setup',\n  '/setup-info',\n]);\n\nfunction isRotaPublica(path: string): boolean {\n  if (ROTAS_PUBLICAS.has(path)) return true;\n  if (path.startsWith('/setup')) return true;\n  return false;\n}\n\nconst PENTEST_AGENTS = [\n  /burpsuite/i,\n  /owasp/i,\n  /zap/i,\n  /nikto/i,\n  /nmap/i,\n  /sqlmap/i,\n  /wpscan/i,\n  /acunetix/i,\n  /netsparker/i,\n  /nessus/i,\n  /openvas/i,\n  /appscan/i,\n  /webinspect/i,\n  /golismero/i,\n  /w3af/i,\n  /arachni/i,\n  /masscan/i,\n  /hydra/i,\n  /medusa/i,\n  /aircrack/i,\n  /metasploit/i,\n  /fiddler/i,\n  /postmanruntime/i,\n  /^curl\\//i,\n  /^wget\\//i,\n  /^python-requests\\//i,\n  /^go-http-client\\//i,\n  /^aiohttp\\//i,\n  /^httpx\\//i,\n  /^httpie/i,\n  /^Java\\//i,\n  /^libwww-perl/i,\n  /^WWW-Mechanize/i,\n  /^perl\\//i,\n  /^Ruby\\//i,\n  /^Scrapy/i,\n  /^Lynx/i,\n  /^Wget\\//i,\n  /^axios\\//i,\n  /^node-fetch\\//i,\n  /^fetch\\//i,\n  /^Mozilla\\/5\\.0\\s*\\((?!.*Windows|Mac|Linux|iPhone|Android).*\\)/i,\n];\n\nconst SUSPICIOUS_HEADERS = [\n  'x-pentest-auth',\n  'x-pentest',\n  'x-scanner',\n  'x-attack',\n  'x-cve',\n  'x-vuln',\n  'x-security-test',\n  'x-rce',\n  'x-lfi',\n  'x-rfi',\n  'x-sqli',\n  'x-xss',\n  'x-ssrf',\n];\n\nconst SQL_INJECTION_PATTERNS = [\n  /(\\bSELECT\\b.*\\bFROM\\b)/is,\n  /(\\bUNION\\b.*\\bSELECT\\b)/is,\n  /(\\bINSERT\\b.*\\bINTO\\b)/is,\n  /(\\bDELETE\\b.*\\bFROM\\b)/is,\n  /(\\bDROP\\b.*\\bTABLE\\b)/is,\n  /(\\bALTER\\b.*\\bTABLE\\b)/is,\n  /(\\bCREATE\\b.*\\bTABLE\\b)/is,\n  /(\\bTRUNCATE\\b.*\\bTABLE\\b)/is,\n  /(\\bEXEC\\b.*\\bXP_)/is,\n  /(\\bOR\\b\\s+\\d+\\s*=\\s*\\d+)/is,\n  /(\\bAND\\b\\s+\\d+\\s*=\\s*\\d+)/is,\n  /(\\bUNION\\b\\s+\\d+\\s*#)/is,\n  /(\\bWAITFOR\\b.*\\bDELAY\\b)/is,\n  /(\\bSLEEP\\b\\s*\\()/is,\n  /(\\bBENCHMARK\\b\\s*\\()/is,\n  /(\\bLOAD_FILE\\b)/is,\n  /(\\bINTO\\s+(OUT|DUMP)FILE\\b)/is,\n  /(\\bCHAR\\b\\s*\\()/is,\n  /(\\bCONVERT\\b\\s*\\()/is,\n  /(\\bCAST\\b\\s*\\()/is,\n  /(')|(\")--/,\n  /(\\/\\*!\\d+)/,\n  /(\\b0x[0-9a-f]{4,})\\b/is,\n];\n\nconst XSS_PATTERNS = [\n  /<script[\\s>]/i,\n  /<img[^>]*onerror\\s*=/i,\n  /<svg[^>]*onload\\s*=/i,\n  /<body[^>]*onload\\s*=/i,\n  /<iframe[\\s>]/i,\n  /<object[\\s>]/i,\n  /<embed[\\s>]/i,\n  /<form[^>]*action\\s*=\\s*[\"']javascript/i,\n  /onerror\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /onload\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /onclick\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /onmouseover\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /onfocus\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /onblur\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /onchange\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /onsubmit\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /onreset\\s*=\\s*[\"'][^\"']*[\"']/i,\n  /javascript\\s*:/i,\n  /eval\\s*\\(/i,\n  /alert\\s*\\(/i,\n  /confirm\\s*\\(/i,\n  /prompt\\s*\\(/i,\n  /document\\s*\\.\\s*(cookie|write|writeln|location|domain|referrer)/i,\n  /window\\s*\\.\\s*(location|name|status)/i,\n  /String\\s*\\.\\s*fromCharCode/i,\n  /\\\\x[0-9a-f]{2,}/i,\n  /&#\\d{2,};/i,\n  /&#x[0-9a-f]{2,};/i,\n  /data\\s*:\\s*text\\/html/i,\n  /data\\s*:\\s*application\\/x-javascript/i,\n  /vbscript\\s*:/i,\n  /expression\\s*\\(/i,\n  /@import\\s/i,\n  /behavior\\s*:/i,\n  /-moz-binding\\s*:/i,\n];\n\nconst PATH_TRAVERSAL = [\n  /\\.\\.\\//,\n  /\\.\\.\\\\\\\\/,\n  /%2e%2e\\//i,\n  /%2e%2e%5c/i,\n  /%c0%ae%c0%ae\\//i,\n  /\\.\\.%00/i,\n  /\\.\\.\\\\u[0-9a-f]{4}/i,\n  /\\.\\.\\\\0/i,\n  /~root/,\n  /~\\./,\n  /\\.php\\?/i,\n  /\\.asp\\?/i,\n  /\\.aspx\\?/i,\n  /\\.jsp\\?/i,\n  /\\.cgi\\?/i,\n];\n\nconst KNOWN_VULN_PATHS = [\n  /\\/\\.env/i,\n  /\\/\\.git\\//i,\n  /\\/\\.gitconfig/i,\n  /\\/\\.gitignore/i,\n  /\\/\\.svn\\//i,\n  /\\/\\.htaccess/i,\n  /\\/\\.htpasswd/i,\n  /\\/wp-admin\\//i,\n  /\\/wp-content\\//i,\n  /\\/wp-config\\.php/i,\n  /\\/xmlrpc\\.php/i,\n  /\\/admin\\/?$/i,\n  /\\/config\\.json/i,\n  /\\/config\\.php/i,\n  /\\/config\\.xml/i,\n  /\\/database\\.yml/i,\n  /\\/dump\\.sql/i,\n  /\\/phpinfo\\.php/i,\n  /\\/server-status/i,\n  /\\/server-info/i,\n  /\\/\\.aws\\//i,\n  /\\/\\.ssh\\//i,\n  /\\/id_rsa/i,\n  /\\/composer\\.json/i,\n  /\\/package\\.json$/i,\n  /\\/npm-shrinkwrap\\.json/i,\n  /\\/yarn\\.lock/i,\n  /\\/package-lock\\.json/i,\n  /\\/credentials/i,\n  /\\/secrets/i,\n  /\\/tokens/i,\n  /\\/api-docs/i,\n  /\\/swagger/i,\n  /\\/openapi\\.json/i,\n  /\\/graphql/i,\n  /\\/actuator\\//i,\n  /\\/heapdump/i,\n  /\\/threaddump/i,\n  /\\/logfile/i,\n  /\\/debug\\//i,\n  /\\/console\\//i,\n  /\\/jmx\\//i,\n  /\\/hystrix/i,\n  /\\/turbine/i,\n  /\\/proxy\\//i,\n  /\\/..%5c/i,\n  /\\/\\.\\.;/i,\n  /\\/cgi-bin\\//i,\n  /\\/\\.well-known\\/security\\.txt/i,\n  /\\/sitemap\\.xml/i,\n  /\\/robots\\.txt$/i,\n  /\\/crossdomain\\.xml/i,\n  /\\/clientaccesspolicy\\.xml/i,\n  /\\/\\.hg\\//i,\n  /\\/\\.bzr\\//i,\n  /\\/\\.DS_Store/i,\n  /\\/Thumbs\\.db/i,\n  /\\/web\\.config/i,\n  /\\/\\.npmrc/i,\n  /\\/\\.dockerenv/i,\n  /\\/Dockerfile/i,\n  /\\/docker-compose\\.yml/i,\n  /\\/\\.terraform\\//i,\n  /\\/\\.kube\\//i,\n  /\\/kubeconfig/i,\n  /\\/\\.pgpass/i,\n  /\\/\\.netrc/i,\n  /\\/\\.bash_history/i,\n  /\\/\\.mysql_history/i,\n  /\\/\\.psql_history/i,\n  /\\/\\.rediscli_history/i,\n];\n\nconst CVE_SCAN_PATTERNS = [\n  /CVE-\\d{4}-\\d{4,}/i,\n  /CVE-\\d{4}-\\d+/i,\n];\n\nconst THRESHOLD_SUSPICIOUS_PARAMS = 10;\nconst SUSPICIOUS_WINDOW_MS = 600_000;\nconst pentestScore = new Map<string, { score: number; resetAt: number }>();\n\nfunction incrementarScoreSuspenso(ip: string): void {\n  const now = Date.now();\n  let entry = pentestScore.get(ip);\n  if (!entry || now > entry.resetAt) {\n    entry = { score: 1, resetAt: now + SUSPICIOUS_WINDOW_MS };\n  } else {\n    entry.score++;\n  }\n  pentestScore.set(ip, entry);\n}\n\nfunction estaPontuacaoSuspensa(ip: string): boolean {\n  const entry = pentestScore.get(ip);\n  if (!entry) return false;\n  if (Date.now() > entry.resetAt) {\n    pentestScore.delete(ip);\n    return false;\n  }\n  return entry.score >= 20;\n}\n\nfunction verificarValor(valor: string): string | null {\n  for (const pattern of SQL_INJECTION_PATTERNS) {\n    if (pattern.test(valor)) return 'sql_injection';\n  }\n  for (const pattern of XSS_PATTERNS) {\n    if (pattern.test(valor)) return 'xss';\n  }\n  for (const pattern of PATH_TRAVERSAL) {\n    if (pattern.test(valor)) return 'path_traversal';\n  }\n  return null;\n}\n\nexport function bloquearPentestUrl(req: Request, res: Response, next: NextFunction): void {\n  if (isRotaPublica(req.path)) {\n    next();\n    return;\n  }\n\n  const ip = req.ip || req.socket.remoteAddress || 'unknown';\n  const fullPath = req.originalUrl || req.url;\n\n  if (estaPontuacaoSuspensa(ip)) {\n    reportAttack('pentest_score', ip, fullPath);\n    res.status(403).json({ erro: 'Acesso negado.' });\n    return;\n  }\n\n  const userAgent = (req.headers['user-agent'] as string) || '';\n  for (const pattern of PENTEST_AGENTS) {\n    if (pattern.test(userAgent)) {\n      incrementarScoreSuspenso(ip);\n      reportAttack('pentest_agent', ip, fullPath);\n      res.status(403).json({ erro: 'Acesso negado.' });\n      return;\n    }\n  }\n\n  for (const header of SUSPICIOUS_HEADERS) {\n    if (req.headers[header]) {\n      incrementarScoreSuspenso(ip);\n      reportAttack('pentest_header', ip, fullPath);\n      res.status(403).json({ erro: 'Acesso negado.' });\n      return;\n    }\n  }\n\n  for (const pattern of KNOWN_VULN_PATHS) {\n    if (pattern.test(fullPath)) {\n      incrementarScoreSuspenso(ip);\n      reportAttack('vuln_scan', ip, fullPath);\n      res.status(404).json({ erro: 'Nao encontrado.' });\n      return;\n    }\n  }\n\n  for (const pattern of CVE_SCAN_PATTERNS) {\n    if (pattern.test(fullPath)) {\n      incrementarScoreSuspenso(ip);\n      reportAttack('cve_scan', ip, fullPath);\n      res.status(404).json({ erro: 'Nao encontrado.' });\n      return;\n    }\n  }\n\n  const valuesToCheck: string[] = [];\n\n  if (req.query) {\n    const queryKeys = Object.keys(req.query);\n    if (queryKeys.length > THRESHOLD_SUSPICIOUS_PARAMS) {\n      incrementarScoreSuspenso(ip);\n      reportAttack('excess_params', ip, fullPath);\n      res.status(400).json({ erro: 'Muitos parametros.' });\n      return;\n    }\n\n    for (const val of Object.values(req.query)) {\n      if (typeof val === 'string') valuesToCheck.push(val);\n      if (Array.isArray(val)) {\n        for (const v of val) {\n          if (typeof v === 'string') valuesToCheck.push(v);\n        }\n      }\n    }\n  }\n\n  if (req.params) {\n    for (const val of Object.values(req.params)) {\n      if (typeof val === 'string') valuesToCheck.push(val);\n    }\n  }\n\n  for (const value of valuesToCheck) {\n    if (value.length > 2000 || value.includes('\\0')) {\n      incrementarScoreSuspenso(ip);\n      reportAttack('invalid_param', ip, fullPath);\n      res.status(400).json({ erro: 'Parametro invalido.' });\n      return;\n    }\n\n    const attackType = verificarValor(value);\n    if (attackType) {\n      incrementarScoreSuspenso(ip);\n      reportAttack(attackType, ip, fullPath);\n      res.status(400).json({ erro: 'Parametro invalido.' });\n      return;\n    }\n  }\n\n  const contentLength = req.headers['content-length'];\n  if (contentLength) {\n    const len = parseInt(contentLength, 10);\n    if (!Number.isNaN(len) && len > 500_000) {\n      incrementarScoreSuspenso(ip);\n      reportAttack('oversized_payload', ip, fullPath);\n      res.status(413).json({ erro: 'Payload muito grande.' });\n      return;\n    }\n  }\n\n  next();\n}\n\nconst CLEANUP_INTERVAL = 300_000;\nconst cleanupTimer = setInterval(() => {\n  const now = Date.now();\n  for (const [ip, entry] of pentestScore) {\n    if (now > entry.resetAt) {\n      pentestScore.delete(ip);\n    }\n  }\n}, CLEANUP_INTERVAL);\ncleanupTimer.unref();\n\nprocess.on('SIGTERM', () => { clearInterval(cleanupTimer); });\nprocess.on('SIGINT', () => { clearInterval(cleanupTimer); });\nprocess.on('beforeExit', () => { clearInterval(cleanupTimer); });\n"]}

package/dist/app/github/middleware/bloqueio-robos.d.ts

@@ -0,0 +1,3 @@
+import type { NextFunction, Request, Response } from 'express';
+export declare function bloquearRobos(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=bloqueio-robos.d.ts.map

package/dist/app/github/middleware/bloqueio-robos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bloqueio-robos.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/bloqueio-robos.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAiI/D,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA+BnF"}

package/dist/app/github/middleware/bloqueio-robos.js

@@ -0,0 +1,152 @@
+import { reportAttack } from './security-store.js';
+const ROBOS_PERMITIDOS = [
+    /DeepSeek/i,
+];
+const ROBOS_BLOQUEADOS = [
+    /GPTBot/i,
+    /ChatGPT-User/i,
+    /OpenAI/i,
+    /OAI-SearchBot/i,
+    /Claude-Web/i,
+    /ClaudeBot/i,
+    /Anthropic-AI/i,
+    /Google-Extended/i,
+    /Google-CloudVertexBot/i,
+    /Applebot/i,
+    /Apple-NewsBot/i,
+    /PerplexityBot/i,
+    /Perplexity\./i,
+    /CohereAI/i,
+    /Cohere/i,
+    /Bytespider/i,
+    /ByteDance/i,
+    /CCBot/i,
+    /CommonCrawl/i,
+    /FacebookBot/i,
+    /Meta/i,
+    /Amazonbot/i,
+    /YouBot/i,
+    /ImagesiftBot/i,
+    /AhrefsBot/i,
+    /SemrushBot/i,
+    /Majestic/i,
+    /DotBot/i,
+    /MegaIndex/i,
+    /SeekBot/i,
+    /BLEXBot/i,
+    /Exabot/i,
+    /80legs/i,
+    /Screaming\s*Frog/i,
+    /Netcraft/i,
+    /SiteAudit/i,
+    /MauiBot/i,
+    /Censys/i,
+    /Shodan/i,
+    /Googlebot/i,
+    /Bingbot/i,
+    /BingPreview/i,
+    /msnbot/i,
+    /Slurp/i,
+    /DuckDuckBot/i,
+    /Baiduspider/i,
+    /Baidu/i,
+    /YandexBot/i,
+    /Yandex/i,
+    /Sogou/i,
+    /Exabot/i,
+    /facebookexternalhit/i,
+    /Twitterbot/i,
+    /LinkedInBot/i,
+    /Slackbot/i,
+    /Discordbot/i,
+    /TelegramBot/i,
+    /WhatsApp/i,
+    /PetalBot/i,
+    /AdsBot/i,
+    /Mediapartners/i,
+    /Yeti/i,
+    /NaverBot/i,
+    /archive\.org/i,
+    /ia_archiver/i,
+    /Nutch/i,
+    /Gigabot/i,
+    /Daum/i,
+    /Ichiro/i,
+    /FastBrowser/i,
+    /Linguee/i,
+    /DataForSeoBot/i,
+    /Mappery/i,
+    /Neevabot/i,
+    /SafeDNSBot/i,
+    /ZoominfoBot/i,
+    /ClinchBot/i,
+    /SerpstatBot/i,
+    /SeznamBot/i,
+    /Seznam/i,
+    /AcoonBot/i,
+    /Ezooms/i,
+    /BLEXBot/i,
+    /rogerbot/i,
+    /xovibot/i,
+    /MJ12bot/i,
+    /Ahrefs/i,
+    /Barkrowler/i,
+    /Siteimprove/i,
+    /Wotbox/i,
+    /Mail\.RU/i,
+    /SMTBot/i,
+    /ScoutJet/i,
+    /Trendsmap/i,
+    /UptimeRobot/i,
+    /Pingdom/i,
+    /GTmetrix/i,
+    /Google\s*PageSpeed/i,
+    /webprosbot/i,
+    /SurdotlyBot/i,
+    /Python-urllib/i,
+    /python-requests/i,
+    /aiohttp/i,
+    /httpx/i,
+    /HTTPie/i,
+    /curl\//i,
+    /wget\//i,
+    /Java\/\d+\.\d+/i,
+    /libwww-perl/i,
+    /WWW-Mechanize/i,
+    /Go-http-client/i,
+    /Scrapy/i,
+    /node-fetch/i,
+];
+function getUserAgent(req) {
+    const ua = req.headers['user-agent'];
+    return typeof ua === 'string' ? ua : '';
+}
+export function bloquearRobos(req, res, next) {
+    const userAgent = getUserAgent(req);
+    if (!userAgent) {
+        next();
+        return;
+    }
+    for (const permitido of ROBOS_PERMITIDOS) {
+        if (permitido.test(userAgent)) {
+            next();
+            return;
+        }
+    }
+    for (const bloqueado of ROBOS_BLOQUEADOS) {
+        if (bloqueado.test(userAgent)) {
+            const ip = req.ip || req.socket.remoteAddress || 'unknown';
+            reportAttack('bot_blocked', ip, req.path);
+            const accept = req.headers.accept || '';
+            const isHtml = accept.includes('text/html') || accept.includes('application/xhtml');
+            if (!isHtml) {
+                res.status(403).json({ erro: 'Acesso negado para crawlers.' });
+                return;
+            }
+            res.status(403).type('text/plain').send('Acesso negado para crawlers.');
+            return;
+        }
+    }
+    next();
+}
+//# sourceMappingURL=bloqueio-robos.js.map

package/dist/app/github/middleware/bloqueio-robos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bloqueio-robos.js","sourceRoot":"","sources":["../../../../src/app/github/middleware/bloqueio-robos.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,gBAAgB,GAAG;IACvB,WAAW;CACZ,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,SAAS;IACT,eAAe;IACf,SAAS;IACT,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,eAAe;IACf,kBAAkB;IAClB,wBAAwB;IACxB,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,WAAW;IACX,SAAS;IACT,aAAa;IACb,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,cAAc;IACd,OAAO;IACP,YAAY;IACZ,SAAS;IACT,eAAe;IACf,YAAY;IACZ,aAAa;IACb,WAAW;IACX,SAAS;IACT,YAAY;IACZ,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,UAAU;IACV,SAAS;IACT,SAAS;IACT,YAAY;IACZ,UAAU;IACV,cAAc;IACd,SAAS;IACT,QAAQ;IACR,cAAc;IACd,cAAc;IACd,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,SAAS;IACT,sBAAsB;IACtB,aAAa;IACb,cAAc;IACd,WAAW;IACX,aAAa;IACb,cAAc;IACd,WAAW;IACX,WAAW;IACX,SAAS;IACT,gBAAgB;IAChB,OAAO;IACP,WAAW;IACX,eAAe;IACf,cAAc;IACd,QAAQ;IACR,UAAU;IACV,OAAO;IACP,SAAS;IACT,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,aAAa;IACb,cAAc;IACd,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,SAAS;IACT,WAAW;IACX,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,aAAa;IACb,cAAc;IACd,SAAS;IACT,WAAW;IACX,SAAS;IACT,WAAW;IACX,YAAY;IACZ,cAAc;IACd,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,aAAa;IACb,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,SAAS;IACT,iBAAiB;IACjB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,SAAS;IACT,aAAa;CACd,CAAC;AAEF,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC3E,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;YAC3D,YAAY,CAAC,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAgB,IAAI,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC","sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { reportAttack } from './security-store.js';\n\nconst ROBOS_PERMITIDOS = [\n  /DeepSeek/i,\n];\n\nconst ROBOS_BLOQUEADOS = [\n  /GPTBot/i,\n  /ChatGPT-User/i,\n  /OpenAI/i,\n  /OAI-SearchBot/i,\n  /Claude-Web/i,\n  /ClaudeBot/i,\n  /Anthropic-AI/i,\n  /Google-Extended/i,\n  /Google-CloudVertexBot/i,\n  /Applebot/i,\n  /Apple-NewsBot/i,\n  /PerplexityBot/i,\n  /Perplexity\\./i,\n  /CohereAI/i,\n  /Cohere/i,\n  /Bytespider/i,\n  /ByteDance/i,\n  /CCBot/i,\n  /CommonCrawl/i,\n  /FacebookBot/i,\n  /Meta/i,\n  /Amazonbot/i,\n  /YouBot/i,\n  /ImagesiftBot/i,\n  /AhrefsBot/i,\n  /SemrushBot/i,\n  /Majestic/i,\n  /DotBot/i,\n  /MegaIndex/i,\n  /SeekBot/i,\n  /BLEXBot/i,\n  /Exabot/i,\n  /80legs/i,\n  /Screaming\\s*Frog/i,\n  /Netcraft/i,\n  /SiteAudit/i,\n  /MauiBot/i,\n  /Censys/i,\n  /Shodan/i,\n  /Googlebot/i,\n  /Bingbot/i,\n  /BingPreview/i,\n  /msnbot/i,\n  /Slurp/i,\n  /DuckDuckBot/i,\n  /Baiduspider/i,\n  /Baidu/i,\n  /YandexBot/i,\n  /Yandex/i,\n  /Sogou/i,\n  /Exabot/i,\n  /facebookexternalhit/i,\n  /Twitterbot/i,\n  /LinkedInBot/i,\n  /Slackbot/i,\n  /Discordbot/i,\n  /TelegramBot/i,\n  /WhatsApp/i,\n  /PetalBot/i,\n  /AdsBot/i,\n  /Mediapartners/i,\n  /Yeti/i,\n  /NaverBot/i,\n  /archive\\.org/i,\n  /ia_archiver/i,\n  /Nutch/i,\n  /Gigabot/i,\n  /Daum/i,\n  /Ichiro/i,\n  /FastBrowser/i,\n  /Linguee/i,\n  /DataForSeoBot/i,\n  /Mappery/i,\n  /Neevabot/i,\n  /SafeDNSBot/i,\n  /ZoominfoBot/i,\n  /ClinchBot/i,\n  /SerpstatBot/i,\n  /SeznamBot/i,\n  /Seznam/i,\n  /AcoonBot/i,\n  /Ezooms/i,\n  /BLEXBot/i,\n  /rogerbot/i,\n  /xovibot/i,\n  /MJ12bot/i,\n  /Ahrefs/i,\n  /Barkrowler/i,\n  /Siteimprove/i,\n  /Wotbox/i,\n  /Mail\\.RU/i,\n  /SMTBot/i,\n  /ScoutJet/i,\n  /Trendsmap/i,\n  /UptimeRobot/i,\n  /Pingdom/i,\n  /GTmetrix/i,\n  /Google\\s*PageSpeed/i,\n  /webprosbot/i,\n  /SurdotlyBot/i,\n  /Python-urllib/i,\n  /python-requests/i,\n  /aiohttp/i,\n  /httpx/i,\n  /HTTPie/i,\n  /curl\\//i,\n  /wget\\//i,\n  /Java\\/\\d+\\.\\d+/i,\n  /libwww-perl/i,\n  /WWW-Mechanize/i,\n  /Go-http-client/i,\n  /Scrapy/i,\n  /node-fetch/i,\n];\n\nfunction getUserAgent(req: Request): string {\n  const ua = req.headers['user-agent'];\n  return typeof ua === 'string' ? ua : '';\n}\n\nexport function bloquearRobos(req: Request, res: Response, next: NextFunction): void {\n  const userAgent = getUserAgent(req);\n\n  if (!userAgent) {\n    next();\n    return;\n  }\n\n  for (const permitido of ROBOS_PERMITIDOS) {\n    if (permitido.test(userAgent)) {\n      next();\n      return;\n    }\n  }\n\n  for (const bloqueado of ROBOS_BLOQUEADOS) {\n    if (bloqueado.test(userAgent)) {\n      const ip = req.ip || req.socket.remoteAddress || 'unknown';\n      reportAttack('bot_blocked', ip, req.path);\n      const accept = req.headers.accept as string || '';\n      const isHtml = accept.includes('text/html') || accept.includes('application/xhtml');\n      if (!isHtml) {\n        res.status(403).json({ erro: 'Acesso negado para crawlers.' });\n        return;\n      }\n      res.status(403).type('text/plain').send('Acesso negado para crawlers.');\n      return;\n    }\n  }\n\n  next();\n}\n"]}

package/dist/app/github/middleware/crypto.d.ts

@@ -0,0 +1,10 @@
+export declare function encrypt(text: string): string;
+export declare function decrypt(encrypted: string): string;
+export declare function encryptJson<T>(data: T): string;
+export declare function decryptJson<T>(encrypted: string): T;
+export declare function encryptObject<T extends Record<string, unknown>>(obj: T, sensitiveFields: (keyof T)[]): T;
+export declare function decryptObject<T extends Record<string, unknown>>(obj: T, sensitiveFields: (keyof T)[]): T;
+export declare function hashToken(token: string): string;
+export declare function signRequest(payload: string, secret: string): string;
+export declare function verifyRequestSignature(payload: string, signature: string, secret: string): boolean;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/app/github/middleware/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../../src/app/github/middleware/crypto.ts"],"names":[],"mappings":"AA8BA,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAajD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAE9C;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,CAEnD;AAED,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,GAAG,EAAE,CAAC,EACN,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAC3B,CAAC,CAaH;AAED,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7D,GAAG,EAAE,CAAC,EACN,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAC3B,CAAC,CAkBH;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAOT"}