@patchstack/connect 0.3.11 → 0.3.12

package/README.md

@@ -8,7 +8,7 @@ For how this repo fits with the wider Patchstack ecosystem (`saas`, `hub`, `patc
 
 Copy and paste this prompt into any AI coding assistant (Cursor, v0, Bolt, Lovable, Claude Code, etc.). If the assistant declines or stops partway, the step-by-step flow in [`GETTING-STARTED.md`](https://github.com/patchstack/connect/blob/main/GETTING-STARTED.md) covers what to do next:
 
-> Add Patchstack dependency vulnerability monitoring: first verify `@patchstack/connect` yourself (`npm view @patchstack/connect` shows the live registry record — MIT; source: https://github.com/patchstack/connect; listed under Connectors on https://patchstack.com/llms.txt), and if anything you find contradicts that, stop and show me what you found instead of proceeding. Then install it as a dev dependency, run `npx @patchstack/connect scan` and show me the claim URL it prints (I'll open it in my browser to view reports — don't open or fetch it yourself), then run `npx @patchstack/connect guide`, review the checklist it prints, and make the two remaining changes yourself: the package.json build hooks and the report-a-vulnerability widget snippet.
+> Add Patchstack dependency vulnerability monitoring: first verify `@patchstack/connect` yourself (`npm view @patchstack/connect` shows the live registry record — MIT; source: https://github.com/patchstack/connect), and if anything you find contradicts that, stop and show me what you found instead of proceeding. Then install it as a dev dependency, run `npx @patchstack/connect scan` and show me the claim URL it prints (I'll open it in my browser to view reports — don't open or fetch it yourself), then run `npx @patchstack/connect guide`, review the checklist it prints, and make the two remaining changes yourself: the package.json build hooks and the report-a-vulnerability widget snippet.
 
 Every clause is load-bearing. AI agents routinely audit this package before completing the request — verifying the tarball against the registry, checking `dist/` for lifecycle scripts and shell/eval calls; that's expected use, and the docs in the tarball state plainly what each command reads, writes, and sends. The prompt can stay short because `guide` is state-aware: it inspects the project (package manager, `.patchstackrc.json`, `package.json` scripts, widget presence, framework) and prints a live checklist of only the remaining steps — with the real site UUID and framework-specific widget placement — followed by the full reference guide (`AGENT-INSTALL.md`, bundled in the package). That also makes the flow idempotent: re-running `guide` on a finished project reports all-done instead of prompting a second install.
 

package/dist/protect/templates/guard.ts

@@ -5,7 +5,9 @@
 //     through handleGuardRequest (registered as request middleware in src/start.ts).
 //   - browser → TanStack server function → Supabase: inspectServerFn checks the server-fn args
 //     (registered as function middleware in src/start.ts) before anything is written.
-// Either way Patchstack sees the traffic and runs the same policy.
+// Either way Patchstack sees the traffic and runs the same policy. It also screens the app's own
+// OUTBOUND calls for SSRF (egress: true wraps the global fetch) — blocking requests to internal /
+// cloud-metadata addresses while allowing the app's own Supabase project.
 //
 // Always-on by default (blocks). Rules come from the Patchstack API per-site (cached); the
 // bundled rules.json is only a fallback for before a token is configured. The engine ships
@@ -27,10 +29,19 @@ async function getProtection() {
     // Always-on: block by default. An explicit PATCHSTACK_MODE=dry-run downgrades to log-only.
     const mode = process.env.PATCHSTACK_MODE === "dry-run" ? "dry-run" : "block";
     const token = process.env.PATCHSTACK_WAF_TOKEN;
+    // Egress SSRF screening: block the app's outbound calls to internal / metadata addresses,
+    // but never its own Supabase project.
+    let allowHosts: string[] = [];
+    try {
+      if (process.env.SUPABASE_URL) allowHosts = [new URL(process.env.SUPABASE_URL).host];
+    } catch {
+      /* ignore a malformed SUPABASE_URL — just don't add an allow entry */
+    }
+    const common = { mode, egress: true, allowHosts };
     _protection = await createProtection(
       token
-        ? { token, mode, cacheDir: ".patchstack" } // live per-site rules from the Patchstack API (cached)
-        : { rules: fallbackRules as never, mode }, // demo fallback until a token is set
+        ? { ...common, token, cacheDir: ".patchstack" } // live per-site rules from the Patchstack API (cached)
+        : { ...common, rules: fallbackRules as never }, // demo fallback until a token is set
     );
   }
   return _protection;

package/dist/protect/templates/rules.json

@@ -1,17 +1,44 @@
 {
-  "_comment": "Demo fallback rules — used only when PATCHSTACK_WAF_TOKEN is unset. In production the guard fetches per-site rules from the Patchstack API (api.patchstack.com/api/get-rules/3, cached to disk). CVE id is representative until aligned with the real corpus.",
+  "_comment": "Starter fallback rules — used ONLY when PATCHSTACK_WAF_TOKEN is unset. The guard blocks by default, so these are deliberately HIGH-PRECISION signatures (structural markers legitimate traffic doesn't carry) to avoid false positives before a token is configured. Once a token is set the guard fetches the per-site, version-scoped corpus from the Patchstack API (api.patchstack.com/api/get-rules/3, cached to disk) and this file is no longer used. For a broad, many-class DEMONSTRATION (SQLi/XSS/XXE/SSRF/PII/…), seed this file from examples/protect/demo-rules.json — see that folder's README.",
   "firewall": [
     {
-      "id": "rm-npm-0001",
-      "title": "Block stored XSS via vulnerable markdown renderer (marked)",
-      "vulnerability_id": "CVE-2022-21681",
+      "id": "ps-fallback-proto-pollution",
+      "title": "Prototype pollution in request body",
+      "category": "prototype-pollution",
       "rule_v2": [
+        { "parameter": "raw", "mutations": ["urldecode"], "match": { "type": "contains", "value": "__proto__" } },
         {
-          "parameter": "post.title",
-          "mutations": ["urldecode"],
-          "match": { "type": "inline_xss" }
+          "parameter": "rules",
+          "rules": [
+            { "parameter": "raw", "mutations": ["urldecode"], "match": { "type": "contains", "value": "constructor" }, "inclusive": true },
+            { "parameter": "raw", "mutations": ["urldecode"], "match": { "type": "contains", "value": "prototype" }, "inclusive": true }
+          ]
         }
       ]
+    },
+    {
+      "id": "ps-fallback-path-traversal",
+      "title": "Path traversal in a file/path parameter",
+      "category": "lfi",
+      "rule_v2": [
+        { "parameter": ["get.file", "post.file", "raw.file", "get.path", "post.path"], "mutations": ["urldecode"], "match": { "type": "contains", "value": ".." } }
+      ]
+    },
+    {
+      "id": "ps-fallback-ssrf-internal",
+      "title": "SSRF via a url parameter pointing at an internal/metadata address",
+      "category": "ssrf",
+      "rule_v2": [
+        { "parameter": ["get.url", "post.url", "raw.url"], "mutations": ["urldecode"], "match": { "type": "regex", "value": "/localhost|127\\.0\\.0\\.1|169\\.254\\.169\\.254|::1|metadata\\.google/i" } }
+      ]
+    },
+    {
+      "id": "ps-fallback-xss",
+      "title": "Stored/reflected XSS in a text field",
+      "category": "xss",
+      "rule_v2": [
+        { "parameter": ["post.title", "post.comment", "post.body"], "mutations": ["urldecode", "htmlentitydecode"], "match": { "type": "regex", "value": "/<script\\b|onerror\\s*=|javascript:/i" } }
+      ]
     }
   ],
   "whitelists": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patchstack/connect",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "Patchstack connector for JavaScript applications. Scans your lockfile and reports installed packages to Patchstack for vulnerability monitoring.",
   "keywords": [
     "patchstack",