@q32/core 0.2.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/http.d.ts +1 -0
  2. package/dist/http.d.ts.map +1 -1
  3. package/dist/http.js +46 -0
  4. package/dist/http.js.map +1 -1
  5. package/package.json +1 -1
  6. package/src/http.ts +51 -0
package/dist/http.d.ts CHANGED
@@ -16,4 +16,5 @@ export declare function requireAdminToken(request: Request, expected: string | u
16
16
  export declare function absoluteUrl(appUrl: string, path: string): string;
17
17
  export declare function escapeHtml(value: string | null | undefined): string;
18
18
  export declare function readResponseExcerpt(response: Response, maxLength?: number): Promise<string>;
19
+ export declare function isCommonAttackProbe(input: Request | URL | string): boolean;
19
20
  //# sourceMappingURL=http.d.ts.map
package/dist/http.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG;IAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,eAAO,MAAM,YAAY,EAAE,SAA+C,CAAC;AAE3E,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aAEd,IAAI;gBAFJ,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,IAAI,SAAe;CAKtC;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,gBAAqB,GAAG,QAAQ,CAOlF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,SAAM,GAAG,QAAQ,CAM5E;AAED,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAUxE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAK3D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAItF;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAOnE;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG9F"}
1
+ {"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG;IAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC;AAErC,eAAO,MAAM,YAAY,EAAE,SAA+C,CAAC;AA6B3E,qBAAa,SAAU,SAAQ,KAAK;aAEhB,MAAM,EAAE,MAAM;aAEd,IAAI;gBAFJ,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,IAAI,SAAe;CAKtC;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,gBAAqB,GAAG,QAAQ,CAOlF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,SAAM,GAAG,QAAQ,CAM5E;AAED,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAUxE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAK3D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAItF;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAOnE;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG9F;AAiBD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,GAAG,MAAM,GAAG,OAAO,CAO1E"}
package/dist/http.js CHANGED
@@ -1,4 +1,29 @@
1
1
  export const defaultFetch = (input, init) => fetch(input, init);
2
+ const COMMON_ATTACK_EXACT_PATHS = new Set([
3
+ "/.env",
4
+ "/.git/config",
5
+ "/xmlrpc.php",
6
+ "/wp-login.php",
7
+ "/wp-config.php",
8
+ "/phpinfo.php",
9
+ "/adminer.php",
10
+ ]);
11
+ const COMMON_ATTACK_PATH_PARTS = [
12
+ "/.git/",
13
+ "/.svn/",
14
+ "/.hg/",
15
+ "/cgi-bin/",
16
+ "/phpmyadmin",
17
+ "/pma/",
18
+ "/vendor/phpunit/",
19
+ "/wordpress/",
20
+ "/wp-admin/",
21
+ "/wp-content/",
22
+ "/wp-includes/",
23
+ "/administrator/",
24
+ "/joomla/",
25
+ "/drupal/",
26
+ ];
2
27
  export class HttpError extends Error {
3
28
  status;
4
29
  code;
@@ -66,4 +91,25 @@ export async function readResponseExcerpt(response, maxLength = 800) {
66
91
  const text = await response.text().catch(() => "");
67
92
  return text.slice(0, maxLength);
68
93
  }
94
+ function safePathname(input) {
95
+ const pathname = typeof input === "string"
96
+ ? new URL(input, "https://example.com").pathname
97
+ : input instanceof URL
98
+ ? input.pathname
99
+ : new URL(input.url).pathname;
100
+ try {
101
+ return decodeURIComponent(pathname).toLowerCase();
102
+ }
103
+ catch {
104
+ return pathname.toLowerCase();
105
+ }
106
+ }
107
+ export function isCommonAttackProbe(input) {
108
+ const pathname = safePathname(input);
109
+ if (COMMON_ATTACK_EXACT_PATHS.has(pathname))
110
+ return true;
111
+ if (pathname.endsWith(".php"))
112
+ return true;
113
+ return COMMON_ATTACK_PATH_PARTS.some((part) => pathname.includes(part));
114
+ }
69
115
  //# sourceMappingURL=http.js.map
package/dist/http.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,YAAY,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAE3E,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IAEA;IAHlB,YACkB,MAAc,EAC9B,OAAe,EACC,OAAO,YAAY;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QAEd,SAAI,GAAJ,IAAI,CAAe;QAGnC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,OAAyB,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACjG,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACpE,GAAG,IAAI;QACP,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,cAAc,GAAG,GAAG;IAChE,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,OAAgB;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yCAAyC,EAAE,wBAAwB,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAM,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,4BAA4B,EAAE,cAAc,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,QAA4B;IAC9E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gCAAgC,EAAE,4BAA4B,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY;IACtD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAgC;IACzD,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAkB,EAAE,SAAS,GAAG,GAAG;IAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC"}
1
+ {"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,YAAY,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAE3E,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,OAAO;IACP,cAAc;IACd,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG;IAC/B,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,WAAW;IACX,aAAa;IACb,OAAO;IACP,kBAAkB;IAClB,aAAa;IACb,YAAY;IACZ,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,UAAU;IACV,UAAU;CACX,CAAC;AAEF,MAAM,OAAO,SAAU,SAAQ,KAAK;IAEhB;IAEA;IAHlB,YACkB,MAAc,EAC9B,OAAe,EACC,OAAO,YAAY;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,WAAM,GAAN,MAAM,CAAQ;QAEd,SAAI,GAAJ,IAAI,CAAe;QAGnC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,OAAyB,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACjG,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACpE,GAAG,IAAI;QACP,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,cAAc,GAAG,GAAG;IAChE,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,OAAgB;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yCAAyC,EAAE,wBAAwB,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAM,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,4BAA4B,EAAE,cAAc,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,QAA4B;IAC9E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gCAAgC,EAAE,4BAA4B,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY;IACtD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAgC;IACzD,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAkB,EAAE,SAAS,GAAG,GAAG;IAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,KAA6B;IACjD,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC,QAAQ;QAChD,CAAC,CAAC,KAAK,YAAY,GAAG;YACpB,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAEpC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA6B;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@q32/core",
3
- "version": "0.2.0",
3
+ "version": "0.2.1",
4
4
  "description": "Shared TypeScript primitives for Q32 Cloudflare Worker projects.",
5
5
  "license": "MIT",
6
6
  "type": "module",
package/src/http.ts CHANGED
@@ -6,6 +6,33 @@ export type FetchLike = typeof fetch;
6
6
 
7
7
  export const defaultFetch: FetchLike = (input, init) => fetch(input, init);
8
8
 
9
+ const COMMON_ATTACK_EXACT_PATHS = new Set([
10
+ "/.env",
11
+ "/.git/config",
12
+ "/xmlrpc.php",
13
+ "/wp-login.php",
14
+ "/wp-config.php",
15
+ "/phpinfo.php",
16
+ "/adminer.php",
17
+ ]);
18
+
19
+ const COMMON_ATTACK_PATH_PARTS = [
20
+ "/.git/",
21
+ "/.svn/",
22
+ "/.hg/",
23
+ "/cgi-bin/",
24
+ "/phpmyadmin",
25
+ "/pma/",
26
+ "/vendor/phpunit/",
27
+ "/wordpress/",
28
+ "/wp-admin/",
29
+ "/wp-content/",
30
+ "/wp-includes/",
31
+ "/administrator/",
32
+ "/joomla/",
33
+ "/drupal/",
34
+ ];
35
+
9
36
  export class HttpError extends Error {
10
37
  constructor(
11
38
  public readonly status: number,
@@ -76,3 +103,27 @@ export async function readResponseExcerpt(response: Response, maxLength = 800):
76
103
  const text = await response.text().catch(() => "");
77
104
  return text.slice(0, maxLength);
78
105
  }
106
+
107
+ function safePathname(input: Request | URL | string): string {
108
+ const pathname =
109
+ typeof input === "string"
110
+ ? new URL(input, "https://example.com").pathname
111
+ : input instanceof URL
112
+ ? input.pathname
113
+ : new URL(input.url).pathname;
114
+
115
+ try {
116
+ return decodeURIComponent(pathname).toLowerCase();
117
+ } catch {
118
+ return pathname.toLowerCase();
119
+ }
120
+ }
121
+
122
+ export function isCommonAttackProbe(input: Request | URL | string): boolean {
123
+ const pathname = safePathname(input);
124
+
125
+ if (COMMON_ATTACK_EXACT_PATHS.has(pathname)) return true;
126
+ if (pathname.endsWith(".php")) return true;
127
+
128
+ return COMMON_ATTACK_PATH_PARTS.some((part) => pathname.includes(part));
129
+ }