@quatrain/core 1.2.10 → 1.2.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/properties/HashProperty.d.ts.map +1 -1
  2. package/dist/properties/HashProperty.js +10 -1
  3. package/dist/properties/HashProperty.js.map +1 -1
  4. package/package.json +1 -1
  5. package/src/properties/HashProperty.test.ts +46 -0
  6. package/src/properties/HashProperty.ts +17 -2
package/dist/properties/HashProperty.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"HashProperty.d.ts","sourceRoot":"","sources":["../../src/properties/HashProperty.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAGrE,MAAM,MAAM,iBAAiB,GACxB,OAAO,YAAY,CAAC,aAAa,GACjC,OAAO,YAAY,CAAC,cAAc,GAClC,OAAO,YAAY,CAAC,gBAAgB,GACpC,OAAO,YAAY,CAAC,gBAAgB,CAAA;AAYzC,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IACzD,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;CACpB;AAoBD,qBAAa,YAAa,SAAQ,cAAc;IAE7C,MAAM,CAAC,IAAI,SAAS;IAEpB,MAAM,CAAC,aAAa,SAAQ;IAE5B,MAAM,CAAC,cAAc,SAAS;IAE9B,MAAM,CAAC,gBAAgB,SAAW;IAElC,MAAM,CAAC,gBAAgB,SAAW;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACvC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAK;IAC5B,SAAS,CAAC,SAAS,UAAQ;gBAEf,MAAM,EAAE,gBAAgB;IAepC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IA2C5B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,UAAO;IAWpC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGjC"}
1
+ {"version":3,"file":"HashProperty.d.ts","sourceRoot":"","sources":["../../src/properties/HashProperty.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAGrE,MAAM,MAAM,iBAAiB,GACxB,OAAO,YAAY,CAAC,aAAa,GACjC,OAAO,YAAY,CAAC,cAAc,GAClC,OAAO,YAAY,CAAC,gBAAgB,GACpC,OAAO,YAAY,CAAC,gBAAgB,CAAA;AAYzC,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IACzD,SAAS,CAAC,EAAE,iBAAiB,CAAA;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,OAAO,CAAA;CACpB;AAoBD,qBAAa,YAAa,SAAQ,cAAc;IAE7C,MAAM,CAAC,IAAI,SAAS;IAEpB,MAAM,CAAC,aAAa,SAAQ;IAE5B,MAAM,CAAC,cAAc,SAAS;IAE9B,MAAM,CAAC,gBAAgB,SAAW;IAElC,MAAM,CAAC,gBAAgB,SAAW;IAElC,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAA;IACvC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAK;IAC5B,SAAS,CAAC,SAAS,UAAQ;gBAEf,MAAM,EAAE,gBAAgB;IA8BpC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IA2C5B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,UAAO;IAWpC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGjC"}
package/dist/properties/HashProperty.js CHANGED
@@ -15,9 +15,18 @@ class HashProperty extends StringProperty_1.StringProperty {
15
15
  _prefixed = false;
16
16
  constructor(config) {
17
17
  super(config);
18
- this._algorithm = config.algorithm || HashProperty.ALGORITHM_MD5;
18
+ this._algorithm = config.algorithm || HashProperty.ALGORITHM_SHA256;
19
19
  this._salt = config.salt || '';
20
20
  this._prefixed = config.prefixed || false;
21
+ if (this._algorithm === HashProperty.ALGORITHM_MD5 ||
22
+ this._algorithm === HashProperty.ALGORITHM_SHA1) {
23
+ const sensitiveTerms = ['password', 'pwd', 'secret', 'token', 'credential'];
24
+ const nameLower = this._name.toLowerCase();
25
+ const isSensitive = sensitiveTerms.some((term) => nameLower.includes(term));
26
+ if (isSensitive) {
27
+ throw new Error(`SecurityError: Insecure hashing algorithm "${this._algorithm}" cannot be used for sensitive property "${this._name}". Please use SHA256 or another secure algorithm.`);
28
+ }
29
+ }
21
30
  }
22
31
  _hash(value) {
23
32
  let algo;
package/dist/properties/HashProperty.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"HashProperty.js","sourceRoot":"","sources":["../../src/properties/HashProperty.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AACxC,qDAAqE;AACrE,kCAA8B;AA0C9B,MAAa,YAAa,SAAQ,+BAAc;IAE7C,MAAM,CAAC,IAAI,GAAG,MAAM,CAAA;IAEpB,MAAM,CAAC,aAAa,GAAG,KAAK,CAAA;IAE5B,MAAM,CAAC,cAAc,GAAG,MAAM,CAAA;IAE9B,MAAM,CAAC,gBAAgB,GAAG,QAAQ,CAAA;IAElC,MAAM,CAAC,gBAAgB,GAAG,QAAQ,CAAA;IAExB,UAAU,CAAmB;IAC7B,KAAK,GAAW,EAAE,CAAA;IAClB,SAAS,GAAG,KAAK,CAAA;IAE3B,YAAY,MAAwB;QACjC,KAAK,CAAC,MAAM,CAAC,CAAA;QACb,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC,aAAa,CAAA;QAChE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAA;QAC9B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAA;IAC5C,CAAC;IAUD,KAAK,CAAC,KAAa;QAChB,IAAI,IAAI,CAAA;QACR,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,KAAK,YAAY,CAAC,aAAa;gBAC5B,IAAI,GAAG,IAAA,wBAAU,EAAC,KAAK,CAAC,CAAA;gBACxB,WAAI,CAAC,IAAI,CACN,sDAAsD,CACxD,CAAA;gBACD,MAAK;YAER,KAAK,YAAY,CAAC,cAAc;gBAC7B,IAAI,GAAG,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAA;gBACzB,WAAI,CAAC,IAAI,CACN,uDAAuD,CACzD,CAAA;gBACD,MAAK;YAER,KAAK,YAAY,CAAC,gBAAgB;gBAC/B,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAA;gBAC3B,MAAK;YAER;gBACG,MAAM,IAAI,KAAK,CACZ,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAC7D,CAAA;QACP,CAAC;QAED,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACtD,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE1D,IAAI,CAAC,SAAS,GAAG,KAAK,CAAA;QAEtB,OAAO,IAAI,CAAA;IACd,CAAC;IAUD,GAAG,CAAC,KAAa,EAAE,UAAU,GAAG,IAAI;QACjC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAA;IAClD,CAAC;IASD,OAAO,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAA;IAC3C,CAAC;;AAvFJ,oCAwFC"}
1
+ {"version":3,"file":"HashProperty.js","sourceRoot":"","sources":["../../src/properties/HashProperty.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AACxC,qDAAqE;AACrE,kCAA8B;AA0C9B,MAAa,YAAa,SAAQ,+BAAc;IAE7C,MAAM,CAAC,IAAI,GAAG,MAAM,CAAA;IAEpB,MAAM,CAAC,aAAa,GAAG,KAAK,CAAA;IAE5B,MAAM,CAAC,cAAc,GAAG,MAAM,CAAA;IAE9B,MAAM,CAAC,gBAAgB,GAAG,QAAQ,CAAA;IAElC,MAAM,CAAC,gBAAgB,GAAG,QAAQ,CAAA;IAExB,UAAU,CAAmB;IAC7B,KAAK,GAAW,EAAE,CAAA;IAClB,SAAS,GAAG,KAAK,CAAA;IAE3B,YAAY,MAAwB;QACjC,KAAK,CAAC,MAAM,CAAC,CAAA;QACb,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC,gBAAgB,CAAA;QACnE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAA;QAC9B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAA;QAGzC,IACG,IAAI,CAAC,UAAU,KAAK,YAAY,CAAC,aAAa;YAC9C,IAAI,CAAC,UAAU,KAAK,YAAY,CAAC,cAAc,EAChD,CAAC;YACA,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;YAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;YAC1C,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3E,IAAI,WAAW,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACZ,8CAA8C,IAAI,CAAC,UAAU,4CAA4C,IAAI,CAAC,KAAK,mDAAmD,CACxK,CAAA;YACJ,CAAC;QACJ,CAAC;IACJ,CAAC;IAUD,KAAK,CAAC,KAAa;QAChB,IAAI,IAAI,CAAA;QACR,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YACvB,KAAK,YAAY,CAAC,aAAa;gBAC5B,IAAI,GAAG,IAAA,wBAAU,EAAC,KAAK,CAAC,CAAA;gBACxB,WAAI,CAAC,IAAI,CACN,sDAAsD,CACxD,CAAA;gBACD,MAAK;YAER,KAAK,YAAY,CAAC,cAAc;gBAC7B,IAAI,GAAG,IAAA,wBAAU,EAAC,MAAM,CAAC,CAAA;gBACzB,WAAI,CAAC,IAAI,CACN,uDAAuD,CACzD,CAAA;gBACD,MAAK;YAER,KAAK,YAAY,CAAC,gBAAgB;gBAC/B,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAA;gBAC3B,MAAK;YAER;gBACG,MAAM,IAAI,KAAK,CACZ,0CAA0C,IAAI,CAAC,UAAU,EAAE,CAC7D,CAAA;QACP,CAAC;QAED,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACtD,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE1D,IAAI,CAAC,SAAS,GAAG,KAAK,CAAA;QAEtB,OAAO,IAAI,CAAA;IACd,CAAC;IAUD,GAAG,CAAC,KAAa,EAAE,UAAU,GAAG,IAAI;QACjC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAA;IAClD,CAAC;IASD,OAAO,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAA;IAC3C,CAAC;;AAtGJ,oCAuGC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@quatrain/core",
3
- "version": "1.2.10",
3
+ "version": "1.2.11",
4
4
  "description": "Core objects for business apps",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
package/src/properties/HashProperty.test.ts CHANGED
@@ -106,3 +106,49 @@ describe('Hash Property allows comparison of string and hash value', () => {
106
106
  expect(prop.set('azertyuiop').compare('qwertz')).toBe(false)
107
107
  })
108
108
  })
109
+
110
+ describe('Hash Property Security Policies', () => {
111
+ test('defaults to SHA256 when no algorithm is provided', () => {
112
+ const prop = new HashProperty({
113
+ name: 'my_hash',
114
+ })
115
+ expect(prop.set('azertyuiop').get()).toBe(
116
+ 'aa3d2fe4f6d301dbd6b8fb2d2fddfb7aeebf3bec53ffff4b39a0967afa88c609'
117
+ )
118
+ })
119
+
120
+ test('throws error if MD5 is used for sensitive property names', () => {
121
+ expect(() => {
122
+ new HashProperty({
123
+ name: 'userPassword',
124
+ algorithm: HashProperty.ALGORITHM_MD5,
125
+ })
126
+ }).toThrow('SecurityError: Insecure hashing algorithm')
127
+
128
+ expect(() => {
129
+ new HashProperty({
130
+ name: 'client_pwd',
131
+ algorithm: HashProperty.ALGORITHM_MD5,
132
+ })
133
+ }).toThrow('SecurityError: Insecure hashing algorithm')
134
+ })
135
+
136
+ test('throws error if SHA1 is used for sensitive property names', () => {
137
+ expect(() => {
138
+ new HashProperty({
139
+ name: 'secretToken',
140
+ algorithm: HashProperty.ALGORITHM_SHA1,
141
+ })
142
+ }).toThrow('SecurityError: Insecure hashing algorithm')
143
+ })
144
+
145
+ test('allows SHA256 for sensitive property names', () => {
146
+ const prop = new HashProperty({
147
+ name: 'password',
148
+ algorithm: HashProperty.ALGORITHM_SHA256,
149
+ })
150
+ expect(prop.set('azertyuiop').get()).toBe(
151
+ 'aa3d2fe4f6d301dbd6b8fb2d2fddfb7aeebf3bec53ffff4b39a0967afa88c609'
152
+ )
153
+ })
154
+ })
package/src/properties/HashProperty.ts CHANGED
@@ -14,7 +14,7 @@ export type HashPropertyAlgos =
14
14
  *
15
15
  * | Parameter | Type | Description | Default |
16
16
  * | :--- | :--- | :--- | :--- |
17
- * | `algorithm` | HashPropertyAlgos | The cryptographic hashing algorithm to use. | `ALGORITHM_MD5` |
17
+ * | `algorithm` | HashPropertyAlgos | The cryptographic hashing algorithm to use. | `ALGORITHM_SHA256` |
18
18
  * | `salt` | string | An optional salt string appended to the value before hashing. | `""` |
19
19
  * | `prefixed` | boolean | If true, prepends the algorithm name to the output (e.g. `md5-abc...`). | `false` |
20
20
  */
@@ -60,9 +60,24 @@ export class HashProperty extends StringProperty {
60
60
 
61
61
  constructor(config: HashPropertyType) {
62
62
  super(config)
63
- this._algorithm = config.algorithm || HashProperty.ALGORITHM_MD5
63
+ this._algorithm = config.algorithm || HashProperty.ALGORITHM_SHA256
64
64
  this._salt = config.salt || ''
65
65
  this._prefixed = config.prefixed || false
66
+
67
+ // Prevent legacy/insecure algorithms (MD5, SHA1) on sensitive properties
68
+ if (
69
+ this._algorithm === HashProperty.ALGORITHM_MD5 ||
70
+ this._algorithm === HashProperty.ALGORITHM_SHA1
71
+ ) {
72
+ const sensitiveTerms = ['password', 'pwd', 'secret', 'token', 'credential']
73
+ const nameLower = this._name.toLowerCase()
74
+ const isSensitive = sensitiveTerms.some((term) => nameLower.includes(term))
75
+ if (isSensitive) {
76
+ throw new Error(
77
+ `SecurityError: Insecure hashing algorithm "${this._algorithm}" cannot be used for sensitive property "${this._name}". Please use SHA256 or another secure algorithm.`
78
+ )
79
+ }
80
+ }
66
81
  }
67
82
 
68
83
  /**