@resq-systems/security 1.0.4 → 2.0.0

package/lib/validators.mjs

@@ -1,3 +1,6 @@
+import { MAX_SCAN_LENGTH, scanForThreats } from "./threats/engine.mjs";
+import { foldConfusables } from "./unicode/confusables.mjs";
+import { analyzeIdentifier, containsBidiControls } from "./unicode/index.mjs";
 import { assertNever } from "@resq-systems/types";
 //#region src/validators.ts
 /**
@@ -16,333 +19,198 @@ import { assertNever } from "@resq-systems/types";
 * limitations under the License.
 */
 /**
-* XSS attack patterns
-* Detects script injection, event handlers, and dangerous URIs
-*/
-const XSS_PATTERNS = [
-	/<script\b/gi,
-	/\bon\w+\s*=/gi,
-	/javascript\s*:/gi,
-	/data\s*:\s*text\/html/gi,
-	/data\s*:\s*application\/javascript/gi,
-	/expression\s*\(/gi,
-	/vbscript\s*:/gi,
-	/<iframe\b/gi,
-	/<object\b/gi,
-	/<embed\b/gi,
-	/<style\b/gi,
-	/document\s*\.\s*(cookie|domain|write|location)/gi,
-	/window\s*\.\s*(location|open|eval)/gi,
-	/\beval\s*\(/gi,
-	/\bnew\s+Function\s*\(/gi,
-	/\.innerHTML\s*=/gi,
-	/__proto__/gi,
-	/constructor\s*\[/gi
-];
-/**
-* SQL injection patterns
-* Detects common SQL attack vectors
-*/
-const SQL_INJECTION_PATTERNS = [
-	/\bUNION\s+(ALL\s+)?SELECT\b/gi,
-	/\bDROP\s+(TABLE|DATABASE|INDEX|VIEW)\b/gi,
-	/\bDELETE\s+FROM\b/gi,
-	/\bTRUNCATE\s+TABLE\b/gi,
-	/--\s*$/gm,
-	/\/\*[\s\S]*?\*\//g,
-	/'\s*OR\s+'[\d\w]+'\s*=\s*'[\d\w]+/gi,
-	/'\s*OR\s+\d+\s*=\s*\d+/gi,
-	/"\s*OR\s+"[\d\w]+"\s*=\s*"[\d\w]+/gi,
-	/1\s*=\s*1/g,
-	/;\s*(SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|UNION)/gi,
-	/SLEEP\s*\(\s*\d+\s*\)/gi,
-	/WAITFOR\s+DELAY/gi,
-	/BENCHMARK\s*\(/gi,
-	/INFORMATION_SCHEMA/gi,
-	/0x[0-9a-f]+/gi,
-	/\bEXEC(UTE)?\s*\(/gi,
-	/\bxp_\w+/gi
-];
-/**
-* NoSQL injection patterns
-* Detects MongoDB and other NoSQL attack vectors
-*/
-const NOSQL_INJECTION_PATTERNS = [
-	/\$(?:gt|gte|lt|lte|ne|eq|in|nin|and|or|not|nor|exists|type|mod|regex|text|where|all|elemMatch|size|slice|expr|jsonSchema|meta)\b/gi,
-	/\$where\s*:/gi,
-	/\$function\s*:/gi,
-	/\{\s*\$[a-z]+\s*:/gi,
-	/\[\s*\$[a-z]+\s*\]/gi
-];
-/**
-* Path traversal patterns
-* Detects directory traversal attacks
-*/
-const PATH_TRAVERSAL_PATTERNS = [
-	/\.\.[/\\]/g,
-	/%2e%2e[%2f%5c]/gi,
-	/%252e%252e%252f/gi,
-	/\.\.%2f/gi,
-	/\.\.%5c/gi,
-	/%00/g,
-	/\/etc\/passwd/gi,
-	/\/etc\/shadow/gi,
-	/\/proc\/self/gi,
-	/C:\\Windows/gi,
-	/C:\\System32/gi
-];
-/**
-* Homoglyph patterns
-* Detects Unicode characters that look like ASCII but aren't
-* Used in phishing and IDN homograph attacks
-*/
-const HOMOGLYPH_MAP = {
-	a: [
-		"а",
-		"ɑ",
-		"α",
-		"а"
-	],
-	c: [
-		"с",
-		"ϲ",
-		"ⅽ"
-	],
-	e: [
-		"е",
-		"ε",
-		"ė"
-	],
-	o: [
-		"о",
-		"ο",
-		"ᴏ",
-		"०"
-	],
-	p: ["р", "ρ"],
-	s: ["ѕ", "ꜱ"],
-	x: ["х", "χ"],
-	y: ["у", "γ"],
-	B: ["В", "Β"],
-	H: ["Н", "Η"],
-	K: ["К", "Κ"],
-	M: ["М", "Μ"],
-	P: ["Р", "Ρ"],
-	T: ["Т", "Τ"]
-};
+* @fileoverview Field-level validators, output encoders, and the compatibility
+* surface over the context-aware rule engine in `@resq-systems/security/threats`.
+*
+* The pattern arrays that used to live here are gone. Every detector below delegates
+* to {@link scanForThreats} with the context matching its sink, which is what stops a
+* detector meant for file paths from rejecting a biography. New code should call
+* `scanForThreats` directly and declare its own contexts; the `contains*` helpers
+* remain for callers written against the previous API.
+*
+* Detection is defense-in-depth. Output encoding, parameterized queries, path
+* containment, and argv-array process spawning are the controls.
+*
+* @module @resq-systems/security/validators
+*/
+/** Translate the legacy toggles into engine contexts. */
+function contextsFor(config) {
+	const contexts = ["general_text"];
+	if (config.checkXSS !== false) contexts.push("html");
+	if (config.checkSQLInjection !== false) contexts.push("sql");
+	if (config.checkNoSQLInjection !== false) contexts.push("nosql");
+	if (config.checkCommandInjection === true) contexts.push("shell");
+	if (config.checkPathTraversal !== false) contexts.push("filesystem");
+	return contexts;
+}
+/**
+* Run one context's rules and keep at most one finding, preserving the
+* one-finding-per-detector contract the `contains*` helpers have always had.
+*/
+function firstFindingOfType(input, contexts, type) {
+	const finding = scanForThreats(input, { contexts }).findings.find((candidate) => candidate.type === type);
+	return finding ? [finding] : [];
+}
 /**
-* Detect XSS-style payloads (script tags, event handlers, dangerous
-* URI schemes, prototype pollution, …) in a UTF-8 input.
+* Detect XSS payloads — script tags, inline event handlers, dangerous URI schemes,
+* markup sinks — in a value bound for an HTML context.
 *
-* Inputs longer than 100 000 characters are truncated before scanning
-* to bound regex evaluation cost and prevent ReDoS on crafted
-* payloads. Returns at most one finding — the regex catalog is
-* exhaustive enough that the first hit is sufficient for a
-* reject-or-sanitize decision.
+* @param input - String to scan. Truncated at 100 000 characters.
+* @returns Empty array, or a single finding of type `"xss"`.
 *
-* @param input - String to scan.
-* @returns Empty array when nothing matches, or a single
-*   {@link ThreatFinding} of type `"xss"`.
+* @remarks
+* Prototype-pollution patterns (`__proto__`, `constructor[`) no longer surface here.
+* They are a distinct weakness class with distinct controls and now report as
+* `prototype_pollution` — see {@link containsPrototypePollution}.
 *
 * @example
 * ```ts
 * containsXSSPatterns(`<img src=x onerror="alert(1)">`);
-* // → [{ type: "xss", description: "...", matchedPattern: "onerror=" }]
+* // → [{ ruleId: "XSS-EVENT-HANDLER-001", type: "xss", severity: "high", … }]
 * ```
 */
 function containsXSSPatterns(input) {
-	const findings = [];
-	const bounded = input.length > 1e5 ? input.slice(0, 1e5) : input;
-	for (const pattern of XSS_PATTERNS) {
-		const match = bounded.match(pattern);
-		if (match) {
-			findings.push({
-				type: "xss",
-				description: "Potential cross-site scripting (XSS) detected",
-				matchedPattern: match[0].slice(0, 50)
-			});
-			break;
-		}
-	}
-	return findings;
+	return firstFindingOfType(input, ["html"], "xss");
 }
 /**
-* Detect SQL-injection patterns (UNION SELECT, DROP TABLE,
-* comment-based bypasses, always-true tautologies, stacked queries)
-* in input.
+* Detect prototype-pollution payloads — `__proto__`, `constructor.prototype`, and the
+* nested-object forms that arrive through a JSON body or query-string expansion.
+*
+* **Not the control.** Reject unknown keys with schema validation, build lookup
+* objects with `Object.create(null)`, and use a merge that skips `__proto__`,
+* `constructor`, and `prototype`.
 *
-* **Not a replacement for parameterised queries.** Use this as a
-* defense-in-depth signal in addition to a properly bound prepared
-* statement, never as the only barrier.
+* @param input - String to scan.
+* @returns Empty array, or a single finding of type `"prototype_pollution"`.
+*/
+function containsPrototypePollution(input) {
+	return firstFindingOfType(input, ["object_merge"], "prototype_pollution");
+}
+/**
+* Detect SQL-injection patterns in a value bound for a query.
+*
+* **Not a replacement for parameterized queries.** A bound parameter is safe whatever
+* keywords it contains; an interpolated one is unsafe however many signatures it
+* dodges. Use this for telemetry alongside binding, never instead of it.
 *
 * @param input - String to scan. Truncated at 100 000 characters.
 * @returns Empty array, or one finding of type `"sql_injection"`.
 */
 function containsSQLInjection(input) {
-	const findings = [];
-	const bounded = input.length > 1e5 ? input.slice(0, 1e5) : input;
-	for (const pattern of SQL_INJECTION_PATTERNS) {
-		const match = bounded.match(pattern);
-		if (match) {
-			findings.push({
-				type: "sql_injection",
-				description: "Potential SQL injection detected",
-				matchedPattern: match[0].slice(0, 50)
-			});
-			break;
-		}
-	}
-	return findings;
+	return firstFindingOfType(input, ["sql"], "sql_injection");
 }
 /**
-* Detect NoSQL-injection patterns — Mongo-style operator injection
-* (`$where`, `$ne`, `$regex`), JavaScript-in-query payloads, and
-* structural manipulators that can bypass auth filters in document
-* stores.
+* Detect NoSQL operator injection — `$where`, `$ne`, `$regex`, and the object and
+* array forms that bypass authentication filters in document stores.
 *
 * @param input - String to scan.
 * @returns Empty array, or one finding of type `"nosql_injection"`.
 */
 function containsNoSQLInjection(input) {
-	const findings = [];
-	for (const pattern of NOSQL_INJECTION_PATTERNS) {
-		const match = input.match(pattern);
-		if (match) {
-			findings.push({
-				type: "nosql_injection",
-				description: "Potential NoSQL injection detected",
-				matchedPattern: match[0].slice(0, 50)
-			});
-			break;
-		}
-	}
-	return findings;
+	return firstFindingOfType(input, ["nosql"], "nosql_injection");
 }
 /**
-* Detect shell command-injection patterns: command substitution
-* (`$(...)`, backticks), chained dangerous commands (`; rm`, `; curl`,
-* …) and shell-piped exec (`| sh`, `| bash`).
+* Detect shell command-injection patterns — command substitution, chained commands,
+* pipes into an interpreter.
 *
-* **Off by default in {@link detectThreatPatterns}** — these patterns
-* occasionally fire on legitimate user content. Enable explicitly
-* (`checkCommandInjection: true`) only when input flows into a child
-* process or shell.
+* **Off by default in {@link detectThreatPatterns}**, because these patterns fire on
+* ordinary prose. Enable only when the value reaches a child process, and prefer
+* spawning with an argv array and `shell: false`, which makes the category moot.
 *
 * @param input - String to scan. Truncated at 100 000 characters.
 * @returns Empty array, or one finding of type `"command_injection"`.
 */
 function containsCommandInjection(input) {
-	const findings = [];
-	const dangerousPatterns = [
-		/\$\([^)]{1,200}\)/g,
-		/`[^`]{1,200}`/g,
-		/;\s*(rm|del|cat|wget|curl|nc)\b/gi,
-		/\|\s*(sh|bash|cmd)\b/gi
-	];
-	const bounded = input.length > 1e5 ? input.slice(0, 1e5) : input;
-	for (const pattern of dangerousPatterns) {
-		const match = bounded.match(pattern);
-		if (match) {
-			findings.push({
-				type: "command_injection",
-				description: "Potential command injection detected",
-				matchedPattern: match[0].slice(0, 50)
-			});
-			break;
-		}
-	}
-	return findings;
+	return firstFindingOfType(input, ["shell"], "command_injection");
 }
 /**
-* Detect path-traversal payloads — `../`, encoded dots, raw absolute
-* paths trying to escape a base directory. Pair with `path.resolve()`
-* + a `startsWith()` containment check on the canonicalised path
-* before reading or writing the file.
+* Detect path-traversal payloads — `../`, its percent-encoded and double-encoded
+* forms, NUL truncation, and references to sensitive system paths.
+*
+* **Not the control.** Use `resolveContainedPath` from
+* `@resq-systems/security/paths`, which resolves the candidate against a base
+* directory and verifies containment — a check that also catches absolute paths and
+* separator tricks no signature enumerates.
 *
 * @param input - String to scan.
 * @returns Empty array, or one finding of type `"path_traversal"`.
 */
 function containsPathTraversal(input) {
-	const findings = [];
-	for (const pattern of PATH_TRAVERSAL_PATTERNS) {
-		const match = input.match(pattern);
-		if (match) {
-			findings.push({
-				type: "path_traversal",
-				description: "Potential path traversal attack detected",
-				matchedPattern: match[0].slice(0, 50)
-			});
-			break;
-		}
-	}
-	return findings;
+	return firstFindingOfType(input, ["filesystem"], "path_traversal");
 }
 /**
-* Detect lookalike Unicode characters (Cyrillic / Greek glyphs that
-* render identically to common ASCII letters). The classic phishing
-* trick is `paypaӏ.com` (`ӏ` instead of `l`); this detector catches
-* the building blocks.
+* Base metadata for the synthetic finding {@link containsHomoglyphs} produces, shaped
+* like a catalog entry so downstream consumers see one consistent record.
+*/
+const MIXED_SCRIPT_FINDING = {
+	ruleId: "UNICODE-MIXED-SCRIPT-001",
+	type: "homoglyph",
+	severity: "high",
+	confidence: "medium",
+	description: "Identifier mixes scripts in a combination used for visual spoofing",
+	cwe: 1007,
+	primaryControl: "Compare UTS #39 skeletons at registration time and enforce an identifier restriction level",
+	variant: "nfc"
+};
+/** Overrides applied when the identifier carries a bidirectional control. */
+const BIDI_FINDING_OVERRIDE = {
+	ruleId: "UNICODE-BIDI-OVERRIDE-001",
+	severity: "critical",
+	confidence: "high",
+	description: "Bidirectional override character in an identifier",
+	cwe: 451
+};
+/**
+* Detect visually confusable characters in a **protected identifier**.
 *
-* Use {@link normalizeUnicode} to *replace* homoglyphs with their
-* ASCII equivalents — this function only flags their presence.
+* Backed by UTS #39 script analysis rather than a hand-written lookalike table, so it
+* reports the actual signal — a Latin/Cyrillic mix in `pаypal` — instead of flagging
+* every non-ASCII character. Single-script values are not confusable with anything, so
+* `Ольга Иванова` and `東京タワー` pass where the previous implementation rejected both.
 *
-* @param input - String to scan.
-* @returns Empty array, or one finding of type `"homoglyph"` (the
-*   first matched lookalike).
+* Scope this to usernames, domains, org names, and package names. Do **not** run it on
+* prose or on people's names — see {@link validatePersonName}.
+*
+* @param input - Identifier to scan.
+* @returns Empty array, or a single finding of type `"homoglyph"`.
 */
 function containsHomoglyphs(input) {
-	const findings = [];
-	for (const [, homoglyphs] of Object.entries(HOMOGLYPH_MAP)) for (const homoglyph of homoglyphs) if (input.includes(homoglyph)) {
-		findings.push({
-			type: "homoglyph",
-			description: "Suspicious lookalike Unicode character detected",
-			matchedPattern: homoglyph
-		});
-		return findings;
-	}
-	return findings;
+	if (!input || typeof input !== "string") return [];
+	const analysis = analyzeIdentifier(input.length > 1e5 ? input.slice(0, MAX_SCAN_LENGTH) : input);
+	if (!analysis.isMixedScript && !analysis.hasBidiControls) return [];
+	return [{
+		...MIXED_SCRIPT_FINDING,
+		...analysis.hasBidiControls ? BIDI_FINDING_OVERRIDE : {},
+		matchedPattern: analysis.scripts.join("+").slice(0, 50)
+	}];
 }
-const DEFAULT_CONFIG = {
-	checkXSS: true,
-	checkSQLInjection: true,
-	checkNoSQLInjection: true,
-	checkCommandInjection: false,
-	checkPathTraversal: true,
-	checkHomoglyphs: true
-};
 /**
-* Run every enabled detector against `input` and aggregate findings.
+* Run the enabled detectors against `input` and aggregate findings.
 *
-* Returns early-but-not-immediately: each individual detector still
-* runs to completion, but each detector returns at most one finding,
-* so the aggregate threats array is small (≤ 6 entries).
+* @deprecated Prefer {@link scanForThreats}, which takes explicit contexts and returns
+*   a score and verdict rather than one boolean. This wrapper maps the legacy toggles
+*   onto contexts and keeps the one-finding-per-category shape.
 *
-* Non-string inputs (`null`, `undefined`, numbers, …) are treated as
-* safe — wrap caller-side validation around this if you want to
-* reject non-strings.
+* Non-string input (`null`, `undefined`, a number) is reported safe — wrap your own
+* type validation around this if you need to reject those.
 *
 * @param input - The candidate string.
-* @param config - Detector toggles. Defaults turn on everything
-*   except command-injection.
+* @param config - Detector toggles. Everything except command injection defaults on.
 * @returns `{ isSafe, threats }`.
-*
-* @example
-* ```ts
-* const result = detectThreatPatterns(req.body.query);
-* if (!result.isSafe) return new Response(getThreatErrorMessage(result), { status: 400 });
-* ```
 */
-function detectThreatPatterns(input, config = DEFAULT_CONFIG) {
+function detectThreatPatterns(input, config = {}) {
 	if (!input || typeof input !== "string") return {
 		isSafe: true,
 		threats: []
 	};
+	const result = scanForThreats(input, { contexts: contextsFor(config) });
 	const threats = [];
-	if (config.checkXSS !== false) threats.push(...containsXSSPatterns(input));
-	if (config.checkSQLInjection !== false) threats.push(...containsSQLInjection(input));
-	if (config.checkNoSQLInjection !== false) threats.push(...containsNoSQLInjection(input));
-	if (config.checkCommandInjection) threats.push(...containsCommandInjection(input));
-	if (config.checkPathTraversal !== false) threats.push(...containsPathTraversal(input));
+	const seen = /* @__PURE__ */ new Set();
+	for (const finding of result.findings) {
+		if (seen.has(finding.type)) continue;
+		seen.add(finding.type);
+		threats.push(finding);
+	}
 	if (config.checkHomoglyphs !== false) threats.push(...containsHomoglyphs(input));
 	return {
 		isSafe: threats.length === 0,
@@ -350,8 +218,7 @@ function detectThreatPatterns(input, config = DEFAULT_CONFIG) {
 	};
 }
 /**
-* Boolean shortcut over {@link detectThreatPatterns} — discards the
-* findings list when you only need a yes/no decision.
+* Boolean shortcut over {@link detectThreatPatterns}.
 *
 * @param input - String to test.
 * @param config - Optional detector toggles.
@@ -361,111 +228,409 @@ function isSafeInput(input, config) {
 	return detectThreatPatterns(input, config).isSafe;
 }
 /**
-* HTML-entity escape `&`, `<`, `>`, `"`, `'`, and `/` for safe
-* insertion into HTML text and attribute contexts.
+* HTML-entity-escape a value being inserted as **element text**.
 *
-* **Limited scope.** This is appropriate for plain text destined for
-* `textContent` or attribute values, not for unfiltered HTML
-* rendering. For rich-text use a vetted sanitizer (DOMPurify on the
-* client, sanitize-html or similar on the server).
+* Escapes `&`, `<`, `>`, `"`, `'`, and `/`, which covers text nodes and fully quoted
+* attribute values.
 *
-* Returns `""` for non-string or empty input.
+* **Output encoding is context-dependent.** HTML text, quoted attributes, unquoted
+* attributes, URLs, JavaScript string literals, and CSS each have different rules, and
+* no single function is correct for all of them. This one is correct for text; use
+* {@link escapeHtmlAttribute} for attribute values, `sanitizeUrl` for URLs, and
+* `sanitizeHtml` (DOMPurify) when the value is meant to *be* markup.
 *
-* @param input - Untrusted string.
-* @returns Entity-escaped output safe to interpolate into HTML.
+* There is deliberately no CSS-context escaper here, and no general JavaScript-string
+* escaper — hand-rolled versions of those are reliably wrong, and the fix is to stop
+* interpolating untrusted values into style and script *source*. Embedding untrusted
+* *data* in a script element is the one tractable case, because `JSON.stringify` fixes
+* the string boundaries first; {@link encodeJsonForScript} covers that and nothing else.
+*
+* @param input - Untrusted string. Non-string or empty input yields `""`.
+* @returns Entity-escaped output safe to interpolate into HTML text.
+*
+* @example
+* ```ts
+* escapeHtmlText('<script>alert("xss")<\/script>');
+* // "&lt;script&gt;alert(&quot;xss&quot;)&lt;&#x2F;script&gt;"
+* ```
 */
-function sanitizeForDisplay(input) {
+function escapeHtmlText(input) {
 	if (!input || typeof input !== "string") return "";
 	return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;").replace(/\//g, "&#x2F;");
 }
 /**
-* Canonicalise a string for safe equality checks against ASCII.
+* Control characters escaped in attribute position.
+*
+* The C0 and C1 ranges plus the two Unicode line terminators. The set is the point:
+* HTML's unquoted-attribute state ends at space, tab, LF, FF or CR, and this used to
+* escape tab, LF and CR but not **form feed**. It also escaped CR, which the input
+* stream preprocessor normalises to LF before the tokenizer runs — so three of the four
+* real terminators were covered, plus the one that cannot matter.
+*
+* @see https://html.spec.whatwg.org/multipage/parsing.html
+*/
+const ATTRIBUTE_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
+/**
+* HTML-entity-escape a value being inserted as an **attribute value**.
 *
-* Two-pass:
-* 1. Normalize to NFC (composed form) so combining-character
-*    sequences don't compare differently from their pre-composed
-*    counterparts.
-* 2. Replace known homoglyphs (Cyrillic `А`, Greek `Ε`, …) with their
-*    ASCII equivalents (`A`, `E`, …).
+* Everything {@link escapeHtmlText} escapes, plus backtick, equals, and whitespace —
+* the characters that let a payload break out of an *unquoted* attribute. That case is
+* precisely what generic "escape for display" helpers get wrong.
 *
-* Use before storing user-controlled identifiers (usernames, domain
-* names) and before comparing them to a denylist or to each other.
+* The ceiling on the unquoted case is injection of a valueless boolean attribute —
+* `autofocus`, `disabled`, `formnovalidate` — not script execution: an injected
+* `onmouseover=…` arrives with its `=` already escaped, so it lands as an attribute
+* whose *name* is the escaped text, with no handler bound.
 *
-* Returns `""` for non-string or empty input.
+* Quote your attributes anyway. This makes an unquoted attribute survivable; it does
+* not make it correct.
 *
-* @param input - Raw string from an untrusted source.
-* @returns ASCII-normalized, NFC-composed string.
+* @param input - Untrusted string. Non-string or empty input yields `""`.
+* @returns Output safe to interpolate into a quoted or unquoted attribute value.
 */
-function normalizeUnicode(input) {
+function escapeHtmlAttribute(input) {
 	if (!input || typeof input !== "string") return "";
-	let normalized = input.normalize("NFC");
-	for (const [ascii, homoglyphs] of Object.entries(HOMOGLYPH_MAP)) for (const homoglyph of homoglyphs) normalized = normalized.replace(new RegExp(homoglyph, "g"), ascii);
-	return normalized;
+	return escapeHtmlText(input).replace(/`/g, "&#x60;").replace(/=/g, "&#x3D;").replace(/ /g, "&#x20;").replace(ATTRIBUTE_CONTROL_CHARS, (character) => {
+		return `&#x${(character.codePointAt(0) ?? 0).toString(16).toUpperCase().padStart(2, "0")};`;
+	});
+}
+/**
+* HTML-entity-escape a value for display.
+*
+* @deprecated Renamed to {@link escapeHtmlText}, which says what it actually does. The
+*   old name suggested a general-purpose "make this safe to display" operation, and
+*   callers reasonably read it as attribute-safe — which entity escaping alone is not,
+*   for *unquoted* attributes. Behaviour is unchanged; only the name is.
+*
+* @param input - Untrusted string.
+* @returns Entity-escaped output.
+*/
+function sanitizeForDisplay(input) {
+	return escapeHtmlText(input);
 }
+/** Cap on the input a log value is read from, before escaping expands it. */
+const DEFAULT_LOG_VALUE_LENGTH = 2048;
+/**
+* Characters that must not reach a log sink as themselves.
+*
+* C0 and C1, the zero-width and bidirectional formatting ranges, and the byte-order
+* mark. ESC lives inside C0, which is why no separate ANSI sequence matching is needed:
+* escaping the introducer alone neutralises every terminal sequence *losslessly*,
+* whereas deleting whole sequences would discard the payload a reader is investigating.
+* The bidi range matters for the same reason `UNICODE-BIDI-OVERRIDE-001` exists — a
+* right-to-left override reorders how a log line renders without changing its bytes.
+*/
+const LOG_UNSAFE_CHARS = /[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2060-\u2064\u2066-\u2069\ufeff]/g;
+/** Readable forms for the three characters a reader expects to recognise. */
+const LOG_SHORTHAND = {
+	"	": "\\t",
+	"\n": "\\n",
+	"\r": "\\r"
+};
 /**
-* Generic user-facing fallback message. Render this verbatim when a
-* detector fires but you don't want to expose which one. Prefer
-* {@link getThreatErrorMessage} for category-specific messages.
+* Escape a value for inclusion in a log record.
+*
+* This is the control named by the log-injection rules. A log line is a *sink*: a value
+* carrying a newline forges an entry (CWE-117), one carrying a terminal escape rewrites
+* what an operator sees, and one carrying a bidirectional override reorders the line
+* without altering a byte of it.
+*
+* Escaping rather than stripping is deliberate. The record is evidence, so the encoded
+* form is reversible and nothing is silently discarded — contrast `stripAnsi`, which
+* deletes. Structured logging is still the better answer, because it removes the
+* ambiguity this function can only make visible; use both.
+*
+* @param value - Untrusted field value. Non-string or empty input yields `""`.
+* @param options - Optional bounds.
+* @param options.maxLength - Characters read from `value`. Defaults to 2048. Truncation
+*   is announced in the output rather than applied silently, and the returned string may
+*   exceed this length, because escaping expands.
+* @returns A single-line, control-free rendering of `value`.
+*
+* @example
+* ```ts
+* encodeLogValue("alice\nINFO  user promoted to admin");
+* // "alice\\nINFO  user promoted to admin"  — one line, no forged entry
+* ```
+*/
+function encodeLogValue(value, options = {}) {
+	if (!value || typeof value !== "string") return "";
+	const { maxLength = DEFAULT_LOG_VALUE_LENGTH } = options;
+	const limit = Number.isInteger(maxLength) && maxLength > 0 ? maxLength : DEFAULT_LOG_VALUE_LENGTH;
+	const dropped = value.length - limit;
+	const encoded = (dropped > 0 ? value.slice(0, limit) : value).replace(LOG_UNSAFE_CHARS, (character) => {
+		const shorthand = LOG_SHORTHAND[character];
+		if (shorthand !== void 0) return shorthand;
+		return `\\u${(character.codePointAt(0) ?? 0).toString(16).padStart(4, "0")}`;
+	});
+	return dropped > 0 ? `${encoded}[truncated ${dropped} chars]` : encoded;
+}
+/**
+* A leading formula trigger, tolerating the whitespace and quotes a reader strips first.
+*
+* Mirrors `CSV-FORMULA-LEAD-001`, deliberately: the rule sees through leading quotes and
+* spaces because spreadsheet importers do, so an encoder that only looked at index 0
+* would leave ` =cmd|'/c calc'!A1` live.
+*/
+const CSV_FORMULA_LEAD = /^[\s'"]{0,8}[=+\-@\t\r]/;
+/** Fields containing any of these must be quoted per RFC 4180 sections 2.6 and 2.7. */
+const CSV_QUOTE_REQUIRED = /["\r\n]/;
+/**
+* Escape one cell for CSV export.
+*
+* This is the control named by the formula-injection rules. A CSV file is not inert: a
+* cell beginning `=`, `+`, `-`, `@`, tab or CR is evaluated as a formula by Excel,
+* Sheets and LibreOffice when the recipient opens it, so the payload executes on *their*
+* machine, outside the exporting application entirely (CWE-1236).
+*
+* Two separate jobs, in order: neutralise the formula trigger with a leading apostrophe,
+* then apply RFC 4180 quoting so the field cannot break the row.
+*
+* **Only strings are prefixed.** A `number` or `boolean` came from the application's own
+* types and cannot carry a formula, so `-1234` exports as a negative number while
+* `"-1234"` exports as text. Pass numeric columns as numbers, or every negative value in
+* the sheet becomes a string.
+*
+* Three things worth knowing before relying on it:
+* - The leading apostrophe is an Excel convention, **not** an RFC 4180 construct. Readers
+*   that do not implement it surface it as a literal character in the data.
+* - NUL is removed rather than escaped, so it does not round-trip.
+* - Scanning the output with `scanForThreats` still reports a finding, by design:
+*   `CSV-FORMULA-LEAD-001` sees through the apostrophe and `CSV-DDE-001` is
+*   position-independent. The rules describe the *value*; this function protects the
+*   *file*. A clean scan is the wrong acceptance test.
+*
+* @param value - Cell value. `null` and `undefined` become `""`.
+* @param options - Optional dialect settings.
+* @param options.delimiter - Field separator the row will be joined with. Defaults to `","`.
+* @returns The escaped field, ready to join into a row.
+*
+* @example
+* ```ts
+* escapeCsvField("=WEBSERVICE(\"https://evil.example\")");
+* // quoted, and inert on open
+* escapeCsvField(-1234); // "-1234" — a number, not a formula
+* ```
+*/
+function escapeCsvField(value, options = {}) {
+	if (value === null || value === void 0) return "";
+	const delimiter = options.delimiter ?? ",";
+	const isUntrustedText = typeof value === "string";
+	const cleaned = (isUntrustedText ? value : String(value)).replace(/\u0000/g, "");
+	const neutralised = isUntrustedText && CSV_FORMULA_LEAD.test(cleaned) ? `'${cleaned}` : cleaned;
+	return CSV_QUOTE_REQUIRED.test(neutralised) || neutralised.includes(delimiter) ? `"${neutralised.replaceAll("\"", "\"\"")}"` : neutralised;
+}
+/**
+* Escape and join one row for CSV export.
+*
+* @param values - Cell values, in column order.
+* @param options - Optional dialect settings.
+* @param options.delimiter - Field separator. Defaults to `","`.
+* @returns The joined row, without a line terminator.
+*
+* @example
+* ```ts
+* toCsvRow(["Ada Lovelace", "=1+1", 42]);
+* ```
+*/
+function toCsvRow(values, options = {}) {
+	if (!Array.isArray(values)) return "";
+	const delimiter = options.delimiter ?? ",";
+	return values.map((value) => escapeCsvField(value, { delimiter })).join(delimiter);
+}
+/**
+* The five characters that must not survive into a script element verbatim.
+*
+* None is a JSON structural character, so each can only ever occur inside a string
+* literal, where a unicode escape is legal and semantically identical. That is what makes
+* this transformation safe to apply to `JSON.stringify` output without reparsing it.
+*
+* `<` and `>` close the element; `&` matters when a caller relocates the payload into a
+* context that *is* entity-decoded; U+2028 and U+2029 terminate a line in JavaScript
+* source, which JSON permits raw inside strings.
+*/
+const SCRIPT_UNSAFE_JSON = /[<>&\u2028\u2029]/g;
+/** Escapes for {@link SCRIPT_UNSAFE_JSON}, all valid inside a JSON string literal. */
+const SCRIPT_JSON_ESCAPES = {
+	"<": "\\u003c",
+	">": "\\u003e",
+	"&": "\\u0026",
+	"\u2028": "\\u2028",
+	"\u2029": "\\u2029"
+};
+/**
+* Serialise a value for embedding inside a `<script>` element.
+*
+* `JSON.stringify` alone is not safe here. Its output may contain `<\/script>`, which
+* closes the element from *inside a string literal* — the HTML tokenizer never looks at
+* JavaScript syntax — so the remainder of the payload becomes markup.
+*
+* **Script element content only.** The output contains unescaped `"`, so it must never be
+* placed in an attribute; use {@link escapeHtmlAttribute} there. It is also not a general
+* JavaScript-string escaper — it is safe precisely because `JSON.stringify` has already
+* decided where the string boundaries are.
+*
+* Using `<script type="application/json">` with `JSON.parse(el.textContent)` does **not**
+* remove the need for this: a raw `<\/script>` in the data closes that element too.
+*
+* @param value - Any JSON-serialisable value.
+* @returns JSON text safe to place between `<script>` tags.
+* @throws {TypeError} If `value` cannot be represented as JSON — `undefined`, a function
+*   or a symbol at the top level (for which `JSON.stringify` returns `undefined` rather
+*   than a string), a circular structure, or a `BigInt`. Failing loudly is deliberate: a
+*   sentinel string would emit a syntax error into the page instead.
+*
+* @example
+* ```ts
+* const json = encodeJsonForScript({ name: userName });
+* const html = "<script>window.__DATA__ = " + json + ";<\/script>";
+* ```
+*/
+function encodeJsonForScript(value) {
+	let serialised;
+	try {
+		serialised = JSON.stringify(value);
+	} catch (cause) {
+		throw new TypeError("encodeJsonForScript: value is not JSON-serialisable", { cause });
+	}
+	if (typeof serialised !== "string") throw new TypeError(`encodeJsonForScript: ${typeof value} has no JSON representation at the top level`);
+	return serialised.replace(SCRIPT_UNSAFE_JSON, (character) => SCRIPT_JSON_ESCAPES[character] ?? character);
+}
+/**
+* Fold non-ASCII lookalike characters onto ASCII and compose to NFC.
+*
+* @deprecated Prefer `getSkeleton` and `analyzeIdentifier` from
+*   `@resq-systems/security/unicode`. Rewriting a user's identifier into a different
+*   string loses information and only *looks* safe — the durable pattern is to store
+*   what they typed, index its skeleton, and compare skeletons for collisions.
+*
+* Now backed by the UTS #39 confusable tables rather than the previous 14-entry map,
+* so coverage is far wider. Combining marks are preserved (`e` + U+0301 still composes
+* to `é`) and ASCII characters are never rewritten.
+*
+* @param input - Raw string from an untrusted source. Non-string input yields `""`.
+* @returns NFC-composed string with non-ASCII confusables folded to ASCII.
+*/
+function normalizeUnicode(input) {
+	return foldConfusables(input);
+}
+/**
+* Generic user-facing fallback message. Render verbatim when a detector fires and you
+* do not want to reveal which one.
 */
 const THREAT_DETECTED_MESSAGE = "Input contains potentially unsafe content";
 /**
-* Boolean refinement helper for use with `zod.string().refine(...)`,
-* `effect/Schema.filter(...)`, or any predicate-based validator.
+* Refinement helper for `zod.string().refine(...)`, `effect/Schema.filter(...)`, or
+* any predicate-based validator. Equivalent to {@link isSafeInput} with defaults.
 *
-* Equivalent to `isSafeInput(input)` with default config.
+* @param input - String to test.
+* @returns `true` when no detector fires.
 */
 function validateSafeText(input) {
 	return isSafeInput(input);
 }
 /**
-* Refinement for human name fields. More permissive than
-* {@link validateSafeText} — allows international letters,
-* combining marks, hyphens, apostrophes, and spaces — but still
-* rejects HTML/SQL/NoSQL injection patterns and homoglyph forgeries.
+* Letters, marks, apostrophes, hyphens, periods, spaces, and the two joiners — nothing
+* else.
+*
+* U+200C (ZWNJ) and U+200D (ZWJ) are part of the spelling, not decoration. Persian and
+* Hindi names need them to be written correctly — a ZWNJ is what keeps the two halves
+* of `می‌روم` from joining — so a pattern without them rejects the name its owner
+* actually has. They carry no injection risk here: everything a payload needs (`<`,
+* `(`, `;`, `$`, `=`, digits) stays excluded. Written as escapes, not literals — an
+* invisible character pasted into a character class is unreviewable in a diff.
+*/
+const PERSON_NAME_PATTERN = /^[\p{L}\p{M}'’.\-\s\u{200C}\u{200D}]+$/u;
+/** Shortest accepted name. Mononyms and single-letter names exist. */
+const MIN_NAME_LENGTH = 1;
+/** Longest accepted name. */
+const MAX_NAME_LENGTH = 200;
+/**
+* Validate a human name field.
+*
+* The policy is an allowlist of what a name is made of — letters in any script,
+* combining marks, apostrophes, hyphens, periods, spaces — plus a length bound and a
+* bidirectional-control check. Nothing that passes it can carry an injection payload,
+* because `<`, `(`, `;`, `$`, `=`, and every digit are already excluded.
+*
+* It deliberately does **not** run SQL, path-traversal, or confusable detectors. A
+* name is not a query, a path, or a protected identifier, and subjecting one to those
+* checks rejects real people: the previous implementation ran the homoglyph detector
+* here, which failed any name containing а, е, о, р, с, or х — that is, most Russian,
+* Ukrainian, Bulgarian, Serbian, and Greek names.
+*
+* Encode the value at whatever sink it eventually reaches. That is what makes it safe;
+* this function only establishes that it is a name.
+*
+* @param input - Candidate name.
+* @returns `true` when the value is a plausible name.
+*
+* @example
+* ```ts
+* validatePersonName("O'Brien");            // true
+* validatePersonName("José García");        // true
+* validatePersonName("Ольга Иванова");      // true
+* validatePersonName("John123");            // false
+* validatePersonName("<script>x<\/script>"); // false
+* ```
+*/
+function validatePersonName(input) {
+	if (typeof input !== "string") return false;
+	const normalized = input.normalize("NFC");
+	if (normalized.length < MIN_NAME_LENGTH || normalized.length > MAX_NAME_LENGTH) return false;
+	if (containsBidiControls(normalized)) return false;
+	return PERSON_NAME_PATTERN.test(normalized);
+}
+/**
+* Validate a human name field.
 *
-* Suitable for first/last/full-name inputs in registration forms.
+* @deprecated Renamed to {@link validatePersonName}. The old name implied a general
+*   "safe name" check and was implemented as one, running injection and homoglyph
+*   detectors against people's names. Behaviour now matches
+*   {@link validatePersonName}.
 *
-* @returns `true` when the name passes both the threat detectors and
-*   the name-shape regex.
+* @param input - Candidate name.
+* @returns `true` when the value is a plausible name.
 */
 function validateSafeName(input) {
-	const normalized = input.normalize("NFC");
-	if (!isSafeInput(normalized, { checkCommandInjection: false })) return false;
-	return /^[\p{L}\p{M}'\-\s.]+$/u.test(normalized);
+	return validatePersonName(input);
 }
+/** Longest address accepted, per RFC 5321 §4.5.3.1.3. Also bounds regex cost. */
+const MAX_EMAIL_LENGTH = 254;
+/** RFC-shaped address check. Length is bounded before this runs. */
+const EMAIL_PATTERN = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
 /**
-* Refinement for email fields. Combines:
+* Validate an email address.
 *
-* 1. RFC-style format check (length-bounded to ≤ 254 chars to
-*    prevent ReDoS).
-* 2. XSS / SQL / NoSQL / homoglyph detectors — emails are extremely
-*    constrained and should never legitimately contain HTML or query
-*    operators.
+* Two checks: an RFC-shaped format match (length-bounded first, so the pattern never
+* sees an unbounded string), and UTS #39 identifier analysis of the **domain**, where
+* a mixed-script host is the IDN homograph attack — `аpple.com` with a Cyrillic `а`
+* resolves somewhere else entirely.
 *
-* @returns `true` when both checks pass.
+* The local part is not confusable-checked: it is not a routable identifier, and
+* flagging it would reject legitimate internationalized mailboxes.
+*
+* @param input - Candidate address.
+* @returns `true` when the format is valid and the domain is not a script mix.
 */
 function validateSafeEmail(input) {
-	if (input.length > 254) return false;
-	if (!/^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(input)) return false;
-	return detectThreatPatterns(input, {
-		checkXSS: true,
-		checkSQLInjection: true,
-		checkNoSQLInjection: true,
-		checkCommandInjection: false,
-		checkPathTraversal: false,
-		checkHomoglyphs: true
-	}).isSafe;
+	if (typeof input !== "string") return false;
+	if (input.length > MAX_EMAIL_LENGTH) return false;
+	if (!EMAIL_PATTERN.test(input)) return false;
+	const analysis = analyzeIdentifier(input.slice(input.lastIndexOf("@") + 1));
+	return !analysis.isMixedScript && !analysis.hasBidiControls;
 }
 /**
-* Map a {@link ThreatDetectionResult} into a user-facing error
-* message string suitable for an HTTP 400 response or form
-* validation error. Returns `""` when the result is safe (so
-* `error || undefined` works).
+* Render a user-facing error message for a detection result.
+*
+* Uses only the **first** finding: enumerating every category that fired leaks the
+* shape of the rule set to whoever is probing it. Log `result.threats` server-side for
+* diagnostics and return this to the client.
 *
-* Uses only the **first** finding for the message — exposing every
-* threat type to the user can leak information about the detection
-* rules. For full diagnostics, log `result.threats` server-side
-* rather than returning them.
+* @param result - A {@link ThreatDetectionResult}, a `ThreatScanResult`-shaped object,
+*   or any `{ isSafe, threats }` pair.
+* @returns A message, or `""` when the result is safe — so `message || undefined`
+*   works at a call site.
 */
 function getThreatErrorMessage(result) {
 	if (result.isSafe) return "";
@@ -477,11 +642,27 @@ function getThreatErrorMessage(result) {
 		case "nosql_injection": return "Input contains potentially malicious query operators";
 		case "command_injection": return "Input contains potentially malicious system commands";
 		case "path_traversal": return "Input contains potentially malicious file path characters";
+		case "prototype_pollution": return "Input contains potentially malicious object property names";
 		case "homoglyph": return "Input contains suspicious lookalike characters";
+		case "header_injection": return "Input contains line breaks that are not allowed in this field";
+		case "ldap_injection": return "Input contains potentially malicious directory query characters";
+		case "xpath_injection": return "Input contains potentially malicious query expressions";
+		case "xml_injection": return "Input contains potentially malicious document declarations";
+		case "template_injection": return "Input contains potentially malicious template expressions";
+		case "file_inclusion": return "Input contains potentially malicious resource references";
+		case "ssrf": return "Input contains a network address that is not allowed";
+		case "formula_injection": return "Input contains spreadsheet formula characters";
+		case "log_injection": return "Input contains characters that are not allowed in this field";
+		case "prompt_injection": return "Input contains instructions that are not allowed in this field";
+		case "parameter_pollution": return "Input contains additional query parameters that are not allowed";
+		case "credential_exposure": return "Request contains credential material that must not be sent or stored here";
+		case "jwt_tampering": return "Token is not signed with an accepted algorithm";
+		case "double_encoding": return "Input contains characters that are encoded more than once";
+		case "resource_abuse": return "Input is too large or too repetitive to process";
 		default: return assertNever(threat.type);
 	}
 }
 //#endregion
-export { THREAT_DETECTED_MESSAGE, containsCommandInjection, containsHomoglyphs, containsNoSQLInjection, containsPathTraversal, containsSQLInjection, containsXSSPatterns, detectThreatPatterns, getThreatErrorMessage, isSafeInput, normalizeUnicode, sanitizeForDisplay, validateSafeEmail, validateSafeName, validateSafeText };
+export { THREAT_DETECTED_MESSAGE, containsCommandInjection, containsHomoglyphs, containsNoSQLInjection, containsPathTraversal, containsPrototypePollution, containsSQLInjection, containsXSSPatterns, detectThreatPatterns, encodeJsonForScript, encodeLogValue, escapeCsvField, escapeHtmlAttribute, escapeHtmlText, getThreatErrorMessage, isSafeInput, normalizeUnicode, sanitizeForDisplay, toCsvRow, validatePersonName, validateSafeEmail, validateSafeName, validateSafeText };
 
 //# sourceMappingURL=validators.mjs.map