@roboteby/parry 1.1.0-rc.1

package/src/detectors/sql.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const { SQL_PATTERNS } = require('../../constants/patterns');
+const { decodeSqlValue } = require('../utils/decode');
+
+const SQLInjectionDetector = {
+  /** @param {string} value @returns {string|null} */
+  scan(value) {
+    if (typeof value !== 'string' || value.trim() === '') return null;
+    const decoded = decodeSqlValue(value);
+    for (const pattern of SQL_PATTERNS) {
+      if (pattern.test(decoded)) return pattern.toString();
+    }
+    return null;
+  },
+};
+
+module.exports = { SQLInjectionDetector };

package/src/detectors/xss.js

@@ -0,0 +1,18 @@
+'use strict';
+
+const { XSS_PATTERNS } = require('../../constants/patterns');
+const { decodeXssValue } = require('../utils/decode');
+
+const XSSDetector = {
+  /** @param {string} value @returns {string|null} */
+  scan(value) {
+    if (typeof value !== 'string' || value.trim() === '') return null;
+    const decoded = decodeXssValue(value);
+    for (const pattern of XSS_PATTERNS) {
+      if (pattern.test(decoded)) return pattern.toString();
+    }
+    return null;
+  },
+};
+
+module.exports = { XSSDetector };

package/src/events/event-bus.js

@@ -0,0 +1,51 @@
+'use strict';
+
+const { createThreatEvent, createHookErrorEvent } = require('./threat-event');
+const { MemoryEventStore } = require('./memory-event-store');
+
+class EventBus {
+  constructor(options = {}) {
+    this.eventStore = options.eventStore || new MemoryEventStore(options);
+    this.listeners = [];
+  }
+
+  emitThreat(event, context = {}) {
+    const normalized = createThreatEvent(event);
+    this._record(normalized);
+    this._notify(normalized, context);
+    return normalized;
+  }
+
+  onThreat(listener) {
+    if (typeof listener !== 'function') return () => {};
+    this.listeners.push(listener);
+    return () => {
+      this.listeners = this.listeners.filter((item) => item !== listener);
+    };
+  }
+
+  getRecentEvents(options) {
+    return this.eventStore.getRecentEvents(options);
+  }
+
+  getEventById(id) {
+    return this.eventStore.getById(id);
+  }
+
+  _record(event) {
+    this.eventStore.add(event);
+  }
+
+  _notify(event, context) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event, context.req, context.res);
+      } catch (error) {
+        const hookError = createHookErrorEvent(error, event);
+        this._record(hookError);
+      }
+    }
+  }
+}
+
+module.exports = { EventBus };

package/src/events/index.js

@@ -0,0 +1,19 @@
+'use strict';
+
+const { EventBus } = require('./event-bus');
+const { MemoryEventStore } = require('./memory-event-store');
+const {
+  createThreatEvent,
+  createStoreErrorEvent,
+  createHookErrorEvent,
+} = require('./threat-event');
+const { sanitizeEvent } = require('./sanitize-event');
+
+module.exports = {
+  EventBus,
+  MemoryEventStore,
+  createThreatEvent,
+  createStoreErrorEvent,
+  createHookErrorEvent,
+  sanitizeEvent,
+};

package/src/events/memory-event-store.js

@@ -0,0 +1,64 @@
+'use strict';
+
+class MemoryEventStore {
+  constructor(options = {}) {
+    this.maxEvents = options.maxEvents || 500;
+    this.events = [];
+  }
+
+  add(event) {
+    this.events.unshift(event);
+    if (this.events.length > this.maxEvents) {
+      this.events.length = this.maxEvents;
+    }
+    return event;
+  }
+
+  getRecentEvents(options = {}) {
+    const limit = clampNumber(options.limit, 50, 1, this.maxEvents);
+    const offset = clampNumber(options.offset, 0, 0, this.maxEvents);
+    const filtered = this.events.filter((event) => matchesFilters(event, options));
+
+    return {
+      data: filtered.slice(offset, offset + limit),
+      pagination: {
+        limit,
+        offset,
+        total: filtered.length,
+      },
+    };
+  }
+
+  getById(id) {
+    return this.events.find((event) => event.id === id) || null;
+  }
+
+  clear() {
+    this.events = [];
+  }
+}
+
+function matchesFilters(event, filters) {
+  for (const key of ['type', 'severity', 'action', 'ip', 'path', 'policyName']) {
+    if (filters[key] && event[key] !== filters[key]) return false;
+  }
+
+  if (
+    filters.detector &&
+    event.detector !== filters.detector &&
+    event.detectorSlug !== filters.detector &&
+    event.detectorType !== filters.detector
+  ) {
+    return false;
+  }
+
+  return true;
+}
+
+function clampNumber(value, fallback, min, max) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.min(max, Math.max(min, Math.floor(parsed)));
+}
+
+module.exports = { MemoryEventStore };

package/src/events/sanitize-event.js

@@ -0,0 +1,54 @@
+'use strict';
+
+const SENSITIVE_KEYS = new Set([
+  'authorization',
+  'cookie',
+  'credentials',
+  'password',
+  'secret',
+  'token',
+]);
+
+function sanitizeEvent(value) {
+  return sanitizeValue(value, new WeakSet());
+}
+
+function sanitizeValue(value, seen) {
+  if (value == null) return value;
+  if (typeof value !== 'object') return value;
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+
+  if (Array.isArray(value)) return value.map((item) => sanitizeValue(item, seen));
+
+  const output = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (isSensitiveKey(key)) {
+      output[key] = '[REDACTED]';
+      continue;
+    }
+
+    if (key === 'body' || key === 'rawBody') {
+      output[key] = '[REDACTED]';
+      continue;
+    }
+
+    output[key] = sanitizeValue(entry, seen);
+  }
+
+  return output;
+}
+
+function isSensitiveKey(key) {
+  const normalized = String(key || '').toLowerCase();
+  return [...SENSITIVE_KEYS].some((sensitive) => normalized.includes(sensitive));
+}
+
+function sanitizeUserAgent(value) {
+  if (!value) return undefined;
+  return String(value)
+    .replace(/[\r\n]/g, ' ')
+    .slice(0, 200);
+}
+
+module.exports = { sanitizeEvent, sanitizeUserAgent, isSensitiveKey };

package/src/events/threat-event.js

@@ -0,0 +1,174 @@
+'use strict';
+
+const { sanitizeEvent, sanitizeUserAgent } = require('./sanitize-event');
+
+let eventSequence = 0;
+
+const LEGACY_TYPE_MAP = {
+  BAN: 'TEMPORARY_BAN_HIT',
+  RATE_LIMIT: 'RATE_LIMIT_EXCEEDED',
+  STORE_FAILURE: 'STORE_ERROR',
+  THREAT: null,
+  BRUTE_FORCE_BLOCK: 'BRUTE_FORCE_BLOCKED',
+};
+
+const DETECTOR_TYPE_MAP = {
+  SQL_INJECTION: 'SQL_INJECTION_BLOCKED',
+  XSS: 'XSS_BLOCKED',
+  NOSQL_INJECTION: 'NOSQL_INJECTION_BLOCKED',
+  HTTP_PARAMETER_POLLUTION: 'HPP_BLOCKED',
+  PROTOTYPE_POLLUTION: 'PROTOTYPE_POLLUTION_BLOCKED',
+  PATH_TRAVERSAL: 'PATH_TRAVERSAL_BLOCKED',
+  REQUEST_SHAPE: 'REQUEST_SHAPE_BLOCKED',
+};
+
+const DETECTOR_NAME_MAP = {
+  SQL_INJECTION: 'sql',
+  XSS: 'xss',
+  NOSQL_INJECTION: 'nosql',
+  HTTP_PARAMETER_POLLUTION: 'hpp',
+  PROTOTYPE_POLLUTION: 'prototype-pollution',
+  PATH_TRAVERSAL: 'path-traversal',
+  REQUEST_SHAPE: 'request-shape',
+  RATE_LIMIT: 'rate-limit',
+  ROUTE_RATE_LIMIT: 'rate-limit',
+  BRUTE_FORCE: 'brute-force',
+};
+
+const DETECTOR_TYPE_BY_SLUG = Object.entries(DETECTOR_NAME_MAP).reduce((map, [type, slug]) => {
+  if (!map[slug]) map[slug] = type;
+  return map;
+}, {});
+
+function createThreatEvent(input = {}) {
+  const source = sanitizeEvent(input);
+  const firstThreat = Array.isArray(source.threats) ? source.threats[0] : null;
+  const sourceDetector = source.detector || firstThreat?.detector;
+  const detectorSlug = normalizeDetector(sourceDetector);
+  const detectorType = normalizeDetectorType(source.detectorType || sourceDetector);
+  const type = normalizeType(source.type, detectorType || sourceDetector);
+  const event = {
+    ...source,
+    id: source.id || createEventId(),
+    type,
+    module: source.module || moduleForType(type),
+    detector: detectorSlug,
+    detectorType,
+    detectorSlug,
+    severity: source.severity || firstThreat?.severity || severityForType(type),
+    action: source.action || actionForType(type),
+    reason: source.reason || firstThreat?.reason || reasonForType(type),
+    ip: source.ip,
+    method: source.method,
+    path: source.path || normalizePath(source.url),
+    statusCode: source.statusCode,
+    policyName: source.policyName,
+    keyTypes: source.keyTypes,
+    requestId: source.requestId,
+    userAgent: sanitizeUserAgent(source.userAgent),
+    timestamp: source.timestamp || new Date().toISOString(),
+    metadata: sanitizeEvent(source.metadata || {}),
+  };
+
+  if (source.url && !event.url) event.url = source.url;
+  if (source.threats) event.threats = source.threats;
+  return sanitizeEvent(event);
+}
+
+function createStoreErrorEvent(error, context = {}) {
+  return createThreatEvent({
+    type: 'STORE_ERROR',
+    module: context.module || 'store',
+    severity: 'medium',
+    action: 'error',
+    reason: error && error.message ? error.message : String(error),
+    ...context,
+  });
+}
+
+function createHookErrorEvent(error, event = {}) {
+  return createThreatEvent({
+    type: 'HOOK_ERROR',
+    module: 'hook',
+    severity: 'low',
+    action: 'error',
+    reason: error && error.message ? error.message : String(error),
+    ip: event.ip,
+    method: event.method,
+    path: event.path,
+    requestId: event.requestId,
+    metadata: { sourceEventId: event.id, sourceType: event.type },
+  });
+}
+
+function createEventId() {
+  eventSequence += 1;
+  return `evt_${Date.now().toString(36)}_${eventSequence.toString(36)}`;
+}
+
+function normalizeType(type, detector) {
+  if (LEGACY_TYPE_MAP[type]) return LEGACY_TYPE_MAP[type];
+  if (type === 'THREAT' && detector) return DETECTOR_TYPE_MAP[detector] || 'THREAT_BLOCKED';
+  if (DETECTOR_TYPE_MAP[detector] && (!type || type === detector))
+    return DETECTOR_TYPE_MAP[detector];
+  return type || 'SECURITY_EVENT';
+}
+
+function normalizeDetector(detector) {
+  return DETECTOR_NAME_MAP[detector] || detector || undefined;
+}
+
+function normalizeDetectorType(detector) {
+  if (!detector) return undefined;
+  if (DETECTOR_NAME_MAP[detector]) return detector;
+  return DETECTOR_TYPE_BY_SLUG[detector] || detector;
+}
+
+function moduleForType(type) {
+  if (type.startsWith('BRUTE_FORCE')) return 'brute-force';
+  if (type === 'ROUTE_RATE_LIMIT_EXCEEDED') return 'route-policy';
+  if (type === 'RATE_LIMIT_EXCEEDED' || type.startsWith('TEMPORARY_BAN')) return 'rate-limit';
+  if (type === 'STORE_ERROR') return 'store';
+  if (type === 'HOOK_ERROR') return 'hook';
+  return 'detector';
+}
+
+function severityForType(type) {
+  if (type.includes('SQL') || type.includes('NOSQL') || type.includes('BRUTE_FORCE_BLOCK'))
+    return 'high';
+  if (type.includes('BLOCKED') || type.includes('RATE_LIMIT') || type.includes('STORE'))
+    return 'medium';
+  if (type.includes('RESET')) return 'low';
+  return 'medium';
+}
+
+function actionForType(type) {
+  if (type.includes('BLOCKED') || type.includes('EXCEEDED') || type.includes('BAN_HIT'))
+    return 'blocked';
+  if (type.includes('ATTEMPT')) return 'observed';
+  if (type.includes('RESET')) return 'reset';
+  if (type.includes('ERROR')) return 'error';
+  if (type.includes('CREATED')) return 'created';
+  return 'observed';
+}
+
+function reasonForType(type) {
+  return type.toLowerCase().replace(/_/g, ' ');
+}
+
+function normalizePath(url) {
+  if (!url) return undefined;
+  const value = String(url);
+  const index = value.indexOf('?');
+  return index === -1 ? value : value.slice(0, index);
+}
+
+module.exports = {
+  createThreatEvent,
+  createStoreErrorEvent,
+  createHookErrorEvent,
+  createEventId,
+  normalizeType,
+  normalizeDetector,
+  normalizeDetectorType,
+};

package/src/express/ip-resolver.js

@@ -0,0 +1,109 @@
+'use strict';
+
+const ipaddr = require('ipaddr.js');
+
+function getClientIp(req, options = {}) {
+  const headers = req.headers || {};
+  const directIp = getDirectIp(req);
+
+  if (!options.trustProxyHeaders) return directIp;
+
+  if (!isTrustedProxy(directIp, options.trustedProxies || [])) return directIp;
+
+  const forwarded = getHeader(headers, 'x-forwarded-for');
+  const firstForwarded = forwarded ? forwarded.split(',')[0].trim() : '';
+  const realIp = getHeader(headers, 'x-real-ip');
+  return normalizeIp(firstForwarded || realIp || directIp);
+}
+
+function resolveClientIP(req, options = {}) {
+  return getClientIp(req, options);
+}
+
+function getDirectIp(req) {
+  return normalizeIp(req?.socket?.remoteAddress || req?.connection?.remoteAddress || req?.ip);
+}
+
+function isTrustedProxy(ip, trustedProxies) {
+  return isIpAllowed(ip, trustedProxies);
+}
+
+function isIpAllowed(clientIp, allowedIps = []) {
+  const parsedClientIp = parseIp(clientIp);
+  if (!parsedClientIp || !Array.isArray(allowedIps) || allowedIps.length === 0) return false;
+
+  return allowedIps.some((entry) => {
+    const rule = String(entry || '').trim();
+    if (!rule) return false;
+
+    try {
+      if (rule.includes('/')) {
+        const [range, bits] = ipaddr.parseCIDR(rule);
+        return parsedClientIp.match(range, bits);
+      }
+
+      const parsedRule = parseIp(rule);
+      return parsedRule ? parsedClientIp.toString() === parsedRule.toString() : false;
+    } catch (_error) {
+      return false;
+    }
+  });
+}
+
+function getHeader(headers, name) {
+  const lower = name.toLowerCase();
+  return (
+    headers[lower] ||
+    headers[name] ||
+    headers[Object.keys(headers).find((key) => key.toLowerCase() === lower)]
+  );
+}
+
+function normalizeIp(value) {
+  const parsed = parseIp(value);
+  return parsed ? parsed.toString() : 'unknown';
+}
+
+function parseIp(value) {
+  const cleaned = cleanIpInput(value);
+  if (!cleaned) return null;
+
+  try {
+    return ipaddr.process(cleaned);
+  } catch (_error) {
+    return null;
+  }
+}
+
+function cleanIpInput(value) {
+  let ip = String(value || '').trim();
+  if (!ip || ip === 'unknown') return '';
+
+  if (ip.startsWith('[')) {
+    const end = ip.indexOf(']');
+    if (end !== -1) ip = ip.slice(1, end);
+  }
+
+  const zoneIndex = ip.indexOf('%');
+  if (zoneIndex !== -1) ip = ip.slice(0, zoneIndex);
+
+  if (ip.startsWith('::ffff:')) return ip;
+
+  const colonCount = (ip.match(/:/g) || []).length;
+  if (colonCount === 1 && ip.includes('.')) {
+    const [host] = ip.split(':');
+    return host;
+  }
+
+  return ip;
+}
+
+module.exports = {
+  getClientIp,
+  resolveClientIP,
+  getDirectIp,
+  isTrustedProxy,
+  isIpAllowed,
+  normalizeIp,
+  getHeader,
+};