@signaltree/core 4.0.15 → 4.1.0

package/dist/lib/security/security-validator.js

@@ -1,139 +1,121 @@
 const DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'];
 const HTML_TAG_PATTERN = /<[^>]*>/g;
-const DANGEROUS_HTML_PATTERNS = [
-    /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
-    /on\w+\s*=/gi,
-    /javascript:/gi,
-    /<iframe\b/gi,
-    /<object\b/gi,
-    /<embed\b/gi,
-];
-export class SecurityValidator {
-    config;
-    dangerousKeys;
-    constructor(config = {}) {
-        this.config = {
-            preventPrototypePollution: config.preventPrototypePollution ?? true,
-            preventXSS: config.preventXSS ?? false,
-            preventFunctions: config.preventFunctions ?? true,
-            customDangerousKeys: config.customDangerousKeys ?? [],
-            onSecurityEvent: config.onSecurityEvent ??
-                (() => {
-                }),
-            sanitizationMode: config.sanitizationMode ?? 'strict',
-        };
-        this.dangerousKeys = new Set([
-            ...DANGEROUS_KEYS,
-            ...this.config.customDangerousKeys,
-        ]);
+const DANGEROUS_HTML_PATTERNS = [/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, /on\w+\s*=/gi, /javascript:/gi, /<iframe\b/gi, /<object\b/gi, /<embed\b/gi];
+class SecurityValidator {
+  config;
+  dangerousKeys;
+  constructor(config = {}) {
+    this.config = {
+      preventPrototypePollution: config.preventPrototypePollution ?? true,
+      preventXSS: config.preventXSS ?? false,
+      preventFunctions: config.preventFunctions ?? true,
+      customDangerousKeys: config.customDangerousKeys ?? [],
+      onSecurityEvent: config.onSecurityEvent ?? (() => {}),
+      sanitizationMode: config.sanitizationMode ?? 'strict'
+    };
+    this.dangerousKeys = new Set([...DANGEROUS_KEYS, ...this.config.customDangerousKeys]);
+  }
+  validateKey(key) {
+    if (!this.config.preventPrototypePollution) {
+      return;
     }
-    validateKey(key) {
-        if (!this.config.preventPrototypePollution) {
-            return;
-        }
-        if (this.dangerousKeys.has(key)) {
-            const event = {
-                type: 'dangerous-key-blocked',
-                key,
-                reason: `Dangerous key "${key}" blocked to prevent prototype pollution`,
-                timestamp: Date.now(),
-            };
-            this.config.onSecurityEvent(event);
-            throw new Error(`[SignalTree Security] Dangerous key "${key}" is not allowed. ` +
-                `This key can lead to prototype pollution attacks. ` +
-                `Blocked keys: ${Array.from(this.dangerousKeys).join(', ')}`);
-        }
+    if (this.dangerousKeys.has(key)) {
+      const event = {
+        type: 'dangerous-key-blocked',
+        key,
+        reason: `Dangerous key "${key}" blocked to prevent prototype pollution`,
+        timestamp: Date.now()
+      };
+      this.config.onSecurityEvent(event);
+      throw new Error(`[SignalTree Security] Dangerous key "${key}" is not allowed. ` + `This key can lead to prototype pollution attacks. ` + `Blocked keys: ${Array.from(this.dangerousKeys).join(', ')}`);
     }
-    validateValue(value) {
-        if (this.config.preventFunctions && typeof value === 'function') {
-            const event = {
-                type: 'function-value-blocked',
-                value,
-                reason: 'Function values are not allowed - state must be serializable',
-                timestamp: Date.now(),
-            };
-            this.config.onSecurityEvent(event);
-            throw new Error(`[SignalTree Security] Function values are not allowed in state trees. ` +
-                `Functions cannot be serialized, breaking features like time-travel, ` +
-                `persistence, debugging, and SSR. ` +
-                `\n\nTo fix this:` +
-                `\n  - Store function references outside the tree` +
-                `\n  - Use method names (strings) and a function registry` +
-                `\n  - Use computed signals for derived values` +
-                `\n\nBlocked value: ${value.toString().substring(0, 100)}...`);
-        }
-        if (!this.config.preventXSS || typeof value !== 'string') {
-            return value;
-        }
-        let hasDangerousPattern = false;
-        for (const pattern of DANGEROUS_HTML_PATTERNS) {
-            pattern.lastIndex = 0;
-            if (pattern.test(value)) {
-                hasDangerousPattern = true;
-                break;
-            }
-        }
-        if (hasDangerousPattern) {
-            const event = {
-                type: 'xss-attempt-blocked',
-                value,
-                reason: 'Dangerous HTML pattern detected and sanitized',
-                timestamp: Date.now(),
-            };
-            this.config.onSecurityEvent(event);
-            return this.sanitize(value);
-        }
-        return this.sanitize(value);
+  }
+  validateValue(value) {
+    if (this.config.preventFunctions && typeof value === 'function') {
+      const event = {
+        type: 'function-value-blocked',
+        value,
+        reason: 'Function values are not allowed - state must be serializable',
+        timestamp: Date.now()
+      };
+      this.config.onSecurityEvent(event);
+      throw new Error(`[SignalTree Security] Function values are not allowed in state trees. ` + `Functions cannot be serialized, breaking features like time-travel, ` + `persistence, debugging, and SSR. ` + `\n\nTo fix this:` + `\n  - Store function references outside the tree` + `\n  - Use method names (strings) and a function registry` + `\n  - Use computed signals for derived values` + `\n\nBlocked value: ${value.toString().substring(0, 100)}...`);
     }
-    sanitize(value) {
-        if (this.config.sanitizationMode === 'strict') {
-            let sanitized = value;
-            for (const pattern of DANGEROUS_HTML_PATTERNS) {
-                pattern.lastIndex = 0;
-                sanitized = sanitized.replace(pattern, '');
-            }
-            return sanitized.replace(HTML_TAG_PATTERN, '');
-        }
-        else {
-            let sanitized = value;
-            for (const pattern of DANGEROUS_HTML_PATTERNS) {
-                pattern.lastIndex = 0;
-                sanitized = sanitized.replace(pattern, '');
-            }
-            return sanitized;
-        }
+    if (!this.config.preventXSS || typeof value !== 'string') {
+      return value;
     }
-    validateKeyValue(key, value) {
-        this.validateKey(key);
-        return this.validateValue(value);
+    let hasDangerousPattern = false;
+    for (const pattern of DANGEROUS_HTML_PATTERNS) {
+      pattern.lastIndex = 0;
+      if (pattern.test(value)) {
+        hasDangerousPattern = true;
+        break;
+      }
     }
-    isDangerousKey(key) {
-        return this.dangerousKeys.has(key);
+    if (hasDangerousPattern) {
+      const event = {
+        type: 'xss-attempt-blocked',
+        value,
+        reason: 'Dangerous HTML pattern detected and sanitized',
+        timestamp: Date.now()
+      };
+      this.config.onSecurityEvent(event);
+      return this.sanitize(value);
     }
-    getConfig() {
-        return { ...this.config };
+    return this.sanitize(value);
+  }
+  sanitize(value) {
+    if (this.config.sanitizationMode === 'strict') {
+      let sanitized = value;
+      for (const pattern of DANGEROUS_HTML_PATTERNS) {
+        pattern.lastIndex = 0;
+        sanitized = sanitized.replace(pattern, '');
+      }
+      return sanitized.replace(HTML_TAG_PATTERN, '');
+    } else {
+      let sanitized = value;
+      for (const pattern of DANGEROUS_HTML_PATTERNS) {
+        pattern.lastIndex = 0;
+        sanitized = sanitized.replace(pattern, '');
+      }
+      return sanitized;
     }
+  }
+  validateKeyValue(key, value) {
+    this.validateKey(key);
+    return this.validateValue(value);
+  }
+  isDangerousKey(key) {
+    return this.dangerousKeys.has(key);
+  }
+  getConfig() {
+    return {
+      ...this.config
+    };
+  }
 }
-export const SecurityPresets = {
-    strict: () => new SecurityValidator({
-        preventPrototypePollution: true,
-        preventXSS: true,
-        preventFunctions: true,
-        sanitizationMode: 'strict',
-    }),
-    standard: () => new SecurityValidator({
-        preventPrototypePollution: true,
-        preventXSS: false,
-        preventFunctions: true,
-    }),
-    permissive: () => new SecurityValidator({
-        preventPrototypePollution: true,
-        preventXSS: false,
-        preventFunctions: false,
-    }),
-    disabled: () => new SecurityValidator({
-        preventPrototypePollution: false,
-        preventXSS: false,
-        preventFunctions: false,
-    }),
+const SecurityPresets = {
+  strict: () => new SecurityValidator({
+    preventPrototypePollution: true,
+    preventXSS: true,
+    preventFunctions: true,
+    sanitizationMode: 'strict'
+  }),
+  standard: () => new SecurityValidator({
+    preventPrototypePollution: true,
+    preventXSS: false,
+    preventFunctions: true
+  }),
+  permissive: () => new SecurityValidator({
+    preventPrototypePollution: true,
+    preventXSS: false,
+    preventFunctions: false
+  }),
+  disabled: () => new SecurityValidator({
+    preventPrototypePollution: false,
+    preventXSS: false,
+    preventFunctions: false
+  })
 };
+
+export { SecurityPresets, SecurityValidator };