@skillsmith/core 0.4.0 → 0.4.2

package/dist/src/validation/index.js

@@ -8,427 +8,15 @@
  * - SSRF prevention (SMI-721, SMI-729)
  * - Path traversal prevention (SMI-720)
  * - RegExp injection prevention (SMI-722)
- */
-import { resolve } from 'path';
-/**
- * Validation error thrown when input fails security checks
- */
-export class ValidationError extends Error {
-    code;
-    details;
-    constructor(message, code, details) {
-        super(message);
-        this.code = code;
-        this.details = details;
-        this.name = 'ValidationError';
-    }
-}
-/**
- * Validate URL to prevent SSRF attacks (SMI-721, SMI-729)
- *
- * Blocks:
- * - Non-http(s) protocols
- * - Private IPv4 ranges (10.x, 172.16-31.x, 192.168.x)
- * - Private IPv6 ranges (fe80::/10, fc00::/7, ff00::/8, ::ffff:0:0/96)
- * - Localhost variants (127.x, localhost, ::1, 0.0.0.0)
- * - Link-local addresses (169.254.x, fe80::/10)
- * - Current network (0.x)
- *
- * @param url - URL to validate
- * @throws {ValidationError} if URL is not allowed
- *
- * @example
- * ```typescript
- * validateUrl('https://example.com/api')  // OK
- * validateUrl('http://localhost:3000')    // Throws ValidationError
- * validateUrl('ftp://example.com')        // Throws ValidationError
- * validateUrl('http://192.168.1.1')       // Throws ValidationError
- * validateUrl('http://[fe80::1]')         // Throws ValidationError (IPv6 link-local)
- * ```
- */
-export function validateUrl(url) {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch (error) {
-        throw new ValidationError(`Invalid URL format: ${url}`, 'INVALID_URL_FORMAT', error);
-    }
-    // Only allow http/https protocols
-    if (!['http:', 'https:'].includes(parsed.protocol)) {
-        throw new ValidationError(`Invalid protocol: ${parsed.protocol}. Only http and https are allowed.`, 'INVALID_PROTOCOL', { protocol: parsed.protocol, url });
-    }
-    let hostname = parsed.hostname.toLowerCase();
-    // Strip brackets from IPv6 addresses for easier comparison
-    // Node.js URL keeps brackets in hostname for IPv6 (e.g., "[::1]")
-    if (hostname.startsWith('[') && hostname.endsWith(']')) {
-        hostname = hostname.slice(1, -1);
-    }
-    // Block localhost variants
-    if (hostname === 'localhost' || hostname === '::1' || hostname === '0.0.0.0') {
-        throw new ValidationError(`Access to localhost is blocked: ${hostname}`, 'LOCALHOST_BLOCKED', {
-            hostname,
-            url,
-        });
-    }
-    // Check for IPv4 addresses
-    const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-    if (ipv4Match) {
-        const [, a, b, c, d] = ipv4Match.map(Number);
-        // Validate IPv4 octets are in valid range
-        if (a > 255 || b > 255 || c > 255 || d > 255) {
-            throw new ValidationError(`Invalid IPv4 address: ${hostname}`, 'INVALID_IPV4', {
-                hostname,
-                url,
-            });
-        }
-        // Block private/internal IP ranges
-        if (a === 10 || // 10.0.0.0/8 - Private network
-            (a === 172 && b >= 16 && b <= 31) || // 172.16.0.0/12 - Private network
-            (a === 192 && b === 168) || // 192.168.0.0/16 - Private network
-            a === 127 || // 127.0.0.0/8 - Loopback
-            (a === 169 && b === 254) || // 169.254.0.0/16 - Link-local
-            a === 0 // 0.0.0.0/8 - Current network
-        ) {
-            throw new ValidationError(`Access to private/internal network blocked: ${hostname}`, 'PRIVATE_NETWORK_BLOCKED', { hostname, url, ipRange: getIpRangeName(a, b) });
-        }
-    }
-    // Check for IPv6 addresses (SMI-729)
-    // IPv6 addresses in URLs are enclosed in square brackets, but hostname strips them
-    if (hostname.includes(':')) {
-        validateIPv6(hostname, url);
-    }
-}
-/**
- * Validate IPv6 address to prevent SSRF attacks (SMI-729)
- *
- * Blocks:
- * - Link-local: fe80::/10
- * - Unique local addresses (ULA): fc00::/7
- * - Multicast: ff00::/8
- * - IPv4-mapped IPv6: ::ffff:0:0/96
- * - Loopback ::1 (already blocked above)
- *
- * @param hostname - IPv6 hostname to validate
- * @param url - Full URL for error context
- * @throws {ValidationError} if IPv6 address is not allowed
- */
-function validateIPv6(hostname, url) {
-    // Normalize IPv6 address
-    const normalized = hostname.toLowerCase();
-    // Block IPv6 loopback (::1 and its full form)
-    // This is defense-in-depth since line 76 should also catch ::1
-    if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
-        throw new ValidationError(`Access to localhost is blocked: ${hostname}`, 'LOCALHOST_BLOCKED', {
-            hostname,
-            url,
-        });
-    }
-    // Block link-local addresses (fe80::/10)
-    // fe80 to febf range
-    if (normalized.startsWith('fe8') ||
-        normalized.startsWith('fe9') ||
-        normalized.startsWith('fea') ||
-        normalized.startsWith('feb')) {
-        throw new ValidationError(`Access to IPv6 link-local address blocked: ${hostname}`, 'IPV6_LINK_LOCAL_BLOCKED', { hostname, url });
-    }
-    // Block unique local addresses (fc00::/7)
-    // fc00 to fdff range
-    if (normalized.startsWith('fc') || normalized.startsWith('fd')) {
-        throw new ValidationError(`Access to IPv6 unique local address blocked: ${hostname}`, 'IPV6_ULA_BLOCKED', { hostname, url });
-    }
-    // Block multicast addresses (ff00::/8)
-    if (normalized.startsWith('ff')) {
-        throw new ValidationError(`Access to IPv6 multicast address blocked: ${hostname}`, 'IPV6_MULTICAST_BLOCKED', { hostname, url });
-    }
-    // Block IPv4-mapped IPv6 addresses (::ffff:0:0/96)
-    // These map IPv4 addresses into IPv6 space
-    if (normalized.includes('::ffff:')) {
-        // Extract the IPv4 part and validate it
-        const ipv4Part = normalized.split('::ffff:')[1];
-        if (ipv4Part) {
-            // Check if it's in dotted decimal notation
-            const ipv4Match = ipv4Part.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/);
-            if (ipv4Match) {
-                const [, a, b] = ipv4Match.map(Number);
-                // Apply same private IP checks as IPv4
-                if (a === 10 ||
-                    (a === 172 && b >= 16 && b <= 31) ||
-                    (a === 192 && b === 168) ||
-                    a === 127 ||
-                    (a === 169 && b === 254) ||
-                    a === 0) {
-                    throw new ValidationError(`Access to IPv4-mapped IPv6 private address blocked: ${hostname}`, 'IPV4_MAPPED_IPV6_BLOCKED', { hostname, url, ipRange: getIpRangeName(a, b) });
-                }
-            }
-            else {
-                // IPv4 in hex notation (e.g., ::ffff:7f00:1 for 127.0.0.1)
-                // Parse hex format: high:low where high = (a<<8)|b, low = (c<<8)|d
-                const hexMatch = ipv4Part.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-                if (hexMatch) {
-                    const high = parseInt(hexMatch[1], 16);
-                    const low = parseInt(hexMatch[2], 16);
-                    const a = (high >> 8) & 0xff;
-                    const b = high & 0xff;
-                    // Apply same private IP checks as IPv4
-                    if (a === 10 ||
-                        (a === 172 && b >= 16 && b <= 31) ||
-                        (a === 192 && b === 168) ||
-                        a === 127 ||
-                        (a === 169 && b === 254) ||
-                        a === 0) {
-                        throw new ValidationError(`Access to IPv4-mapped IPv6 private address blocked: ${hostname}`, 'IPV4_MAPPED_IPV6_BLOCKED', { hostname, url, ipRange: getIpRangeName(a, b) });
-                    }
-                }
-                // If we can't parse it, block it to be safe
-                throw new ValidationError(`Access to IPv4-mapped IPv6 address blocked: ${hostname}`, 'IPV4_MAPPED_IPV6_BLOCKED', { hostname, url });
-            }
-        }
-    }
-    // Block 6to4 addresses with embedded private IPv4 (2002::/16) - SMI-1004
-    // 6to4 embeds IPv4 in bits 16-48: 2002:AABB:CCDD::/48 where IPv4 is AA.BB.CC.DD
-    if (normalized.startsWith('2002:')) {
-        // Extract the two hex segments after 2002:
-        const segments = normalized.split(':');
-        if (segments.length >= 3 && segments[1] && segments[2]) {
-            // Parse hex segments: 2002:AABB:CCDD -> IPv4 is 0xAA.0xBB.0xCC.0xDD
-            const highHex = segments[1].padStart(4, '0');
-            const lowHex = segments[2].padStart(4, '0');
-            const a = parseInt(highHex.slice(0, 2), 16);
-            const b = parseInt(highHex.slice(2, 4), 16);
-            const c = parseInt(lowHex.slice(0, 2), 16);
-            const d = parseInt(lowHex.slice(2, 4), 16);
-            // Check if embedded IPv4 is private
-            if (a === 10 ||
-                (a === 172 && b >= 16 && b <= 31) ||
-                (a === 192 && b === 168) ||
-                a === 127 ||
-                (a === 169 && b === 254) ||
-                a === 0) {
-                throw new ValidationError(`Access to 6to4 address with embedded private IPv4 blocked: ${hostname}`, 'IPV6_6TO4_PRIVATE', { hostname, url, embeddedIPv4: `${a}.${b}.${c}.${d}`, ipRange: getIpRangeName(a, b) });
-            }
-        }
-    }
-    // Block IPv4-compatible addresses (::IPv4) without ffff prefix - SMI-1005
-    // Pattern: ::x.x.x.x (deprecated but still valid)
-    // Note: URL parser normalizes ::192.168.1.1 to ::c0a8:101 (hex format)
-    // So we need to match both dotted-decimal and the normalized hex format
-    const ipv4CompatibleMatch = normalized.match(/^::(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-    if (ipv4CompatibleMatch) {
-        const [, aStr, bStr, cStr, dStr] = ipv4CompatibleMatch;
-        const a = parseInt(aStr, 10);
-        const b = parseInt(bStr, 10);
-        const c = parseInt(cStr, 10);
-        const d = parseInt(dStr, 10);
-        // Validate octets
-        if (a <= 255 && b <= 255 && c <= 255 && d <= 255) {
-            // Check if embedded IPv4 is private
-            if (a === 10 ||
-                (a === 172 && b >= 16 && b <= 31) ||
-                (a === 192 && b === 168) ||
-                a === 127 ||
-                (a === 169 && b === 254) ||
-                a === 0) {
-                throw new ValidationError(`Access to IPv4-compatible IPv6 address with private IPv4 blocked: ${hostname}`, 'IPV6_COMPATIBLE_PRIVATE', { hostname, url, embeddedIPv4: `${a}.${b}.${c}.${d}`, ipRange: getIpRangeName(a, b) });
-            }
-        }
-    }
-    // Also check for normalized hex format: ::XXXX:XXXX (without ffff: prefix)
-    // URL parser normalizes ::192.168.1.1 to ::c0a8:101
-    const ipv4CompatibleHexMatch = normalized.match(/^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
-    if (ipv4CompatibleHexMatch) {
-        const high = parseInt(ipv4CompatibleHexMatch[1], 16);
-        const low = parseInt(ipv4CompatibleHexMatch[2], 16);
-        const a = (high >> 8) & 0xff;
-        const b = high & 0xff;
-        const c = (low >> 8) & 0xff;
-        const d = low & 0xff;
-        // Check if embedded IPv4 is private
-        if (a === 10 ||
-            (a === 172 && b >= 16 && b <= 31) ||
-            (a === 192 && b === 168) ||
-            a === 127 ||
-            (a === 169 && b === 254) ||
-            a === 0) {
-            throw new ValidationError(`Access to IPv4-compatible IPv6 address with private IPv4 blocked: ${hostname}`, 'IPV6_COMPATIBLE_PRIVATE', { hostname, url, embeddedIPv4: `${a}.${b}.${c}.${d}`, ipRange: getIpRangeName(a, b) });
-        }
-    }
-    // Block Teredo addresses (2001:0::/32) - SMI-1006
-    // Teredo tunneling can bypass firewall rules
-    if (normalized.startsWith('2001:0000:') || normalized.startsWith('2001:0:')) {
-        throw new ValidationError(`Access to Teredo tunnel address blocked: ${hostname}`, 'IPV6_TEREDO_BLOCKED', { hostname, url });
-    }
-}
-/**
- * Get human-readable IP range name for error messages
- */
-function getIpRangeName(a, b) {
-    if (a === 10)
-        return '10.0.0.0/8 (Private)';
-    if (a === 172 && b >= 16 && b <= 31)
-        return '172.16.0.0/12 (Private)';
-    if (a === 192 && b === 168)
-        return '192.168.0.0/16 (Private)';
-    if (a === 127)
-        return '127.0.0.0/8 (Loopback)';
-    if (a === 169 && b === 254)
-        return '169.254.0.0/16 (Link-local)';
-    if (a === 0)
-        return '0.0.0.0/8 (Current network)';
-    return 'Unknown';
-}
-/**
- * Validate file path to prevent path traversal attacks (SMI-720)
- *
- * Ensures the resolved path remains within the allowed root directory.
- *
- * @param path - Path to validate (can be relative or absolute)
- * @param rootDir - Root directory that must contain the path
- * @throws {ValidationError} if path escapes root directory
- *
- * @example
- * ```typescript
- * validatePath('skills/my-skill', '/home/user/.claude')  // OK
- * validatePath('../etc/passwd', '/home/user/.claude')    // Throws ValidationError
- * validatePath('/etc/passwd', '/home/user/.claude')      // Throws ValidationError
- * ```
- */
-export function validatePath(path, rootDir) {
-    if (!path) {
-        throw new ValidationError('Path cannot be empty', 'EMPTY_PATH');
-    }
-    if (!rootDir) {
-        throw new ValidationError('Root directory cannot be empty', 'EMPTY_ROOT_DIR');
-    }
-    // Normalize both paths to resolve '..' and '.'
-    // Resolve path relative to rootDir so relative paths work correctly
-    const normalizedPath = resolve(rootDir, path);
-    const normalizedRoot = resolve(rootDir);
-    // Check that normalized path is within root directory
-    // Handle edge case where path equals root exactly
-    const isWithinRoot = normalizedPath.startsWith(normalizedRoot + '/') || normalizedPath === normalizedRoot;
-    if (!isWithinRoot) {
-        throw new ValidationError(`Path traversal detected: ${path}`, 'PATH_TRAVERSAL', {
-            originalPath: path,
-            normalizedPath,
-            rootDir,
-            normalizedRoot,
-        });
-    }
-}
-/**
- * Sanitize input string for safe use in various contexts
- *
- * Removes or escapes potentially dangerous characters.
- *
- * @param input - Input string to sanitize
- * @param options - Sanitization options
- * @returns Sanitized string
- *
- * @example
- * ```typescript
- * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
- * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
- * ```
- */
-export function sanitizeInput(input, options = {}) {
-    const { removePathTraversal = true, escapeHtml = true, removeNullBytes = true } = options;
-    let sanitized = input;
-    // Remove null bytes (security risk)
-    if (removeNullBytes) {
-        sanitized = sanitized.replace(/\0/g, '');
-    }
-    // Remove path traversal sequences
-    if (removePathTraversal) {
-        // Remove '../' and '..\' patterns
-        sanitized = sanitized.replace(/\.\.[\\/]/g, '');
-        // Remove leading '../' or '..\'
-        sanitized = sanitized.replace(/^\.\.[\\/]+/, '');
-    }
-    // HTML escape
-    if (escapeHtml) {
-        sanitized = sanitized
-            .replace(/&/g, '&amp;')
-            .replace(/</g, '&lt;')
-            .replace(/>/g, '&gt;')
-            .replace(/"/g, '&quot;')
-            .replace(/'/g, '&#x27;');
-    }
-    return sanitized;
-}
-/**
- * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
- *
- * Tries exact match, prefix match, and regex match (with error handling).
- * Falls back to includes check if regex is invalid.
- *
- * @param value - Value to test
- * @param pattern - Pattern to match (string or regex)
- * @returns True if value matches pattern
- *
- * @example
- * ```typescript
- * safePatternMatch('node_modules', 'node_modules')  // true (exact)
- * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
- * safePatternMatch('test.js', '\\.js$')             // true (regex)
- * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
- * ```
- */
-export function safePatternMatch(value, pattern) {
-    // Exact match
-    if (value === pattern) {
-        return true;
-    }
-    // Check if pattern looks like a regex (contains special chars)
-    // If it's a simple alphanumeric pattern, only do prefix matching
-    const isLikelyRegex = /[\\^$.*+?()[\]{}|]/.test(pattern);
-    if (!isLikelyRegex) {
-        // Simple pattern - only match as prefix
-        return value.startsWith(pattern);
-    }
-    // Try regex match with error handling for patterns that look like regex
-    try {
-        const regex = new RegExp(pattern);
-        return regex.test(value);
-    }
-    catch {
-        // Invalid regex - fall back to safe includes check
-        return value.includes(pattern);
-    }
-}
-/**
- * Validate that patterns array is safe to use
- *
- * Checks for potentially dangerous regex patterns that could cause ReDoS.
- *
- * @param patterns - Array of patterns to validate
- * @returns Array of validation warnings (empty if all patterns are safe)
  *
- * @example
- * ```typescript
- * validatePatterns(['node_modules', '\\.js$'])  // []
- * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
- * ```
+ * @module validation
  */
-export function validatePatterns(patterns) {
-    const warnings = [];
-    for (const pattern of patterns) {
-        // Check for potentially dangerous nested quantifiers (ReDoS)
-        if (/(\(.*\+.*\))\+/.test(pattern) || /(\(.*\*.*\))\*/.test(pattern)) {
-            warnings.push(`Pattern may cause ReDoS (nested quantifiers): ${pattern}`);
-        }
-        // Check for extremely long patterns
-        if (pattern.length > 1000) {
-            warnings.push(`Pattern is suspiciously long (${pattern.length} chars): ${pattern.slice(0, 50)}...`);
-        }
-        // Try to compile as regex to check validity
-        try {
-            new RegExp(pattern);
-        }
-        catch (error) {
-            warnings.push(`Invalid regex pattern: ${pattern}`);
-        }
-    }
-    return warnings;
-}
+// Validation Error
+export { ValidationError } from './validation-error.js';
+// URL Validators (SSRF prevention)
+export { validateUrl, validateIPv6, getIpRangeName } from './url-validators.js';
+// Path Validators (Path traversal prevention)
+export { validatePath } from './path-validators.js';
+// Input Validators (General sanitization)
+export { sanitizeInput, safePatternMatch, validatePatterns } from './input-validators.js';
 //# sourceMappingURL=index.js.map

package/dist/src/validation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB;IACA;IAHlB,YACE,OAAe,EACC,IAAY,EACZ,OAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAU;QAGjC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,uBAAuB,GAAG,EAAE,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAA;IACtF,CAAC;IAED,kCAAkC;IAClC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,CAAC,QAAQ,oCAAoC,EACxE,kBAAkB,EAClB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CACnC,CAAA;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAE5C,2DAA2D;IAC3D,kEAAkE;IAClE,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC;IAED,2BAA2B;IAC3B,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7E,MAAM,IAAI,eAAe,CAAC,mCAAmC,QAAQ,EAAE,EAAE,mBAAmB,EAAE;YAC5F,QAAQ;YACR,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IAED,2BAA2B;IAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAChF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAE5C,0CAA0C;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,eAAe,CAAC,yBAAyB,QAAQ,EAAE,EAAE,cAAc,EAAE;gBAC7E,QAAQ;gBACR,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QAED,mCAAmC;QACnC,IACE,CAAC,KAAK,EAAE,IAAI,+BAA+B;YAC3C,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,kCAAkC;YACvE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,mCAAmC;YAC/D,CAAC,KAAK,GAAG,IAAI,yBAAyB;YACtC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,8BAA8B;YAC1D,CAAC,KAAK,CAAC,CAAC,8BAA8B;UACtC,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,+CAA+C,QAAQ,EAAE,EACzD,yBAAyB,EACzB,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACjD,CAAA;QACH,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,mFAAmF;IACnF,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,QAAgB,EAAE,GAAW;IACjD,yBAAyB;IACzB,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAEzC,8CAA8C;IAC9C,+DAA+D;IAC/D,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;QAC7D,MAAM,IAAI,eAAe,CAAC,mCAAmC,QAAQ,EAAE,EAAE,mBAAmB,EAAE;YAC5F,QAAQ;YACR,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IAED,yCAAyC;IACzC,qBAAqB;IACrB,IACE,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,8CAA8C,QAAQ,EAAE,EACxD,yBAAyB,EACzB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;IACH,CAAC;IAED,0CAA0C;IAC1C,qBAAqB;IACrB,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,eAAe,CACvB,gDAAgD,QAAQ,EAAE,EAC1D,kBAAkB,EAClB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,eAAe,CACvB,6CAA6C,QAAQ,EAAE,EACvD,wBAAwB,EACxB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;IACH,CAAC;IAED,mDAAmD;IACnD,2CAA2C;IAC3C,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,wCAAwC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,2CAA2C;YAC3C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC/E,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACtC,uCAAuC;gBACvC,IACE,CAAC,KAAK,EAAE;oBACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;oBACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;oBACxB,CAAC,KAAK,GAAG;oBACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;oBACxB,CAAC,KAAK,CAAC,EACP,CAAC;oBACD,MAAM,IAAI,eAAe,CACvB,uDAAuD,QAAQ,EAAE,EACjE,0BAA0B,EAC1B,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACjD,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;gBACrE,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;oBACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;oBACtC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;oBAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;oBACrB,uCAAuC;oBACvC,IACE,CAAC,KAAK,EAAE;wBACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;wBACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;wBACxB,CAAC,KAAK,GAAG;wBACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;wBACxB,CAAC,KAAK,CAAC,EACP,CAAC;wBACD,MAAM,IAAI,eAAe,CACvB,uDAAuD,QAAQ,EAAE,EACjE,0BAA0B,EAC1B,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACjD,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,4CAA4C;gBAC5C,MAAM,IAAI,eAAe,CACvB,+CAA+C,QAAQ,EAAE,EACzD,0BAA0B,EAC1B,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,gFAAgF;IAChF,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,oEAAoE;YACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAC1C,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAE1C,oCAAoC;YACpC,IACE,CAAC,KAAK,EAAE;gBACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxB,CAAC,KAAK,GAAG;gBACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxB,CAAC,KAAK,CAAC,EACP,CAAC;gBACD,MAAM,IAAI,eAAe,CACvB,8DAA8D,QAAQ,EAAE,EACxE,mBAAmB,EACnB,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACtF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,kDAAkD;IAClD,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAA;IAC9F,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,mBAAmB,CAAA;QACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAK,EAAE,EAAE,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAK,EAAE,EAAE,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAK,EAAE,EAAE,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAK,EAAE,EAAE,CAAC,CAAA;QAE7B,kBAAkB;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;YACjD,oCAAoC;YACpC,IACE,CAAC,KAAK,EAAE;gBACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxB,CAAC,KAAK,GAAG;gBACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;gBACxB,CAAC,KAAK,CAAC,EACP,CAAC;gBACD,MAAM,IAAI,eAAe,CACvB,qEAAqE,QAAQ,EAAE,EAC/E,yBAAyB,EACzB,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACtF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,sBAAsB,GAAG,UAAU,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACtF,IAAI,sBAAsB,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAA;QAC3B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAA;QAEpB,oCAAoC;QACpC,IACE,CAAC,KAAK,EAAE;YACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;YACxB,CAAC,KAAK,GAAG;YACT,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;YACxB,CAAC,KAAK,CAAC,EACP,CAAC;YACD,MAAM,IAAI,eAAe,CACvB,qEAAqE,QAAQ,EAAE,EAC/E,yBAAyB,EACzB,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CACtF,CAAA;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,6CAA6C;IAC7C,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,eAAe,CACvB,4CAA4C,QAAQ,EAAE,EACtD,qBAAqB,EACrB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,sBAAsB,CAAA;IAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,yBAAyB,CAAA;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,0BAA0B,CAAA;IAC7D,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,wBAAwB,CAAA;IAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,6BAA6B,CAAA;IAChE,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,6BAA6B,CAAA;IACjD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,eAAe,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,gBAAgB,CAAC,CAAA;IAC/E,CAAC;IAED,+CAA+C;IAC/C,oEAAoE;IACpE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvC,sDAAsD;IACtD,kDAAkD;IAClD,MAAM,YAAY,GAChB,cAAc,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,IAAI,cAAc,KAAK,cAAc,CAAA;IAEtF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,4BAA4B,IAAI,EAAE,EAAE,gBAAgB,EAAE;YAC9E,YAAY,EAAE,IAAI;YAClB,cAAc;YACd,OAAO;YACP,cAAc;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAOI,EAAE;IAEN,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAEzF,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,oCAAoC;IACpC,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,kCAAkC;IAClC,IAAI,mBAAmB,EAAE,CAAC;QACxB,kCAAkC;QAClC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;QAC/C,gCAAgC;QAChC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,cAAc;IACd,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,GAAG,SAAS;aAClB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAe;IAC7D,cAAc;IACd,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAExD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,wCAAwC;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACjC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6DAA6D;QAC7D,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAA;QAC3E,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,iCAAiC,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACrF,CAAA;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,mCAAmC;AACnC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAE/E,8CAA8C;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,0CAA0C;AAC1C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/src/validation/input-validators.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Input Validation Utilities
+ *
+ * General input sanitization and pattern matching.
+ *
+ * Security Features:
+ * - RegExp injection prevention (SMI-722)
+ * - Input sanitization
+ * - Pattern validation
+ */
+/**
+ * Sanitize input string for safe use in various contexts
+ *
+ * Removes or escapes potentially dangerous characters.
+ *
+ * @param input - Input string to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized string
+ *
+ * @example
+ * ```typescript
+ * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
+ * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
+ * ```
+ */
+export declare function sanitizeInput(input: string, options?: {
+    /** Remove path traversal sequences like '../' (default: true) */
+    removePathTraversal?: boolean;
+    /** HTML-escape special characters (default: true) */
+    escapeHtml?: boolean;
+    /** Remove null bytes (default: true) */
+    removeNullBytes?: boolean;
+}): string;
+/**
+ * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
+ *
+ * Tries exact match, prefix match, and regex match (with error handling).
+ * Falls back to includes check if regex is invalid.
+ *
+ * @param value - Value to test
+ * @param pattern - Pattern to match (string or regex)
+ * @returns True if value matches pattern
+ *
+ * @example
+ * ```typescript
+ * safePatternMatch('node_modules', 'node_modules')  // true (exact)
+ * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
+ * safePatternMatch('test.js', '\\.js$')             // true (regex)
+ * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
+ * ```
+ */
+export declare function safePatternMatch(value: string, pattern: string): boolean;
+/**
+ * Validate that patterns array is safe to use
+ *
+ * Checks for potentially dangerous regex patterns that could cause ReDoS.
+ *
+ * @param patterns - Array of patterns to validate
+ * @returns Array of validation warnings (empty if all patterns are safe)
+ *
+ * @example
+ * ```typescript
+ * validatePatterns(['node_modules', '\\.js$'])  // []
+ * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
+ * ```
+ */
+export declare function validatePatterns(patterns: string[]): string[];
+//# sourceMappingURL=input-validators.d.ts.map

package/dist/src/validation/input-validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validators.d.ts","sourceRoot":"","sources":["../../../src/validation/input-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IACP,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,qDAAqD;IACrD,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,OAAO,CAAA;CACrB,GACL,MAAM,CA6BR;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAuBxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAyB7D"}

package/dist/src/validation/input-validators.js

@@ -0,0 +1,126 @@
+/**
+ * Input Validation Utilities
+ *
+ * General input sanitization and pattern matching.
+ *
+ * Security Features:
+ * - RegExp injection prevention (SMI-722)
+ * - Input sanitization
+ * - Pattern validation
+ */
+/**
+ * Sanitize input string for safe use in various contexts
+ *
+ * Removes or escapes potentially dangerous characters.
+ *
+ * @param input - Input string to sanitize
+ * @param options - Sanitization options
+ * @returns Sanitized string
+ *
+ * @example
+ * ```typescript
+ * sanitizeInput('<script>alert(1)</script>')  // Returns: '&lt;script&gt;alert(1)&lt;/script&gt;'
+ * sanitizeInput('../../etc/passwd')           // Returns: 'etc/passwd'
+ * ```
+ */
+export function sanitizeInput(input, options = {}) {
+    const { removePathTraversal = true, escapeHtml = true, removeNullBytes = true } = options;
+    let sanitized = input;
+    // Remove null bytes (security risk)
+    if (removeNullBytes) {
+        sanitized = sanitized.replace(/\0/g, '');
+    }
+    // Remove path traversal sequences
+    if (removePathTraversal) {
+        // Remove '../' and '..\' patterns
+        sanitized = sanitized.replace(/\.\.[\\/]/g, '');
+        // Remove leading '../' or '..\'
+        sanitized = sanitized.replace(/^\.\.[\\/]+/, '');
+    }
+    // HTML escape
+    if (escapeHtml) {
+        sanitized = sanitized
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#x27;');
+    }
+    return sanitized;
+}
+/**
+ * Safely test a string against a pattern, preventing RegExp injection (SMI-722)
+ *
+ * Tries exact match, prefix match, and regex match (with error handling).
+ * Falls back to includes check if regex is invalid.
+ *
+ * @param value - Value to test
+ * @param pattern - Pattern to match (string or regex)
+ * @returns True if value matches pattern
+ *
+ * @example
+ * ```typescript
+ * safePatternMatch('node_modules', 'node_modules')  // true (exact)
+ * safePatternMatch('node_modules/pkg', 'node_')     // true (prefix)
+ * safePatternMatch('test.js', '\\.js$')             // true (regex)
+ * safePatternMatch('test.js', '(evil')              // false (invalid regex, falls back)
+ * ```
+ */
+export function safePatternMatch(value, pattern) {
+    // Exact match
+    if (value === pattern) {
+        return true;
+    }
+    // Check if pattern looks like a regex (contains special chars)
+    // If it's a simple alphanumeric pattern, only do prefix matching
+    const isLikelyRegex = /[\\^$.*+?()[\]{}|]/.test(pattern);
+    if (!isLikelyRegex) {
+        // Simple pattern - only match as prefix
+        return value.startsWith(pattern);
+    }
+    // Try regex match with error handling for patterns that look like regex
+    try {
+        const regex = new RegExp(pattern);
+        return regex.test(value);
+    }
+    catch {
+        // Invalid regex - fall back to safe includes check
+        return value.includes(pattern);
+    }
+}
+/**
+ * Validate that patterns array is safe to use
+ *
+ * Checks for potentially dangerous regex patterns that could cause ReDoS.
+ *
+ * @param patterns - Array of patterns to validate
+ * @returns Array of validation warnings (empty if all patterns are safe)
+ *
+ * @example
+ * ```typescript
+ * validatePatterns(['node_modules', '\\.js$'])  // []
+ * validatePatterns(['(a+)+b'])                  // ['Pattern may cause ReDoS: (a+)+b']
+ * ```
+ */
+export function validatePatterns(patterns) {
+    const warnings = [];
+    for (const pattern of patterns) {
+        // Check for potentially dangerous nested quantifiers (ReDoS)
+        if (/(\(.*\+.*\))\+/.test(pattern) || /(\(.*\*.*\))\*/.test(pattern)) {
+            warnings.push(`Pattern may cause ReDoS (nested quantifiers): ${pattern}`);
+        }
+        // Check for extremely long patterns
+        if (pattern.length > 1000) {
+            warnings.push(`Pattern is suspiciously long (${pattern.length} chars): ${pattern.slice(0, 50)}...`);
+        }
+        // Try to compile as regex to check validity
+        try {
+            new RegExp(pattern);
+        }
+        catch {
+            warnings.push(`Invalid regex pattern: ${pattern}`);
+        }
+    }
+    return warnings;
+}
+//# sourceMappingURL=input-validators.js.map

package/dist/src/validation/input-validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-validators.js","sourceRoot":"","sources":["../../../src/validation/input-validators.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAa,EACb,UAOI,EAAE;IAEN,MAAM,EAAE,mBAAmB,GAAG,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAEzF,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,oCAAoC;IACpC,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,kCAAkC;IAClC,IAAI,mBAAmB,EAAE,CAAC;QACxB,kCAAkC;QAClC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;QAC/C,gCAAgC;QAChC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,cAAc;IACd,IAAI,UAAU,EAAE,CAAC;QACf,SAAS,GAAG,SAAS;aAClB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAe;IAC7D,cAAc;IACd,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAExD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,wCAAwC;QACxC,OAAO,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAED,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACjC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,6DAA6D;QAC7D,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,OAAO,EAAE,CAAC,CAAA;QAC3E,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,iCAAiC,OAAO,CAAC,MAAM,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACrF,CAAA;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}