@stacksjs/bun-router 0.0.14 → 0.0.15

package/src/middleware/ddos_protection.ts

@@ -0,0 +1,255 @@
+import type { EnhancedRequest, NextFunction } from '../types'
+import { config } from '../config'
+
+export interface DDoSProtectionOptions {
+  enabled?: boolean
+  maxRequestsPerSecond?: number
+  maxRequestsPerMinute?: number
+  maxRequestsPerHour?: number
+  burstLimit?: number
+  windowSize?: number
+  blockDuration?: number
+  whitelistedIPs?: string[]
+  blacklistedIPs?: string[]
+  trustProxy?: boolean
+  skipSuccessfulRequests?: boolean
+  skipFailedRequests?: boolean
+  keyGenerator?: (req: EnhancedRequest) => string
+  onLimitReached?: (req: EnhancedRequest, rateLimitInfo: any) => Response | Promise<Response>
+  store?: 'memory' | 'redis'
+  redis?: {
+    url: string
+    prefix?: string
+  }
+}
+
+interface RequestInfo {
+  count: number
+  firstRequest: number
+  lastRequest: number
+  blocked: boolean
+  blockExpires?: number
+}
+
+export default class DDoSProtection {
+  private options: DDoSProtectionOptions
+  private requestStore: Map<string, RequestInfo> = new Map()
+  private cleanupInterval: ReturnType<typeof setInterval> | null = null
+
+  constructor(options: DDoSProtectionOptions = {}) {
+    const ddosConfig = config.server?.security?.ddos || {}
+
+    this.options = {
+      enabled: options.enabled ?? ddosConfig.enabled ?? true,
+      maxRequestsPerSecond: options.maxRequestsPerSecond ?? ddosConfig.maxRequestsPerSecond ?? 10,
+      maxRequestsPerMinute: options.maxRequestsPerMinute ?? ddosConfig.maxRequestsPerMinute ?? 100,
+      maxRequestsPerHour: options.maxRequestsPerHour ?? ddosConfig.maxRequestsPerHour ?? 1000,
+      burstLimit: options.burstLimit ?? ddosConfig.burstLimit ?? 20,
+      windowSize: options.windowSize ?? ddosConfig.windowSize ?? 60000, // 1 minute
+      blockDuration: options.blockDuration ?? ddosConfig.blockDuration ?? 300000, // 5 minutes
+      whitelistedIPs: options.whitelistedIPs ?? ddosConfig.whitelistedIPs ?? [],
+      blacklistedIPs: options.blacklistedIPs ?? ddosConfig.blacklistedIPs ?? [],
+      trustProxy: options.trustProxy ?? ddosConfig.trustProxy ?? true,
+      skipSuccessfulRequests: options.skipSuccessfulRequests ?? ddosConfig.skipSuccessfulRequests ?? false,
+      skipFailedRequests: options.skipFailedRequests ?? ddosConfig.skipFailedRequests ?? false,
+      keyGenerator: options.keyGenerator ?? this.defaultKeyGenerator.bind(this),
+      onLimitReached: options.onLimitReached,
+      store: options.store ?? ddosConfig.store ?? 'memory',
+      redis: options.redis ?? ddosConfig.redis,
+    }
+
+    // Start cleanup interval for memory store
+    if (this.options.store === 'memory') {
+      this.startCleanupInterval()
+    }
+  }
+
+  private defaultKeyGenerator(req: EnhancedRequest): string {
+    const forwarded = req.headers.get('x-forwarded-for')
+    const realIP = req.headers.get('x-real-ip')
+    const cfIP = req.headers.get('cf-connecting-ip')
+
+    if (this.options.trustProxy && forwarded) {
+      return forwarded.split(',')[0].trim()
+    }
+
+    return realIP || cfIP || 'unknown'
+  }
+
+  private startCleanupInterval(): void {
+    this.cleanupInterval = setInterval(() => {
+      const now = Date.now()
+      for (const [key, info] of this.requestStore.entries()) {
+        // Remove expired entries
+        if (now - info.lastRequest > this.options.windowSize! * 2) {
+          this.requestStore.delete(key)
+        }
+        // Remove expired blocks
+        if (info.blocked && info.blockExpires && now > info.blockExpires) {
+          info.blocked = false
+          info.blockExpires = undefined
+        }
+      }
+    }, this.options.windowSize! / 2) // Cleanup every half window
+  }
+
+  private isWhitelisted(ip: string): boolean {
+    return this.options.whitelistedIPs?.includes(ip) ?? false
+  }
+
+  private isBlacklisted(ip: string): boolean {
+    return this.options.blacklistedIPs?.includes(ip) ?? false
+  }
+
+  private getRateLimitInfo(key: string, now: number): RequestInfo {
+    let info = this.requestStore.get(key)
+
+    if (!info) {
+      info = {
+        count: 0,
+        firstRequest: now,
+        lastRequest: now,
+        blocked: false,
+      }
+      this.requestStore.set(key, info)
+    }
+
+    // Reset count if window has passed
+    if (now - info.firstRequest > this.options.windowSize!) {
+      info.count = 0
+      info.firstRequest = now
+    }
+
+    return info
+  }
+
+  private shouldBlock(info: RequestInfo, now: number): boolean {
+    // Check if already blocked and block hasn't expired
+    if (info.blocked && info.blockExpires && now < info.blockExpires) {
+      return true
+    }
+
+    // Check burst limit (requests per second)
+    const _secondWindow = 1000
+    const recentRequests = info.count // Simplified for this implementation
+    if (recentRequests > this.options.burstLimit!) {
+      return true
+    }
+
+    // Check requests per minute
+    if (info.count > this.options.maxRequestsPerMinute!) {
+      return true
+    }
+
+    return false
+  }
+
+  private blockIP(info: RequestInfo, now: number): void {
+    info.blocked = true
+    info.blockExpires = now + this.options.blockDuration!
+  }
+
+  private createBlockedResponse(req: EnhancedRequest, info: RequestInfo): Response {
+    const retryAfter = Math.ceil((info.blockExpires! - Date.now()) / 1000)
+
+    const headers = {
+      'Retry-After': retryAfter.toString(),
+      'X-RateLimit-Limit': this.options.maxRequestsPerMinute!.toString(),
+      'X-RateLimit-Remaining': '0',
+      'X-RateLimit-Reset': Math.ceil(info.blockExpires! / 1000).toString(),
+    }
+
+    if (this.options.onLimitReached) {
+      return this.options.onLimitReached(req, { ...info, retryAfter }) as Response
+    }
+
+    return new Response(JSON.stringify({
+      error: 'Too Many Requests',
+      message: 'Rate limit exceeded. Please try again later.',
+      retryAfter,
+    }), {
+      status: 429,
+      headers: {
+        'Content-Type': 'application/json',
+        ...headers,
+      },
+    })
+  }
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    // Skip if DDoS protection is disabled
+    if (!this.options.enabled) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    const now = Date.now()
+    const key = this.options.keyGenerator!(req)
+
+    // Check if IP is whitelisted
+    if (this.isWhitelisted(key)) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    // Check if IP is blacklisted
+    if (this.isBlacklisted(key)) {
+      return new Response('Access Denied', { status: 403 })
+    }
+
+    // Get rate limit info
+    const info = this.getRateLimitInfo(key, now)
+
+    // Check if should block
+    if (this.shouldBlock(info, now)) {
+      this.blockIP(info, now)
+      return this.createBlockedResponse(req, info)
+    }
+
+    // Increment request count
+    info.count++
+    info.lastRequest = now
+
+    // Process request
+    const response = await next()
+
+    if (!response) {
+      return new Response('Not Found', { status: 404 })
+    }
+
+    // Skip counting based on response status if configured
+    if (this.options.skipSuccessfulRequests && response.status < 400) {
+      info.count--
+    }
+    if (this.options.skipFailedRequests && response.status >= 400) {
+      info.count--
+    }
+
+    // Add rate limit headers
+    const headers = new Headers(response.headers)
+    headers.set('X-RateLimit-Limit', this.options.maxRequestsPerMinute!.toString())
+    headers.set('X-RateLimit-Remaining', Math.max(0, this.options.maxRequestsPerMinute! - info.count).toString())
+    headers.set('X-RateLimit-Reset', Math.ceil((info.firstRequest + this.options.windowSize!) / 1000).toString())
+
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    })
+  }
+
+  // Cleanup method
+  destroy(): void {
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval)
+      this.cleanupInterval = null
+    }
+    this.requestStore.clear()
+  }
+}
+
+// Factory function for easy use
+export function ddosProtection(options: DDoSProtectionOptions = {}): (req: EnhancedRequest, next: NextFunction) => Promise<Response> {
+  const instance = new DDoSProtection(options)
+  return async (req: EnhancedRequest, next: NextFunction) => instance.handle(req, next)
+}

package/src/middleware/file_security.ts

@@ -0,0 +1,191 @@
+import type { UploadedFile } from './file_upload'
+
+export interface FileSecurityConfig {
+  scanForMalware?: boolean
+  checkMagicNumbers?: boolean
+  sanitizeFilenames?: boolean
+  preventExecutableUploads?: boolean
+  maxFilenameLength?: number
+}
+
+export default class FileSecurity {
+  private config: Required<FileSecurityConfig>
+
+  // Common file signatures (magic numbers)
+  private readonly FILE_SIGNATURES: Record<string, Uint8Array[]> = {
+    'image/jpeg': [
+      new Uint8Array([0xFF, 0xD8, 0xFF]),
+    ],
+    'image/png': [
+      new Uint8Array([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
+    ],
+    'image/gif': [
+      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x37, 0x61]),
+      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x39, 0x61]),
+    ],
+    'application/pdf': [
+      new Uint8Array([0x25, 0x50, 0x44, 0x46]),
+    ],
+    'application/zip': [
+      new Uint8Array([0x50, 0x4B, 0x03, 0x04]),
+      new Uint8Array([0x50, 0x4B, 0x05, 0x06]),
+      new Uint8Array([0x50, 0x4B, 0x07, 0x08]),
+    ],
+  }
+
+  // Dangerous file extensions
+  private readonly EXECUTABLE_EXTENSIONS = [
+    '.exe',
+    '.bat',
+    '.cmd',
+    '.com',
+    '.pif',
+    '.scr',
+    '.vbs',
+    '.js',
+    '.jar',
+    '.app',
+    '.deb',
+    '.pkg',
+    '.dmg',
+    '.sh',
+    '.ps1',
+    '.msi',
+    '.dll',
+  ]
+
+  constructor(config: FileSecurityConfig = {}) {
+    this.config = {
+      scanForMalware: config.scanForMalware ?? false,
+      checkMagicNumbers: config.checkMagicNumbers ?? true,
+      sanitizeFilenames: config.sanitizeFilenames ?? true,
+      preventExecutableUploads: config.preventExecutableUploads ?? true,
+      maxFilenameLength: config.maxFilenameLength ?? 255,
+    }
+  }
+
+  validateFile(file: UploadedFile): { isValid: boolean, errors: string[] } {
+    const errors: string[] = []
+
+    // Check filename length
+    if (file.originalName.length > this.config.maxFilenameLength) {
+      errors.push(`Filename too long (max ${this.config.maxFilenameLength} characters)`)
+    }
+
+    // Check for dangerous filename patterns (but don't reject if we're sanitizing)
+    if (this.config.sanitizeFilenames) {
+      const sanitizedName = this.sanitizeFilename(file.originalName)
+      // Only error if sanitization results in empty filename
+      if (!sanitizedName || sanitizedName.length === 0) {
+        errors.push('Filename is invalid or empty after sanitization')
+      }
+    }
+
+    // Check for executable files
+    if (this.config.preventExecutableUploads) {
+      const extension = this.getFileExtension(file.originalName).toLowerCase()
+      if (this.EXECUTABLE_EXTENSIONS.includes(extension)) {
+        errors.push('Executable files are not allowed')
+      }
+    }
+
+    // Validate file signature (magic numbers)
+    if (this.config.checkMagicNumbers) {
+      const isValidSignature = this.validateFileSignature(file)
+      if (!isValidSignature) {
+        errors.push('File signature does not match declared MIME type')
+      }
+    }
+
+    // Basic malware scan (simple heuristics)
+    if (this.config.scanForMalware) {
+      const malwareDetected = this.basicMalwareScan(file)
+      if (malwareDetected) {
+        errors.push('Potential malware detected')
+      }
+    }
+
+    return {
+      isValid: errors.length === 0,
+      errors,
+    }
+  }
+
+  private validateFileSignature(file: UploadedFile): boolean {
+    const signatures = this.FILE_SIGNATURES[file.mimetype]
+    if (!signatures) {
+      // If we don't have signatures for this MIME type, allow it
+      return true
+    }
+
+    const fileBuffer = new Uint8Array(file.buffer.slice(0, 16)) // Check first 16 bytes
+
+    return signatures.some((signature) => {
+      if (fileBuffer.length < signature.length)
+        return false
+
+      for (let i = 0; i < signature.length; i++) {
+        if (fileBuffer[i] !== signature[i])
+          return false
+      }
+      return true
+    })
+  }
+
+  private sanitizeFilename(filename: string): string {
+    // Remove or replace dangerous characters
+    return filename
+      // eslint-disable-next-line no-control-regex
+      .replace(/[<>:"/\\|?*\u0000-\u001F]/u, '_') // Replace dangerous chars with underscore
+      .replace(/^\.+/, '') // Remove leading dots
+      .replace(/\.+$/, '') // Remove trailing dots
+      .replace(/\s+/g, '_') // Replace spaces with underscores
+      .substring(0, this.config.maxFilenameLength) // Truncate if too long
+  }
+
+  private getFileExtension(filename: string): string {
+    const lastDotIndex = filename.lastIndexOf('.')
+    return lastDotIndex === -1 ? '' : filename.substring(lastDotIndex)
+  }
+
+  private basicMalwareScan(file: UploadedFile): boolean {
+    // Simple heuristic-based malware detection
+    const buffer = new Uint8Array(file.buffer)
+    const content = new TextDecoder('utf-8', { fatal: false }).decode(buffer)
+
+    // Check for common malware patterns (very basic)
+    const malwarePatterns = [
+      /eval\s*\(/gi,
+      /document\.write/gi,
+      /window\.location/gi,
+      /<script[^>]*>/gi,
+      /javascript:/gi,
+      /vbscript:/gi,
+      /onload\s*=/gi,
+      /onerror\s*=/gi,
+    ]
+
+    return malwarePatterns.some(pattern => pattern.test(content))
+  }
+
+  // Utility method to get safe filename
+  getSafeFilename(originalName: string): string {
+    return this.sanitizeFilename(originalName)
+  }
+
+  // Check if file type is allowed based on whitelist
+  isAllowedFileType(mimetype: string, allowedTypes: string[]): boolean {
+    if (allowedTypes.length === 0)
+      return true
+    return allowedTypes.includes(mimetype)
+  }
+
+  // Check file size limits
+  isWithinSizeLimit(fileSize: number, maxSize: number): boolean {
+    return fileSize <= maxSize
+  }
+}
+
+export function createFileSecurity(config: FileSecurityConfig = {}): FileSecurity {
+  return new FileSecurity(config)
+}