@stacksjs/bun-router 0.0.16 → 0.0.18

package/src/middleware/ddos_protection.ts

@@ -1,255 +0,0 @@
-import type { EnhancedRequest, NextFunction } from '../types'
-import { config } from '../config'
-
-export interface DDoSProtectionOptions {
-  enabled?: boolean
-  maxRequestsPerSecond?: number
-  maxRequestsPerMinute?: number
-  maxRequestsPerHour?: number
-  burstLimit?: number
-  windowSize?: number
-  blockDuration?: number
-  whitelistedIPs?: string[]
-  blacklistedIPs?: string[]
-  trustProxy?: boolean
-  skipSuccessfulRequests?: boolean
-  skipFailedRequests?: boolean
-  keyGenerator?: (req: EnhancedRequest) => string
-  onLimitReached?: (req: EnhancedRequest, rateLimitInfo: any) => Response | Promise<Response>
-  store?: 'memory' | 'redis'
-  redis?: {
-    url: string
-    prefix?: string
-  }
-}
-
-interface RequestInfo {
-  count: number
-  firstRequest: number
-  lastRequest: number
-  blocked: boolean
-  blockExpires?: number
-}
-
-export default class DDoSProtection {
-  private options: DDoSProtectionOptions
-  private requestStore: Map<string, RequestInfo> = new Map()
-  private cleanupInterval: ReturnType<typeof setInterval> | null = null
-
-  constructor(options: DDoSProtectionOptions = {}) {
-    const ddosConfig = config.server?.security?.ddos || {}
-
-    this.options = {
-      enabled: options.enabled ?? ddosConfig.enabled ?? true,
-      maxRequestsPerSecond: options.maxRequestsPerSecond ?? ddosConfig.maxRequestsPerSecond ?? 10,
-      maxRequestsPerMinute: options.maxRequestsPerMinute ?? ddosConfig.maxRequestsPerMinute ?? 100,
-      maxRequestsPerHour: options.maxRequestsPerHour ?? ddosConfig.maxRequestsPerHour ?? 1000,
-      burstLimit: options.burstLimit ?? ddosConfig.burstLimit ?? 20,
-      windowSize: options.windowSize ?? ddosConfig.windowSize ?? 60000, // 1 minute
-      blockDuration: options.blockDuration ?? ddosConfig.blockDuration ?? 300000, // 5 minutes
-      whitelistedIPs: options.whitelistedIPs ?? ddosConfig.whitelistedIPs ?? [],
-      blacklistedIPs: options.blacklistedIPs ?? ddosConfig.blacklistedIPs ?? [],
-      trustProxy: options.trustProxy ?? ddosConfig.trustProxy ?? true,
-      skipSuccessfulRequests: options.skipSuccessfulRequests ?? ddosConfig.skipSuccessfulRequests ?? false,
-      skipFailedRequests: options.skipFailedRequests ?? ddosConfig.skipFailedRequests ?? false,
-      keyGenerator: options.keyGenerator ?? this.defaultKeyGenerator.bind(this),
-      onLimitReached: options.onLimitReached,
-      store: options.store ?? ddosConfig.store ?? 'memory',
-      redis: options.redis ?? ddosConfig.redis,
-    }
-
-    // Start cleanup interval for memory store
-    if (this.options.store === 'memory') {
-      this.startCleanupInterval()
-    }
-  }
-
-  private defaultKeyGenerator(req: EnhancedRequest): string {
-    const forwarded = req.headers.get('x-forwarded-for')
-    const realIP = req.headers.get('x-real-ip')
-    const cfIP = req.headers.get('cf-connecting-ip')
-
-    if (this.options.trustProxy && forwarded) {
-      return forwarded.split(',')[0].trim()
-    }
-
-    return realIP || cfIP || 'unknown'
-  }
-
-  private startCleanupInterval(): void {
-    this.cleanupInterval = setInterval(() => {
-      const now = Date.now()
-      for (const [key, info] of this.requestStore.entries()) {
-        // Remove expired entries
-        if (now - info.lastRequest > this.options.windowSize! * 2) {
-          this.requestStore.delete(key)
-        }
-        // Remove expired blocks
-        if (info.blocked && info.blockExpires && now > info.blockExpires) {
-          info.blocked = false
-          info.blockExpires = undefined
-        }
-      }
-    }, this.options.windowSize! / 2) // Cleanup every half window
-  }
-
-  private isWhitelisted(ip: string): boolean {
-    return this.options.whitelistedIPs?.includes(ip) ?? false
-  }
-
-  private isBlacklisted(ip: string): boolean {
-    return this.options.blacklistedIPs?.includes(ip) ?? false
-  }
-
-  private getRateLimitInfo(key: string, now: number): RequestInfo {
-    let info = this.requestStore.get(key)
-
-    if (!info) {
-      info = {
-        count: 0,
-        firstRequest: now,
-        lastRequest: now,
-        blocked: false,
-      }
-      this.requestStore.set(key, info)
-    }
-
-    // Reset count if window has passed
-    if (now - info.firstRequest > this.options.windowSize!) {
-      info.count = 0
-      info.firstRequest = now
-    }
-
-    return info
-  }
-
-  private shouldBlock(info: RequestInfo, now: number): boolean {
-    // Check if already blocked and block hasn't expired
-    if (info.blocked && info.blockExpires && now < info.blockExpires) {
-      return true
-    }
-
-    // Check burst limit (requests per second)
-    const _secondWindow = 1000
-    const recentRequests = info.count // Simplified for this implementation
-    if (recentRequests > this.options.burstLimit!) {
-      return true
-    }
-
-    // Check requests per minute
-    if (info.count > this.options.maxRequestsPerMinute!) {
-      return true
-    }
-
-    return false
-  }
-
-  private blockIP(info: RequestInfo, now: number): void {
-    info.blocked = true
-    info.blockExpires = now + this.options.blockDuration!
-  }
-
-  private createBlockedResponse(req: EnhancedRequest, info: RequestInfo): Response {
-    const retryAfter = Math.ceil((info.blockExpires! - Date.now()) / 1000)
-
-    const headers = {
-      'Retry-After': retryAfter.toString(),
-      'X-RateLimit-Limit': this.options.maxRequestsPerMinute!.toString(),
-      'X-RateLimit-Remaining': '0',
-      'X-RateLimit-Reset': Math.ceil(info.blockExpires! / 1000).toString(),
-    }
-
-    if (this.options.onLimitReached) {
-      return this.options.onLimitReached(req, { ...info, retryAfter }) as Response
-    }
-
-    return new Response(JSON.stringify({
-      error: 'Too Many Requests',
-      message: 'Rate limit exceeded. Please try again later.',
-      retryAfter,
-    }), {
-      status: 429,
-      headers: {
-        'Content-Type': 'application/json',
-        ...headers,
-      },
-    })
-  }
-
-  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
-    // Skip if DDoS protection is disabled
-    if (!this.options.enabled) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    const now = Date.now()
-    const key = this.options.keyGenerator!(req)
-
-    // Check if IP is whitelisted
-    if (this.isWhitelisted(key)) {
-      const response = await next()
-      return response || new Response('Not Found', { status: 404 })
-    }
-
-    // Check if IP is blacklisted
-    if (this.isBlacklisted(key)) {
-      return new Response('Access Denied', { status: 403 })
-    }
-
-    // Get rate limit info
-    const info = this.getRateLimitInfo(key, now)
-
-    // Check if should block
-    if (this.shouldBlock(info, now)) {
-      this.blockIP(info, now)
-      return this.createBlockedResponse(req, info)
-    }
-
-    // Increment request count
-    info.count++
-    info.lastRequest = now
-
-    // Process request
-    const response = await next()
-
-    if (!response) {
-      return new Response('Not Found', { status: 404 })
-    }
-
-    // Skip counting based on response status if configured
-    if (this.options.skipSuccessfulRequests && response.status < 400) {
-      info.count--
-    }
-    if (this.options.skipFailedRequests && response.status >= 400) {
-      info.count--
-    }
-
-    // Add rate limit headers
-    const headers = new Headers(response.headers)
-    headers.set('X-RateLimit-Limit', this.options.maxRequestsPerMinute!.toString())
-    headers.set('X-RateLimit-Remaining', Math.max(0, this.options.maxRequestsPerMinute! - info.count).toString())
-    headers.set('X-RateLimit-Reset', Math.ceil((info.firstRequest + this.options.windowSize!) / 1000).toString())
-
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers,
-    })
-  }
-
-  // Cleanup method
-  destroy(): void {
-    if (this.cleanupInterval) {
-      clearInterval(this.cleanupInterval)
-      this.cleanupInterval = null
-    }
-    this.requestStore.clear()
-  }
-}
-
-// Factory function for easy use
-export function ddosProtection(options: DDoSProtectionOptions = {}): (req: EnhancedRequest, next: NextFunction) => Promise<Response> {
-  const instance = new DDoSProtection(options)
-  return async (req: EnhancedRequest, next: NextFunction) => instance.handle(req, next)
-}

package/src/middleware/file_security.ts

@@ -1,191 +0,0 @@
-import type { UploadedFile } from './file_upload'
-
-export interface FileSecurityConfig {
-  scanForMalware?: boolean
-  checkMagicNumbers?: boolean
-  sanitizeFilenames?: boolean
-  preventExecutableUploads?: boolean
-  maxFilenameLength?: number
-}
-
-export default class FileSecurity {
-  private config: Required<FileSecurityConfig>
-
-  // Common file signatures (magic numbers)
-  private readonly FILE_SIGNATURES: Record<string, Uint8Array[]> = {
-    'image/jpeg': [
-      new Uint8Array([0xFF, 0xD8, 0xFF]),
-    ],
-    'image/png': [
-      new Uint8Array([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
-    ],
-    'image/gif': [
-      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x37, 0x61]),
-      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x39, 0x61]),
-    ],
-    'application/pdf': [
-      new Uint8Array([0x25, 0x50, 0x44, 0x46]),
-    ],
-    'application/zip': [
-      new Uint8Array([0x50, 0x4B, 0x03, 0x04]),
-      new Uint8Array([0x50, 0x4B, 0x05, 0x06]),
-      new Uint8Array([0x50, 0x4B, 0x07, 0x08]),
-    ],
-  }
-
-  // Dangerous file extensions
-  private readonly EXECUTABLE_EXTENSIONS = [
-    '.exe',
-    '.bat',
-    '.cmd',
-    '.com',
-    '.pif',
-    '.scr',
-    '.vbs',
-    '.js',
-    '.jar',
-    '.app',
-    '.deb',
-    '.pkg',
-    '.dmg',
-    '.sh',
-    '.ps1',
-    '.msi',
-    '.dll',
-  ]
-
-  constructor(config: FileSecurityConfig = {}) {
-    this.config = {
-      scanForMalware: config.scanForMalware ?? false,
-      checkMagicNumbers: config.checkMagicNumbers ?? true,
-      sanitizeFilenames: config.sanitizeFilenames ?? true,
-      preventExecutableUploads: config.preventExecutableUploads ?? true,
-      maxFilenameLength: config.maxFilenameLength ?? 255,
-    }
-  }
-
-  validateFile(file: UploadedFile): { isValid: boolean, errors: string[] } {
-    const errors: string[] = []
-
-    // Check filename length
-    if (file.originalName.length > this.config.maxFilenameLength) {
-      errors.push(`Filename too long (max ${this.config.maxFilenameLength} characters)`)
-    }
-
-    // Check for dangerous filename patterns (but don't reject if we're sanitizing)
-    if (this.config.sanitizeFilenames) {
-      const sanitizedName = this.sanitizeFilename(file.originalName)
-      // Only error if sanitization results in empty filename
-      if (!sanitizedName || sanitizedName.length === 0) {
-        errors.push('Filename is invalid or empty after sanitization')
-      }
-    }
-
-    // Check for executable files
-    if (this.config.preventExecutableUploads) {
-      const extension = this.getFileExtension(file.originalName).toLowerCase()
-      if (this.EXECUTABLE_EXTENSIONS.includes(extension)) {
-        errors.push('Executable files are not allowed')
-      }
-    }
-
-    // Validate file signature (magic numbers)
-    if (this.config.checkMagicNumbers) {
-      const isValidSignature = this.validateFileSignature(file)
-      if (!isValidSignature) {
-        errors.push('File signature does not match declared MIME type')
-      }
-    }
-
-    // Basic malware scan (simple heuristics)
-    if (this.config.scanForMalware) {
-      const malwareDetected = this.basicMalwareScan(file)
-      if (malwareDetected) {
-        errors.push('Potential malware detected')
-      }
-    }
-
-    return {
-      isValid: errors.length === 0,
-      errors,
-    }
-  }
-
-  private validateFileSignature(file: UploadedFile): boolean {
-    const signatures = this.FILE_SIGNATURES[file.mimetype]
-    if (!signatures) {
-      // If we don't have signatures for this MIME type, allow it
-      return true
-    }
-
-    const fileBuffer = new Uint8Array(file.buffer.slice(0, 16)) // Check first 16 bytes
-
-    return signatures.some((signature) => {
-      if (fileBuffer.length < signature.length)
-        return false
-
-      for (let i = 0; i < signature.length; i++) {
-        if (fileBuffer[i] !== signature[i])
-          return false
-      }
-      return true
-    })
-  }
-
-  private sanitizeFilename(filename: string): string {
-    // Remove or replace dangerous characters
-    return filename
-      // eslint-disable-next-line no-control-regex
-      .replace(/[<>:"/\\|?*\u0000-\u001F]/u, '_') // Replace dangerous chars with underscore
-      .replace(/^\.+/, '') // Remove leading dots
-      .replace(/\.+$/, '') // Remove trailing dots
-      .replace(/\s+/g, '_') // Replace spaces with underscores
-      .substring(0, this.config.maxFilenameLength) // Truncate if too long
-  }
-
-  private getFileExtension(filename: string): string {
-    const lastDotIndex = filename.lastIndexOf('.')
-    return lastDotIndex === -1 ? '' : filename.substring(lastDotIndex)
-  }
-
-  private basicMalwareScan(file: UploadedFile): boolean {
-    // Simple heuristic-based malware detection
-    const buffer = new Uint8Array(file.buffer)
-    const content = new TextDecoder('utf-8', { fatal: false }).decode(buffer)
-
-    // Check for common malware patterns (very basic)
-    const malwarePatterns = [
-      /eval\s*\(/gi,
-      /document\.write/gi,
-      /window\.location/gi,
-      /<script[^>]*>/gi,
-      /javascript:/gi,
-      /vbscript:/gi,
-      /onload\s*=/gi,
-      /onerror\s*=/gi,
-    ]
-
-    return malwarePatterns.some(pattern => pattern.test(content))
-  }
-
-  // Utility method to get safe filename
-  getSafeFilename(originalName: string): string {
-    return this.sanitizeFilename(originalName)
-  }
-
-  // Check if file type is allowed based on whitelist
-  isAllowedFileType(mimetype: string, allowedTypes: string[]): boolean {
-    if (allowedTypes.length === 0)
-      return true
-    return allowedTypes.includes(mimetype)
-  }
-
-  // Check file size limits
-  isWithinSizeLimit(fileSize: number, maxSize: number): boolean {
-    return fileSize <= maxSize
-  }
-}
-
-export function createFileSecurity(config: FileSecurityConfig = {}): FileSecurity {
-  return new FileSecurity(config)
-}