@stacksjs/bun-router 0.0.4 → 0.0.6

package/src/middleware/ddos_protection.ts

@@ -0,0 +1,255 @@
+import type { EnhancedRequest, NextFunction } from '../types'
+import { config } from '../config'
+
+export interface DDoSProtectionOptions {
+  enabled?: boolean
+  maxRequestsPerSecond?: number
+  maxRequestsPerMinute?: number
+  maxRequestsPerHour?: number
+  burstLimit?: number
+  windowSize?: number
+  blockDuration?: number
+  whitelistedIPs?: string[]
+  blacklistedIPs?: string[]
+  trustProxy?: boolean
+  skipSuccessfulRequests?: boolean
+  skipFailedRequests?: boolean
+  keyGenerator?: (req: EnhancedRequest) => string
+  onLimitReached?: (req: EnhancedRequest, rateLimitInfo: any) => Response | Promise<Response>
+  store?: 'memory' | 'redis'
+  redis?: {
+    url: string
+    prefix?: string
+  }
+}
+
+interface RequestInfo {
+  count: number
+  firstRequest: number
+  lastRequest: number
+  blocked: boolean
+  blockExpires?: number
+}
+
+export default class DDoSProtection {
+  private options: DDoSProtectionOptions
+  private requestStore: Map<string, RequestInfo> = new Map()
+  private cleanupInterval: ReturnType<typeof setInterval> | null = null
+
+  constructor(options: DDoSProtectionOptions = {}) {
+    const ddosConfig = config.server?.security?.ddos || {}
+
+    this.options = {
+      enabled: options.enabled ?? ddosConfig.enabled ?? true,
+      maxRequestsPerSecond: options.maxRequestsPerSecond ?? ddosConfig.maxRequestsPerSecond ?? 10,
+      maxRequestsPerMinute: options.maxRequestsPerMinute ?? ddosConfig.maxRequestsPerMinute ?? 100,
+      maxRequestsPerHour: options.maxRequestsPerHour ?? ddosConfig.maxRequestsPerHour ?? 1000,
+      burstLimit: options.burstLimit ?? ddosConfig.burstLimit ?? 20,
+      windowSize: options.windowSize ?? ddosConfig.windowSize ?? 60000, // 1 minute
+      blockDuration: options.blockDuration ?? ddosConfig.blockDuration ?? 300000, // 5 minutes
+      whitelistedIPs: options.whitelistedIPs ?? ddosConfig.whitelistedIPs ?? [],
+      blacklistedIPs: options.blacklistedIPs ?? ddosConfig.blacklistedIPs ?? [],
+      trustProxy: options.trustProxy ?? ddosConfig.trustProxy ?? true,
+      skipSuccessfulRequests: options.skipSuccessfulRequests ?? ddosConfig.skipSuccessfulRequests ?? false,
+      skipFailedRequests: options.skipFailedRequests ?? ddosConfig.skipFailedRequests ?? false,
+      keyGenerator: options.keyGenerator ?? this.defaultKeyGenerator.bind(this),
+      onLimitReached: options.onLimitReached,
+      store: options.store ?? ddosConfig.store ?? 'memory',
+      redis: options.redis ?? ddosConfig.redis,
+    }
+
+    // Start cleanup interval for memory store
+    if (this.options.store === 'memory') {
+      this.startCleanupInterval()
+    }
+  }
+
+  private defaultKeyGenerator(req: EnhancedRequest): string {
+    const forwarded = req.headers.get('x-forwarded-for')
+    const realIP = req.headers.get('x-real-ip')
+    const cfIP = req.headers.get('cf-connecting-ip')
+
+    if (this.options.trustProxy && forwarded) {
+      return forwarded.split(',')[0].trim()
+    }
+
+    return realIP || cfIP || 'unknown'
+  }
+
+  private startCleanupInterval(): void {
+    this.cleanupInterval = setInterval(() => {
+      const now = Date.now()
+      for (const [key, info] of this.requestStore.entries()) {
+        // Remove expired entries
+        if (now - info.lastRequest > this.options.windowSize! * 2) {
+          this.requestStore.delete(key)
+        }
+        // Remove expired blocks
+        if (info.blocked && info.blockExpires && now > info.blockExpires) {
+          info.blocked = false
+          info.blockExpires = undefined
+        }
+      }
+    }, this.options.windowSize! / 2) // Cleanup every half window
+  }
+
+  private isWhitelisted(ip: string): boolean {
+    return this.options.whitelistedIPs?.includes(ip) ?? false
+  }
+
+  private isBlacklisted(ip: string): boolean {
+    return this.options.blacklistedIPs?.includes(ip) ?? false
+  }
+
+  private getRateLimitInfo(key: string, now: number): RequestInfo {
+    let info = this.requestStore.get(key)
+
+    if (!info) {
+      info = {
+        count: 0,
+        firstRequest: now,
+        lastRequest: now,
+        blocked: false,
+      }
+      this.requestStore.set(key, info)
+    }
+
+    // Reset count if window has passed
+    if (now - info.firstRequest > this.options.windowSize!) {
+      info.count = 0
+      info.firstRequest = now
+    }
+
+    return info
+  }
+
+  private shouldBlock(info: RequestInfo, now: number): boolean {
+    // Check if already blocked and block hasn't expired
+    if (info.blocked && info.blockExpires && now < info.blockExpires) {
+      return true
+    }
+
+    // Check burst limit (requests per second)
+    const _secondWindow = 1000
+    const recentRequests = info.count // Simplified for this implementation
+    if (recentRequests > this.options.burstLimit!) {
+      return true
+    }
+
+    // Check requests per minute
+    if (info.count > this.options.maxRequestsPerMinute!) {
+      return true
+    }
+
+    return false
+  }
+
+  private blockIP(info: RequestInfo, now: number): void {
+    info.blocked = true
+    info.blockExpires = now + this.options.blockDuration!
+  }
+
+  private createBlockedResponse(req: EnhancedRequest, info: RequestInfo): Response {
+    const retryAfter = Math.ceil((info.blockExpires! - Date.now()) / 1000)
+
+    const headers = {
+      'Retry-After': retryAfter.toString(),
+      'X-RateLimit-Limit': this.options.maxRequestsPerMinute!.toString(),
+      'X-RateLimit-Remaining': '0',
+      'X-RateLimit-Reset': Math.ceil(info.blockExpires! / 1000).toString(),
+    }
+
+    if (this.options.onLimitReached) {
+      return this.options.onLimitReached(req, { ...info, retryAfter }) as Response
+    }
+
+    return new Response(JSON.stringify({
+      error: 'Too Many Requests',
+      message: 'Rate limit exceeded. Please try again later.',
+      retryAfter,
+    }), {
+      status: 429,
+      headers: {
+        'Content-Type': 'application/json',
+        ...headers,
+      },
+    })
+  }
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    // Skip if DDoS protection is disabled
+    if (!this.options.enabled) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    const now = Date.now()
+    const key = this.options.keyGenerator!(req)
+
+    // Check if IP is whitelisted
+    if (this.isWhitelisted(key)) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    // Check if IP is blacklisted
+    if (this.isBlacklisted(key)) {
+      return new Response('Access Denied', { status: 403 })
+    }
+
+    // Get rate limit info
+    const info = this.getRateLimitInfo(key, now)
+
+    // Check if should block
+    if (this.shouldBlock(info, now)) {
+      this.blockIP(info, now)
+      return this.createBlockedResponse(req, info)
+    }
+
+    // Increment request count
+    info.count++
+    info.lastRequest = now
+
+    // Process request
+    const response = await next()
+
+    if (!response) {
+      return new Response('Not Found', { status: 404 })
+    }
+
+    // Skip counting based on response status if configured
+    if (this.options.skipSuccessfulRequests && response.status < 400) {
+      info.count--
+    }
+    if (this.options.skipFailedRequests && response.status >= 400) {
+      info.count--
+    }
+
+    // Add rate limit headers
+    const headers = new Headers(response.headers)
+    headers.set('X-RateLimit-Limit', this.options.maxRequestsPerMinute!.toString())
+    headers.set('X-RateLimit-Remaining', Math.max(0, this.options.maxRequestsPerMinute! - info.count).toString())
+    headers.set('X-RateLimit-Reset', Math.ceil((info.firstRequest + this.options.windowSize!) / 1000).toString())
+
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    })
+  }
+
+  // Cleanup method
+  destroy(): void {
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval)
+      this.cleanupInterval = null
+    }
+    this.requestStore.clear()
+  }
+}
+
+// Factory function for easy use
+export function ddosProtection(options: DDoSProtectionOptions = {}): (req: EnhancedRequest, next: NextFunction) => Promise<Response> {
+  const instance = new DDoSProtection(options)
+  return async (req: EnhancedRequest, next: NextFunction) => instance.handle(req, next)
+}

package/src/middleware/file_security.ts

@@ -0,0 +1,191 @@
+import type { UploadedFile } from './file_upload'
+
+export interface FileSecurityConfig {
+  scanForMalware?: boolean
+  checkMagicNumbers?: boolean
+  sanitizeFilenames?: boolean
+  preventExecutableUploads?: boolean
+  maxFilenameLength?: number
+}
+
+export default class FileSecurity {
+  private config: Required<FileSecurityConfig>
+
+  // Common file signatures (magic numbers)
+  private readonly FILE_SIGNATURES: Record<string, Uint8Array[]> = {
+    'image/jpeg': [
+      new Uint8Array([0xFF, 0xD8, 0xFF]),
+    ],
+    'image/png': [
+      new Uint8Array([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]),
+    ],
+    'image/gif': [
+      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x37, 0x61]),
+      new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x39, 0x61]),
+    ],
+    'application/pdf': [
+      new Uint8Array([0x25, 0x50, 0x44, 0x46]),
+    ],
+    'application/zip': [
+      new Uint8Array([0x50, 0x4B, 0x03, 0x04]),
+      new Uint8Array([0x50, 0x4B, 0x05, 0x06]),
+      new Uint8Array([0x50, 0x4B, 0x07, 0x08]),
+    ],
+  }
+
+  // Dangerous file extensions
+  private readonly EXECUTABLE_EXTENSIONS = [
+    '.exe',
+    '.bat',
+    '.cmd',
+    '.com',
+    '.pif',
+    '.scr',
+    '.vbs',
+    '.js',
+    '.jar',
+    '.app',
+    '.deb',
+    '.pkg',
+    '.dmg',
+    '.sh',
+    '.ps1',
+    '.msi',
+    '.dll',
+  ]
+
+  constructor(config: FileSecurityConfig = {}) {
+    this.config = {
+      scanForMalware: config.scanForMalware ?? false,
+      checkMagicNumbers: config.checkMagicNumbers ?? true,
+      sanitizeFilenames: config.sanitizeFilenames ?? true,
+      preventExecutableUploads: config.preventExecutableUploads ?? true,
+      maxFilenameLength: config.maxFilenameLength ?? 255,
+    }
+  }
+
+  validateFile(file: UploadedFile): { isValid: boolean, errors: string[] } {
+    const errors: string[] = []
+
+    // Check filename length
+    if (file.originalName.length > this.config.maxFilenameLength) {
+      errors.push(`Filename too long (max ${this.config.maxFilenameLength} characters)`)
+    }
+
+    // Check for dangerous filename patterns (but don't reject if we're sanitizing)
+    if (this.config.sanitizeFilenames) {
+      const sanitizedName = this.sanitizeFilename(file.originalName)
+      // Only error if sanitization results in empty filename
+      if (!sanitizedName || sanitizedName.length === 0) {
+        errors.push('Filename is invalid or empty after sanitization')
+      }
+    }
+
+    // Check for executable files
+    if (this.config.preventExecutableUploads) {
+      const extension = this.getFileExtension(file.originalName).toLowerCase()
+      if (this.EXECUTABLE_EXTENSIONS.includes(extension)) {
+        errors.push('Executable files are not allowed')
+      }
+    }
+
+    // Validate file signature (magic numbers)
+    if (this.config.checkMagicNumbers) {
+      const isValidSignature = this.validateFileSignature(file)
+      if (!isValidSignature) {
+        errors.push('File signature does not match declared MIME type')
+      }
+    }
+
+    // Basic malware scan (simple heuristics)
+    if (this.config.scanForMalware) {
+      const malwareDetected = this.basicMalwareScan(file)
+      if (malwareDetected) {
+        errors.push('Potential malware detected')
+      }
+    }
+
+    return {
+      isValid: errors.length === 0,
+      errors,
+    }
+  }
+
+  private validateFileSignature(file: UploadedFile): boolean {
+    const signatures = this.FILE_SIGNATURES[file.mimetype]
+    if (!signatures) {
+      // If we don't have signatures for this MIME type, allow it
+      return true
+    }
+
+    const fileBuffer = new Uint8Array(file.buffer.slice(0, 16)) // Check first 16 bytes
+
+    return signatures.some((signature) => {
+      if (fileBuffer.length < signature.length)
+        return false
+
+      for (let i = 0; i < signature.length; i++) {
+        if (fileBuffer[i] !== signature[i])
+          return false
+      }
+      return true
+    })
+  }
+
+  private sanitizeFilename(filename: string): string {
+    // Remove or replace dangerous characters
+    return filename
+      // eslint-disable-next-line no-control-regex
+      .replace(/[<>:"/\\|?*\u0000-\u001F]/u, '_') // Replace dangerous chars with underscore
+      .replace(/^\.+/, '') // Remove leading dots
+      .replace(/\.+$/, '') // Remove trailing dots
+      .replace(/\s+/g, '_') // Replace spaces with underscores
+      .substring(0, this.config.maxFilenameLength) // Truncate if too long
+  }
+
+  private getFileExtension(filename: string): string {
+    const lastDotIndex = filename.lastIndexOf('.')
+    return lastDotIndex === -1 ? '' : filename.substring(lastDotIndex)
+  }
+
+  private basicMalwareScan(file: UploadedFile): boolean {
+    // Simple heuristic-based malware detection
+    const buffer = new Uint8Array(file.buffer)
+    const content = new TextDecoder('utf-8', { fatal: false }).decode(buffer)
+
+    // Check for common malware patterns (very basic)
+    const malwarePatterns = [
+      /eval\s*\(/gi,
+      /document\.write/gi,
+      /window\.location/gi,
+      /<script[^>]*>/gi,
+      /javascript:/gi,
+      /vbscript:/gi,
+      /onload\s*=/gi,
+      /onerror\s*=/gi,
+    ]
+
+    return malwarePatterns.some(pattern => pattern.test(content))
+  }
+
+  // Utility method to get safe filename
+  getSafeFilename(originalName: string): string {
+    return this.sanitizeFilename(originalName)
+  }
+
+  // Check if file type is allowed based on whitelist
+  isAllowedFileType(mimetype: string, allowedTypes: string[]): boolean {
+    if (allowedTypes.length === 0)
+      return true
+    return allowedTypes.includes(mimetype)
+  }
+
+  // Check file size limits
+  isWithinSizeLimit(fileSize: number, maxSize: number): boolean {
+    return fileSize <= maxSize
+  }
+}
+
+export function createFileSecurity(config: FileSecurityConfig = {}): FileSecurity {
+  return new FileSecurity(config)
+}

package/src/middleware/file_upload.ts

@@ -0,0 +1,264 @@
+import type { EnhancedRequest, NextFunction } from '../types'
+import type { FileSecurityConfig } from './file_security'
+import { randomUUID } from 'node:crypto'
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
+import { basename, extname, join } from 'node:path'
+import FileSecurity from './file_security'
+
+export interface UploadedFile {
+  fieldName: string
+  originalName: string
+  filename: string
+  path: string
+  size: number
+  mimetype: string
+  buffer: ArrayBuffer
+}
+
+export interface FileUploadConfig extends FileSecurityConfig {
+  destination?: string
+  maxFileSize?: number // in bytes
+  maxFiles?: number
+  allowedMimeTypes?: string[]
+  allowedExtensions?: string[]
+  preserveOriginalName?: boolean
+  generateUniqueFilename?: boolean
+  createDestination?: boolean
+}
+
+export interface FileUploadOptions extends FileUploadConfig {
+  fieldName?: string | string[]
+}
+
+export default class FileUpload {
+  private config: Required<FileUploadConfig>
+
+  private fileSecurity: FileSecurity
+
+  constructor(config: FileUploadConfig = {}) {
+    this.config = {
+      destination: config.destination || './uploads',
+      maxFileSize: config.maxFileSize || 10 * 1024 * 1024, // 10MB default
+      maxFiles: config.maxFiles || 10,
+      allowedMimeTypes: config.allowedMimeTypes || [],
+      allowedExtensions: config.allowedExtensions || [],
+      preserveOriginalName: config.preserveOriginalName ?? false,
+      generateUniqueFilename: config.generateUniqueFilename ?? true,
+      createDestination: config.createDestination ?? true,
+      scanForMalware: config.scanForMalware ?? false,
+      checkMagicNumbers: config.checkMagicNumbers ?? true,
+      sanitizeFilenames: config.sanitizeFilenames ?? true,
+      preventExecutableUploads: config.preventExecutableUploads ?? true,
+      maxFilenameLength: config.maxFilenameLength ?? 255,
+    }
+
+    this.fileSecurity = new FileSecurity(config)
+
+    // Create destination directory if it doesn't exist
+    if (this.config.createDestination && !existsSync(this.config.destination)) {
+      mkdirSync(this.config.destination, { recursive: true })
+    }
+  }
+
+  async handle(req: EnhancedRequest, next: NextFunction): Promise<Response> {
+    const contentType = req.headers.get('content-type')
+
+    if (!contentType || !contentType.includes('multipart/form-data')) {
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+
+    try {
+      const formData = await req.formData()
+      const uploadedFiles: UploadedFile[] = []
+      const fields: Record<string, any> = {}
+
+      for (const [key, value] of (formData as any).entries()) {
+        if (value instanceof File) {
+          // Validate file count
+          if (uploadedFiles.length >= this.config.maxFiles) {
+            return this.createErrorResponse(`Maximum ${this.config.maxFiles} files allowed`, 400)
+          }
+
+          // Validate file size
+          if (value.size > this.config.maxFileSize) {
+            return this.createErrorResponse(
+              `File ${value.name} exceeds maximum size of ${this.formatBytes(this.config.maxFileSize)}`,
+              413,
+            )
+          }
+
+          // Validate MIME type
+          if (this.config.allowedMimeTypes.length > 0) {
+            const baseType = value.type.split(';')[0] // Remove charset info
+            if (!this.config.allowedMimeTypes.includes(baseType)) {
+              return this.createErrorResponse(
+                `File type ${baseType} not allowed. Allowed types: ${this.config.allowedMimeTypes.join(', ')}`,
+                415,
+              )
+            }
+          }
+
+          // Validate file extension
+          const fileExtension = extname(value.name).toLowerCase()
+          if (this.config.allowedExtensions.length > 0 && !this.config.allowedExtensions.includes(fileExtension)) {
+            return this.createErrorResponse(
+              `File extension ${fileExtension} not allowed. Allowed extensions: ${this.config.allowedExtensions.join(', ')}`,
+              415,
+            )
+          }
+
+          // Generate filename
+          const filename = this.generateFilename(value.name)
+          const filePath = join(this.config.destination, filename)
+
+          // Convert file to buffer and save
+          const buffer = await value.arrayBuffer()
+
+          const uploadedFile: UploadedFile = {
+            fieldName: key,
+            originalName: value.name,
+            filename,
+            path: filePath,
+            size: value.size,
+            mimetype: value.type,
+            buffer,
+          }
+
+          // Validate file security
+          const securityCheck = this.fileSecurity.validateFile(uploadedFile)
+          if (!securityCheck.isValid) {
+            return this.createErrorResponse(
+              `Security validation failed: ${securityCheck.errors.join(', ')}`,
+              400,
+            )
+          }
+
+          writeFileSync(filePath, new Uint8Array(buffer))
+          uploadedFiles.push(uploadedFile)
+        }
+        else {
+          // Handle regular form fields
+          if (fields[key]) {
+            // Convert to array if multiple values
+            if (Array.isArray(fields[key])) {
+              fields[key].push(value)
+            }
+            else {
+              fields[key] = [fields[key], value]
+            }
+          }
+          else {
+            fields[key] = value
+          }
+        }
+      }
+
+      // Attach files and fields to request
+      Object.defineProperty(req, 'files', {
+        value: uploadedFiles,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+      })
+
+      Object.defineProperty(req, 'formBody', {
+        value: fields,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+      })
+
+      const response = await next()
+      return response || new Response('Not Found', { status: 404 })
+    }
+    catch (error) {
+      return this.createErrorResponse(
+        `File upload failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+        500,
+      )
+    }
+  }
+
+  private generateFilename(originalName: string): string {
+    // Always sanitize the filename first
+    const sanitizedName = this.fileSecurity.getSafeFilename(originalName)
+
+    if (this.config.preserveOriginalName && !this.config.generateUniqueFilename) {
+      return sanitizedName
+    }
+
+    const extension = extname(sanitizedName)
+    const baseName = basename(sanitizedName, extension)
+
+    if (this.config.generateUniqueFilename) {
+      const uuid = randomUUID()
+      return this.config.preserveOriginalName
+        ? `${baseName}_${uuid}${extension}`
+        : `${uuid}${extension}`
+    }
+
+    return sanitizedName
+  }
+
+  private formatBytes(bytes: number): string {
+    if (bytes === 0)
+      return '0 Bytes'
+    const k = 1024
+    const sizes = ['Bytes', 'KB', 'MB', 'GB']
+    const i = Math.floor(Math.log(bytes) / Math.log(k))
+    return `${Number.parseFloat((bytes / k ** i).toFixed(2))} ${sizes[i]}`
+  }
+
+  private createErrorResponse(message: string, status: number): Response {
+    return new Response(
+      JSON.stringify({ error: message }),
+      {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+      },
+    )
+  }
+}
+
+// Factory function for easier usage
+export function fileUpload(config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload(config)
+}
+
+// Specialized factory functions
+export function singleFileUpload(_fieldName: string, config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload({ ...config, maxFiles: 1 })
+}
+
+export function multipleFileUpload(maxFiles: number = 10, config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload({ ...config, maxFiles })
+}
+
+export function imageUpload(config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload({
+    ...config,
+    allowedMimeTypes: [
+      'image/jpeg',
+      'image/jpg',
+      'image/png',
+      'image/gif',
+      'image/webp',
+      'image/svg+xml',
+    ],
+    allowedExtensions: ['.jpg', '.jpeg', '.png', '.gif', '.webp', '.svg'],
+  })
+}
+
+export function documentUpload(config: FileUploadConfig = {}): FileUpload {
+  return new FileUpload({
+    ...config,
+    allowedMimeTypes: [
+      'application/pdf',
+      'application/msword',
+      'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      'text/plain',
+    ],
+    allowedExtensions: ['.pdf', '.doc', '.docx', '.txt'],
+  })
+}