@virusis/api-client 0.1.17 → 0.1.19

package/dist/security/request-sanitizer.js

@@ -0,0 +1,242 @@
+import { sanitize } from "./input-security-service.js";
+/**
+ * Request-level defensive sanitizer for API client fetch helpers.
+ * Validates/sanitizes path, body string fields, headers, and FormData filenames.
+ */
+// ─── Path validation ────────────────────────────────────────────
+const DANGEROUS_PATH_PATTERNS = [
+    /\.\.[/\\]/, // path traversal
+    /%2e%2e/i, // encoded traversal
+    /%2f/i, // encoded slash
+    /%5c/i, // encoded backslash
+    /[\r\n]/, // CRLF
+    /[\x00-\x1F]/, // control chars
+    /\/\//, // double slash (protocol-relative)
+];
+export function validatePath(path) {
+    for (const p of DANGEROUS_PATH_PATTERNS) {
+        if (p.test(path)) {
+            return { safe: false, sanitized: "" };
+        }
+    }
+    return { safe: true, sanitized: path };
+}
+// ─── URL host validation ────────────────────────────────────────
+// ─── Private/reserved IP patterns for SSRF ─────────────────────
+const PRIVATE_IP_PATTERNS = [
+    /^127\./,
+    /^10\./,
+    /^172\.(1[6-9]|2\d|3[01])\./,
+    /^192\.168\./,
+    /^169\.254\./,
+    /^0\./,
+    /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./,
+    /^198\.1[89]\./,
+    /^(2[4-5]\d)\./,
+];
+export function validateAbsoluteUrl(url, trustedHosts) {
+    try {
+        const parsed = new URL(url);
+        // Block javascript/data/file schemes
+        if (["javascript:", "data:", "file:", "vbscript:", "ftp:", "gopher:", "dict:", "ldap:"].includes(parsed.protocol)) {
+            return { safe: false, reason: `Blocked scheme: ${parsed.protocol}` };
+        }
+        const host = parsed.hostname.toLowerCase();
+        // Block embedded credentials
+        if (parsed.username || parsed.password) {
+            return { safe: false, reason: "URL contains embedded credentials" };
+        }
+        // Block localhost/loopback
+        if (host === "localhost" || host === "127.0.0.1" || host === "[::1]") {
+            return { safe: false, reason: `Blocked localhost/loopback: ${host}` };
+        }
+        // Block metadata hosts
+        if (host === "169.254.169.254" || host === "metadata.google.internal" || host === "100.100.100.200") {
+            return { safe: false, reason: `Blocked metadata host: ${host}` };
+        }
+        // Block private/reserved IPs
+        for (const pattern of PRIVATE_IP_PATTERNS) {
+            if (pattern.test(host)) {
+                return { safe: false, reason: `Blocked private/reserved IP: ${host}` };
+            }
+        }
+        // Check trusted hosts if list is provided
+        if (trustedHosts.length > 0) {
+            const isTrusted = trustedHosts.some((h) => host === h.toLowerCase() || host.endsWith("." + h.toLowerCase()));
+            if (!isTrusted) {
+                return { safe: false, reason: `Untrusted host: ${host}` };
+            }
+        }
+        return { safe: true };
+    }
+    catch {
+        return { safe: false, reason: "Invalid URL" };
+    }
+}
+// ─── Body sanitization ─────────────────────────────────────────
+// Property name → policy kind mapping for common API fields
+const FIELD_POLICIES = {
+    sha256: "sha256",
+    sha1: "sha1",
+    md5: "md5",
+    url: "url",
+    ip: "ip",
+    email: "email",
+    nickName: "freeTextShort",
+    title: "freeTextShort",
+    subject: "freeTextShort",
+    scanName: "scanName",
+    name: "scanDisplayName",
+    submissionName: "scanDisplayName",
+    description: "freeTextLong",
+    message: "freeTextLong",
+    fileName: "fileName",
+    scanMode: "scanMode",
+    scanType: "enum",
+    otp: "otp",
+    password: "password",
+    captchaToken: "captchaToken",
+    scanGuid: "guid",
+    guid: "guid",
+    selectedEngineIdsJson: "engineIdsJson",
+    analysisIdsJson: "analysisIdsJson",
+    dto: "jsonPayload",
+};
+// ─── Prototype pollution key denylist ────────────────────────────
+const DENIED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const MAX_BODY_DEPTH = 8;
+export function sanitizeBody(body, depth = 0, visited = new WeakSet()) {
+    const result = {
+        body: { ...body },
+        modified: false,
+        blocked: false,
+        threats: [],
+    };
+    if (depth >= MAX_BODY_DEPTH)
+        return result;
+    if (visited.has(body))
+        return result;
+    visited.add(body);
+    for (const [key, value] of Object.entries(body)) {
+        // Reject prototype pollution keys
+        if (DENIED_KEYS.has(key)) {
+            result.blocked = true;
+            result.threats.push({
+                sanitized: "",
+                modified: false,
+                blocked: true,
+                detectedThreats: [{
+                        type: "prototype-pollution",
+                        severity: "critical",
+                        message: `Prototype pollution key rejected: ${key}`,
+                    }],
+            });
+            continue;
+        }
+        if (Array.isArray(value)) {
+            // Recursively check array items
+            const arrayResult = sanitizeArray(value, depth + 1, visited);
+            if (arrayResult.blocked) {
+                result.blocked = true;
+                result.threats.push(...arrayResult.threats);
+            }
+            else if (arrayResult.modified) {
+                result.body[key] = arrayResult.items;
+                result.modified = true;
+                result.threats.push(...arrayResult.threats);
+            }
+            continue;
+        }
+        if (typeof value === "object" && value !== null) {
+            // Recursively check nested objects for prototype pollution keys
+            const nested = sanitizeBody(value, depth + 1, visited);
+            if (nested.blocked) {
+                result.blocked = true;
+                result.threats.push(...nested.threats);
+            }
+            else if (nested.modified) {
+                result.body[key] = nested.body;
+                result.modified = true;
+                result.threats.push(...nested.threats);
+            }
+            continue;
+        }
+        if (typeof value !== "string")
+            continue;
+        const kind = FIELD_POLICIES[key] ?? "freeTextShort";
+        const secResult = sanitize(kind, value, key);
+        if (secResult.blocked) {
+            result.blocked = true;
+            result.threats.push(secResult);
+        }
+        else if (secResult.modified) {
+            result.body[key] = secResult.sanitized;
+            result.modified = true;
+            if (secResult.detectedThreats.length > 0) {
+                result.threats.push(secResult);
+            }
+        }
+    }
+    return result;
+}
+function sanitizeArray(items, depth, visited) {
+    const result = {
+        items: [...items],
+        modified: false,
+        blocked: false,
+        threats: [],
+    };
+    if (depth >= MAX_BODY_DEPTH)
+        return result;
+    for (let i = 0; i < items.length; i++) {
+        const item = items[i];
+        if (item === null || item === undefined)
+            continue;
+        if (Array.isArray(item)) {
+            const nested = sanitizeArray(item, depth + 1, visited);
+            if (nested.blocked) {
+                result.blocked = true;
+                result.threats.push(...nested.threats);
+            }
+            else if (nested.modified) {
+                result.items[i] = nested.items;
+                result.modified = true;
+                result.threats.push(...nested.threats);
+            }
+        }
+        else if (typeof item === "object") {
+            const nested = sanitizeBody(item, depth + 1, visited);
+            if (nested.blocked) {
+                result.blocked = true;
+                result.threats.push(...nested.threats);
+            }
+            else if (nested.modified) {
+                result.items[i] = nested.body;
+                result.modified = true;
+                result.threats.push(...nested.threats);
+            }
+        }
+        else if (typeof item === "string") {
+            const secResult = sanitize("freeTextShort", item, `[${i}]`);
+            if (secResult.blocked) {
+                result.blocked = true;
+                result.threats.push(secResult);
+            }
+            else if (secResult.modified) {
+                result.items[i] = secResult.sanitized;
+                result.modified = true;
+            }
+        }
+    }
+    return result;
+}
+// ─── FormData sanitization ──────────────────────────────────────
+export function sanitizeFormDataFileName(filename) {
+    const result = sanitize("fileName", filename, "formDataFile");
+    return result.blocked ? "sanitized_file" : result.sanitized;
+}
+// ─── Header sanitization ────────────────────────────────────────
+export function sanitizeHeaderValue(value) {
+    const result = sanitize("headerValue", value, "header");
+    return result.blocked ? "" : result.sanitized;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@virusis/api-client",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -23,13 +23,18 @@
     },
     "./package.json": "./package.json"
   },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
   "scripts": {
     "generate": "node scripts/run-nswag.mjs",
     "postgenerate": "node scripts/split-clients.js",
-    "build": "tsc -p tsconfig.json",
-    "test": "vitest run",
+    "build": "node node_modules/typescript/bin/tsc -p tsconfig.json",
+    "test": "node node_modules/vitest/vitest.mjs run",
     "ci": "npm run generate && npm run build && npm test",
-    "release": "npm run ci && npm publish --access=public",
+    "release": "npm run ci && npm publish --access=public --registry=https://registry.npmjs.org/",
+    "release:dry": "npm run ci && npm publish --dry-run --access=public --registry=https://registry.npmjs.org/",
     "pack:local": "node -e \"require('fs').mkdirSync('packages',{recursive:true});\" && npm pack --pack-destination ./packages",
     "fetch:spec": "node scripts/fetch-spec.mjs",
     "gen:python": "npm run fetch:spec && npx @openapitools/openapi-generator-cli generate -g python -i specs/openapi.json -o out/python --package-name virusis_api_client",