@zudojs/security 1.0.0 → 1.0.1

package/dist/body/body.core.js

@@ -77,13 +77,19 @@ export function validateBodyFraming(headers, maxSize) {
         }
         return validateContentLength(contentLength, maxSize);
     }
-    if (typeof transferEncoding === "string") {
-        const encodings = transferEncoding
+    // A repeated Transfer-Encoding field is one comma-separated list (RFC 9110
+    // s5.3), so an array is flattened before the final-coding check. It used to
+    // be skipped entirely, so `["gzip"]` passed where `"gzip"` was rejected.
+    const transferEncodingList = Array.isArray(transferEncoding)
+        ? transferEncoding.join(",")
+        : transferEncoding;
+    if (typeof transferEncodingList === "string") {
+        const encodings = transferEncodingList
             .toLowerCase()
             .split(",")
             .map((e) => e.trim());
         if (encodings.length > 0 && encodings[encodings.length - 1] !== "chunked") {
-            return `Transfer-Encoding must end with "chunked", got: ${transferEncoding}`;
+            return `Transfer-Encoding must end with "chunked", got: ${transferEncodingList}`;
         }
     }
     return undefined;

package/dist/rateLimit/rateLimit.core.js

@@ -9,6 +9,8 @@ const DEFAULT_WINDOW_MS = 60_000;
 const DEFAULT_MESSAGE = "Too many requests";
 /** Default cap on tracked keys before least-recently-seen eviction. */
 const DEFAULT_MAX_KEYS = 100_000;
+/** Largest delay `setInterval` honours without overflowing to 1 ms. */
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 /**
  * Default key generator using IP address.
  *
@@ -88,8 +90,11 @@ export function createRateLimiter(config) {
         });
     const skip = config.skip;
     const maxKeys = config.maxKeys ?? DEFAULT_MAX_KEYS;
-    // Cleanup old entries periodically. Bounded so a very short window does not
-    // schedule a near-continuous timer.
+    // Cleanup old entries periodically. Bounded below so a very short window
+    // does not schedule a near-continuous timer, and above because Node stores
+    // timer delays as a signed 32-bit integer: a delay past 2^31 - 1 ms (about
+    // 24.8 days) is silently replaced with 1 ms, so a month-long window used to
+    // sweep the whole store a thousand times a second.
     const cleanupInterval = setInterval(() => {
         const cutoff = Date.now() - config.windowMs;
         for (const [key, entry] of store) {
@@ -97,7 +102,7 @@ export function createRateLimiter(config) {
                 store.delete(key);
             }
         }
-    }, Math.max(config.windowMs, 1_000));
+    }, Math.min(Math.max(config.windowMs, 1_000), MAX_TIMER_DELAY_MS));
     // Allow cleanup to not keep process alive
     if (cleanupInterval.unref) {
         cleanupInterval.unref();
@@ -107,16 +112,20 @@ export function createRateLimiter(config) {
      *
      * Without this, a caller rotating the key (a spoofed forwarding header, a
      * per-request identifier) grows the map without limit between sweeps.
+     *
+     * The store is kept in recency order — `check` re-inserts an entry on every
+     * hit — so the oldest key is always the first one iterated and eviction is
+     * O(1). It used to copy and sort the whole map on every new key past the
+     * cap, which turned the defence against key rotation into an O(n log n)
+     * cost per rotated request: the attack it was meant to bound became the
+     * cheapest way to burn the CPU.
      */
     function evictIfNeeded() {
-        if (store.size <= maxKeys)
-            return;
-        const entries = [...store.entries()].sort((a, b) => a[1].lastSeen - b[1].lastSeen);
-        const excess = store.size - maxKeys;
-        for (let i = 0; i < excess; i++) {
-            const entry = entries[i];
-            if (entry)
-                store.delete(entry[0]);
+        while (store.size > maxKeys) {
+            const oldest = store.keys().next();
+            if (oldest.done)
+                break;
+            store.delete(oldest.value);
         }
     }
     /**
@@ -141,6 +150,11 @@ export function createRateLimiter(config) {
             store.set(key, entry);
             evictIfNeeded();
         }
+        else {
+            // Move to the most-recent end so eviction order stays least-recent-first.
+            store.delete(key);
+            store.set(key, entry);
+        }
         // Prune everything that has slid out of the window.
         const timestamps = entry.timestamps.filter((t) => t > windowStart);
         entry.lastSeen = now;

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@zudojs/security",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Security primitives for input validation, header security, CORS, CSRF protection, rate limiting, and security headers.",
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -20,8 +24,8 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/errors": "1.0.0",
-    "@zudojs/constants": "1.0.0"
+    "@zudojs/errors": "1.0.1",
+    "@zudojs/constants": "1.0.1"
   },
   "devDependencies": {
     "typescript": "7.0.2",