auto-smart-security 1.0.13 → 1.0.15

package/dist/apply-security.js

@@ -9,10 +9,30 @@ const utils_1 = require("./utils");
 const bot_detector_1 = require("./bot-detector");
 const rate_limiter_1 = require("./rate-limiter");
 const memory_store_1 = require("./blacklist/memory.store");
+const STATIC_EXTENSIONS = [
+    '.png',
+    '.jpg',
+    '.jpeg',
+    '.gif',
+    '.webp',
+    '.svg',
+    '.ico',
+    '.bmp',
+    '.css',
+    '.js',
+    '.map',
+    '.woff',
+    '.woff2',
+    '.ttf',
+    '.eot',
+];
 function applySecurity(app, options) {
     // Dev mode → skip security
     if (options.mode === 'dev')
         return;
+    const pathViolationMap = new Map();
+    const PATH_VIOLATION_TTL = 60000; // 1 minute
+    const PATH_VIOLATION_LIMIT = 10; // accept 10 violation per minute
     if (options.rateLimit) {
         if (options.trustProxy === undefined) {
             throw new Error('[auto-smart-security] rateLimit requires trustProxy to be a number (e.g. 1). Do NOT use true.');
@@ -44,6 +64,11 @@ function applySecurity(app, options) {
             });
         }));
     }
+    /** ================= IMAGES ================= */
+    const isStaticAsset = (url) => {
+        const path = url.split('?')[0].toLowerCase();
+        return STATIC_EXTENSIONS.some((ext) => path.endsWith(ext));
+    };
     /** ================= MAIN SECURITY ================= */
     app.use(async (req, res, next) => {
         // pass OPTIONS requests
@@ -51,12 +76,12 @@ function applySecurity(app, options) {
             return next();
         const ip = (0, utils_1.getClientIP)(req);
         const url = req.originalUrl;
-        console.log('url =========>', url, ip, blacklist);
+        if (isStaticAsset(url))
+            return next();
         /** 1️⃣ Blacklist */
         if (await blacklist.isBlocked(ip)) {
             return res.status(403).send('Access denied');
         }
-        console.log('run to here  =========>', 1);
         /** 2️⃣ Bot detection */
         if (botDetector?.detect(req)) {
             await blacklist.block(ip);
@@ -68,23 +93,35 @@ function applySecurity(app, options) {
             });
             return res.status(403).send('Bot detected');
         }
-        console.log('run to here  =========>', 2);
         /** 3️⃣ Path whitelist */
         const normalizePath = (url) => url.split('?')[0].replace(/^\/+/, '');
         const isPathAllowed = (url, whitelist) => {
             const path = normalizePath(url);
             return whitelist.some((p) => path === p || path.includes(`${p}`));
         };
-        console.log('run to here  =========>', 3, options.pathWhitelist, url);
+        function recordPathViolation(ip) {
+            const now = Date.now();
+            const entry = pathViolationMap.get(ip);
+            if (!entry || now - entry.ts > PATH_VIOLATION_TTL) {
+                pathViolationMap.set(ip, { count: 1, ts: now });
+                return false; // not block
+            }
+            entry.count++;
+            pathViolationMap.set(ip, entry);
+            return entry.count > PATH_VIOLATION_LIMIT; // block if limit exceeded
+        }
         if (options.pathWhitelist?.length &&
             !isPathAllowed(url, options.pathWhitelist)) {
-            await blacklist.block(ip);
-            options.onBlock?.({
-                ip,
-                reason: 'path-not-allowed',
-                url,
-            });
-            return res.status(403).send('Blocked path');
+            const shouldBlock = recordPathViolation(ip); // check violation count
+            if (shouldBlock) {
+                await blacklist.block(ip);
+                options.onBlock?.({
+                    ip,
+                    reason: 'path-not-allowed',
+                    url,
+                });
+                return res.status(403).send('Blocked path');
+            }
         }
         next();
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-smart-security",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "Production-ready security middleware for Express / NestJS",
   "author": "Hai Vinh <haivinhinspirit@gmail.com>",
   "main": "dist/index.js",