baileys-antiban 3.8.10 → 3.8.11

package/dist/antiban.js

@@ -79,6 +79,15 @@ function mapLegacyToFlat(legacy) {
         flat.identicalMessageWindowMs = legacyAsFlat.identicalMessageWindowMs;
     if (flat.burstAllowance === undefined && typeof legacyAsFlat.burstAllowance === 'number')
         flat.burstAllowance = legacyAsFlat.burstAllowance;
+    // v3 fields that may coexist with legacy nested keys
+    if (flat.autoPauseAt === undefined && typeof legacyAsFlat.autoPauseAt === 'string')
+        flat.autoPauseAt = legacyAsFlat.autoPauseAt;
+    if (flat.groupMultiplier === undefined && typeof legacyAsFlat.groupMultiplier === 'number')
+        flat.groupMultiplier = legacyAsFlat.groupMultiplier;
+    if (flat.groupProfiles === undefined && typeof legacyAsFlat.groupProfiles === 'boolean')
+        flat.groupProfiles = legacyAsFlat.groupProfiles;
+    if (flat.persist === undefined && typeof legacyAsFlat.persist === 'string')
+        flat.persist = legacyAsFlat.persist;
     return flat;
 }
 export class AntiBan {

package/dist/cjs/antiban.js

@@ -82,6 +82,15 @@ function mapLegacyToFlat(legacy) {
         flat.identicalMessageWindowMs = legacyAsFlat.identicalMessageWindowMs;
     if (flat.burstAllowance === undefined && typeof legacyAsFlat.burstAllowance === 'number')
         flat.burstAllowance = legacyAsFlat.burstAllowance;
+    // v3 fields that may coexist with legacy nested keys
+    if (flat.autoPauseAt === undefined && typeof legacyAsFlat.autoPauseAt === 'string')
+        flat.autoPauseAt = legacyAsFlat.autoPauseAt;
+    if (flat.groupMultiplier === undefined && typeof legacyAsFlat.groupMultiplier === 'number')
+        flat.groupMultiplier = legacyAsFlat.groupMultiplier;
+    if (flat.groupProfiles === undefined && typeof legacyAsFlat.groupProfiles === 'boolean')
+        flat.groupProfiles = legacyAsFlat.groupProfiles;
+    if (flat.persist === undefined && typeof legacyAsFlat.persist === 'string')
+        flat.persist = legacyAsFlat.persist;
     return flat;
 }
 class AntiBan {

package/dist/cjs/persist.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StateManager = void 0;
 const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const KNOWN_CHATS_MAX = 1000;
 const DEBOUNCE_MS = 5000;
 /**
@@ -48,13 +49,20 @@ class StateManager {
     path;
     debounceTimer = null;
     constructor(filePath) {
-        this.path = filePath;
+        // Resolve to absolute path and reject null bytes to prevent path injection
+        if (filePath.includes('\0'))
+            throw new Error('[baileys-antiban] Invalid state file path: null byte');
+        this.path = path.resolve(filePath);
     }
     load() {
         try {
             const raw = fs.readFileSync(this.path, 'utf-8');
             const parsed = JSON.parse(raw);
-            if (parsed.version !== 3) {
+            // Strict shape validation before trusting file content
+            if (typeof parsed !== 'object' || parsed === null ||
+                parsed.version !== 3 ||
+                typeof parsed.savedAt !== 'number' ||
+                !Array.isArray(parsed.knownChats)) {
                 console.warn('[baileys-antiban] WARN: corrupt state file or version mismatch, starting fresh');
                 return null;
             }

package/dist/cjs/proxyRotator.js

@@ -19,20 +19,19 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.proxyRotator = proxyRotator;
-// Create require function for loading optional peer dependencies
-// This function works in both ESM and CJS contexts
+// Load optional peer dependencies synchronously in both ESM and CJS builds.
+// CJS: native require is available. ESM: new Function() reads import.meta.url
+// without causing TypeScript parse errors in CJS compilation. The string passed
+// to new Function is a static literal — not user-controlled.
 function lazyRequire(moduleName) {
-    // In CJS: use native require
     if (typeof require !== 'undefined') {
         return require(moduleName);
     }
-    // In ESM: use createRequire with import.meta.url
-    // We use indirect eval to get import.meta.url to avoid parse errors in CJS
-    // @ts-ignore - ESM-only code path
-    const { createRequire } = (0, eval)('require')('node:module');
-    // @ts-ignore - ESM-only code path
-    const dynamicRequire = createRequire((0, eval)('import.meta.url'));
-    return dynamicRequire(moduleName);
+    // ESM path: new Function with static literal string avoids TS CJS-parse error on import.meta.
+    // Not user-controlled — both strings are compile-time constants.
+    const { createRequire } = (new Function('return require')())('node:module');
+    const metaUrl = new Function('return import.meta.url')();
+    return createRequire(metaUrl)(moduleName);
 }
 const NoopLogger = {
     info: () => { },

package/dist/cjs/rateLimiter.js

@@ -177,6 +177,15 @@ class RateLimiter {
                 this.identicalCount.delete(hash);
             }
         }
+        // LRU size cap — prevents unbounded growth when sending many unique messages.
+        // Evict oldest-by-lastSeen entries when map exceeds 10,000 entries.
+        const IDENTICAL_COUNT_MAX = 10_000;
+        if (this.identicalCount.size > IDENTICAL_COUNT_MAX) {
+            const sorted = [...this.identicalCount.entries()].sort(([, a], [, b]) => a.lastSeen - b.lastSeen);
+            const excess = this.identicalCount.size - IDENTICAL_COUNT_MAX;
+            for (let i = 0; i < excess; i++)
+                this.identicalCount.delete(sorted[i][0]);
+        }
     }
     /** Random delay between min and max (gaussian-ish distribution) */
     jitter(min, max) {

package/dist/persist.js

@@ -1,4 +1,5 @@
 import * as fs from 'fs';
+import * as path from 'path';
 const KNOWN_CHATS_MAX = 1000;
 const DEBOUNCE_MS = 5000;
 /**
@@ -12,13 +13,20 @@ export class StateManager {
     path;
     debounceTimer = null;
     constructor(filePath) {
-        this.path = filePath;
+        // Resolve to absolute path and reject null bytes to prevent path injection
+        if (filePath.includes('\0'))
+            throw new Error('[baileys-antiban] Invalid state file path: null byte');
+        this.path = path.resolve(filePath);
     }
     load() {
         try {
             const raw = fs.readFileSync(this.path, 'utf-8');
             const parsed = JSON.parse(raw);
-            if (parsed.version !== 3) {
+            // Strict shape validation before trusting file content
+            if (typeof parsed !== 'object' || parsed === null ||
+                parsed.version !== 3 ||
+                typeof parsed.savedAt !== 'number' ||
+                !Array.isArray(parsed.knownChats)) {
                 console.warn('[baileys-antiban] WARN: corrupt state file or version mismatch, starting fresh');
                 return null;
             }

package/dist/proxyRotator.js

@@ -16,20 +16,19 @@
  * @author Kobus Wentzel <kobie@pop.co.za>
  * @license MIT
  */
-// Create require function for loading optional peer dependencies
-// This function works in both ESM and CJS contexts
+// Load optional peer dependencies synchronously in both ESM and CJS builds.
+// CJS: native require is available. ESM: new Function() reads import.meta.url
+// without causing TypeScript parse errors in CJS compilation. The string passed
+// to new Function is a static literal — not user-controlled.
 function lazyRequire(moduleName) {
-    // In CJS: use native require
     if (typeof require !== 'undefined') {
         return require(moduleName);
     }
-    // In ESM: use createRequire with import.meta.url
-    // We use indirect eval to get import.meta.url to avoid parse errors in CJS
-    // @ts-ignore - ESM-only code path
-    const { createRequire } = (0, eval)('require')('node:module');
-    // @ts-ignore - ESM-only code path
-    const dynamicRequire = createRequire((0, eval)('import.meta.url'));
-    return dynamicRequire(moduleName);
+    // ESM path: new Function with static literal string avoids TS CJS-parse error on import.meta.
+    // Not user-controlled — both strings are compile-time constants.
+    const { createRequire } = (new Function('return require')())('node:module');
+    const metaUrl = new Function('return import.meta.url')();
+    return createRequire(metaUrl)(moduleName);
 }
 const NoopLogger = {
     info: () => { },

package/dist/rateLimiter.js

@@ -174,6 +174,15 @@ export class RateLimiter {
                 this.identicalCount.delete(hash);
             }
         }
+        // LRU size cap — prevents unbounded growth when sending many unique messages.
+        // Evict oldest-by-lastSeen entries when map exceeds 10,000 entries.
+        const IDENTICAL_COUNT_MAX = 10_000;
+        if (this.identicalCount.size > IDENTICAL_COUNT_MAX) {
+            const sorted = [...this.identicalCount.entries()].sort(([, a], [, b]) => a.lastSeen - b.lastSeen);
+            const excess = this.identicalCount.size - IDENTICAL_COUNT_MAX;
+            for (let i = 0; i < excess; i++)
+                this.identicalCount.delete(sorted[i][0]);
+        }
     }
     /** Random delay between min and max (gaussian-ish distribution) */
     jitter(min, max) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baileys-antiban",
-  "version": "3.8.10",
+  "version": "3.8.11",
   "description": "Anti-ban middleware for Baileys WhatsApp bots. Rate limiting, warmup, health monitor, LID resolver, disconnect classifier. Free Whapi.Cloud alternative.",
   "main": "dist/cjs/index.js",
   "types": "dist/index.d.ts",