chrome-cdp-cli 1.5.0 → 1.6.0

package/dist/proxy/server/SecurityManager.js

@@ -0,0 +1,337 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityManager = void 0;
+const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
+const logger_1 = require("../../utils/logger");
+class SecurityManager {
+    constructor(config) {
+        this.logger = (0, logger_1.createLogger)({ component: 'SecurityManager' });
+        this.config = {
+            enableRateLimit: true,
+            rateLimitWindowMs: 60 * 1000,
+            rateLimitMaxRequests: 100,
+            enableRequestValidation: true,
+            enableInputSanitization: true,
+            allowedHosts: ['localhost', '127.0.0.1'],
+            maxRequestBodySize: '10mb',
+            enableSecurityHeaders: true,
+            ...config
+        };
+        this.setupRateLimiters();
+        this.logger.info('Security manager initialized', { config: this.config });
+    }
+    setupRateLimiters() {
+        this.rateLimiter = (0, express_rate_limit_1.default)({
+            windowMs: this.config.rateLimitWindowMs,
+            max: this.config.rateLimitMaxRequests,
+            message: {
+                success: false,
+                error: 'Too many requests, please try again later',
+                timestamp: Date.now()
+            },
+            standardHeaders: true,
+            legacyHeaders: false,
+            skip: (req) => {
+                return req.path === '/api/health' || req.path === '/api/status';
+            },
+            handler: (req, res) => {
+                this.logger.logSecurityEvent('rate_limit_exceeded', 'Rate limit exceeded', {
+                    ip: req.ip,
+                    path: req.path,
+                    method: req.method,
+                    userAgent: req.get('user-agent')
+                });
+                res.status(429).json({
+                    success: false,
+                    error: 'Too many requests, please try again later',
+                    timestamp: Date.now()
+                });
+            }
+        });
+        this.strictRateLimiter = (0, express_rate_limit_1.default)({
+            windowMs: this.config.rateLimitWindowMs,
+            max: Math.floor(this.config.rateLimitMaxRequests / 4),
+            message: {
+                success: false,
+                error: 'Too many requests for this operation, please try again later',
+                timestamp: Date.now()
+            },
+            standardHeaders: true,
+            legacyHeaders: false,
+            handler: (req, res) => {
+                this.logger.logSecurityEvent('strict_rate_limit_exceeded', 'Strict rate limit exceeded', {
+                    ip: req.ip,
+                    path: req.path,
+                    method: req.method,
+                    userAgent: req.get('user-agent')
+                });
+                res.status(429).json({
+                    success: false,
+                    error: 'Too many requests for this operation, please try again later',
+                    timestamp: Date.now()
+                });
+            }
+        });
+    }
+    getRateLimiter() {
+        return this.config.enableRateLimit ? this.rateLimiter : this.noOpMiddleware;
+    }
+    getStrictRateLimiter() {
+        return this.config.enableRateLimit ? this.strictRateLimiter : this.noOpMiddleware;
+    }
+    getSecurityHeadersMiddleware() {
+        return (_req, res, next) => {
+            if (!this.config.enableSecurityHeaders) {
+                return next();
+            }
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+            res.setHeader('X-Frame-Options', 'DENY');
+            res.setHeader('X-XSS-Protection', '1; mode=block');
+            res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+            res.setHeader('Content-Security-Policy', "default-src 'self'");
+            res.removeHeader('X-Powered-By');
+            next();
+        };
+    }
+    getRequestValidationMiddleware() {
+        return (req, res, next) => {
+            if (!this.config.enableRequestValidation) {
+                return next();
+            }
+            try {
+                const allowedMethods = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'];
+                if (!allowedMethods.includes(req.method)) {
+                    this.logger.logSecurityEvent('invalid_method', 'Invalid HTTP method', {
+                        method: req.method,
+                        ip: req.ip,
+                        path: req.path
+                    });
+                    return res.status(405).json({
+                        success: false,
+                        error: 'Method not allowed',
+                        timestamp: Date.now()
+                    });
+                }
+                if (['POST', 'PUT'].includes(req.method)) {
+                    const contentType = req.get('content-type');
+                    if (!contentType || !contentType.includes('application/json')) {
+                        this.logger.logSecurityEvent('invalid_content_type', 'Invalid content type', {
+                            contentType,
+                            method: req.method,
+                            ip: req.ip,
+                            path: req.path
+                        });
+                        return res.status(400).json({
+                            success: false,
+                            error: 'Content-Type must be application/json',
+                            timestamp: Date.now()
+                        });
+                    }
+                }
+                const contentLength = req.get('content-length');
+                if (contentLength) {
+                    const maxSize = this.parseSize(this.config.maxRequestBodySize);
+                    if (parseInt(contentLength) > maxSize) {
+                        this.logger.logSecurityEvent('request_too_large', 'Request body too large', {
+                            contentLength: parseInt(contentLength),
+                            maxSize,
+                            ip: req.ip,
+                            path: req.path
+                        });
+                        return res.status(413).json({
+                            success: false,
+                            error: 'Request body too large',
+                            timestamp: Date.now()
+                        });
+                    }
+                }
+                const userAgent = req.get('user-agent');
+                if (!userAgent || this.isSuspiciousUserAgent(userAgent)) {
+                    this.logger.logSecurityEvent('suspicious_user_agent', 'Suspicious user agent', {
+                        userAgent,
+                        ip: req.ip,
+                        path: req.path
+                    });
+                }
+                next();
+            }
+            catch (error) {
+                this.logger.error('Request validation error:', error);
+                res.status(500).json({
+                    success: false,
+                    error: 'Request validation failed',
+                    timestamp: Date.now()
+                });
+            }
+        };
+    }
+    getInputSanitizationMiddleware() {
+        return (req, res, next) => {
+            if (!this.config.enableInputSanitization) {
+                return next();
+            }
+            try {
+                if (req.body && typeof req.body === 'object') {
+                    req.body = this.sanitizeObject(req.body);
+                }
+                if (req.query && typeof req.query === 'object') {
+                    req.query = this.sanitizeObject(req.query);
+                }
+                if (req.params && typeof req.params === 'object') {
+                    req.params = this.sanitizeObject(req.params);
+                }
+                next();
+            }
+            catch (error) {
+                this.logger.error('Input sanitization error:', error);
+                res.status(500).json({
+                    success: false,
+                    error: 'Input sanitization failed',
+                    timestamp: Date.now()
+                });
+            }
+        };
+    }
+    getHostValidationMiddleware() {
+        return (req, res, next) => {
+            if (req.path === '/api/connect' && req.method === 'POST') {
+                const { host } = req.body;
+                if (host && !this.isAllowedHost(host)) {
+                    this.logger.logSecurityEvent('unauthorized_host', 'Unauthorized host connection attempt', {
+                        requestedHost: host,
+                        clientIP: req.ip,
+                        allowedHosts: this.config.allowedHosts
+                    });
+                    res.status(403).json({
+                        success: false,
+                        error: 'Connection to this host is not allowed for security reasons',
+                        timestamp: Date.now()
+                    });
+                    return;
+                }
+            }
+            next();
+        };
+    }
+    getSecurityLoggingMiddleware() {
+        return (req, res, next) => {
+            const startTime = Date.now();
+            this.logger.debug('Security: Request received', {
+                method: req.method,
+                path: req.path,
+                ip: req.ip,
+                userAgent: req.get('user-agent'),
+                contentType: req.get('content-type'),
+                contentLength: req.get('content-length')
+            });
+            res.on('finish', () => {
+                const duration = Date.now() - startTime;
+                if (res.statusCode >= 400) {
+                    this.logger.logSecurityEvent('error_response', 'Error response sent', {
+                        method: req.method,
+                        path: req.path,
+                        statusCode: res.statusCode,
+                        duration,
+                        ip: req.ip,
+                        userAgent: req.get('user-agent')
+                    });
+                }
+            });
+            next();
+        };
+    }
+    isAllowedHost(host) {
+        if (host === 'localhost' || host === '127.0.0.1') {
+            return true;
+        }
+        if (this.config.allowedHosts.includes(host)) {
+            return true;
+        }
+        if (host.startsWith('192.168.') ||
+            host.startsWith('10.') ||
+            host.match(/^172\.(1[6-9]|2[0-9]|3[0-1])\./)) {
+            return true;
+        }
+        return false;
+    }
+    isSuspiciousUserAgent(userAgent) {
+        const suspiciousPatterns = [
+            /bot/i,
+            /crawler/i,
+            /spider/i,
+            /scraper/i,
+            /curl/i,
+            /wget/i,
+            /python/i,
+            /^$/
+        ];
+        return suspiciousPatterns.some(pattern => pattern.test(userAgent));
+    }
+    sanitizeObject(obj) {
+        if (obj === null || obj === undefined) {
+            return obj;
+        }
+        if (typeof obj === 'string') {
+            return this.sanitizeString(obj);
+        }
+        if (typeof obj === 'number' || typeof obj === 'boolean') {
+            return obj;
+        }
+        if (Array.isArray(obj)) {
+            return obj.map(item => this.sanitizeObject(item));
+        }
+        if (typeof obj === 'object') {
+            const sanitized = {};
+            for (const [key, value] of Object.entries(obj)) {
+                const sanitizedKey = this.sanitizeString(key);
+                sanitized[sanitizedKey] = this.sanitizeObject(value);
+            }
+            return sanitized;
+        }
+        return obj;
+    }
+    sanitizeString(str) {
+        if (typeof str !== 'string') {
+            return str;
+        }
+        let sanitized = str.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
+        if (sanitized.length > 10000) {
+            sanitized = sanitized.substring(0, 10000);
+            this.logger.warn('String truncated during sanitization', {
+                originalLength: str.length,
+                truncatedLength: sanitized.length
+            });
+        }
+        return sanitized;
+    }
+    parseSize(sizeStr) {
+        const match = sizeStr.match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)$/i);
+        if (!match) {
+            return 10 * 1024 * 1024;
+        }
+        const value = parseFloat(match[1]);
+        const unit = match[2].toLowerCase();
+        switch (unit) {
+            case 'b': return value;
+            case 'kb': return value * 1024;
+            case 'mb': return value * 1024 * 1024;
+            case 'gb': return value * 1024 * 1024 * 1024;
+            default: return 10 * 1024 * 1024;
+        }
+    }
+    noOpMiddleware(_req, _res, next) {
+        next();
+    }
+    updateConfig(newConfig) {
+        this.config = { ...this.config, ...newConfig };
+        this.setupRateLimiters();
+        this.logger.info('Security configuration updated', { config: this.config });
+    }
+    getConfig() {
+        return { ...this.config };
+    }
+}
+exports.SecurityManager = SecurityManager;