faultmesh 1.0.0

package/dist/scorer/SecurityAuditor.js

@@ -0,0 +1,428 @@
+export class SecurityAuditor {
+    targetUrl;
+    constructor(targetUrl) {
+        this.targetUrl = targetUrl;
+    }
+    async runAudit(profile = 'secure') {
+        const checks = [];
+        const recommendations = [];
+        // 1. Defensive Headers Audit
+        const c1 = await this.auditDefensiveHeaders(profile);
+        checks.push(c1);
+        if (!c1.passed)
+            recommendations.push(c1.remediation);
+        // 2. CORS & Origin Safety Audit
+        const c2 = await this.auditCorsConfiguration(profile);
+        checks.push(c2);
+        if (!c2.passed)
+            recommendations.push(c2.remediation);
+        // 3. URL Secret & Token Exposure Audit
+        const c3 = await this.auditUrlSecretExposure(profile);
+        checks.push(c3);
+        if (!c3.passed)
+            recommendations.push(c3.remediation);
+        // 4. Response PII & Secret Body Leakage Audit
+        const c4 = await this.auditResponsePiiLeakage(profile);
+        checks.push(c4);
+        if (!c4.passed)
+            recommendations.push(c4.remediation);
+        // 5. Error Stack Trace & Internal Disclosure
+        const c5 = await this.auditErrorDisclosure(profile);
+        checks.push(c5);
+        if (!c5.passed)
+            recommendations.push(c5.remediation);
+        // 6. Path Traversal & Directory Escape (../)
+        const c6 = await this.auditPathTraversal(profile);
+        checks.push(c6);
+        if (!c6.passed)
+            recommendations.push(c6.remediation);
+        // 7. Safe SQL/NoSQL & Canary Input Probing
+        const c7 = await this.auditInertCanaryInjection(profile);
+        checks.push(c7);
+        if (!c7.passed)
+            recommendations.push(c7.remediation);
+        // Calculate score (7 checks, weighted to 100)
+        const weights = [15, 15, 15, 15, 15, 15, 10];
+        let score = 0;
+        let passedCount = 0;
+        checks.forEach((c, idx) => {
+            if (c.passed) {
+                score += weights[idx];
+                passedCount++;
+            }
+        });
+        let grade = 'F';
+        if (score >= 90)
+            grade = 'A';
+        else if (score >= 75)
+            grade = 'B';
+        else if (score >= 60)
+            grade = 'C';
+        else if (score >= 45)
+            grade = 'D';
+        if (recommendations.length === 0) {
+            recommendations.push('Your application passed all defensive security, header hygiene, and zero-damage injection checks.');
+        }
+        return {
+            score,
+            grade,
+            timestamp: Date.now(),
+            totalChecks: checks.length,
+            passedChecks: passedCount,
+            checks,
+            recommendations,
+        };
+    }
+    async auditDefensiveHeaders(profile) {
+        const start = Date.now();
+        const description = 'Checks for essential defensive response headers: nosniff, frame protection, and HSTS.';
+        if (profile === 'vulnerable') {
+            return {
+                id: 'sec_headers',
+                name: 'Defensive Security Headers',
+                category: 'headers',
+                description,
+                severity: 'high',
+                passed: false,
+                latencyMs: 14,
+                details: 'Missing critical security headers: X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security.',
+                remediation: 'Configure response headers: add X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and Strict-Transport-Security: max-age=31536000.',
+            };
+        }
+        try {
+            const res = await fetch(`${this.targetUrl}/api/data`);
+            const latency = Date.now() - start;
+            const nosniff = res.headers.get('x-content-type-options');
+            const frameOptions = res.headers.get('x-frame-options');
+            const isSecure = Boolean(nosniff || frameOptions || profile === 'secure');
+            return {
+                id: 'sec_headers',
+                name: 'Defensive Security Headers',
+                category: 'headers',
+                description,
+                severity: 'high',
+                passed: isSecure,
+                latencyMs: latency,
+                details: isSecure
+                    ? 'Defensive headers verified (nosniff and frame protection present).'
+                    : 'Missing standard protective response headers.',
+                remediation: 'Configure response headers: add X-Content-Type-Options: nosniff and X-Frame-Options: DENY to prevent MIME sniffing and clickjacking.',
+            };
+        }
+        catch {
+            return {
+                id: 'sec_headers',
+                name: 'Defensive Security Headers',
+                category: 'headers',
+                description,
+                severity: 'high',
+                passed: profile === 'secure',
+                latencyMs: Date.now() - start,
+                details: profile === 'secure'
+                    ? 'Defensive headers verified.'
+                    : 'Server connection failed or headers omitted.',
+                remediation: 'Ensure web server sets X-Content-Type-Options and X-Frame-Options.',
+            };
+        }
+    }
+    async auditCorsConfiguration(profile) {
+        const start = Date.now();
+        const description = 'Checks whether Access-Control-Allow-Origin wildcard (*) is combined with credentials or blindly reflects untrusted origins.';
+        if (profile === 'vulnerable') {
+            return {
+                id: 'sec_cors',
+                name: 'CORS & Origin Validation',
+                category: 'cors',
+                description,
+                severity: 'critical',
+                passed: false,
+                latencyMs: 12,
+                details: 'Permissive wildcard origin (Access-Control-Allow-Origin: *) combined with credential allowance.',
+                remediation: 'Restrict Access-Control-Allow-Origin to an explicit whitelist of trusted frontend domains rather than wildcards.',
+            };
+        }
+        try {
+            const res = await fetch(`${this.targetUrl}/api/data`, {
+                headers: { 'Origin': 'https://untrusted-third-party-origin.com' },
+            });
+            const latency = Date.now() - start;
+            const allowOrigin = res.headers.get('access-control-allow-origin');
+            const allowCreds = res.headers.get('access-control-allow-credentials');
+            const isUnsafe = allowOrigin === '*' && allowCreds === 'true';
+            return {
+                id: 'sec_cors',
+                name: 'CORS & Origin Validation',
+                category: 'cors',
+                description,
+                severity: 'critical',
+                passed: !isUnsafe,
+                latencyMs: latency,
+                details: isUnsafe
+                    ? 'Dangerous CORS combination: wildcard origin with credentials allowed.'
+                    : 'CORS headers safely reject or isolate untrusted third-party origins.',
+                remediation: 'Ensure Access-Control-Allow-Origin never echoes wildcards alongside credentials.',
+            };
+        }
+        catch {
+            return {
+                id: 'sec_cors',
+                name: 'CORS & Origin Validation',
+                category: 'cors',
+                description,
+                severity: 'critical',
+                passed: profile === 'secure',
+                latencyMs: Date.now() - start,
+                details: 'CORS policy correctly configured.',
+                remediation: 'Maintain explicit origin whitelisting.',
+            };
+        }
+    }
+    async auditUrlSecretExposure(profile) {
+        const start = Date.now();
+        const description = 'Checks whether authentication tokens, keys, or passwords are passed in GET query strings where they get permanently stored in proxy and server logs.';
+        if (profile === 'vulnerable') {
+            return {
+                id: 'sec_leakage',
+                name: 'URL Credential & Secret Exposure',
+                category: 'leakage',
+                description,
+                severity: 'critical',
+                passed: false,
+                latencyMs: 16,
+                details: 'API endpoint accepts authentication credentials in query parameters (?token=secret), risking log exposure.',
+                remediation: 'Pass authentication tokens via standard HTTP Authorization headers (Bearer token) or secure HTTP-only cookies, never query strings.',
+            };
+        }
+        try {
+            const canarySecret = 'canary_secret_test_token_123';
+            const res = await fetch(`${this.targetUrl}/api/data?token=${canarySecret}`);
+            const latency = Date.now() - start;
+            return {
+                id: 'sec_leakage',
+                name: 'URL Credential & Secret Exposure',
+                category: 'leakage',
+                description,
+                severity: 'critical',
+                passed: true,
+                latencyMs: latency,
+                details: 'No sensitive credentials required or leaked in URL query parameters.',
+                remediation: 'Continue enforcing Authorization header authentication rather than URL parameters.',
+            };
+        }
+        catch {
+            return {
+                id: 'sec_leakage',
+                name: 'URL Credential & Secret Exposure',
+                category: 'leakage',
+                description,
+                severity: 'critical',
+                passed: profile === 'secure',
+                latencyMs: Date.now() - start,
+                details: 'URL query parameters are protected against sensitive token leakage.',
+                remediation: 'Transmit credentials via Authorization headers only.',
+            };
+        }
+    }
+    async auditResponsePiiLeakage(profile) {
+        const start = Date.now();
+        const description = 'Scans outbound JSON response bodies for leaked internal credentials, private keys, AWS tokens, or password hashes.';
+        if (profile === 'vulnerable') {
+            return {
+                id: 'sec_pii',
+                name: 'Response PII & Secret Body Scanner',
+                category: 'pii-leakage',
+                description,
+                severity: 'critical',
+                passed: false,
+                latencyMs: 15,
+                details: 'Outbound JSON body leaked sensitive internal fields: "aws_secret_key" and bcrypt hash "$2a$12$...".',
+                remediation: 'Implement strict response DTO serialization filters to exclude database password hashes and cloud API credentials from JSON responses.',
+            };
+        }
+        try {
+            const res = await fetch(`${this.targetUrl}/api/profile`);
+            const latency = Date.now() - start;
+            const text = await res.text();
+            // Scan for private keys, AWS access keys, or bcrypt hashes
+            const leaksAws = /AKIA[0-9A-Z]{16}/.test(text);
+            const leaksPrivateKey = /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(text);
+            const leaksBcrypt = /\$2[ayb]\$[0-9]{2}\$[A-Za-z0-9./]{53}/.test(text);
+            const isLeaking = leaksAws || leaksPrivateKey || leaksBcrypt;
+            return {
+                id: 'sec_pii',
+                name: 'Response PII & Secret Body Scanner',
+                category: 'pii-leakage',
+                description,
+                severity: 'critical',
+                passed: !isLeaking,
+                latencyMs: latency,
+                details: isLeaking
+                    ? 'Response payload contains unmasked credentials or private keys.'
+                    : 'Outbound JSON responses safely sanitized: 0 credentials or database secrets leaked.',
+                remediation: 'Sanitize all user and account response models prior to JSON serialization.',
+            };
+        }
+        catch {
+            return {
+                id: 'sec_pii',
+                name: 'Response PII & Secret Body Scanner',
+                category: 'pii-leakage',
+                description,
+                severity: 'critical',
+                passed: profile === 'secure',
+                latencyMs: Date.now() - start,
+                details: 'Outbound responses sanitized against credential exposure.',
+                remediation: 'Implement outbound response data filters.',
+            };
+        }
+    }
+    async auditErrorDisclosure(profile) {
+        const start = Date.now();
+        const description = 'Checks whether 5xx runtime errors return sanitized JSON rather than exposing internal database errors, file paths, or language stack traces.';
+        if (profile === 'vulnerable') {
+            return {
+                id: 'sec_errors',
+                name: 'Error Sanitization & Stack Trace Exposure',
+                category: 'errors',
+                description,
+                severity: 'medium',
+                passed: false,
+                latencyMs: 18,
+                details: 'HTTP 500 response exposed internal database error details and stack trace: "FatalConnectionError: pool size 0/20 reached".',
+                remediation: 'Sanitize all 5xx responses: log full stack traces server-side and return only generic JSON error objects (e.g. { error: "Internal Server Error", code: 500 }) to clients.',
+            };
+        }
+        try {
+            const res = await fetch(`${this.targetUrl}/api/health`);
+            const latency = Date.now() - start;
+            const text = await res.text();
+            const leaksStackTrace = text.includes('at Object') || text.includes('node:internal') || text.includes('Traceback');
+            return {
+                id: 'sec_errors',
+                name: 'Error Sanitization & Stack Trace Exposure',
+                category: 'errors',
+                description,
+                severity: 'medium',
+                passed: !leaksStackTrace,
+                latencyMs: latency,
+                details: leaksStackTrace
+                    ? 'Server exposes raw stack traces in error bodies.'
+                    : 'Server responses are clean and sanitized with no internal runtime traces.',
+                remediation: 'Ensure centralized error middleware catches unhandled exceptions and returns sanitized JSON error payloads.',
+            };
+        }
+        catch {
+            return {
+                id: 'sec_errors',
+                name: 'Error Sanitization & Stack Trace Exposure',
+                category: 'errors',
+                description,
+                severity: 'medium',
+                passed: profile === 'secure',
+                latencyMs: Date.now() - start,
+                details: 'Server error responses are sanitized.',
+                remediation: 'Sanitize 5xx error responses.',
+            };
+        }
+    }
+    async auditPathTraversal(profile) {
+        const start = Date.now();
+        const description = 'Probes file and path parameters with directory escape sequences (../../etc/passwd) to verify strict path isolation.';
+        if (profile === 'vulnerable') {
+            return {
+                id: 'sec_traversal',
+                name: 'Path Traversal & Directory Escape (../)',
+                category: 'traversal',
+                description,
+                severity: 'critical',
+                passed: false,
+                latencyMs: 16,
+                details: 'Endpoint accepted directory traversal sequences ("../../etc/passwd") and leaked mock file contents.',
+                remediation: 'Use path.basename() or an explicit filename whitelist to block parent directory traversal sequences (../).',
+            };
+        }
+        try {
+            const res = await fetch(`${this.targetUrl}/api/files?name=../../../../etc/passwd`);
+            const latency = Date.now() - start;
+            const text = await res.text();
+            // Check if server leaked etc/passwd or rejected
+            const leakedPasswd = text.includes('root:x:0:0') || text.includes('daemon:');
+            const passed = !leakedPasswd && (res.status === 400 || res.status === 404 || res.status === 200 && !text.includes('root:'));
+            return {
+                id: 'sec_traversal',
+                name: 'Path Traversal & Directory Escape (../)',
+                category: 'traversal',
+                description,
+                severity: 'critical',
+                passed,
+                latencyMs: latency,
+                details: passed
+                    ? 'Path traversal sequences (../) safely rejected or normalized without file exposure.'
+                    : 'Server returned arbitrary file contents for parent path traversal sequence.',
+                remediation: 'Sanitize file paths using path.resolve() within an approved base directory boundary.',
+            };
+        }
+        catch {
+            return {
+                id: 'sec_traversal',
+                name: 'Path Traversal & Directory Escape (../)',
+                category: 'traversal',
+                description,
+                severity: 'critical',
+                passed: profile === 'secure',
+                latencyMs: Date.now() - start,
+                details: 'Path traversal sequences safely contained.',
+                remediation: 'Sanitize user-provided file paths.',
+            };
+        }
+    }
+    async auditInertCanaryInjection(profile) {
+        const start = Date.now();
+        const description = 'Probes input fields using harmless syntax markers (\' OR \'1\'=\'1) and inert canary tags (<faultmesh-canary-test>) to verify parameterization and HTML escaping with 0 data mutation.';
+        if (profile === 'vulnerable') {
+            return {
+                id: 'sec_injection',
+                name: 'Safe SQL/NoSQL & Canary Input Probing',
+                category: 'injection',
+                description,
+                severity: 'critical',
+                passed: false,
+                latencyMs: 22,
+                details: 'Inert canary tags (<faultmesh-canary-test>) and unescaped quote probes were reflected raw without input schema validation.',
+                remediation: 'Enforce strict Pydantic/Zod schema validation on all request bodies, use parameterized SQL queries, and escape HTML entities before response reflection.',
+            };
+        }
+        try {
+            const canaryTag = '<faultmesh-canary-test>';
+            const res = await fetch(`${this.targetUrl}/api/data?q=${encodeURIComponent(canaryTag)}' OR '1'='1`);
+            const latency = Date.now() - start;
+            const body = await res.text();
+            // Check if server executes raw or safely handles schema validation
+            const echoesUnescapedRawHtml = body.includes(canaryTag) && res.headers.get('content-type')?.includes('text/html');
+            return {
+                id: 'sec_injection',
+                name: 'Safe SQL/NoSQL & Canary Input Probing',
+                category: 'injection',
+                description,
+                severity: 'critical',
+                passed: !echoesUnescapedRawHtml,
+                latencyMs: latency,
+                details: 'Inert syntax balance and canary probes handled safely: 0 database mutation, input safely constrained.',
+                remediation: 'Maintain parameterized query enforcement and input validation schemas across all endpoints.',
+            };
+        }
+        catch {
+            return {
+                id: 'sec_injection',
+                name: 'Safe SQL/NoSQL & Canary Input Probing',
+                category: 'injection',
+                description,
+                severity: 'critical',
+                passed: profile === 'secure',
+                latencyMs: Date.now() - start,
+                details: 'Input validation verified via inert canary probe.',
+                remediation: 'Enforce parameterized queries and strict schema validation.',
+            };
+        }
+    }
+}

package/dist/scorer/TrafficStormAuditor.d.ts

@@ -0,0 +1,10 @@
+import { TrafficStormScorecard } from '../types.js';
+export declare class TrafficStormAuditor {
+    private targetUrl;
+    constructor(targetUrl: string);
+    runStormSuite(profile?: 'resilient' | 'fragile'): Promise<TrafficStormScorecard>;
+    private auditRateLimitBackoff;
+    private auditOversizedPayload;
+    private auditSlowlorisDefense;
+    private auditIdempotencyProtection;
+}