fullshield 0.4.0 → 1.0.0

package/dist/runtime/index.js

@@ -1,229 +1 @@
-// src/runtime/signatures.ts
-var SQLI = /('\s*or\s+'?1'?\s*='?1)|union\s+select|;\s*drop\s+table|;\s*delete\s+from/i;
-var XSS = /<\s*script\b|javascript:\s*|onerror\s*=/i;
-var PATH = /(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\\)/i;
-function flattenValues(value, out = [], depth = 0) {
-  if (depth > 8 || out.length > 200) return out;
-  if (typeof value === "string") {
-    out.push(value);
-    return out;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) flattenValues(item, out, depth + 1);
-    return out;
-  }
-  if (value !== null && typeof value === "object") {
-    for (const item of Object.values(value)) {
-      flattenValues(item, out, depth + 1);
-    }
-  }
-  return out;
-}
-function detectAttack(text) {
-  if (PATH.test(text)) return "path";
-  if (XSS.test(text)) return "xss";
-  if (SQLI.test(text)) return "sqli";
-  return void 0;
-}
-function inspectValues(values) {
-  for (const value of values) {
-    const hit = detectAttack(value);
-    if (hit !== void 0) return hit;
-  }
-  return void 0;
-}
-
-// src/runtime/lru.ts
-var LruMap = class {
-  constructor(max) {
-    this.max = max;
-    if (max < 1) throw new Error("LruMap max must be >= 1");
-  }
-  max;
-  map = /* @__PURE__ */ new Map();
-  get size() {
-    return this.map.size;
-  }
-  has(key) {
-    return this.map.has(key);
-  }
-  get(key) {
-    if (!this.map.has(key)) return void 0;
-    const value = this.map.get(key);
-    this.map.delete(key);
-    this.map.set(key, value);
-    return value;
-  }
-  set(key, value) {
-    if (this.map.has(key)) this.map.delete(key);
-    this.map.set(key, value);
-    while (this.map.size > this.max) {
-      const oldest = this.map.keys().next().value;
-      if (oldest === void 0) break;
-      this.map.delete(oldest);
-    }
-    return this;
-  }
-};
-
-// src/runtime/rateLimit.ts
-var DEFAULT_MAX_KEYS = 1e4;
-function createRateLimiter(options) {
-  const maxKeys = options.maxKeys ?? DEFAULT_MAX_KEYS;
-  const hits = new LruMap(maxKeys);
-  return {
-    allow(key, now = Date.now()) {
-      const windowStart = now - options.windowMs;
-      const prev = hits.get(key);
-      if (prev === void 0) {
-        hits.set(key, [now]);
-        return true;
-      }
-      let keep = 0;
-      for (let i = 0; i < prev.length; i += 1) {
-        const t = prev[i];
-        if (t !== void 0 && t > windowStart) {
-          prev[keep] = t;
-          keep += 1;
-        }
-      }
-      prev.length = keep;
-      if (prev.length >= options.max) {
-        hits.set(key, prev);
-        return false;
-      }
-      prev.push(now);
-      hits.set(key, prev);
-      return true;
-    },
-    get size() {
-      return hits.size;
-    },
-    get maxKeys() {
-      return maxKeys;
-    }
-  };
-}
-
-// src/runtime/inspect.ts
-var RULE = {
-  sqli: "RUNTIME-SQLI-001",
-  xss: "RUNTIME-XSS-001",
-  path: "RUNTIME-PATH-001"
-};
-function bodyStats(value, depth = 0) {
-  if (value === null || value === void 0) return { bytes: 0, depth, keys: 0 };
-  if (typeof value === "string") return { bytes: value.length, depth, keys: 0 };
-  if (typeof value === "number" || typeof value === "boolean") {
-    return { bytes: String(value).length, depth, keys: 0 };
-  }
-  if (typeof value !== "object") return { bytes: 0, depth, keys: 0 };
-  const entries = Object.entries(value);
-  let bytes = 2;
-  let keys = entries.length;
-  let maxDepth = depth;
-  for (const [k, v] of entries) {
-    bytes += k.length;
-    const inner = bodyStats(v, depth + 1);
-    bytes += inner.bytes;
-    keys += inner.keys;
-    if (inner.depth > maxDepth) maxDepth = inner.depth;
-  }
-  return { bytes, depth: maxDepth, keys };
-}
-var DEFAULT_MAX_ROUTES = 1e3;
-var DEFAULT_MAX_PARAM_NAMES = 200;
-function keysOf(value) {
-  if (value === null || value === void 0 || typeof value !== "object") return [];
-  return Object.keys(value);
-}
-function createInspector(options = {}) {
-  const mode = options.mode ?? "monitor";
-  const authRoutes = new Set(options.authRoutes ?? ["/login"]);
-  const limiter = createRateLimiter(options.rateLimit ?? { windowMs: 6e4, max: 20 });
-  const maxBodyBytes = options.maxBodyBytes ?? 1e6;
-  const maxBodyDepth = options.maxBodyDepth ?? 8;
-  const maxBodyKeys = options.maxBodyKeys ?? 200;
-  const anomaly = options.anomaly;
-  const maxRoutes = anomaly?.maxRoutes ?? DEFAULT_MAX_ROUTES;
-  const maxParamNames = anomaly?.maxParamNames ?? DEFAULT_MAX_PARAM_NAMES;
-  const routes = new LruMap(maxRoutes);
-  let windowStart;
-  const inspect = ((req) => {
-    const path = req.path ?? req.url?.split("?")[0] ?? "/";
-    const ip = req.ip ?? "unknown";
-    const emit = (ruleId, sample, shouldBlock) => {
-      const event = { ruleId, path, ip, sample: sample.slice(0, 40) };
-      options.onEvent?.(event);
-      if (shouldBlock) options.onBlock?.(event);
-      return { block: shouldBlock, event };
-    };
-    if (authRoutes.has(path) && !limiter.allow(`${ip}:${path}`)) {
-      return emit("RUNTIME-RATELIMIT-001", path, mode === "block");
-    }
-    const stats = bodyStats(req.body);
-    if (stats.bytes > maxBodyBytes || stats.depth > maxBodyDepth || stats.keys > maxBodyKeys) {
-      return emit("RUNTIME-BODY-001", "oversized-body", mode === "block");
-    }
-    const values = [
-      ...flattenValues(req.query),
-      ...flattenValues(req.body),
-      ...flattenValues(req.params)
-    ];
-    const kind = inspectValues(values);
-    if (kind !== void 0) {
-      return emit(RULE[kind], kind, mode === "block");
-    }
-    if (anomaly !== void 0) {
-      const now = anomaly.now ?? Date.now;
-      const t = now();
-      if (windowStart === void 0) windowStart = t;
-      const learning = t - windowStart < anomaly.learnMinutes * 6e4;
-      let baseline = routes.get(path);
-      if (baseline === void 0) {
-        baseline = {
-          count: 0,
-          bodySum: 0,
-          paramNames: new LruMap(maxParamNames),
-          status401: 0,
-          status404: 0,
-          recent404: 0
-        };
-        routes.set(path, baseline);
-      }
-      const names = [...keysOf(req.query), ...keysOf(req.body), ...keysOf(req.params)];
-      const status = req.statusCode;
-      if (learning) {
-        baseline.count += 1;
-        baseline.bodySum += stats.bytes;
-        for (const n of names) baseline.paramNames.set(n, true);
-        if (status === 401) baseline.status401 += 1;
-        if (status === 404) baseline.status404 += 1;
-      } else {
-        const newParam = names.some((n) => !baseline.paramNames.has(n));
-        const spike401 = status === 401 && baseline.status401 === 0 && baseline.count > 0;
-        if (status === 404) baseline.recent404 += 1;
-        else baseline.recent404 = 0;
-        const burst404 = baseline.recent404 >= 3 && baseline.status404 === 0 && baseline.count > 0;
-        if (newParam || spike401 || burst404) {
-          const event = {
-            ruleId: "RUNTIME-ANOMALY-001",
-            path,
-            ip,
-            sample: newParam ? "new-param" : spike401 ? "401-spike" : "404-burst"
-          };
-          anomaly.onAnomaly?.(event);
-          options.onEvent?.(event);
-          return { block: false, event };
-        }
-      }
-    }
-    return { block: false };
-  });
-  Object.defineProperty(inspect, "limiterSize", { get: () => limiter.size });
-  Object.defineProperty(inspect, "routeCount", { get: () => routes.size });
-  inspect.paramCount = (path) => routes.get(path)?.paramNames.size ?? 0;
-  return inspect;
-}
-
-export { createInspector, createRateLimiter, detectAttack, flattenValues, inspectValues };
+var j=/('\s*or\s+'?1'?\s*='?1)|union\s+select|;\s*drop\s+table|;\s*delete\s+from/i,z=/<\s*script\b|javascript:\s*|onerror\s*=/i,U=/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\\)/i;function p(e,t=[],n=0){if(n>8||t.length>200)return t;if(typeof e=="string")return t.push(e),t;if(Array.isArray(e)){for(let r of e)p(r,t,n+1);return t}if(e!==null&&typeof e=="object")for(let r of Object.values(e))p(r,t,n+1);return t}function G(e){if(U.test(e))return "path";if(z.test(e))return "xss";if(j.test(e))return "sqli"}function L(e){for(let t of e){let n=G(t);if(n!==void 0)return n}}var f=class{constructor(t){this.max=t;if(t<1)throw new Error("LruMap max must be >= 1")}max;map=new Map;get size(){return this.map.size}has(t){return this.map.has(t)}get(t){if(!this.map.has(t))return;let n=this.map.get(t);return this.map.delete(t),this.map.set(t,n),n}set(t,n){for(this.map.has(t)&&this.map.delete(t),this.map.set(t,n);this.map.size>this.max;){let r=this.map.keys().next().value;if(r===void 0)break;this.map.delete(r);}return this}};var V=1e4;function K(e){let t=e.maxKeys??V,n=new f(t);return {allow(r,m=Date.now()){let c=m-e.windowMs,o=n.get(r);if(o===void 0)return n.set(r,[m]),true;let a=0;for(let u=0;u<o.length;u+=1){let l=o[u];l!==void 0&&l>c&&(o[a]=l,a+=1);}return o.length=a,o.length>=e.max?(n.set(r,o),false):(o.push(m),n.set(r,o),true)},get size(){return n.size},get maxKeys(){return t}}}var D={sqli:"RUNTIME-SQLI-001",xss:"RUNTIME-XSS-001",path:"RUNTIME-PATH-001"};function T(e,t=0){if(e==null)return {bytes:0,depth:t,keys:0};if(typeof e=="string")return {bytes:e.length,depth:t,keys:0};if(typeof e=="number"||typeof e=="boolean")return {bytes:String(e).length,depth:t,keys:0};if(typeof e!="object")return {bytes:0,depth:t,keys:0};let n=Object.entries(e),r=2,m=n.length,c=t;for(let[o,a]of n){r+=o.length;let u=T(a,t+1);r+=u.bytes,m+=u.keys,u.depth>c&&(c=u.depth);}return {bytes:r,depth:c,keys:m}}var P=1e3,C=200;function S(e){return e==null||typeof e!="object"?[]:Object.keys(e)}function X(e={}){let t=e.mode??"monitor",n=new Set(e.authRoutes??["/login"]),r=K(e.rateLimit??{windowMs:6e4,max:20}),m=e.maxBodyBytes??1e6,c=e.maxBodyDepth??8,o=e.maxBodyKeys??200,a=e.anomaly,u=a?.maxRoutes??P,l=a?.maxParamNames??C,y=new f(u),I,g=(i=>{let d=i.path??i.url?.split("?")[0]??"/",A=i.ip??"unknown",E=(B,x,k)=>{let s={ruleId:B,path:d,ip:A,sample:x.slice(0,40)};return e.onEvent?.(s),k&&e.onBlock?.(s),{block:k,event:s}};if(n.has(d)&&!r.allow(`${A}:${d}`))return E("RUNTIME-RATELIMIT-001",d,t==="block");let h=T(i.body);if(h.bytes>m||h.depth>c||h.keys>o)return E("RUNTIME-BODY-001","oversized-body",t==="block");let v=[...p(i.query),...p(i.body),...p(i.params)],M=L(v);if(M!==void 0)return E(D[M],M,t==="block");if(a!==void 0){let x=(a.now??Date.now)();I===void 0&&(I=x);let k=x-I<a.learnMinutes*6e4,s=y.get(d);s===void 0&&(s={count:0,bodySum:0,paramNames:new f(l),status401:0,status404:0,recent404:0},y.set(d,s));let N=[...S(i.query),...S(i.body),...S(i.params)],R=i.statusCode;if(k){s.count+=1,s.bodySum+=h.bytes;for(let w of N)s.paramNames.set(w,true);R===401&&(s.status401+=1),R===404&&(s.status404+=1);}else {let w=N.some(b=>!s.paramNames.has(b)),O=R===401&&s.status401===0&&s.count>0;R===404?s.recent404+=1:s.recent404=0;let _=s.recent404>=3&&s.status404===0&&s.count>0;if(w||O||_){let b={ruleId:"RUNTIME-ANOMALY-001",path:d,ip:A,sample:w?"new-param":O?"401-spike":"404-burst"};return a.onAnomaly?.(b),e.onEvent?.(b),{block:false,event:b}}}}return {block:false}});return Object.defineProperty(g,"limiterSize",{get:()=>r.size}),Object.defineProperty(g,"routeCount",{get:()=>y.size}),g.paramCount=i=>y.get(i)?.paramNames.size??0,g}export{X as createInspector,K as createRateLimiter,G as detectAttack,p as flattenValues,L as inspectValues};