hi-secure 1.0.0

package/src/adapters/XSSAdapter.ts

@@ -0,0 +1,153 @@
+// src/adapters/XSSAdapter.ts - NEW FILE
+import { FilterXSS, getDefaultWhiteList, whiteList } from 'xss';
+import { AdapterError } from "../core/errors/AdapterError.js";
+import { logger } from "../logging/index.js";
+
+export interface XSSOptions {
+    whiteList?: typeof whiteList;
+    stripIgnoreTag?: boolean;
+    stripIgnoreTagBody?: string[];
+    allowCommentTag?: boolean;
+    css?: boolean | { [key: string]: boolean };
+    onTag?: (tag: string, html: string, options: any) => string;
+    onTagAttr?: (tag: string, name: string, value: string, isWhiteAttr: boolean) => string;
+    onIgnoreTag?: (tag: string, html: string, options: any) => string;
+    [key: string]: any;
+}
+
+export class XSSAdapter {
+    private globalOptions: XSSOptions;
+    private defaultFilter: FilterXSS;
+
+    constructor(options: XSSOptions = {}) {
+        this.globalOptions = options;
+        
+        // Default safe configuration
+        const defaultOptions: XSSOptions = {
+            whiteList: getDefaultWhiteList(),
+            stripIgnoreTag: true, // Remove non-whitelisted tags completely
+            stripIgnoreTagBody: ['script', 'style', 'iframe', 'object', 'embed'],
+            allowCommentTag: false,
+            css: false, // Disable CSS by default
+            onTag: (tag, html, options) => {
+                // Add noopener/noreferrer to links for security
+                if (tag === 'a') {
+                    return html.replace(/<a /i, '<a target="_blank" rel="noopener noreferrer" ');
+                }
+                return html;
+            }
+        };
+
+        const finalOptions = { ...defaultOptions, ...options };
+        this.defaultFilter = new FilterXSS(finalOptions);
+    }
+
+    /**
+     * Sanitize a string with global + dynamic merged options
+     */
+    sanitize(input: string, dynamicOptions?: XSSOptions): string {
+        try {
+            if (typeof input !== "string") {
+                return input as any;
+            }
+
+            // If no dynamic options, use default filter
+            if (!dynamicOptions || Object.keys(dynamicOptions).length === 0) {
+                return this.defaultFilter.process(input);
+            }
+
+            // Merge options for this specific call
+            const mergedOptions = { ...this.globalOptions, ...dynamicOptions };
+            const customFilter = new FilterXSS(mergedOptions);
+            
+            return customFilter.process(input);
+
+        } catch (err: any) {
+            logger.error("❌ XSS sanitizer failed", {
+                error: err?.message,
+                preview: input?.slice?.(0, 80)
+            });
+            throw new AdapterError("XSS sanitizer failed.");
+        }
+    }
+
+    /**
+     * Middleware wrapper WITH dynamic options
+     * Doesn't mutate original request - creates sanitized copy
+     */
+    middleware(dynamicOptions?: XSSOptions) {
+        return (req: any, _res: any, next: any) => {
+            try {
+                if (req.body && typeof req.body === "object") {
+                    const originalBody = req.body;
+                    const sanitizedBody: any = Array.isArray(originalBody) ? [] : {};
+                    
+                    for (const key of Object.keys(originalBody)) {
+                        const val = originalBody[key];
+
+                        if (typeof val === "string") {
+                            sanitizedBody[key] = this.sanitize(val, dynamicOptions);
+                        } else if (Array.isArray(val)) {
+                            sanitizedBody[key] = val.map((v) =>
+                                typeof v === "string"
+                                    ? this.sanitize(v, dynamicOptions)
+                                    : v
+                            );
+                        } else if (val && typeof val === "object") {
+                            // Handle nested objects (simple recursion)
+                            sanitizedBody[key] = this.deepSanitize(val, dynamicOptions);
+                        } else {
+                            sanitizedBody[key] = val;
+                        }
+                    }
+                    
+                    // Store sanitized version separately
+                    req.sanitizedBody = sanitizedBody;
+                    
+                    logger.debug("🛡️ XSS sanitizer applied", {
+                        originalKeys: Object.keys(originalBody),
+                        sanitizedKeys: Object.keys(sanitizedBody)
+                    });
+                }
+
+                next();
+            } catch (err: any) {
+                logger.error("❌ XSS middleware failed", {
+                    error: err?.message || err
+                });
+                next(err);
+            }
+        };
+    }
+
+    /**
+     * Deep sanitize nested objects/arrays
+     */
+    private deepSanitize(obj: any, options?: XSSOptions, visited = new WeakSet()): any {
+        // Handle circular references
+        if (obj && typeof obj === "object") {
+            if (visited.has(obj)) {
+                return obj;
+            }
+            visited.add(obj);
+        }
+
+        if (typeof obj === "string") {
+            return this.sanitize(obj, options);
+        }
+
+        if (Array.isArray(obj)) {
+            return obj.map(item => this.deepSanitize(item, options, visited));
+        }
+
+        if (obj && typeof obj === "object") {
+            const result: any = {};
+            for (const key of Object.keys(obj)) {
+                result[key] = this.deepSanitize(obj[key], options, visited);
+            }
+            return result;
+        }
+
+        return obj;
+    }
+}

package/src/adapters/ZodAdapter.ts

@@ -0,0 +1,91 @@
+// import { ZodSchema, ZodError } from "zod";
+// import { ValidationError } from "../core/errors/ValidationError";
+// import { logger } from "../logging";
+
+// export class ZodAdapter {
+//     private globalSchema?: ZodSchema;
+
+//     constructor(globalSchema?: ZodSchema) {
+//         this.globalSchema = globalSchema as any;
+//     }
+
+//     /**
+//      * Validate with global + dynamic schema (dynamic overrides global)
+//      */
+//     validate(dynamicSchema?: ZodSchema) {
+//         return (req: any, res: any, next: any) => {
+//             const schema = dynamicSchema || this.globalSchema;
+
+//             if (!schema) return next(); // no validation for this route
+
+//             const result = schema.safeParse(req.body);
+
+//             if (result.success) return next();
+
+//             const zodErr: ZodError = result.error;
+
+//             const issues = zodErr.issues.map(issue => ({
+//                 message: issue.message,
+//                 path: issue.path.join("."),
+//                 code: issue.code
+//             }));
+
+//             logger.warn("⚠ Zod validation failed", {
+//                 path: req.path,
+//                 method: req.method,
+//                 issues,
+//                 preview: JSON.stringify(req.body).slice(0, 200)
+//             });
+
+//             return next(
+//                 new ValidationError(issues[0]?.message || "Validation failed.")
+//             );
+//         };
+//     }
+// }
+
+
+
+// src/adapters/ZodAdapter.ts - FIXED
+import { ZodSchema, ZodError } from "zod";
+import { ValidationError } from "../core/errors/ValidationError.js"; // ✅ Add .js
+import { logger } from "../logging/index.js";
+
+export class ZodAdapter {
+    private globalSchema?: ZodSchema;
+
+    constructor(globalSchema?: ZodSchema) {
+        this.globalSchema = globalSchema;
+    }
+
+    validate(dynamicSchema?: ZodSchema) {
+        return (req: any, res: any, next: any) => {
+            const schema = dynamicSchema || this.globalSchema;
+
+            if (!schema) return next();
+
+            const result = schema.safeParse(req.body);
+
+            if (result.success) return next();
+
+            const zodErr: ZodError = result.error;
+
+            const issues = zodErr.issues.map(issue => ({
+                message: issue.message,
+                path: issue.path.join("."),
+                code: issue.code
+            }));
+
+            logger.warn("⚠ Zod validation failed", {
+                path: req.path,
+                method: req.method,
+                issues,
+                preview: JSON.stringify(req.body).slice(0, 200)
+            });
+
+            return next(
+                new ValidationError("Validation failed.", issues as any) // ✅ Pass issues
+            );
+        };
+    }
+}