hppx 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Hiprax
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,124 @@
+# hppx
+
+🔐 **Superior HTTP Parameter Pollution protection middleware** for Node.js/Express, written in TypeScript. It sanitizes `req.query`, `req.body`, and `req.params`, blocks prototype-pollution keys, supports nested whitelists, multiple merge strategies, and plays nicely with stacked middlewares.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.8.3-blue.svg)](https://www.typescriptlang.org/)
+[![Node.js](https://img.shields.io/badge/Node.js-18+-green.svg)](https://nodejs.org/)
+
+## Features
+
+- Array merging strategies: `keepFirst`, `keepLast` (default), `combine`
+- Safe-by-default: blocks `__proto__`, `prototype`, `constructor`
+- Nested whitelist with dot-notation and leaf matching
+- Records polluted parameters on the request (`queryPolluted`, `bodyPolluted`, `paramsPolluted`)
+- Works with multiple middlewares on different routes (whitelists applied incrementally)
+- DoS-guards: `maxDepth`, `maxKeys`
+- Fully typed API and helpers (`sanitize`)
+
+## 📦 Installation
+
+```bash
+npm install hppx
+```
+
+## Usage
+
+```ts
+import express from "express";
+import hppx from "hppx";
+
+const app = express();
+app.use(express.urlencoded({ extended: true }));
+app.use(express.json());
+
+app.use(
+  hppx({
+    whitelist: ["tags", "user.roles", "ids"],
+    mergeStrategy: "keepLast",
+    sources: ["query", "body"],
+  })
+);
+
+app.get("/search", (req, res) => {
+  res.json({
+    query: req.query,
+    queryPolluted: req.queryPolluted ?? {},
+    body: req.body ?? {},
+    bodyPolluted: req.bodyPolluted ?? {},
+  });
+});
+```
+
+## API
+
+### default export: `hppx(options?: HppxOptions)`
+
+Creates an Express-compatible middleware. Applies sanitization to each selected source and exposes `*.Polluted` objects.
+
+Key options:
+
+- `whitelist?: string[]` — keys allowed as arrays; supports dot-notation; leaf matches too
+- `mergeStrategy?: 'keepFirst'|'keepLast'|'combine'` — how to reduce arrays when not whitelisted
+- `sources?: Array<'query'|'body'|'params'>` — which request parts to sanitize
+- `checkBodyContentType?: 'urlencoded'|'any'|'none'` — when to process `req.body` (default: `urlencoded`)
+- `excludePaths?: string[]` — exclude specific paths (supports `*` suffix)
+- `maxDepth?: number` and `maxKeys?: number` — DoS protections
+- `strict?: boolean` — if pollution detected, immediately respond 400
+- `onPollutionDetected?: (req, info) => void` — callback on detection
+
+### named export: `sanitize(input, options)`
+
+Sanitize an arbitrary object using the same rules as the middleware. Useful for manual usage.
+
+## Advanced usage
+
+- Strict mode (respond 400 on pollution):
+
+```ts
+app.use(hppx({ strict: true }));
+```
+
+- Process JSON bodies too:
+
+```ts
+app.use(express.json());
+app.use(hppx({ checkBodyContentType: 'any' }));
+```
+
+- Exclude specific paths (supports `*` suffix):
+
+```ts
+app.use(hppx({ excludePaths: ['/public', '/assets*'] }));
+```
+
+- Use the sanitizer directly:
+
+```ts
+import { sanitize } from 'hppx';
+
+const clean = sanitize(payload, {
+  whitelist: ['user.tags'],
+  mergeStrategy: 'keepFirst',
+});
+```
+
+## Notes
+
+- Arrays are reduced by default; whitelisted paths are preserved as arrays.
+- Dangerous keys like `__proto__`, `prototype`, `constructor` are removed.
+- DoS protections are available via `maxDepth` and `maxKeys`.
+
+## 📄 License
+
+MIT License - see [LICENSE](LICENSE) file for details.
+
+## 🔗 Links
+
+- [NPM Package](https://www.npmjs.com/package/@hiprax/hppx)
+- [GitHub Repository](https://github.com/Hiprax/hppx)
+- [Issue Tracker](https://github.com/Hiprax/hppx/issues)
+
+---
+
+### **Made with ❤️ for secure applications**

package/dist/index.cjs

@@ -0,0 +1,349 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DANGEROUS_KEYS: () => DANGEROUS_KEYS,
+  DEFAULT_SOURCES: () => DEFAULT_SOURCES,
+  DEFAULT_STRATEGY: () => DEFAULT_STRATEGY,
+  default: () => hppx,
+  sanitize: () => sanitize
+});
+module.exports = __toCommonJS(index_exports);
+var DEFAULT_SOURCES = ["query", "body", "params"];
+var DEFAULT_STRATEGY = "keepLast";
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function sanitizeKey(key) {
+  if (typeof key !== "string") return null;
+  if (DANGEROUS_KEYS.has(key)) return null;
+  if (key.includes("\0")) return null;
+  return key;
+}
+function parsePathSegments(key) {
+  const dotted = key.replace(/\]/g, "").replace(/\[/g, ".");
+  return dotted.split(".").filter((s) => s.length > 0);
+}
+function expandObjectPaths(obj) {
+  const result = {};
+  for (const rawKey of Object.keys(obj)) {
+    const safeKey = sanitizeKey(rawKey);
+    if (!safeKey) continue;
+    const value = obj[rawKey];
+    const expandedValue = isPlainObject(value) ? expandObjectPaths(value) : value;
+    if (safeKey.includes(".") || safeKey.includes("[")) {
+      const segments = parsePathSegments(safeKey);
+      if (segments.length > 0) {
+        setIn(result, segments, expandedValue);
+        continue;
+      }
+    }
+    result[safeKey] = expandedValue;
+  }
+  return result;
+}
+function setReqPropertySafe(target, key, value) {
+  try {
+    const desc = Object.getOwnPropertyDescriptor(target, key);
+    if (desc && desc.configurable === false && desc.writable === false) {
+      return;
+    }
+    if (!desc || desc.configurable !== false) {
+      Object.defineProperty(target, key, {
+        value,
+        writable: true,
+        configurable: true,
+        enumerable: true
+      });
+      return;
+    }
+  } catch (_) {
+  }
+  try {
+    target[key] = value;
+  } catch (_) {
+  }
+}
+function safeDeepClone(input) {
+  if (Array.isArray(input)) {
+    return input.map((v) => safeDeepClone(v));
+  }
+  if (isPlainObject(input)) {
+    const out = {};
+    for (const k of Object.keys(input)) {
+      if (!sanitizeKey(k)) continue;
+      out[k] = safeDeepClone(input[k]);
+    }
+    return out;
+  }
+  return input;
+}
+function mergeValues(values, strategy) {
+  switch (strategy) {
+    case "keepFirst":
+      return values[0];
+    case "keepLast":
+      return values[values.length - 1];
+    case "combine":
+      return values.reduce((acc, v) => {
+        if (Array.isArray(v)) acc.push(...v);
+        else acc.push(v);
+        return acc;
+      }, []);
+    default:
+      return values[values.length - 1];
+  }
+}
+function isUrlEncodedContentType(req) {
+  const ct = String(req?.headers?.["content-type"] || "").toLowerCase();
+  return ct.startsWith("application/x-www-form-urlencoded");
+}
+function shouldExcludePath(path, excludePaths) {
+  if (!path || excludePaths.length === 0) return false;
+  const currentPath = path;
+  for (const p of excludePaths) {
+    if (p.endsWith("*")) {
+      if (currentPath.startsWith(p.slice(0, -1))) return true;
+    } else if (currentPath === p) {
+      return true;
+    }
+  }
+  return false;
+}
+function normalizeWhitelist(whitelist) {
+  if (!whitelist) return [];
+  if (typeof whitelist === "string") return [whitelist];
+  return whitelist.filter((w) => typeof w === "string");
+}
+function buildWhitelistHelpers(whitelist) {
+  const exact = new Set(whitelist);
+  const prefixes = whitelist.filter((w) => w.length > 0);
+  return {
+    exact,
+    prefixes,
+    isWhitelistedPath(pathParts) {
+      if (pathParts.length === 0) return false;
+      const full = pathParts.join(".");
+      if (exact.has(full)) return true;
+      const leaf = pathParts[pathParts.length - 1];
+      if (exact.has(leaf)) return true;
+      for (const p of prefixes) {
+        if (full === p || full.startsWith(p + ".")) return true;
+      }
+      return false;
+    }
+  };
+}
+function setIn(target, path, value) {
+  if (path.length === 0) {
+    return;
+  }
+  let cur = target;
+  for (let i = 0; i < path.length - 1; i++) {
+    const k = path[i];
+    if (!isPlainObject(cur[k])) cur[k] = {};
+    cur = cur[k];
+  }
+  const lastKey = path[path.length - 1];
+  cur[lastKey] = value;
+}
+function moveWhitelistedFromPolluted(reqPart, polluted, isWhitelisted) {
+  function walk(node, path = [], parent) {
+    for (const k of Object.keys(node)) {
+      const v = node[k];
+      const curPath = [...path, k];
+      if (isPlainObject(v)) {
+        walk(v, curPath, node);
+        if (Object.keys(v).length === 0) {
+          delete node[k];
+        }
+      } else {
+        if (isWhitelisted(curPath)) {
+          const normalizedPath = curPath.flatMap(
+            (seg) => seg.includes(".") ? seg.split(".") : [seg]
+          );
+          setIn(reqPart, normalizedPath, v);
+          delete node[k];
+        }
+      }
+    }
+  }
+  walk(polluted);
+}
+function detectAndReduce(input, opts) {
+  let keyCount = 0;
+  const polluted = {};
+  const pollutedKeys = [];
+  function processNode(node, path = [], depth = 0) {
+    if (node === null || node === void 0) return opts.preserveNull ? node : node;
+    if (Array.isArray(node)) {
+      const mapped = node.map((v) => processNode(v, path, depth));
+      if (opts.mergeStrategy === "combine") {
+        return mergeValues(mapped, "combine");
+      }
+      setIn(polluted, path, safeDeepClone(node));
+      pollutedKeys.push(path.join("."));
+      const reduced = mergeValues(mapped, opts.mergeStrategy);
+      return reduced;
+    }
+    if (isPlainObject(node)) {
+      if (depth > opts.maxDepth)
+        throw new Error(`Maximum object depth (${opts.maxDepth}) exceeded`);
+      const out = {};
+      for (const rawKey of Object.keys(node)) {
+        keyCount++;
+        if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {
+          throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);
+        }
+        const safeKey = sanitizeKey(rawKey);
+        if (!safeKey) continue;
+        const child = node[rawKey];
+        const childPath = path.concat([safeKey]);
+        let value = processNode(child, childPath, depth + 1);
+        if (typeof value === "string" && opts.trimValues) value = value.trim();
+        out[safeKey] = value;
+      }
+      return out;
+    }
+    return node;
+  }
+  const cloned = safeDeepClone(input);
+  const cleaned = processNode(cloned, [], 0);
+  return { cleaned, pollutedTree: polluted, pollutedKeys };
+}
+function sanitize(input, options = {}) {
+  const expandedInput = isPlainObject(input) ? expandObjectPaths(input) : input;
+  const whitelist = normalizeWhitelist(options.whitelist);
+  const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);
+  const {
+    mergeStrategy = DEFAULT_STRATEGY,
+    maxDepth = 20,
+    maxKeys = 5e3,
+    trimValues = false,
+    preserveNull = true
+  } = options;
+  const { cleaned, pollutedTree } = detectAndReduce(expandedInput, {
+    mergeStrategy,
+    maxDepth,
+    maxKeys,
+    trimValues,
+    preserveNull
+  });
+  moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);
+  return cleaned;
+}
+function hppx(options = {}) {
+  const {
+    whitelist = [],
+    mergeStrategy = DEFAULT_STRATEGY,
+    sources = DEFAULT_SOURCES,
+    checkBodyContentType = "urlencoded",
+    excludePaths = [],
+    maxDepth = 20,
+    maxKeys = 5e3,
+    trimValues = false,
+    preserveNull = true,
+    strict = false,
+    onPollutionDetected,
+    logger
+  } = options;
+  const whitelistArr = normalizeWhitelist(whitelist);
+  const { isWhitelistedPath } = buildWhitelistHelpers(whitelistArr);
+  return function hppxMiddleware(req, res, next) {
+    try {
+      if (shouldExcludePath(req?.path, excludePaths)) return next();
+      let anyPollutionDetected = false;
+      const allPollutedKeys = [];
+      for (const source of sources) {
+        if (!req || typeof req !== "object") break;
+        if (req[source] === void 0) continue;
+        if (source === "body") {
+          if (checkBodyContentType === "none") continue;
+          if (checkBodyContentType === "urlencoded" && !isUrlEncodedContentType(req)) continue;
+        }
+        const part = req[source];
+        if (!isPlainObject(part)) continue;
+        const expandedPart = expandObjectPaths(part);
+        const pollutedKey = `${source}Polluted`;
+        const processedKey = `__hppxProcessed_${source}`;
+        const hasProcessedBefore = Boolean(req[processedKey]);
+        if (!hasProcessedBefore) {
+          const { cleaned, pollutedTree, pollutedKeys } = detectAndReduce(expandedPart, {
+            mergeStrategy,
+            maxDepth,
+            maxKeys,
+            trimValues,
+            preserveNull
+          });
+          setReqPropertySafe(req, source, cleaned);
+          setReqPropertySafe(req, pollutedKey, pollutedTree);
+          req[processedKey] = true;
+          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);
+          if (pollutedKeys.length > 0) {
+            anyPollutionDetected = true;
+            for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);
+          }
+        } else {
+          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);
+        }
+      }
+      if (anyPollutionDetected) {
+        if (onPollutionDetected) {
+          try {
+            onPollutionDetected(req, {
+              source: "query",
+              pollutedKeys: allPollutedKeys
+            });
+          } catch (_) {
+          }
+        }
+        if (strict && res && typeof res.status === "function") {
+          return res.status(400).json({
+            error: "Bad Request",
+            message: "HTTP Parameter Pollution detected",
+            pollutedParameters: allPollutedKeys,
+            code: "HPP_DETECTED"
+          });
+        }
+      }
+      return next();
+    } catch (err) {
+      if (logger) {
+        try {
+          logger(err);
+        } catch (_) {
+        }
+      }
+      return next(err);
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DANGEROUS_KEYS,
+  DEFAULT_SOURCES,
+  DEFAULT_STRATEGY,
+  sanitize
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\r\n * hppx — Superior HTTP Parameter Pollution protection middleware\r\n *\r\n * - Protects against parameter and prototype pollution\r\n * - Supports nested whitelists via dot-notation and leaf matching\r\n * - Merge strategies: keepFirst | keepLast | combine\r\n * - Multiple middleware compatibility: arrays are \"put aside\" once and selectively restored\r\n * - Exposes req.queryPolluted / req.bodyPolluted / req.paramsPolluted\r\n * - TypeScript-first API\r\n */\r\n\r\nexport type RequestSource = \"query\" | \"body\" | \"params\";\r\nexport type MergeStrategy = \"keepFirst\" | \"keepLast\" | \"combine\";\r\n\r\nexport interface SanitizeOptions {\r\n  whitelist?: string[] | string;\r\n  mergeStrategy?: MergeStrategy;\r\n  maxDepth?: number;\r\n  maxKeys?: number;\r\n  trimValues?: boolean;\r\n  preserveNull?: boolean;\r\n}\r\n\r\nexport interface HppxOptions extends SanitizeOptions {\r\n  sources?: RequestSource[];\r\n  /** When to process req.body */\r\n  checkBodyContentType?: \"urlencoded\" | \"any\" | \"none\";\r\n  excludePaths?: string[];\r\n  strict?: boolean;\r\n  onPollutionDetected?: (req: any, info: { source: RequestSource; pollutedKeys: string[] }) => void;\r\n  logger?: (err: unknown) => void;\r\n}\r\n\r\nexport interface SanitizedResult<T> {\r\n  cleaned: T;\r\n  pollutedTree: Record<string, unknown>;\r\n  pollutedKeys: string[];\r\n}\r\n\r\nconst DEFAULT_SOURCES: RequestSource[] = [\"query\", \"body\", \"params\"];\r\nconst DEFAULT_STRATEGY: MergeStrategy = \"keepLast\";\r\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\r\n\r\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\r\n  if (value === null || typeof value !== \"object\") return false;\r\n  const proto = Object.getPrototypeOf(value);\r\n  return proto === Object.prototype || proto === null;\r\n}\r\n\r\nfunction sanitizeKey(key: string): string | null {\r\n  /* istanbul ignore next */ if (typeof key !== \"string\") return null;\r\n  if (DANGEROUS_KEYS.has(key)) return null;\r\n  if (key.includes(\"\\u0000\")) return null;\r\n  return key;\r\n}\r\n\r\nfunction parsePathSegments(key: string): string[] {\r\n  // Convert bracket notation to dots, then split\r\n  // a[b][c] -> a.b.c\r\n  const dotted = key.replace(/\\]/g, \"\").replace(/\\[/g, \".\");\r\n  return dotted.split(\".\").filter((s) => s.length > 0);\r\n}\r\n\r\nfunction expandObjectPaths(obj: Record<string, unknown>): Record<string, unknown> {\r\n  const result: Record<string, unknown> = {};\r\n  for (const rawKey of Object.keys(obj)) {\r\n    const safeKey = sanitizeKey(rawKey);\r\n    if (!safeKey) continue;\r\n    const value = (obj as any)[rawKey];\r\n\r\n    // Recursively expand nested objects first\r\n    const expandedValue = isPlainObject(value)\r\n      ? expandObjectPaths(value as Record<string, unknown>)\r\n      : value;\r\n\r\n    if (safeKey.includes(\".\") || safeKey.includes(\"[\")) {\r\n      const segments = parsePathSegments(safeKey);\r\n      if (segments.length > 0) {\r\n        setIn(result, segments, expandedValue);\r\n        continue;\r\n      }\r\n    }\r\n    result[safeKey] = expandedValue;\r\n  }\r\n  return result;\r\n}\r\n\r\nfunction setReqPropertySafe(target: any, key: string, value: unknown): void {\r\n  try {\r\n    const desc = Object.getOwnPropertyDescriptor(target, key);\r\n    if (desc && desc.configurable === false && desc.writable === false) {\r\n      // Non-configurable and not writable: skip\r\n      return;\r\n    }\r\n    if (!desc || desc.configurable !== false) {\r\n      Object.defineProperty(target, key, {\r\n        value,\r\n        writable: true,\r\n        configurable: true,\r\n        enumerable: true,\r\n      });\r\n      return;\r\n    }\r\n  } catch (_) {\r\n    // fall back to assignment below\r\n  }\r\n  try {\r\n    target[key] = value;\r\n  } catch (_) {\r\n    // last resort: skip if cannot assign\r\n  }\r\n}\r\n\r\nfunction safeDeepClone<T>(input: T): T {\r\n  if (Array.isArray(input)) {\r\n    return input.map((v) => safeDeepClone(v)) as T;\r\n  }\r\n  if (isPlainObject(input)) {\r\n    const out: Record<string, unknown> = {};\r\n    for (const k of Object.keys(input)) {\r\n      if (!sanitizeKey(k)) continue;\r\n      out[k] = safeDeepClone((input as Record<string, unknown>)[k]);\r\n    }\r\n    return out as T;\r\n  }\r\n  return input;\r\n}\r\n\r\nfunction mergeValues(values: unknown[], strategy: MergeStrategy): unknown {\r\n  switch (strategy) {\r\n    case \"keepFirst\":\r\n      return values[0];\r\n    case \"keepLast\":\r\n      return values[values.length - 1];\r\n    case \"combine\":\r\n      return values.reduce<unknown[]>((acc, v) => {\r\n        if (Array.isArray(v)) acc.push(...v);\r\n        else acc.push(v);\r\n        return acc;\r\n      }, []);\r\n    default:\r\n      return values[values.length - 1];\r\n  }\r\n}\r\n\r\nfunction isUrlEncodedContentType(req: any): boolean {\r\n  const ct = String(req?.headers?.[\"content-type\"] || \"\").toLowerCase();\r\n  return ct.startsWith(\"application/x-www-form-urlencoded\");\r\n}\r\n\r\nfunction shouldExcludePath(path: string | undefined, excludePaths: string[]): boolean {\r\n  if (!path || excludePaths.length === 0) return false;\r\n  const currentPath = path;\r\n  for (const p of excludePaths) {\r\n    if (p.endsWith(\"*\")) {\r\n      if (currentPath.startsWith(p.slice(0, -1))) return true;\r\n    } else if (currentPath === p) {\r\n      return true;\r\n    }\r\n  }\r\n  return false;\r\n}\r\n\r\nfunction normalizeWhitelist(whitelist?: string[] | string): string[] {\r\n  if (!whitelist) return [];\r\n  if (typeof whitelist === \"string\") return [whitelist];\r\n  return whitelist.filter((w) => typeof w === \"string\");\r\n}\r\n\r\nfunction buildWhitelistHelpers(whitelist: string[]) {\r\n  const exact = new Set(whitelist);\r\n  const prefixes = whitelist.filter((w) => w.length > 0);\r\n  return {\r\n    exact,\r\n    prefixes,\r\n    isWhitelistedPath(pathParts: string[]): boolean {\r\n      if (pathParts.length === 0) return false;\r\n      const full = pathParts.join(\".\");\r\n      if (exact.has(full)) return true;\r\n      // leaf match\r\n      const leaf = pathParts[pathParts.length - 1]!;\r\n      if (exact.has(leaf)) return true;\r\n      // prefix match (treat any listed segment as prefix of a subtree)\r\n      for (const p of prefixes) {\r\n        if (full === p || full.startsWith(p + \".\")) return true;\r\n      }\r\n      return false;\r\n    },\r\n  };\r\n}\r\n\r\nfunction setIn(target: Record<string, unknown>, path: string[], value: unknown): void {\r\n  /* istanbul ignore if */\r\n  if (path.length === 0) {\r\n    return;\r\n  }\r\n  let cur: any = target;\r\n  for (let i = 0; i < path.length - 1; i++) {\r\n    const k = path[i]!;\r\n    if (!isPlainObject(cur[k])) cur[k] = {};\r\n    cur = cur[k];\r\n  }\r\n  const lastKey = path[path.length - 1]!;\r\n  cur[lastKey] = value;\r\n}\r\n\r\nfunction moveWhitelistedFromPolluted(\r\n  reqPart: Record<string, unknown>,\r\n  polluted: Record<string, unknown>,\r\n  isWhitelisted: (path: string[]) => boolean,\r\n): void {\r\n  function walk(\r\n    node: Record<string, unknown>,\r\n    path: string[] = [],\r\n    parent?: Record<string, unknown>,\r\n  ) {\r\n    for (const k of Object.keys(node)) {\r\n      const v = node[k];\r\n      const curPath = [...path, k];\r\n      if (isPlainObject(v)) {\r\n        walk(v as Record<string, unknown>, curPath, node);\r\n        // prune empty objects\r\n        if (Object.keys(v as Record<string, unknown>).length === 0) {\r\n          delete (node as any)[k];\r\n        }\r\n      } else {\r\n        if (isWhitelisted(curPath)) {\r\n          // put back into request\r\n          const normalizedPath = curPath.flatMap((seg) =>\r\n            seg.includes(\".\") ? seg.split(\".\") : [seg],\r\n          );\r\n          setIn(reqPart, normalizedPath, v);\r\n          delete (node as any)[k];\r\n        }\r\n      }\r\n    }\r\n  }\r\n  walk(polluted);\r\n}\r\n\r\nfunction detectAndReduce(\r\n  input: Record<string, unknown>,\r\n  opts: Required<\r\n    Pick<SanitizeOptions, \"mergeStrategy\" | \"maxDepth\" | \"maxKeys\" | \"trimValues\" | \"preserveNull\">\r\n  >,\r\n): SanitizedResult<Record<string, unknown>> {\r\n  let keyCount = 0;\r\n  const polluted: Record<string, unknown> = {};\r\n  const pollutedKeys: string[] = [];\r\n\r\n  function processNode(node: unknown, path: string[] = [], depth = 0): unknown {\r\n    if (node === null || node === undefined) return opts.preserveNull ? node : node;\r\n\r\n    if (Array.isArray(node)) {\r\n      const mapped = node.map((v) => processNode(v, path, depth));\r\n      if (opts.mergeStrategy === \"combine\") {\r\n        // combine: do not record pollution, but flatten using mergeValues\r\n        return mergeValues(mapped, \"combine\");\r\n      }\r\n      // Other strategies: record pollution and reduce\r\n      setIn(polluted, path, safeDeepClone(node));\r\n      pollutedKeys.push(path.join(\".\"));\r\n      const reduced = mergeValues(mapped, opts.mergeStrategy);\r\n      return reduced;\r\n    }\r\n\r\n    if (isPlainObject(node)) {\r\n      if (depth > opts.maxDepth)\r\n        throw new Error(`Maximum object depth (${opts.maxDepth}) exceeded`);\r\n      const out: Record<string, unknown> = {};\r\n      for (const rawKey of Object.keys(node)) {\r\n        keyCount++;\r\n        if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {\r\n          throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);\r\n        }\r\n        const safeKey = sanitizeKey(rawKey);\r\n        if (!safeKey) continue;\r\n        const child = (node as Record<string, unknown>)[rawKey];\r\n        const childPath = path.concat([safeKey]);\r\n        let value = processNode(child, childPath, depth + 1);\r\n        if (typeof value === \"string\" && opts.trimValues) value = value.trim();\r\n        out[safeKey] = value;\r\n      }\r\n      return out;\r\n    }\r\n\r\n    return node;\r\n  }\r\n\r\n  const cloned = safeDeepClone(input);\r\n  const cleaned = processNode(cloned, [], 0) as Record<string, unknown>;\r\n  return { cleaned, pollutedTree: polluted, pollutedKeys };\r\n}\r\n\r\nexport function sanitize<T extends Record<string, unknown>>(\r\n  input: T,\r\n  options: SanitizeOptions = {},\r\n): T {\r\n  // Normalize and expand keys prior to sanitization\r\n  const expandedInput = isPlainObject(input) ? expandObjectPaths(input) : input;\r\n  const whitelist = normalizeWhitelist(options.whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);\r\n  const {\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n  } = options;\r\n\r\n  // First: reduce arrays and collect polluted\r\n  const { cleaned, pollutedTree } = detectAndReduce(expandedInput, {\r\n    mergeStrategy,\r\n    maxDepth,\r\n    maxKeys,\r\n    trimValues,\r\n    preserveNull,\r\n  });\r\n\r\n  // Second: move back whitelisted arrays\r\n  moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);\r\n\r\n  return cleaned as T;\r\n}\r\n\r\ntype ExpressLikeNext = (err?: any) => void;\r\n\r\nexport default function hppx(options: HppxOptions = {}) {\r\n  const {\r\n    whitelist = [],\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    sources = DEFAULT_SOURCES,\r\n    checkBodyContentType = \"urlencoded\",\r\n    excludePaths = [],\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n    strict = false,\r\n    onPollutionDetected,\r\n    logger,\r\n  } = options;\r\n\r\n  const whitelistArr = normalizeWhitelist(whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelistArr);\r\n\r\n  return function hppxMiddleware(req: any, res: any, next: ExpressLikeNext) {\r\n    try {\r\n      if (shouldExcludePath(req?.path, excludePaths)) return next();\r\n\r\n      let anyPollutionDetected = false;\r\n      const allPollutedKeys: string[] = [];\r\n\r\n      for (const source of sources) {\r\n        /* istanbul ignore next */ if (!req || typeof req !== \"object\") break;\r\n        if (req[source] === undefined) continue;\r\n\r\n        if (source === \"body\") {\r\n          if (checkBodyContentType === \"none\") continue;\r\n          if (checkBodyContentType === \"urlencoded\" && !isUrlEncodedContentType(req)) continue;\r\n        }\r\n\r\n        const part = req[source];\r\n        if (!isPlainObject(part)) continue;\r\n\r\n        // Preprocess: expand dotted and bracketed keys into nested objects\r\n        const expandedPart = expandObjectPaths(part);\r\n\r\n        const pollutedKey = `${source}Polluted`;\r\n        const processedKey = `__hppxProcessed_${source}`;\r\n        const hasProcessedBefore = Boolean((req as any)[processedKey]);\r\n\r\n        if (!hasProcessedBefore) {\r\n          // First pass for this request part: reduce arrays and collect polluted\r\n          const { cleaned, pollutedTree, pollutedKeys } = detectAndReduce(expandedPart, {\r\n            mergeStrategy,\r\n            maxDepth,\r\n            maxKeys,\r\n            trimValues,\r\n            preserveNull,\r\n          });\r\n\r\n          setReqPropertySafe(req, source, cleaned);\r\n\r\n          // Attach polluted object (always present as {} when source processed)\r\n          setReqPropertySafe(req, pollutedKey, pollutedTree);\r\n          (req as any)[processedKey] = true;\r\n\r\n          // Apply whitelist now: move whitelisted arrays back\r\n          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);\r\n\r\n          if (pollutedKeys.length > 0) {\r\n            anyPollutionDetected = true;\r\n            for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);\r\n          }\r\n        } else {\r\n          // Subsequent middleware: only put back whitelisted entries\r\n          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);\r\n          // pollution already accounted for in previous pass\r\n        }\r\n      }\r\n\r\n      if (anyPollutionDetected) {\r\n        if (onPollutionDetected) {\r\n          try {\r\n            onPollutionDetected(req, {\r\n              source: \"query\",\r\n              pollutedKeys: allPollutedKeys,\r\n            });\r\n          } catch (_) {\r\n            /* ignore user callback errors */\r\n          }\r\n        }\r\n        if (strict && res && typeof res.status === \"function\") {\r\n          return res.status(400).json({\r\n            error: \"Bad Request\",\r\n            message: \"HTTP Parameter Pollution detected\",\r\n            pollutedParameters: allPollutedKeys,\r\n            code: \"HPP_DETECTED\",\r\n          });\r\n        }\r\n      }\r\n\r\n      return next();\r\n    } catch (err) {\r\n      if (logger) {\r\n        try {\r\n          logger(err);\r\n        } catch (_) {\r\n          /* noop */\r\n        }\r\n      }\r\n      return next(err);\r\n    }\r\n  };\r\n}\r\n\r\nexport { DANGEROUS_KEYS, DEFAULT_STRATEGY, DEFAULT_SOURCES };\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuCA,IAAM,kBAAmC,CAAC,SAAS,QAAQ,QAAQ;AACnE,IAAM,mBAAkC;AACxC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAExE,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,YAAY,KAA4B;AACpB,MAAI,OAAO,QAAQ,SAAU,QAAO;AAC/D,MAAI,eAAe,IAAI,GAAG,EAAG,QAAO;AACpC,MAAI,IAAI,SAAS,IAAQ,EAAG,QAAO;AACnC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAuB;AAGhD,QAAM,SAAS,IAAI,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,GAAG;AACxD,SAAO,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD;AAEA,SAAS,kBAAkB,KAAuD;AAChF,QAAM,SAAkC,CAAC;AACzC,aAAW,UAAU,OAAO,KAAK,GAAG,GAAG;AACrC,UAAM,UAAU,YAAY,MAAM;AAClC,QAAI,CAAC,QAAS;AACd,UAAM,QAAS,IAAY,MAAM;AAGjC,UAAM,gBAAgB,cAAc,KAAK,IACrC,kBAAkB,KAAgC,IAClD;AAEJ,QAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAClD,YAAM,WAAW,kBAAkB,OAAO;AAC1C,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,QAAQ,UAAU,aAAa;AACrC;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAa,KAAa,OAAsB;AAC1E,MAAI;AACF,UAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;AACxD,QAAI,QAAQ,KAAK,iBAAiB,SAAS,KAAK,aAAa,OAAO;AAElE;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,KAAK,iBAAiB,OAAO;AACxC,aAAO,eAAe,QAAQ,KAAK;AAAA,QACjC;AAAA,QACA,UAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AACD;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACA,MAAI;AACF,WAAO,GAAG,IAAI;AAAA,EAChB,SAAS,GAAG;AAAA,EAEZ;AACF;AAEA,SAAS,cAAiB,OAAa;AACrC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC;AAAA,EAC1C;AACA,MAAI,cAAc,KAAK,GAAG;AACxB,UAAM,MAA+B,CAAC;AACtC,eAAW,KAAK,OAAO,KAAK,KAAK,GAAG;AAClC,UAAI,CAAC,YAAY,CAAC,EAAG;AACrB,UAAI,CAAC,IAAI,cAAe,MAAkC,CAAC,CAAC;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAmB,UAAkC;AACxE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,OAAO,CAAC;AAAA,IACjB,KAAK;AACH,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,OAAO,OAAkB,CAAC,KAAK,MAAM;AAC1C,YAAI,MAAM,QAAQ,CAAC,EAAG,KAAI,KAAK,GAAG,CAAC;AAAA,YAC9B,KAAI,KAAK,CAAC;AACf,eAAO;AAAA,MACT,GAAG,CAAC,CAAC;AAAA,IACP;AACE,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,wBAAwB,KAAmB;AAClD,QAAM,KAAK,OAAO,KAAK,UAAU,cAAc,KAAK,EAAE,EAAE,YAAY;AACpE,SAAO,GAAG,WAAW,mCAAmC;AAC1D;AAEA,SAAS,kBAAkB,MAA0B,cAAiC;AACpF,MAAI,CAAC,QAAQ,aAAa,WAAW,EAAG,QAAO;AAC/C,QAAM,cAAc;AACpB,aAAW,KAAK,cAAc;AAC5B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,UAAI,YAAY,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC,EAAG,QAAO;AAAA,IACrD,WAAW,gBAAgB,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,WAAyC;AACnE,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,MAAI,OAAO,cAAc,SAAU,QAAO,CAAC,SAAS;AACpD,SAAO,UAAU,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ;AACtD;AAEA,SAAS,sBAAsB,WAAqB;AAClD,QAAM,QAAQ,IAAI,IAAI,SAAS;AAC/B,QAAM,WAAW,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,kBAAkB,WAA8B;AAC9C,UAAI,UAAU,WAAW,EAAG,QAAO;AACnC,YAAM,OAAO,UAAU,KAAK,GAAG;AAC/B,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAE5B,YAAM,OAAO,UAAU,UAAU,SAAS,CAAC;AAC3C,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAE5B,iBAAW,KAAK,UAAU;AACxB,YAAI,SAAS,KAAK,KAAK,WAAW,IAAI,GAAG,EAAG,QAAO;AAAA,MACrD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,MAAM,QAAiC,MAAgB,OAAsB;AAEpF,MAAI,KAAK,WAAW,GAAG;AACrB;AAAA,EACF;AACA,MAAI,MAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK;AACxC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,CAAC,cAAc,IAAI,CAAC,CAAC,EAAG,KAAI,CAAC,IAAI,CAAC;AACtC,UAAM,IAAI,CAAC;AAAA,EACb;AACA,QAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,MAAI,OAAO,IAAI;AACjB;AAEA,SAAS,4BACP,SACA,UACA,eACM;AACN,WAAS,KACP,MACA,OAAiB,CAAC,GAClB,QACA;AACA,eAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,YAAM,IAAI,KAAK,CAAC;AAChB,YAAM,UAAU,CAAC,GAAG,MAAM,CAAC;AAC3B,UAAI,cAAc,CAAC,GAAG;AACpB,aAAK,GAA8B,SAAS,IAAI;AAEhD,YAAI,OAAO,KAAK,CAA4B,EAAE,WAAW,GAAG;AAC1D,iBAAQ,KAAa,CAAC;AAAA,QACxB;AAAA,MACF,OAAO;AACL,YAAI,cAAc,OAAO,GAAG;AAE1B,gBAAM,iBAAiB,QAAQ;AAAA,YAAQ,CAAC,QACtC,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG;AAAA,UAC3C;AACA,gBAAM,SAAS,gBAAgB,CAAC;AAChC,iBAAQ,KAAa,CAAC;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,OAAK,QAAQ;AACf;AAEA,SAAS,gBACP,OACA,MAG0C;AAC1C,MAAI,WAAW;AACf,QAAM,WAAoC,CAAC;AAC3C,QAAM,eAAyB,CAAC;AAEhC,WAAS,YAAY,MAAe,OAAiB,CAAC,GAAG,QAAQ,GAAY;AAC3E,QAAI,SAAS,QAAQ,SAAS,OAAW,QAAO,KAAK,eAAe,OAAO;AAE3E,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,YAAM,SAAS,KAAK,IAAI,CAAC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC;AAC1D,UAAI,KAAK,kBAAkB,WAAW;AAEpC,eAAO,YAAY,QAAQ,SAAS;AAAA,MACtC;AAEA,YAAM,UAAU,MAAM,cAAc,IAAI,CAAC;AACzC,mBAAa,KAAK,KAAK,KAAK,GAAG,CAAC;AAChC,YAAM,UAAU,YAAY,QAAQ,KAAK,aAAa;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,cAAc,IAAI,GAAG;AACvB,UAAI,QAAQ,KAAK;AACf,cAAM,IAAI,MAAM,yBAAyB,KAAK,QAAQ,YAAY;AACpE,YAAM,MAA+B,CAAC;AACtC,iBAAW,UAAU,OAAO,KAAK,IAAI,GAAG;AACtC;AACA,YAAI,YAAY,KAAK,WAAW,OAAO,mBAAmB;AACxD,gBAAM,IAAI,MAAM,sBAAsB,KAAK,OAAO,YAAY;AAAA,QAChE;AACA,cAAM,UAAU,YAAY,MAAM;AAClC,YAAI,CAAC,QAAS;AACd,cAAM,QAAS,KAAiC,MAAM;AACtD,cAAM,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC;AACvC,YAAI,QAAQ,YAAY,OAAO,WAAW,QAAQ,CAAC;AACnD,YAAI,OAAO,UAAU,YAAY,KAAK,WAAY,SAAQ,MAAM,KAAK;AACrE,YAAI,OAAO,IAAI;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,cAAc,KAAK;AAClC,QAAM,UAAU,YAAY,QAAQ,CAAC,GAAG,CAAC;AACzC,SAAO,EAAE,SAAS,cAAc,UAAU,aAAa;AACzD;AAEO,SAAS,SACd,OACA,UAA2B,CAAC,GACzB;AAEH,QAAM,gBAAgB,cAAc,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACxE,QAAM,YAAY,mBAAmB,QAAQ,SAAS;AACtD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,SAAS;AAC7D,QAAM;AAAA,IACJ,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB,IAAI;AAGJ,QAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,eAAe;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,8BAA4B,SAAS,cAAc,iBAAiB;AAEpE,SAAO;AACT;AAIe,SAAR,KAAsB,UAAuB,CAAC,GAAG;AACtD,QAAM;AAAA,IACJ,YAAY,CAAC;AAAA,IACb,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,eAAe,CAAC;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,eAAe,mBAAmB,SAAS;AACjD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,YAAY;AAEhE,SAAO,SAAS,eAAe,KAAU,KAAU,MAAuB;AACxE,QAAI;AACF,UAAI,kBAAkB,KAAK,MAAM,YAAY,EAAG,QAAO,KAAK;AAE5D,UAAI,uBAAuB;AAC3B,YAAM,kBAA4B,CAAC;AAEnC,iBAAW,UAAU,SAAS;AACD,YAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AAChE,YAAI,IAAI,MAAM,MAAM,OAAW;AAE/B,YAAI,WAAW,QAAQ;AACrB,cAAI,yBAAyB,OAAQ;AACrC,cAAI,yBAAyB,gBAAgB,CAAC,wBAAwB,GAAG,EAAG;AAAA,QAC9E;AAEA,cAAM,OAAO,IAAI,MAAM;AACvB,YAAI,CAAC,cAAc,IAAI,EAAG;AAG1B,cAAM,eAAe,kBAAkB,IAAI;AAE3C,cAAM,cAAc,GAAG,MAAM;AAC7B,cAAM,eAAe,mBAAmB,MAAM;AAC9C,cAAM,qBAAqB,QAAS,IAAY,YAAY,CAAC;AAE7D,YAAI,CAAC,oBAAoB;AAEvB,gBAAM,EAAE,SAAS,cAAc,aAAa,IAAI,gBAAgB,cAAc;AAAA,YAC5E;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,6BAAmB,KAAK,QAAQ,OAAO;AAGvC,6BAAmB,KAAK,aAAa,YAAY;AACjD,UAAC,IAAY,YAAY,IAAI;AAG7B,sCAA4B,IAAI,MAAM,GAAG,IAAI,WAAW,GAAG,iBAAiB;AAE5E,cAAI,aAAa,SAAS,GAAG;AAC3B,mCAAuB;AACvB,uBAAW,KAAK,aAAc,iBAAgB,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE;AAAA,UACrE;AAAA,QACF,OAAO;AAEL,sCAA4B,IAAI,MAAM,GAAG,IAAI,WAAW,GAAG,iBAAiB;AAAA,QAE9E;AAAA,MACF;AAEA,UAAI,sBAAsB;AACxB,YAAI,qBAAqB;AACvB,cAAI;AACF,gCAAoB,KAAK;AAAA,cACvB,QAAQ;AAAA,cACR,cAAc;AAAA,YAChB,CAAC;AAAA,UACH,SAAS,GAAG;AAAA,UAEZ;AAAA,QACF;AACA,YAAI,UAAU,OAAO,OAAO,IAAI,WAAW,YAAY;AACrD,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS;AAAA,YACT,oBAAoB;AAAA,YACpB,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,UAAI,QAAQ;AACV,YAAI;AACF,iBAAO,GAAG;AAAA,QACZ,SAAS,GAAG;AAAA,QAEZ;AAAA,MACF;AACA,aAAO,KAAK,GAAG;AAAA,IACjB;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,45 @@
+/**
+ * hppx — Superior HTTP Parameter Pollution protection middleware
+ *
+ * - Protects against parameter and prototype pollution
+ * - Supports nested whitelists via dot-notation and leaf matching
+ * - Merge strategies: keepFirst | keepLast | combine
+ * - Multiple middleware compatibility: arrays are "put aside" once and selectively restored
+ * - Exposes req.queryPolluted / req.bodyPolluted / req.paramsPolluted
+ * - TypeScript-first API
+ */
+type RequestSource = "query" | "body" | "params";
+type MergeStrategy = "keepFirst" | "keepLast" | "combine";
+interface SanitizeOptions {
+    whitelist?: string[] | string;
+    mergeStrategy?: MergeStrategy;
+    maxDepth?: number;
+    maxKeys?: number;
+    trimValues?: boolean;
+    preserveNull?: boolean;
+}
+interface HppxOptions extends SanitizeOptions {
+    sources?: RequestSource[];
+    /** When to process req.body */
+    checkBodyContentType?: "urlencoded" | "any" | "none";
+    excludePaths?: string[];
+    strict?: boolean;
+    onPollutionDetected?: (req: any, info: {
+        source: RequestSource;
+        pollutedKeys: string[];
+    }) => void;
+    logger?: (err: unknown) => void;
+}
+interface SanitizedResult<T> {
+    cleaned: T;
+    pollutedTree: Record<string, unknown>;
+    pollutedKeys: string[];
+}
+declare const DEFAULT_SOURCES: RequestSource[];
+declare const DEFAULT_STRATEGY: MergeStrategy;
+declare const DANGEROUS_KEYS: Set<string>;
+declare function sanitize<T extends Record<string, unknown>>(input: T, options?: SanitizeOptions): T;
+type ExpressLikeNext = (err?: any) => void;
+declare function hppx(options?: HppxOptions): (req: any, res: any, next: ExpressLikeNext) => any;
+
+export { DANGEROUS_KEYS, DEFAULT_SOURCES, DEFAULT_STRATEGY, type HppxOptions, type MergeStrategy, type RequestSource, type SanitizeOptions, type SanitizedResult, hppx as default, sanitize };

package/dist/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * hppx — Superior HTTP Parameter Pollution protection middleware
+ *
+ * - Protects against parameter and prototype pollution
+ * - Supports nested whitelists via dot-notation and leaf matching
+ * - Merge strategies: keepFirst | keepLast | combine
+ * - Multiple middleware compatibility: arrays are "put aside" once and selectively restored
+ * - Exposes req.queryPolluted / req.bodyPolluted / req.paramsPolluted
+ * - TypeScript-first API
+ */
+type RequestSource = "query" | "body" | "params";
+type MergeStrategy = "keepFirst" | "keepLast" | "combine";
+interface SanitizeOptions {
+    whitelist?: string[] | string;
+    mergeStrategy?: MergeStrategy;
+    maxDepth?: number;
+    maxKeys?: number;
+    trimValues?: boolean;
+    preserveNull?: boolean;
+}
+interface HppxOptions extends SanitizeOptions {
+    sources?: RequestSource[];
+    /** When to process req.body */
+    checkBodyContentType?: "urlencoded" | "any" | "none";
+    excludePaths?: string[];
+    strict?: boolean;
+    onPollutionDetected?: (req: any, info: {
+        source: RequestSource;
+        pollutedKeys: string[];
+    }) => void;
+    logger?: (err: unknown) => void;
+}
+interface SanitizedResult<T> {
+    cleaned: T;
+    pollutedTree: Record<string, unknown>;
+    pollutedKeys: string[];
+}
+declare const DEFAULT_SOURCES: RequestSource[];
+declare const DEFAULT_STRATEGY: MergeStrategy;
+declare const DANGEROUS_KEYS: Set<string>;
+declare function sanitize<T extends Record<string, unknown>>(input: T, options?: SanitizeOptions): T;
+type ExpressLikeNext = (err?: any) => void;
+declare function hppx(options?: HppxOptions): (req: any, res: any, next: ExpressLikeNext) => any;
+
+export { DANGEROUS_KEYS, DEFAULT_SOURCES, DEFAULT_STRATEGY, type HppxOptions, type MergeStrategy, type RequestSource, type SanitizeOptions, type SanitizedResult, hppx as default, sanitize };

package/dist/index.js

@@ -0,0 +1,321 @@
+// src/index.ts
+var DEFAULT_SOURCES = ["query", "body", "params"];
+var DEFAULT_STRATEGY = "keepLast";
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function sanitizeKey(key) {
+  if (typeof key !== "string") return null;
+  if (DANGEROUS_KEYS.has(key)) return null;
+  if (key.includes("\0")) return null;
+  return key;
+}
+function parsePathSegments(key) {
+  const dotted = key.replace(/\]/g, "").replace(/\[/g, ".");
+  return dotted.split(".").filter((s) => s.length > 0);
+}
+function expandObjectPaths(obj) {
+  const result = {};
+  for (const rawKey of Object.keys(obj)) {
+    const safeKey = sanitizeKey(rawKey);
+    if (!safeKey) continue;
+    const value = obj[rawKey];
+    const expandedValue = isPlainObject(value) ? expandObjectPaths(value) : value;
+    if (safeKey.includes(".") || safeKey.includes("[")) {
+      const segments = parsePathSegments(safeKey);
+      if (segments.length > 0) {
+        setIn(result, segments, expandedValue);
+        continue;
+      }
+    }
+    result[safeKey] = expandedValue;
+  }
+  return result;
+}
+function setReqPropertySafe(target, key, value) {
+  try {
+    const desc = Object.getOwnPropertyDescriptor(target, key);
+    if (desc && desc.configurable === false && desc.writable === false) {
+      return;
+    }
+    if (!desc || desc.configurable !== false) {
+      Object.defineProperty(target, key, {
+        value,
+        writable: true,
+        configurable: true,
+        enumerable: true
+      });
+      return;
+    }
+  } catch (_) {
+  }
+  try {
+    target[key] = value;
+  } catch (_) {
+  }
+}
+function safeDeepClone(input) {
+  if (Array.isArray(input)) {
+    return input.map((v) => safeDeepClone(v));
+  }
+  if (isPlainObject(input)) {
+    const out = {};
+    for (const k of Object.keys(input)) {
+      if (!sanitizeKey(k)) continue;
+      out[k] = safeDeepClone(input[k]);
+    }
+    return out;
+  }
+  return input;
+}
+function mergeValues(values, strategy) {
+  switch (strategy) {
+    case "keepFirst":
+      return values[0];
+    case "keepLast":
+      return values[values.length - 1];
+    case "combine":
+      return values.reduce((acc, v) => {
+        if (Array.isArray(v)) acc.push(...v);
+        else acc.push(v);
+        return acc;
+      }, []);
+    default:
+      return values[values.length - 1];
+  }
+}
+function isUrlEncodedContentType(req) {
+  const ct = String(req?.headers?.["content-type"] || "").toLowerCase();
+  return ct.startsWith("application/x-www-form-urlencoded");
+}
+function shouldExcludePath(path, excludePaths) {
+  if (!path || excludePaths.length === 0) return false;
+  const currentPath = path;
+  for (const p of excludePaths) {
+    if (p.endsWith("*")) {
+      if (currentPath.startsWith(p.slice(0, -1))) return true;
+    } else if (currentPath === p) {
+      return true;
+    }
+  }
+  return false;
+}
+function normalizeWhitelist(whitelist) {
+  if (!whitelist) return [];
+  if (typeof whitelist === "string") return [whitelist];
+  return whitelist.filter((w) => typeof w === "string");
+}
+function buildWhitelistHelpers(whitelist) {
+  const exact = new Set(whitelist);
+  const prefixes = whitelist.filter((w) => w.length > 0);
+  return {
+    exact,
+    prefixes,
+    isWhitelistedPath(pathParts) {
+      if (pathParts.length === 0) return false;
+      const full = pathParts.join(".");
+      if (exact.has(full)) return true;
+      const leaf = pathParts[pathParts.length - 1];
+      if (exact.has(leaf)) return true;
+      for (const p of prefixes) {
+        if (full === p || full.startsWith(p + ".")) return true;
+      }
+      return false;
+    }
+  };
+}
+function setIn(target, path, value) {
+  if (path.length === 0) {
+    return;
+  }
+  let cur = target;
+  for (let i = 0; i < path.length - 1; i++) {
+    const k = path[i];
+    if (!isPlainObject(cur[k])) cur[k] = {};
+    cur = cur[k];
+  }
+  const lastKey = path[path.length - 1];
+  cur[lastKey] = value;
+}
+function moveWhitelistedFromPolluted(reqPart, polluted, isWhitelisted) {
+  function walk(node, path = [], parent) {
+    for (const k of Object.keys(node)) {
+      const v = node[k];
+      const curPath = [...path, k];
+      if (isPlainObject(v)) {
+        walk(v, curPath, node);
+        if (Object.keys(v).length === 0) {
+          delete node[k];
+        }
+      } else {
+        if (isWhitelisted(curPath)) {
+          const normalizedPath = curPath.flatMap(
+            (seg) => seg.includes(".") ? seg.split(".") : [seg]
+          );
+          setIn(reqPart, normalizedPath, v);
+          delete node[k];
+        }
+      }
+    }
+  }
+  walk(polluted);
+}
+function detectAndReduce(input, opts) {
+  let keyCount = 0;
+  const polluted = {};
+  const pollutedKeys = [];
+  function processNode(node, path = [], depth = 0) {
+    if (node === null || node === void 0) return opts.preserveNull ? node : node;
+    if (Array.isArray(node)) {
+      const mapped = node.map((v) => processNode(v, path, depth));
+      if (opts.mergeStrategy === "combine") {
+        return mergeValues(mapped, "combine");
+      }
+      setIn(polluted, path, safeDeepClone(node));
+      pollutedKeys.push(path.join("."));
+      const reduced = mergeValues(mapped, opts.mergeStrategy);
+      return reduced;
+    }
+    if (isPlainObject(node)) {
+      if (depth > opts.maxDepth)
+        throw new Error(`Maximum object depth (${opts.maxDepth}) exceeded`);
+      const out = {};
+      for (const rawKey of Object.keys(node)) {
+        keyCount++;
+        if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {
+          throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);
+        }
+        const safeKey = sanitizeKey(rawKey);
+        if (!safeKey) continue;
+        const child = node[rawKey];
+        const childPath = path.concat([safeKey]);
+        let value = processNode(child, childPath, depth + 1);
+        if (typeof value === "string" && opts.trimValues) value = value.trim();
+        out[safeKey] = value;
+      }
+      return out;
+    }
+    return node;
+  }
+  const cloned = safeDeepClone(input);
+  const cleaned = processNode(cloned, [], 0);
+  return { cleaned, pollutedTree: polluted, pollutedKeys };
+}
+function sanitize(input, options = {}) {
+  const expandedInput = isPlainObject(input) ? expandObjectPaths(input) : input;
+  const whitelist = normalizeWhitelist(options.whitelist);
+  const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);
+  const {
+    mergeStrategy = DEFAULT_STRATEGY,
+    maxDepth = 20,
+    maxKeys = 5e3,
+    trimValues = false,
+    preserveNull = true
+  } = options;
+  const { cleaned, pollutedTree } = detectAndReduce(expandedInput, {
+    mergeStrategy,
+    maxDepth,
+    maxKeys,
+    trimValues,
+    preserveNull
+  });
+  moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);
+  return cleaned;
+}
+function hppx(options = {}) {
+  const {
+    whitelist = [],
+    mergeStrategy = DEFAULT_STRATEGY,
+    sources = DEFAULT_SOURCES,
+    checkBodyContentType = "urlencoded",
+    excludePaths = [],
+    maxDepth = 20,
+    maxKeys = 5e3,
+    trimValues = false,
+    preserveNull = true,
+    strict = false,
+    onPollutionDetected,
+    logger
+  } = options;
+  const whitelistArr = normalizeWhitelist(whitelist);
+  const { isWhitelistedPath } = buildWhitelistHelpers(whitelistArr);
+  return function hppxMiddleware(req, res, next) {
+    try {
+      if (shouldExcludePath(req?.path, excludePaths)) return next();
+      let anyPollutionDetected = false;
+      const allPollutedKeys = [];
+      for (const source of sources) {
+        if (!req || typeof req !== "object") break;
+        if (req[source] === void 0) continue;
+        if (source === "body") {
+          if (checkBodyContentType === "none") continue;
+          if (checkBodyContentType === "urlencoded" && !isUrlEncodedContentType(req)) continue;
+        }
+        const part = req[source];
+        if (!isPlainObject(part)) continue;
+        const expandedPart = expandObjectPaths(part);
+        const pollutedKey = `${source}Polluted`;
+        const processedKey = `__hppxProcessed_${source}`;
+        const hasProcessedBefore = Boolean(req[processedKey]);
+        if (!hasProcessedBefore) {
+          const { cleaned, pollutedTree, pollutedKeys } = detectAndReduce(expandedPart, {
+            mergeStrategy,
+            maxDepth,
+            maxKeys,
+            trimValues,
+            preserveNull
+          });
+          setReqPropertySafe(req, source, cleaned);
+          setReqPropertySafe(req, pollutedKey, pollutedTree);
+          req[processedKey] = true;
+          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);
+          if (pollutedKeys.length > 0) {
+            anyPollutionDetected = true;
+            for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);
+          }
+        } else {
+          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);
+        }
+      }
+      if (anyPollutionDetected) {
+        if (onPollutionDetected) {
+          try {
+            onPollutionDetected(req, {
+              source: "query",
+              pollutedKeys: allPollutedKeys
+            });
+          } catch (_) {
+          }
+        }
+        if (strict && res && typeof res.status === "function") {
+          return res.status(400).json({
+            error: "Bad Request",
+            message: "HTTP Parameter Pollution detected",
+            pollutedParameters: allPollutedKeys,
+            code: "HPP_DETECTED"
+          });
+        }
+      }
+      return next();
+    } catch (err) {
+      if (logger) {
+        try {
+          logger(err);
+        } catch (_) {
+        }
+      }
+      return next(err);
+    }
+  };
+}
+export {
+  DANGEROUS_KEYS,
+  DEFAULT_SOURCES,
+  DEFAULT_STRATEGY,
+  hppx as default,
+  sanitize
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\r\n * hppx — Superior HTTP Parameter Pollution protection middleware\r\n *\r\n * - Protects against parameter and prototype pollution\r\n * - Supports nested whitelists via dot-notation and leaf matching\r\n * - Merge strategies: keepFirst | keepLast | combine\r\n * - Multiple middleware compatibility: arrays are \"put aside\" once and selectively restored\r\n * - Exposes req.queryPolluted / req.bodyPolluted / req.paramsPolluted\r\n * - TypeScript-first API\r\n */\r\n\r\nexport type RequestSource = \"query\" | \"body\" | \"params\";\r\nexport type MergeStrategy = \"keepFirst\" | \"keepLast\" | \"combine\";\r\n\r\nexport interface SanitizeOptions {\r\n  whitelist?: string[] | string;\r\n  mergeStrategy?: MergeStrategy;\r\n  maxDepth?: number;\r\n  maxKeys?: number;\r\n  trimValues?: boolean;\r\n  preserveNull?: boolean;\r\n}\r\n\r\nexport interface HppxOptions extends SanitizeOptions {\r\n  sources?: RequestSource[];\r\n  /** When to process req.body */\r\n  checkBodyContentType?: \"urlencoded\" | \"any\" | \"none\";\r\n  excludePaths?: string[];\r\n  strict?: boolean;\r\n  onPollutionDetected?: (req: any, info: { source: RequestSource; pollutedKeys: string[] }) => void;\r\n  logger?: (err: unknown) => void;\r\n}\r\n\r\nexport interface SanitizedResult<T> {\r\n  cleaned: T;\r\n  pollutedTree: Record<string, unknown>;\r\n  pollutedKeys: string[];\r\n}\r\n\r\nconst DEFAULT_SOURCES: RequestSource[] = [\"query\", \"body\", \"params\"];\r\nconst DEFAULT_STRATEGY: MergeStrategy = \"keepLast\";\r\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\r\n\r\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\r\n  if (value === null || typeof value !== \"object\") return false;\r\n  const proto = Object.getPrototypeOf(value);\r\n  return proto === Object.prototype || proto === null;\r\n}\r\n\r\nfunction sanitizeKey(key: string): string | null {\r\n  /* istanbul ignore next */ if (typeof key !== \"string\") return null;\r\n  if (DANGEROUS_KEYS.has(key)) return null;\r\n  if (key.includes(\"\\u0000\")) return null;\r\n  return key;\r\n}\r\n\r\nfunction parsePathSegments(key: string): string[] {\r\n  // Convert bracket notation to dots, then split\r\n  // a[b][c] -> a.b.c\r\n  const dotted = key.replace(/\\]/g, \"\").replace(/\\[/g, \".\");\r\n  return dotted.split(\".\").filter((s) => s.length > 0);\r\n}\r\n\r\nfunction expandObjectPaths(obj: Record<string, unknown>): Record<string, unknown> {\r\n  const result: Record<string, unknown> = {};\r\n  for (const rawKey of Object.keys(obj)) {\r\n    const safeKey = sanitizeKey(rawKey);\r\n    if (!safeKey) continue;\r\n    const value = (obj as any)[rawKey];\r\n\r\n    // Recursively expand nested objects first\r\n    const expandedValue = isPlainObject(value)\r\n      ? expandObjectPaths(value as Record<string, unknown>)\r\n      : value;\r\n\r\n    if (safeKey.includes(\".\") || safeKey.includes(\"[\")) {\r\n      const segments = parsePathSegments(safeKey);\r\n      if (segments.length > 0) {\r\n        setIn(result, segments, expandedValue);\r\n        continue;\r\n      }\r\n    }\r\n    result[safeKey] = expandedValue;\r\n  }\r\n  return result;\r\n}\r\n\r\nfunction setReqPropertySafe(target: any, key: string, value: unknown): void {\r\n  try {\r\n    const desc = Object.getOwnPropertyDescriptor(target, key);\r\n    if (desc && desc.configurable === false && desc.writable === false) {\r\n      // Non-configurable and not writable: skip\r\n      return;\r\n    }\r\n    if (!desc || desc.configurable !== false) {\r\n      Object.defineProperty(target, key, {\r\n        value,\r\n        writable: true,\r\n        configurable: true,\r\n        enumerable: true,\r\n      });\r\n      return;\r\n    }\r\n  } catch (_) {\r\n    // fall back to assignment below\r\n  }\r\n  try {\r\n    target[key] = value;\r\n  } catch (_) {\r\n    // last resort: skip if cannot assign\r\n  }\r\n}\r\n\r\nfunction safeDeepClone<T>(input: T): T {\r\n  if (Array.isArray(input)) {\r\n    return input.map((v) => safeDeepClone(v)) as T;\r\n  }\r\n  if (isPlainObject(input)) {\r\n    const out: Record<string, unknown> = {};\r\n    for (const k of Object.keys(input)) {\r\n      if (!sanitizeKey(k)) continue;\r\n      out[k] = safeDeepClone((input as Record<string, unknown>)[k]);\r\n    }\r\n    return out as T;\r\n  }\r\n  return input;\r\n}\r\n\r\nfunction mergeValues(values: unknown[], strategy: MergeStrategy): unknown {\r\n  switch (strategy) {\r\n    case \"keepFirst\":\r\n      return values[0];\r\n    case \"keepLast\":\r\n      return values[values.length - 1];\r\n    case \"combine\":\r\n      return values.reduce<unknown[]>((acc, v) => {\r\n        if (Array.isArray(v)) acc.push(...v);\r\n        else acc.push(v);\r\n        return acc;\r\n      }, []);\r\n    default:\r\n      return values[values.length - 1];\r\n  }\r\n}\r\n\r\nfunction isUrlEncodedContentType(req: any): boolean {\r\n  const ct = String(req?.headers?.[\"content-type\"] || \"\").toLowerCase();\r\n  return ct.startsWith(\"application/x-www-form-urlencoded\");\r\n}\r\n\r\nfunction shouldExcludePath(path: string | undefined, excludePaths: string[]): boolean {\r\n  if (!path || excludePaths.length === 0) return false;\r\n  const currentPath = path;\r\n  for (const p of excludePaths) {\r\n    if (p.endsWith(\"*\")) {\r\n      if (currentPath.startsWith(p.slice(0, -1))) return true;\r\n    } else if (currentPath === p) {\r\n      return true;\r\n    }\r\n  }\r\n  return false;\r\n}\r\n\r\nfunction normalizeWhitelist(whitelist?: string[] | string): string[] {\r\n  if (!whitelist) return [];\r\n  if (typeof whitelist === \"string\") return [whitelist];\r\n  return whitelist.filter((w) => typeof w === \"string\");\r\n}\r\n\r\nfunction buildWhitelistHelpers(whitelist: string[]) {\r\n  const exact = new Set(whitelist);\r\n  const prefixes = whitelist.filter((w) => w.length > 0);\r\n  return {\r\n    exact,\r\n    prefixes,\r\n    isWhitelistedPath(pathParts: string[]): boolean {\r\n      if (pathParts.length === 0) return false;\r\n      const full = pathParts.join(\".\");\r\n      if (exact.has(full)) return true;\r\n      // leaf match\r\n      const leaf = pathParts[pathParts.length - 1]!;\r\n      if (exact.has(leaf)) return true;\r\n      // prefix match (treat any listed segment as prefix of a subtree)\r\n      for (const p of prefixes) {\r\n        if (full === p || full.startsWith(p + \".\")) return true;\r\n      }\r\n      return false;\r\n    },\r\n  };\r\n}\r\n\r\nfunction setIn(target: Record<string, unknown>, path: string[], value: unknown): void {\r\n  /* istanbul ignore if */\r\n  if (path.length === 0) {\r\n    return;\r\n  }\r\n  let cur: any = target;\r\n  for (let i = 0; i < path.length - 1; i++) {\r\n    const k = path[i]!;\r\n    if (!isPlainObject(cur[k])) cur[k] = {};\r\n    cur = cur[k];\r\n  }\r\n  const lastKey = path[path.length - 1]!;\r\n  cur[lastKey] = value;\r\n}\r\n\r\nfunction moveWhitelistedFromPolluted(\r\n  reqPart: Record<string, unknown>,\r\n  polluted: Record<string, unknown>,\r\n  isWhitelisted: (path: string[]) => boolean,\r\n): void {\r\n  function walk(\r\n    node: Record<string, unknown>,\r\n    path: string[] = [],\r\n    parent?: Record<string, unknown>,\r\n  ) {\r\n    for (const k of Object.keys(node)) {\r\n      const v = node[k];\r\n      const curPath = [...path, k];\r\n      if (isPlainObject(v)) {\r\n        walk(v as Record<string, unknown>, curPath, node);\r\n        // prune empty objects\r\n        if (Object.keys(v as Record<string, unknown>).length === 0) {\r\n          delete (node as any)[k];\r\n        }\r\n      } else {\r\n        if (isWhitelisted(curPath)) {\r\n          // put back into request\r\n          const normalizedPath = curPath.flatMap((seg) =>\r\n            seg.includes(\".\") ? seg.split(\".\") : [seg],\r\n          );\r\n          setIn(reqPart, normalizedPath, v);\r\n          delete (node as any)[k];\r\n        }\r\n      }\r\n    }\r\n  }\r\n  walk(polluted);\r\n}\r\n\r\nfunction detectAndReduce(\r\n  input: Record<string, unknown>,\r\n  opts: Required<\r\n    Pick<SanitizeOptions, \"mergeStrategy\" | \"maxDepth\" | \"maxKeys\" | \"trimValues\" | \"preserveNull\">\r\n  >,\r\n): SanitizedResult<Record<string, unknown>> {\r\n  let keyCount = 0;\r\n  const polluted: Record<string, unknown> = {};\r\n  const pollutedKeys: string[] = [];\r\n\r\n  function processNode(node: unknown, path: string[] = [], depth = 0): unknown {\r\n    if (node === null || node === undefined) return opts.preserveNull ? node : node;\r\n\r\n    if (Array.isArray(node)) {\r\n      const mapped = node.map((v) => processNode(v, path, depth));\r\n      if (opts.mergeStrategy === \"combine\") {\r\n        // combine: do not record pollution, but flatten using mergeValues\r\n        return mergeValues(mapped, \"combine\");\r\n      }\r\n      // Other strategies: record pollution and reduce\r\n      setIn(polluted, path, safeDeepClone(node));\r\n      pollutedKeys.push(path.join(\".\"));\r\n      const reduced = mergeValues(mapped, opts.mergeStrategy);\r\n      return reduced;\r\n    }\r\n\r\n    if (isPlainObject(node)) {\r\n      if (depth > opts.maxDepth)\r\n        throw new Error(`Maximum object depth (${opts.maxDepth}) exceeded`);\r\n      const out: Record<string, unknown> = {};\r\n      for (const rawKey of Object.keys(node)) {\r\n        keyCount++;\r\n        if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {\r\n          throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);\r\n        }\r\n        const safeKey = sanitizeKey(rawKey);\r\n        if (!safeKey) continue;\r\n        const child = (node as Record<string, unknown>)[rawKey];\r\n        const childPath = path.concat([safeKey]);\r\n        let value = processNode(child, childPath, depth + 1);\r\n        if (typeof value === \"string\" && opts.trimValues) value = value.trim();\r\n        out[safeKey] = value;\r\n      }\r\n      return out;\r\n    }\r\n\r\n    return node;\r\n  }\r\n\r\n  const cloned = safeDeepClone(input);\r\n  const cleaned = processNode(cloned, [], 0) as Record<string, unknown>;\r\n  return { cleaned, pollutedTree: polluted, pollutedKeys };\r\n}\r\n\r\nexport function sanitize<T extends Record<string, unknown>>(\r\n  input: T,\r\n  options: SanitizeOptions = {},\r\n): T {\r\n  // Normalize and expand keys prior to sanitization\r\n  const expandedInput = isPlainObject(input) ? expandObjectPaths(input) : input;\r\n  const whitelist = normalizeWhitelist(options.whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);\r\n  const {\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n  } = options;\r\n\r\n  // First: reduce arrays and collect polluted\r\n  const { cleaned, pollutedTree } = detectAndReduce(expandedInput, {\r\n    mergeStrategy,\r\n    maxDepth,\r\n    maxKeys,\r\n    trimValues,\r\n    preserveNull,\r\n  });\r\n\r\n  // Second: move back whitelisted arrays\r\n  moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);\r\n\r\n  return cleaned as T;\r\n}\r\n\r\ntype ExpressLikeNext = (err?: any) => void;\r\n\r\nexport default function hppx(options: HppxOptions = {}) {\r\n  const {\r\n    whitelist = [],\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    sources = DEFAULT_SOURCES,\r\n    checkBodyContentType = \"urlencoded\",\r\n    excludePaths = [],\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n    strict = false,\r\n    onPollutionDetected,\r\n    logger,\r\n  } = options;\r\n\r\n  const whitelistArr = normalizeWhitelist(whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelistArr);\r\n\r\n  return function hppxMiddleware(req: any, res: any, next: ExpressLikeNext) {\r\n    try {\r\n      if (shouldExcludePath(req?.path, excludePaths)) return next();\r\n\r\n      let anyPollutionDetected = false;\r\n      const allPollutedKeys: string[] = [];\r\n\r\n      for (const source of sources) {\r\n        /* istanbul ignore next */ if (!req || typeof req !== \"object\") break;\r\n        if (req[source] === undefined) continue;\r\n\r\n        if (source === \"body\") {\r\n          if (checkBodyContentType === \"none\") continue;\r\n          if (checkBodyContentType === \"urlencoded\" && !isUrlEncodedContentType(req)) continue;\r\n        }\r\n\r\n        const part = req[source];\r\n        if (!isPlainObject(part)) continue;\r\n\r\n        // Preprocess: expand dotted and bracketed keys into nested objects\r\n        const expandedPart = expandObjectPaths(part);\r\n\r\n        const pollutedKey = `${source}Polluted`;\r\n        const processedKey = `__hppxProcessed_${source}`;\r\n        const hasProcessedBefore = Boolean((req as any)[processedKey]);\r\n\r\n        if (!hasProcessedBefore) {\r\n          // First pass for this request part: reduce arrays and collect polluted\r\n          const { cleaned, pollutedTree, pollutedKeys } = detectAndReduce(expandedPart, {\r\n            mergeStrategy,\r\n            maxDepth,\r\n            maxKeys,\r\n            trimValues,\r\n            preserveNull,\r\n          });\r\n\r\n          setReqPropertySafe(req, source, cleaned);\r\n\r\n          // Attach polluted object (always present as {} when source processed)\r\n          setReqPropertySafe(req, pollutedKey, pollutedTree);\r\n          (req as any)[processedKey] = true;\r\n\r\n          // Apply whitelist now: move whitelisted arrays back\r\n          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);\r\n\r\n          if (pollutedKeys.length > 0) {\r\n            anyPollutionDetected = true;\r\n            for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);\r\n          }\r\n        } else {\r\n          // Subsequent middleware: only put back whitelisted entries\r\n          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);\r\n          // pollution already accounted for in previous pass\r\n        }\r\n      }\r\n\r\n      if (anyPollutionDetected) {\r\n        if (onPollutionDetected) {\r\n          try {\r\n            onPollutionDetected(req, {\r\n              source: \"query\",\r\n              pollutedKeys: allPollutedKeys,\r\n            });\r\n          } catch (_) {\r\n            /* ignore user callback errors */\r\n          }\r\n        }\r\n        if (strict && res && typeof res.status === \"function\") {\r\n          return res.status(400).json({\r\n            error: \"Bad Request\",\r\n            message: \"HTTP Parameter Pollution detected\",\r\n            pollutedParameters: allPollutedKeys,\r\n            code: \"HPP_DETECTED\",\r\n          });\r\n        }\r\n      }\r\n\r\n      return next();\r\n    } catch (err) {\r\n      if (logger) {\r\n        try {\r\n          logger(err);\r\n        } catch (_) {\r\n          /* noop */\r\n        }\r\n      }\r\n      return next(err);\r\n    }\r\n  };\r\n}\r\n\r\nexport { DANGEROUS_KEYS, DEFAULT_STRATEGY, DEFAULT_SOURCES };\r\n"],"mappings":";AAuCA,IAAM,kBAAmC,CAAC,SAAS,QAAQ,QAAQ;AACnE,IAAM,mBAAkC;AACxC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAExE,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,YAAY,KAA4B;AACpB,MAAI,OAAO,QAAQ,SAAU,QAAO;AAC/D,MAAI,eAAe,IAAI,GAAG,EAAG,QAAO;AACpC,MAAI,IAAI,SAAS,IAAQ,EAAG,QAAO;AACnC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAuB;AAGhD,QAAM,SAAS,IAAI,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,GAAG;AACxD,SAAO,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD;AAEA,SAAS,kBAAkB,KAAuD;AAChF,QAAM,SAAkC,CAAC;AACzC,aAAW,UAAU,OAAO,KAAK,GAAG,GAAG;AACrC,UAAM,UAAU,YAAY,MAAM;AAClC,QAAI,CAAC,QAAS;AACd,UAAM,QAAS,IAAY,MAAM;AAGjC,UAAM,gBAAgB,cAAc,KAAK,IACrC,kBAAkB,KAAgC,IAClD;AAEJ,QAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAClD,YAAM,WAAW,kBAAkB,OAAO;AAC1C,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,QAAQ,UAAU,aAAa;AACrC;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAa,KAAa,OAAsB;AAC1E,MAAI;AACF,UAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;AACxD,QAAI,QAAQ,KAAK,iBAAiB,SAAS,KAAK,aAAa,OAAO;AAElE;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,KAAK,iBAAiB,OAAO;AACxC,aAAO,eAAe,QAAQ,KAAK;AAAA,QACjC;AAAA,QACA,UAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AACD;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACA,MAAI;AACF,WAAO,GAAG,IAAI;AAAA,EAChB,SAAS,GAAG;AAAA,EAEZ;AACF;AAEA,SAAS,cAAiB,OAAa;AACrC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC;AAAA,EAC1C;AACA,MAAI,cAAc,KAAK,GAAG;AACxB,UAAM,MAA+B,CAAC;AACtC,eAAW,KAAK,OAAO,KAAK,KAAK,GAAG;AAClC,UAAI,CAAC,YAAY,CAAC,EAAG;AACrB,UAAI,CAAC,IAAI,cAAe,MAAkC,CAAC,CAAC;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAmB,UAAkC;AACxE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,OAAO,CAAC;AAAA,IACjB,KAAK;AACH,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,OAAO,OAAkB,CAAC,KAAK,MAAM;AAC1C,YAAI,MAAM,QAAQ,CAAC,EAAG,KAAI,KAAK,GAAG,CAAC;AAAA,YAC9B,KAAI,KAAK,CAAC;AACf,eAAO;AAAA,MACT,GAAG,CAAC,CAAC;AAAA,IACP;AACE,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,wBAAwB,KAAmB;AAClD,QAAM,KAAK,OAAO,KAAK,UAAU,cAAc,KAAK,EAAE,EAAE,YAAY;AACpE,SAAO,GAAG,WAAW,mCAAmC;AAC1D;AAEA,SAAS,kBAAkB,MAA0B,cAAiC;AACpF,MAAI,CAAC,QAAQ,aAAa,WAAW,EAAG,QAAO;AAC/C,QAAM,cAAc;AACpB,aAAW,KAAK,cAAc;AAC5B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,UAAI,YAAY,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC,EAAG,QAAO;AAAA,IACrD,WAAW,gBAAgB,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,WAAyC;AACnE,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,MAAI,OAAO,cAAc,SAAU,QAAO,CAAC,SAAS;AACpD,SAAO,UAAU,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ;AACtD;AAEA,SAAS,sBAAsB,WAAqB;AAClD,QAAM,QAAQ,IAAI,IAAI,SAAS;AAC/B,QAAM,WAAW,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,kBAAkB,WAA8B;AAC9C,UAAI,UAAU,WAAW,EAAG,QAAO;AACnC,YAAM,OAAO,UAAU,KAAK,GAAG;AAC/B,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAE5B,YAAM,OAAO,UAAU,UAAU,SAAS,CAAC;AAC3C,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAE5B,iBAAW,KAAK,UAAU;AACxB,YAAI,SAAS,KAAK,KAAK,WAAW,IAAI,GAAG,EAAG,QAAO;AAAA,MACrD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,MAAM,QAAiC,MAAgB,OAAsB;AAEpF,MAAI,KAAK,WAAW,GAAG;AACrB;AAAA,EACF;AACA,MAAI,MAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK;AACxC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,CAAC,cAAc,IAAI,CAAC,CAAC,EAAG,KAAI,CAAC,IAAI,CAAC;AACtC,UAAM,IAAI,CAAC;AAAA,EACb;AACA,QAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,MAAI,OAAO,IAAI;AACjB;AAEA,SAAS,4BACP,SACA,UACA,eACM;AACN,WAAS,KACP,MACA,OAAiB,CAAC,GAClB,QACA;AACA,eAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,YAAM,IAAI,KAAK,CAAC;AAChB,YAAM,UAAU,CAAC,GAAG,MAAM,CAAC;AAC3B,UAAI,cAAc,CAAC,GAAG;AACpB,aAAK,GAA8B,SAAS,IAAI;AAEhD,YAAI,OAAO,KAAK,CAA4B,EAAE,WAAW,GAAG;AAC1D,iBAAQ,KAAa,CAAC;AAAA,QACxB;AAAA,MACF,OAAO;AACL,YAAI,cAAc,OAAO,GAAG;AAE1B,gBAAM,iBAAiB,QAAQ;AAAA,YAAQ,CAAC,QACtC,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG;AAAA,UAC3C;AACA,gBAAM,SAAS,gBAAgB,CAAC;AAChC,iBAAQ,KAAa,CAAC;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,OAAK,QAAQ;AACf;AAEA,SAAS,gBACP,OACA,MAG0C;AAC1C,MAAI,WAAW;AACf,QAAM,WAAoC,CAAC;AAC3C,QAAM,eAAyB,CAAC;AAEhC,WAAS,YAAY,MAAe,OAAiB,CAAC,GAAG,QAAQ,GAAY;AAC3E,QAAI,SAAS,QAAQ,SAAS,OAAW,QAAO,KAAK,eAAe,OAAO;AAE3E,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,YAAM,SAAS,KAAK,IAAI,CAAC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC;AAC1D,UAAI,KAAK,kBAAkB,WAAW;AAEpC,eAAO,YAAY,QAAQ,SAAS;AAAA,MACtC;AAEA,YAAM,UAAU,MAAM,cAAc,IAAI,CAAC;AACzC,mBAAa,KAAK,KAAK,KAAK,GAAG,CAAC;AAChC,YAAM,UAAU,YAAY,QAAQ,KAAK,aAAa;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,cAAc,IAAI,GAAG;AACvB,UAAI,QAAQ,KAAK;AACf,cAAM,IAAI,MAAM,yBAAyB,KAAK,QAAQ,YAAY;AACpE,YAAM,MAA+B,CAAC;AACtC,iBAAW,UAAU,OAAO,KAAK,IAAI,GAAG;AACtC;AACA,YAAI,YAAY,KAAK,WAAW,OAAO,mBAAmB;AACxD,gBAAM,IAAI,MAAM,sBAAsB,KAAK,OAAO,YAAY;AAAA,QAChE;AACA,cAAM,UAAU,YAAY,MAAM;AAClC,YAAI,CAAC,QAAS;AACd,cAAM,QAAS,KAAiC,MAAM;AACtD,cAAM,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC;AACvC,YAAI,QAAQ,YAAY,OAAO,WAAW,QAAQ,CAAC;AACnD,YAAI,OAAO,UAAU,YAAY,KAAK,WAAY,SAAQ,MAAM,KAAK;AACrE,YAAI,OAAO,IAAI;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,cAAc,KAAK;AAClC,QAAM,UAAU,YAAY,QAAQ,CAAC,GAAG,CAAC;AACzC,SAAO,EAAE,SAAS,cAAc,UAAU,aAAa;AACzD;AAEO,SAAS,SACd,OACA,UAA2B,CAAC,GACzB;AAEH,QAAM,gBAAgB,cAAc,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACxE,QAAM,YAAY,mBAAmB,QAAQ,SAAS;AACtD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,SAAS;AAC7D,QAAM;AAAA,IACJ,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB,IAAI;AAGJ,QAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,eAAe;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,8BAA4B,SAAS,cAAc,iBAAiB;AAEpE,SAAO;AACT;AAIe,SAAR,KAAsB,UAAuB,CAAC,GAAG;AACtD,QAAM;AAAA,IACJ,YAAY,CAAC;AAAA,IACb,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,eAAe,CAAC;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,eAAe,mBAAmB,SAAS;AACjD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,YAAY;AAEhE,SAAO,SAAS,eAAe,KAAU,KAAU,MAAuB;AACxE,QAAI;AACF,UAAI,kBAAkB,KAAK,MAAM,YAAY,EAAG,QAAO,KAAK;AAE5D,UAAI,uBAAuB;AAC3B,YAAM,kBAA4B,CAAC;AAEnC,iBAAW,UAAU,SAAS;AACD,YAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AAChE,YAAI,IAAI,MAAM,MAAM,OAAW;AAE/B,YAAI,WAAW,QAAQ;AACrB,cAAI,yBAAyB,OAAQ;AACrC,cAAI,yBAAyB,gBAAgB,CAAC,wBAAwB,GAAG,EAAG;AAAA,QAC9E;AAEA,cAAM,OAAO,IAAI,MAAM;AACvB,YAAI,CAAC,cAAc,IAAI,EAAG;AAG1B,cAAM,eAAe,kBAAkB,IAAI;AAE3C,cAAM,cAAc,GAAG,MAAM;AAC7B,cAAM,eAAe,mBAAmB,MAAM;AAC9C,cAAM,qBAAqB,QAAS,IAAY,YAAY,CAAC;AAE7D,YAAI,CAAC,oBAAoB;AAEvB,gBAAM,EAAE,SAAS,cAAc,aAAa,IAAI,gBAAgB,cAAc;AAAA,YAC5E;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,6BAAmB,KAAK,QAAQ,OAAO;AAGvC,6BAAmB,KAAK,aAAa,YAAY;AACjD,UAAC,IAAY,YAAY,IAAI;AAG7B,sCAA4B,IAAI,MAAM,GAAG,IAAI,WAAW,GAAG,iBAAiB;AAE5E,cAAI,aAAa,SAAS,GAAG;AAC3B,mCAAuB;AACvB,uBAAW,KAAK,aAAc,iBAAgB,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE;AAAA,UACrE;AAAA,QACF,OAAO;AAEL,sCAA4B,IAAI,MAAM,GAAG,IAAI,WAAW,GAAG,iBAAiB;AAAA,QAE9E;AAAA,MACF;AAEA,UAAI,sBAAsB;AACxB,YAAI,qBAAqB;AACvB,cAAI;AACF,gCAAoB,KAAK;AAAA,cACvB,QAAQ;AAAA,cACR,cAAc;AAAA,YAChB,CAAC;AAAA,UACH,SAAS,GAAG;AAAA,UAEZ;AAAA,QACF;AACA,YAAI,UAAU,OAAO,OAAO,IAAI,WAAW,YAAY;AACrD,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS;AAAA,YACT,oBAAoB;AAAA,YACpB,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,UAAI,QAAQ;AACV,YAAI;AACF,iBAAO,GAAG;AAAA,QACZ,SAAS,GAAG;AAAA,QAEZ;AAAA,MACF;AACA,aAAO,KAAK,GAAG;AAAA,IACjB;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "hppx",
+  "version": "0.1.0",
+  "description": "Superior HTTP Parameter Pollution protection middleware with modern TypeScript, robust sanitizer, and extensive tests.",
+  "license": "MIT",
+  "author": "Hiprax",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Hiprax/hppx"
+  },
+  "homepage": "https://github.com/Hiprax/hppx#readme",
+  "bugs": {
+    "url": "https://github.com/Hiprax/hppx/issues"
+  },
+  "type": "module",
+  "main": "dist/index.cjs",
+  "module": "dist/index.mjs",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=16"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "clean": "rimraf dist",
+    "dev": "tsup --watch",
+    "test": "jest",
+    "test:coverage": "jest --coverage",
+    "test:watch": "jest --watch",
+    "prepare": "npm run build",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint \"{src,tests}/**/*.{ts,tsx}\"",
+    "format": "prettier --write \"**/*.{ts,tsx,js,json,md,yml,yaml}\""
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.5",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.10.0",
+    "@types/supertest": "^6.0.3",
+    "@typescript-eslint/eslint-plugin": "^8.46.3",
+    "@typescript-eslint/parser": "^8.46.3",
+    "eslint": "^9.39.1",
+    "eslint-config-prettier": "^10.1.8",
+    "express": "^5.1.0",
+    "jest": "^30.2.0",
+    "patch-package": "^8.0.1",
+    "prettier": "^3.6.2",
+    "rimraf": "^6.1.0",
+    "supertest": "^7.1.4",
+    "ts-jest": "^29.4.5",
+    "ts-node": "^10.9.2",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3"
+  }
+}