hppx 0.1.0 → 0.1.1

package/README.md

@@ -3,18 +3,23 @@
 🔐 **Superior HTTP Parameter Pollution protection middleware** for Node.js/Express, written in TypeScript. It sanitizes `req.query`, `req.body`, and `req.params`, blocks prototype-pollution keys, supports nested whitelists, multiple merge strategies, and plays nicely with stacked middlewares.
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.8.3-blue.svg)](https://www.typescriptlang.org/)
-[![Node.js](https://img.shields.io/badge/Node.js-18+-green.svg)](https://nodejs.org/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.9.3-blue.svg)](https://www.typescriptlang.org/)
+[![Node.js](https://img.shields.io/badge/Node.js-16+-green.svg)](https://nodejs.org/)
 
 ## Features
 
-- Array merging strategies: `keepFirst`, `keepLast` (default), `combine`
-- Safe-by-default: blocks `__proto__`, `prototype`, `constructor`
-- Nested whitelist with dot-notation and leaf matching
-- Records polluted parameters on the request (`queryPolluted`, `bodyPolluted`, `paramsPolluted`)
-- Works with multiple middlewares on different routes (whitelists applied incrementally)
-- DoS-guards: `maxDepth`, `maxKeys`
-- Fully typed API and helpers (`sanitize`)
+- **Multiple merge strategies**: `keepFirst`, `keepLast` (default), `combine`
+- **Enhanced security**:
+  - Blocks dangerous keys: `__proto__`, `prototype`, `constructor`
+  - Prevents null-byte injection in keys
+  - Validates key lengths to prevent DoS attacks
+  - Limits array sizes to prevent memory exhaustion
+- **Flexible whitelisting**: Nested whitelist with dot-notation and leaf matching
+- **Pollution tracking**: Records polluted parameters on the request (`queryPolluted`, `bodyPolluted`, `paramsPolluted`)
+- **Multi-middleware support**: Works with multiple middlewares on different routes (whitelists applied incrementally)
+- **DoS protection**: `maxDepth`, `maxKeys`, `maxArrayLength`, `maxKeyLength`
+- **Performance optimized**: Path caching for improved performance
+- **Fully typed API**: TypeScript-first with comprehensive type definitions and helper functions (`sanitize`)
 
 ## 📦 Installation
 
@@ -37,7 +42,7 @@ app.use(
     whitelist: ["tags", "user.roles", "ids"],
     mergeStrategy: "keepLast",
     sources: ["query", "body"],
-  })
+  }),
 );
 
 app.get("/search", (req, res) => {
@@ -56,16 +61,33 @@ app.get("/search", (req, res) => {
 
 Creates an Express-compatible middleware. Applies sanitization to each selected source and exposes `*.Polluted` objects.
 
-Key options:
+#### Key Options
+
+**Whitelist & Strategy:**
 
 - `whitelist?: string[]` — keys allowed as arrays; supports dot-notation; leaf matches too
 - `mergeStrategy?: 'keepFirst'|'keepLast'|'combine'` — how to reduce arrays when not whitelisted
-- `sources?: Array<'query'|'body'|'params'>` — which request parts to sanitize
+
+**Source Selection:**
+
+- `sources?: Array<'query'|'body'|'params'>` — which request parts to sanitize (default: all)
 - `checkBodyContentType?: 'urlencoded'|'any'|'none'` — when to process `req.body` (default: `urlencoded`)
-- `excludePaths?: string[]` — exclude specific paths (supports `*` suffix)
-- `maxDepth?: number` and `maxKeys?: number` — DoS protections
-- `strict?: boolean` — if pollution detected, immediately respond 400
-- `onPollutionDetected?: (req, info) => void` — callback on detection
+- `excludePaths?: string[]` — exclude specific paths (supports `*` wildcard suffix)
+
+**Security Limits (DoS Protection):**
+
+- `maxDepth?: number` — maximum object nesting depth (default: 20, max: 100)
+- `maxKeys?: number` — maximum number of keys to process (default: 5000)
+- `maxArrayLength?: number` — maximum array length (default: 1000)
+- `maxKeyLength?: number` — maximum key string length (default: 200, max: 1000)
+
+**Additional Options:**
+
+- `trimValues?: boolean` — trim string values (default: false)
+- `preserveNull?: boolean` — preserve null values (default: true)
+- `strict?: boolean` — if pollution detected, immediately respond with 400 error
+- `onPollutionDetected?: (req, info) => void` — callback on pollution detection
+- `logger?: (err: Error) => void` — custom error logger
 
 ### named export: `sanitize(input, options)`
 
@@ -83,39 +105,106 @@ app.use(hppx({ strict: true }));
 
 ```ts
 app.use(express.json());
-app.use(hppx({ checkBodyContentType: 'any' }));
+app.use(hppx({ checkBodyContentType: "any" }));
 ```
 
 - Exclude specific paths (supports `*` suffix):
 
 ```ts
-app.use(hppx({ excludePaths: ['/public', '/assets*'] }));
+app.use(hppx({ excludePaths: ["/public", "/assets*"] }));
 ```
 
 - Use the sanitizer directly:
 
 ```ts
-import { sanitize } from 'hppx';
+import { sanitize } from "hppx";
 
 const clean = sanitize(payload, {
-  whitelist: ['user.tags'],
-  mergeStrategy: 'keepFirst',
+  whitelist: ["user.tags"],
+  mergeStrategy: "keepFirst",
 });
 ```
 
-## Notes
+## Security Best Practices
+
+### Input Validation
+
+Always combine HPP protection with additional input validation:
 
-- Arrays are reduced by default; whitelisted paths are preserved as arrays.
-- Dangerous keys like `__proto__`, `prototype`, `constructor` are removed.
-- DoS protections are available via `maxDepth` and `maxKeys`.
+- Use schema validation libraries (e.g., Joi, Yup, Zod)
+- Validate data types and ranges after sanitization
+- Never trust user input, even after sanitization
+
+### Configuration Recommendations
+
+For production environments, consider these settings:
+
+```ts
+app.use(
+  hppx({
+    maxDepth: 10, // Lower depth for typical use cases
+    maxKeys: 1000, // Reasonable limit for most requests
+    maxArrayLength: 100, // Prevent large array attacks
+    maxKeyLength: 100, // Shorter keys for most applications
+    strict: true, // Return 400 on pollution attempts
+    onPollutionDetected: (req, info) => {
+      // Log security events for monitoring
+      securityLogger.warn("HPP detected", {
+        ip: req.ip,
+        path: req.path,
+        pollutedKeys: info.pollutedKeys,
+      });
+    },
+  }),
+);
+```
+
+### What HPP Protects Against
+
+- **Parameter pollution**: Duplicate parameters causing unexpected behavior
+- **Prototype pollution**: Attacks via `__proto__`, `constructor`, `prototype`
+- **DoS attacks**: Excessive nesting, too many keys, huge arrays
+- **Null-byte injection**: Keys containing null characters (`\u0000`)
+
+### What HPP Does NOT Protect Against
+
+HPP is not a complete security solution. You still need:
+
+- **SQL injection protection**: Use parameterized queries
+- **XSS protection**: Sanitize output, use CSP headers
+- **CSRF protection**: Use CSRF tokens
+- **Authentication/Authorization**: Validate user permissions
+- **Rate limiting**: Prevent brute-force attacks
 
 ## 📄 License
 
 MIT License - see [LICENSE](LICENSE) file for details.
 
+## Changelog
+
+### v0.1.1 (Security & Performance Update)
+
+- **Security Enhancements:**
+  - Added `maxArrayLength` to prevent memory exhaustion attacks
+  - Added `maxKeyLength` to prevent long key DoS attacks
+  - Enhanced prototype pollution protection in nested operations
+  - Fixed validation of malformed keys (null bytes, bracket/dot-only keys)
+  - Added comprehensive options validation with helpful error messages
+- **Bug Fixes:**
+  - Fixed `onPollutionDetected` callback receiving correct source information
+  - Improved error handling with proper error propagation
+- **Performance:**
+  - Added path caching for faster whitelist checks
+  - Added path segment caching to reduce parsing overhead
+  - Optimized repeated sanitization operations
+- **Developer Experience:**
+  - Improved TypeScript types and removed unnecessary `any` types
+  - Enhanced error messages and logging
+  - Added comprehensive test suite for security features
+
 ## 🔗 Links
 
-- [NPM Package](https://www.npmjs.com/package/@hiprax/hppx)
+- [NPM Package](https://www.npmjs.com/package/hppx)
 - [GitHub Repository](https://github.com/Hiprax/hppx)
 - [Issue Tracker](https://github.com/Hiprax/hppx/issues)
 

package/dist/index.cjs

@@ -35,23 +35,33 @@ function isPlainObject(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 }
-function sanitizeKey(key) {
+function sanitizeKey(key, maxKeyLength) {
   if (typeof key !== "string") return null;
   if (DANGEROUS_KEYS.has(key)) return null;
   if (key.includes("\0")) return null;
+  const maxLen = maxKeyLength ?? 200;
+  if (key.length > maxLen) return null;
+  if (key.length > 1 && /^[.\[\]]+$/.test(key)) return null;
   return key;
 }
+var pathSegmentCache = /* @__PURE__ */ new Map();
 function parsePathSegments(key) {
+  const cached = pathSegmentCache.get(key);
+  if (cached) return cached;
   const dotted = key.replace(/\]/g, "").replace(/\[/g, ".");
-  return dotted.split(".").filter((s) => s.length > 0);
+  const result = dotted.split(".").filter((s) => s.length > 0);
+  if (pathSegmentCache.size < 500) {
+    pathSegmentCache.set(key, result);
+  }
+  return result;
 }
-function expandObjectPaths(obj) {
+function expandObjectPaths(obj, maxKeyLength) {
   const result = {};
   for (const rawKey of Object.keys(obj)) {
-    const safeKey = sanitizeKey(rawKey);
+    const safeKey = sanitizeKey(rawKey, maxKeyLength);
     if (!safeKey) continue;
     const value = obj[rawKey];
-    const expandedValue = isPlainObject(value) ? expandObjectPaths(value) : value;
+    const expandedValue = isPlainObject(value) ? expandObjectPaths(value, maxKeyLength) : value;
     if (safeKey.includes(".") || safeKey.includes("[")) {
       const segments = parsePathSegments(safeKey);
       if (segments.length > 0) {
@@ -85,15 +95,17 @@ function setReqPropertySafe(target, key, value) {
   } catch (_) {
   }
 }
-function safeDeepClone(input) {
+function safeDeepClone(input, maxKeyLength, maxArrayLength) {
   if (Array.isArray(input)) {
-    return input.map((v) => safeDeepClone(v));
+    const limit = maxArrayLength ?? 1e3;
+    const limited = input.slice(0, limit);
+    return limited.map((v) => safeDeepClone(v, maxKeyLength, maxArrayLength));
   }
   if (isPlainObject(input)) {
     const out = {};
     for (const k of Object.keys(input)) {
-      if (!sanitizeKey(k)) continue;
-      out[k] = safeDeepClone(input[k]);
+      if (!sanitizeKey(k, maxKeyLength)) continue;
+      out[k] = safeDeepClone(input[k], maxKeyLength, maxArrayLength);
     }
     return out;
   }
@@ -139,19 +151,32 @@ function normalizeWhitelist(whitelist) {
 function buildWhitelistHelpers(whitelist) {
   const exact = new Set(whitelist);
   const prefixes = whitelist.filter((w) => w.length > 0);
+  const pathCache = /* @__PURE__ */ new Map();
   return {
     exact,
     prefixes,
     isWhitelistedPath(pathParts) {
       if (pathParts.length === 0) return false;
       const full = pathParts.join(".");
-      if (exact.has(full)) return true;
-      const leaf = pathParts[pathParts.length - 1];
-      if (exact.has(leaf)) return true;
-      for (const p of prefixes) {
-        if (full === p || full.startsWith(p + ".")) return true;
+      const cached = pathCache.get(full);
+      if (cached !== void 0) return cached;
+      let result = false;
+      if (exact.has(full)) {
+        result = true;
+      } else if (exact.has(pathParts[pathParts.length - 1])) {
+        result = true;
+      } else {
+        for (const p of prefixes) {
+          if (full === p || full.startsWith(p + ".")) {
+            result = true;
+            break;
+          }
+        }
+      }
+      if (pathCache.size < 1e3) {
+        pathCache.set(full, result);
       }
-      return false;
+      return result;
     }
   };
 }
@@ -162,19 +187,23 @@ function setIn(target, path, value) {
   let cur = target;
   for (let i = 0; i < path.length - 1; i++) {
     const k = path[i];
-    if (!isPlainObject(cur[k])) cur[k] = {};
+    if (DANGEROUS_KEYS.has(k)) return;
+    if (!isPlainObject(cur[k])) {
+      cur[k] = {};
+    }
     cur = cur[k];
   }
   const lastKey = path[path.length - 1];
+  if (DANGEROUS_KEYS.has(lastKey)) return;
   cur[lastKey] = value;
 }
 function moveWhitelistedFromPolluted(reqPart, polluted, isWhitelisted) {
-  function walk(node, path = [], parent) {
+  function walk(node, path = []) {
     for (const k of Object.keys(node)) {
       const v = node[k];
       const curPath = [...path, k];
       if (isPlainObject(v)) {
-        walk(v, curPath, node);
+        walk(v, curPath);
         if (Object.keys(v).length === 0) {
           delete node[k];
         }
@@ -198,11 +227,13 @@ function detectAndReduce(input, opts) {
   function processNode(node, path = [], depth = 0) {
     if (node === null || node === void 0) return opts.preserveNull ? node : node;
     if (Array.isArray(node)) {
-      const mapped = node.map((v) => processNode(v, path, depth));
+      const limit = opts.maxArrayLength ?? 1e3;
+      const limitedNode = node.slice(0, limit);
+      const mapped = limitedNode.map((v) => processNode(v, path, depth));
       if (opts.mergeStrategy === "combine") {
         return mergeValues(mapped, "combine");
       }
-      setIn(polluted, path, safeDeepClone(node));
+      setIn(polluted, path, safeDeepClone(limitedNode, opts.maxKeyLength, opts.maxArrayLength));
       pollutedKeys.push(path.join("."));
       const reduced = mergeValues(mapped, opts.mergeStrategy);
       return reduced;
@@ -216,7 +247,7 @@ function detectAndReduce(input, opts) {
         if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {
           throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);
         }
-        const safeKey = sanitizeKey(rawKey);
+        const safeKey = sanitizeKey(rawKey, opts.maxKeyLength);
         if (!safeKey) continue;
         const child = node[rawKey];
         const childPath = path.concat([safeKey]);
@@ -228,18 +259,20 @@ function detectAndReduce(input, opts) {
     }
     return node;
   }
-  const cloned = safeDeepClone(input);
+  const cloned = safeDeepClone(input, opts.maxKeyLength, opts.maxArrayLength);
   const cleaned = processNode(cloned, [], 0);
   return { cleaned, pollutedTree: polluted, pollutedKeys };
 }
 function sanitize(input, options = {}) {
-  const expandedInput = isPlainObject(input) ? expandObjectPaths(input) : input;
+  const maxKeyLength = options.maxKeyLength ?? 200;
+  const expandedInput = isPlainObject(input) ? expandObjectPaths(input, maxKeyLength) : input;
   const whitelist = normalizeWhitelist(options.whitelist);
   const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);
   const {
     mergeStrategy = DEFAULT_STRATEGY,
     maxDepth = 20,
     maxKeys = 5e3,
+    maxArrayLength = 1e3,
     trimValues = false,
     preserveNull = true
   } = options;
@@ -247,13 +280,49 @@ function sanitize(input, options = {}) {
     mergeStrategy,
     maxDepth,
     maxKeys,
+    maxArrayLength,
+    maxKeyLength,
     trimValues,
     preserveNull
   });
   moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);
   return cleaned;
 }
+function validateOptions(options) {
+  if (options.maxDepth !== void 0 && (typeof options.maxDepth !== "number" || options.maxDepth < 1 || options.maxDepth > 100)) {
+    throw new TypeError("maxDepth must be a number between 1 and 100");
+  }
+  if (options.maxKeys !== void 0 && (typeof options.maxKeys !== "number" || options.maxKeys < 1)) {
+    throw new TypeError("maxKeys must be a positive number");
+  }
+  if (options.maxArrayLength !== void 0 && (typeof options.maxArrayLength !== "number" || options.maxArrayLength < 1)) {
+    throw new TypeError("maxArrayLength must be a positive number");
+  }
+  if (options.maxKeyLength !== void 0 && (typeof options.maxKeyLength !== "number" || options.maxKeyLength < 1 || options.maxKeyLength > 1e3)) {
+    throw new TypeError("maxKeyLength must be a number between 1 and 1000");
+  }
+  if (options.mergeStrategy !== void 0 && !["keepFirst", "keepLast", "combine"].includes(options.mergeStrategy)) {
+    throw new TypeError("mergeStrategy must be 'keepFirst', 'keepLast', or 'combine'");
+  }
+  if (options.sources !== void 0 && !Array.isArray(options.sources)) {
+    throw new TypeError("sources must be an array");
+  }
+  if (options.sources !== void 0) {
+    for (const source of options.sources) {
+      if (!["query", "body", "params"].includes(source)) {
+        throw new TypeError("sources must only contain 'query', 'body', or 'params'");
+      }
+    }
+  }
+  if (options.checkBodyContentType !== void 0 && !["urlencoded", "any", "none"].includes(options.checkBodyContentType)) {
+    throw new TypeError("checkBodyContentType must be 'urlencoded', 'any', or 'none'");
+  }
+  if (options.excludePaths !== void 0 && !Array.isArray(options.excludePaths)) {
+    throw new TypeError("excludePaths must be an array");
+  }
+}
 function hppx(options = {}) {
+  validateOptions(options);
   const {
     whitelist = [],
     mergeStrategy = DEFAULT_STRATEGY,
@@ -262,6 +331,8 @@ function hppx(options = {}) {
     excludePaths = [],
     maxDepth = 20,
     maxKeys = 5e3,
+    maxArrayLength = 1e3,
+    maxKeyLength = 200,
     trimValues = false,
     preserveNull = true,
     strict = false,
@@ -284,7 +355,7 @@ function hppx(options = {}) {
         }
         const part = req[source];
         if (!isPlainObject(part)) continue;
-        const expandedPart = expandObjectPaths(part);
+        const expandedPart = expandObjectPaths(part, maxKeyLength);
         const pollutedKey = `${source}Polluted`;
         const processedKey = `__hppxProcessed_${source}`;
         const hasProcessedBefore = Boolean(req[processedKey]);
@@ -293,28 +364,49 @@ function hppx(options = {}) {
             mergeStrategy,
             maxDepth,
             maxKeys,
+            maxArrayLength,
+            maxKeyLength,
             trimValues,
             preserveNull
           });
           setReqPropertySafe(req, source, cleaned);
           setReqPropertySafe(req, pollutedKey, pollutedTree);
           req[processedKey] = true;
-          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);
+          const sourceData = req[source];
+          const pollutedData = req[pollutedKey];
+          if (isPlainObject(sourceData) && isPlainObject(pollutedData)) {
+            moveWhitelistedFromPolluted(sourceData, pollutedData, isWhitelistedPath);
+          }
           if (pollutedKeys.length > 0) {
             anyPollutionDetected = true;
             for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);
           }
         } else {
-          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);
+          const sourceData = req[source];
+          const pollutedData = req[pollutedKey];
+          if (isPlainObject(sourceData) && isPlainObject(pollutedData)) {
+            moveWhitelistedFromPolluted(sourceData, pollutedData, isWhitelistedPath);
+          }
         }
       }
       if (anyPollutionDetected) {
         if (onPollutionDetected) {
           try {
-            onPollutionDetected(req, {
-              source: "query",
-              pollutedKeys: allPollutedKeys
-            });
+            for (const source of sources) {
+              const pollutedKey = `${source}Polluted`;
+              const pollutedData = req[pollutedKey];
+              if (pollutedData && Object.keys(pollutedData).length > 0) {
+                const sourcePollutedKeys = allPollutedKeys.filter(
+                  (k) => k.startsWith(`${source}.`)
+                );
+                if (sourcePollutedKeys.length > 0) {
+                  onPollutionDetected(req, {
+                    source,
+                    pollutedKeys: sourcePollutedKeys
+                  });
+                }
+              }
+            }
           } catch (_) {
           }
         }
@@ -329,13 +421,18 @@ function hppx(options = {}) {
       }
       return next();
     } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
       if (logger) {
         try {
-          logger(err);
-        } catch (_) {
+          logger(error);
+        } catch (logErr) {
+          if (process.env.NODE_ENV !== "production") {
+            console.error("[hppx] Logger failed:", logErr);
+            console.error("[hppx] Original error:", error);
+          }
         }
       }
-      return next(err);
+      return next(error);
     }
   };
 }

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\r\n * hppx — Superior HTTP Parameter Pollution protection middleware\r\n *\r\n * - Protects against parameter and prototype pollution\r\n * - Supports nested whitelists via dot-notation and leaf matching\r\n * - Merge strategies: keepFirst | keepLast | combine\r\n * - Multiple middleware compatibility: arrays are \"put aside\" once and selectively restored\r\n * - Exposes req.queryPolluted / req.bodyPolluted / req.paramsPolluted\r\n * - TypeScript-first API\r\n */\r\n\r\nexport type RequestSource = \"query\" | \"body\" | \"params\";\r\nexport type MergeStrategy = \"keepFirst\" | \"keepLast\" | \"combine\";\r\n\r\nexport interface SanitizeOptions {\r\n  whitelist?: string[] | string;\r\n  mergeStrategy?: MergeStrategy;\r\n  maxDepth?: number;\r\n  maxKeys?: number;\r\n  trimValues?: boolean;\r\n  preserveNull?: boolean;\r\n}\r\n\r\nexport interface HppxOptions extends SanitizeOptions {\r\n  sources?: RequestSource[];\r\n  /** When to process req.body */\r\n  checkBodyContentType?: \"urlencoded\" | \"any\" | \"none\";\r\n  excludePaths?: string[];\r\n  strict?: boolean;\r\n  onPollutionDetected?: (req: any, info: { source: RequestSource; pollutedKeys: string[] }) => void;\r\n  logger?: (err: unknown) => void;\r\n}\r\n\r\nexport interface SanitizedResult<T> {\r\n  cleaned: T;\r\n  pollutedTree: Record<string, unknown>;\r\n  pollutedKeys: string[];\r\n}\r\n\r\nconst DEFAULT_SOURCES: RequestSource[] = [\"query\", \"body\", \"params\"];\r\nconst DEFAULT_STRATEGY: MergeStrategy = \"keepLast\";\r\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\r\n\r\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\r\n  if (value === null || typeof value !== \"object\") return false;\r\n  const proto = Object.getPrototypeOf(value);\r\n  return proto === Object.prototype || proto === null;\r\n}\r\n\r\nfunction sanitizeKey(key: string): string | null {\r\n  /* istanbul ignore next */ if (typeof key !== \"string\") return null;\r\n  if (DANGEROUS_KEYS.has(key)) return null;\r\n  if (key.includes(\"\\u0000\")) return null;\r\n  return key;\r\n}\r\n\r\nfunction parsePathSegments(key: string): string[] {\r\n  // Convert bracket notation to dots, then split\r\n  // a[b][c] -> a.b.c\r\n  const dotted = key.replace(/\\]/g, \"\").replace(/\\[/g, \".\");\r\n  return dotted.split(\".\").filter((s) => s.length > 0);\r\n}\r\n\r\nfunction expandObjectPaths(obj: Record<string, unknown>): Record<string, unknown> {\r\n  const result: Record<string, unknown> = {};\r\n  for (const rawKey of Object.keys(obj)) {\r\n    const safeKey = sanitizeKey(rawKey);\r\n    if (!safeKey) continue;\r\n    const value = (obj as any)[rawKey];\r\n\r\n    // Recursively expand nested objects first\r\n    const expandedValue = isPlainObject(value)\r\n      ? expandObjectPaths(value as Record<string, unknown>)\r\n      : value;\r\n\r\n    if (safeKey.includes(\".\") || safeKey.includes(\"[\")) {\r\n      const segments = parsePathSegments(safeKey);\r\n      if (segments.length > 0) {\r\n        setIn(result, segments, expandedValue);\r\n        continue;\r\n      }\r\n    }\r\n    result[safeKey] = expandedValue;\r\n  }\r\n  return result;\r\n}\r\n\r\nfunction setReqPropertySafe(target: any, key: string, value: unknown): void {\r\n  try {\r\n    const desc = Object.getOwnPropertyDescriptor(target, key);\r\n    if (desc && desc.configurable === false && desc.writable === false) {\r\n      // Non-configurable and not writable: skip\r\n      return;\r\n    }\r\n    if (!desc || desc.configurable !== false) {\r\n      Object.defineProperty(target, key, {\r\n        value,\r\n        writable: true,\r\n        configurable: true,\r\n        enumerable: true,\r\n      });\r\n      return;\r\n    }\r\n  } catch (_) {\r\n    // fall back to assignment below\r\n  }\r\n  try {\r\n    target[key] = value;\r\n  } catch (_) {\r\n    // last resort: skip if cannot assign\r\n  }\r\n}\r\n\r\nfunction safeDeepClone<T>(input: T): T {\r\n  if (Array.isArray(input)) {\r\n    return input.map((v) => safeDeepClone(v)) as T;\r\n  }\r\n  if (isPlainObject(input)) {\r\n    const out: Record<string, unknown> = {};\r\n    for (const k of Object.keys(input)) {\r\n      if (!sanitizeKey(k)) continue;\r\n      out[k] = safeDeepClone((input as Record<string, unknown>)[k]);\r\n    }\r\n    return out as T;\r\n  }\r\n  return input;\r\n}\r\n\r\nfunction mergeValues(values: unknown[], strategy: MergeStrategy): unknown {\r\n  switch (strategy) {\r\n    case \"keepFirst\":\r\n      return values[0];\r\n    case \"keepLast\":\r\n      return values[values.length - 1];\r\n    case \"combine\":\r\n      return values.reduce<unknown[]>((acc, v) => {\r\n        if (Array.isArray(v)) acc.push(...v);\r\n        else acc.push(v);\r\n        return acc;\r\n      }, []);\r\n    default:\r\n      return values[values.length - 1];\r\n  }\r\n}\r\n\r\nfunction isUrlEncodedContentType(req: any): boolean {\r\n  const ct = String(req?.headers?.[\"content-type\"] || \"\").toLowerCase();\r\n  return ct.startsWith(\"application/x-www-form-urlencoded\");\r\n}\r\n\r\nfunction shouldExcludePath(path: string | undefined, excludePaths: string[]): boolean {\r\n  if (!path || excludePaths.length === 0) return false;\r\n  const currentPath = path;\r\n  for (const p of excludePaths) {\r\n    if (p.endsWith(\"*\")) {\r\n      if (currentPath.startsWith(p.slice(0, -1))) return true;\r\n    } else if (currentPath === p) {\r\n      return true;\r\n    }\r\n  }\r\n  return false;\r\n}\r\n\r\nfunction normalizeWhitelist(whitelist?: string[] | string): string[] {\r\n  if (!whitelist) return [];\r\n  if (typeof whitelist === \"string\") return [whitelist];\r\n  return whitelist.filter((w) => typeof w === \"string\");\r\n}\r\n\r\nfunction buildWhitelistHelpers(whitelist: string[]) {\r\n  const exact = new Set(whitelist);\r\n  const prefixes = whitelist.filter((w) => w.length > 0);\r\n  return {\r\n    exact,\r\n    prefixes,\r\n    isWhitelistedPath(pathParts: string[]): boolean {\r\n      if (pathParts.length === 0) return false;\r\n      const full = pathParts.join(\".\");\r\n      if (exact.has(full)) return true;\r\n      // leaf match\r\n      const leaf = pathParts[pathParts.length - 1]!;\r\n      if (exact.has(leaf)) return true;\r\n      // prefix match (treat any listed segment as prefix of a subtree)\r\n      for (const p of prefixes) {\r\n        if (full === p || full.startsWith(p + \".\")) return true;\r\n      }\r\n      return false;\r\n    },\r\n  };\r\n}\r\n\r\nfunction setIn(target: Record<string, unknown>, path: string[], value: unknown): void {\r\n  /* istanbul ignore if */\r\n  if (path.length === 0) {\r\n    return;\r\n  }\r\n  let cur: any = target;\r\n  for (let i = 0; i < path.length - 1; i++) {\r\n    const k = path[i]!;\r\n    if (!isPlainObject(cur[k])) cur[k] = {};\r\n    cur = cur[k];\r\n  }\r\n  const lastKey = path[path.length - 1]!;\r\n  cur[lastKey] = value;\r\n}\r\n\r\nfunction moveWhitelistedFromPolluted(\r\n  reqPart: Record<string, unknown>,\r\n  polluted: Record<string, unknown>,\r\n  isWhitelisted: (path: string[]) => boolean,\r\n): void {\r\n  function walk(\r\n    node: Record<string, unknown>,\r\n    path: string[] = [],\r\n    parent?: Record<string, unknown>,\r\n  ) {\r\n    for (const k of Object.keys(node)) {\r\n      const v = node[k];\r\n      const curPath = [...path, k];\r\n      if (isPlainObject(v)) {\r\n        walk(v as Record<string, unknown>, curPath, node);\r\n        // prune empty objects\r\n        if (Object.keys(v as Record<string, unknown>).length === 0) {\r\n          delete (node as any)[k];\r\n        }\r\n      } else {\r\n        if (isWhitelisted(curPath)) {\r\n          // put back into request\r\n          const normalizedPath = curPath.flatMap((seg) =>\r\n            seg.includes(\".\") ? seg.split(\".\") : [seg],\r\n          );\r\n          setIn(reqPart, normalizedPath, v);\r\n          delete (node as any)[k];\r\n        }\r\n      }\r\n    }\r\n  }\r\n  walk(polluted);\r\n}\r\n\r\nfunction detectAndReduce(\r\n  input: Record<string, unknown>,\r\n  opts: Required<\r\n    Pick<SanitizeOptions, \"mergeStrategy\" | \"maxDepth\" | \"maxKeys\" | \"trimValues\" | \"preserveNull\">\r\n  >,\r\n): SanitizedResult<Record<string, unknown>> {\r\n  let keyCount = 0;\r\n  const polluted: Record<string, unknown> = {};\r\n  const pollutedKeys: string[] = [];\r\n\r\n  function processNode(node: unknown, path: string[] = [], depth = 0): unknown {\r\n    if (node === null || node === undefined) return opts.preserveNull ? node : node;\r\n\r\n    if (Array.isArray(node)) {\r\n      const mapped = node.map((v) => processNode(v, path, depth));\r\n      if (opts.mergeStrategy === \"combine\") {\r\n        // combine: do not record pollution, but flatten using mergeValues\r\n        return mergeValues(mapped, \"combine\");\r\n      }\r\n      // Other strategies: record pollution and reduce\r\n      setIn(polluted, path, safeDeepClone(node));\r\n      pollutedKeys.push(path.join(\".\"));\r\n      const reduced = mergeValues(mapped, opts.mergeStrategy);\r\n      return reduced;\r\n    }\r\n\r\n    if (isPlainObject(node)) {\r\n      if (depth > opts.maxDepth)\r\n        throw new Error(`Maximum object depth (${opts.maxDepth}) exceeded`);\r\n      const out: Record<string, unknown> = {};\r\n      for (const rawKey of Object.keys(node)) {\r\n        keyCount++;\r\n        if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {\r\n          throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);\r\n        }\r\n        const safeKey = sanitizeKey(rawKey);\r\n        if (!safeKey) continue;\r\n        const child = (node as Record<string, unknown>)[rawKey];\r\n        const childPath = path.concat([safeKey]);\r\n        let value = processNode(child, childPath, depth + 1);\r\n        if (typeof value === \"string\" && opts.trimValues) value = value.trim();\r\n        out[safeKey] = value;\r\n      }\r\n      return out;\r\n    }\r\n\r\n    return node;\r\n  }\r\n\r\n  const cloned = safeDeepClone(input);\r\n  const cleaned = processNode(cloned, [], 0) as Record<string, unknown>;\r\n  return { cleaned, pollutedTree: polluted, pollutedKeys };\r\n}\r\n\r\nexport function sanitize<T extends Record<string, unknown>>(\r\n  input: T,\r\n  options: SanitizeOptions = {},\r\n): T {\r\n  // Normalize and expand keys prior to sanitization\r\n  const expandedInput = isPlainObject(input) ? expandObjectPaths(input) : input;\r\n  const whitelist = normalizeWhitelist(options.whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);\r\n  const {\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n  } = options;\r\n\r\n  // First: reduce arrays and collect polluted\r\n  const { cleaned, pollutedTree } = detectAndReduce(expandedInput, {\r\n    mergeStrategy,\r\n    maxDepth,\r\n    maxKeys,\r\n    trimValues,\r\n    preserveNull,\r\n  });\r\n\r\n  // Second: move back whitelisted arrays\r\n  moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);\r\n\r\n  return cleaned as T;\r\n}\r\n\r\ntype ExpressLikeNext = (err?: any) => void;\r\n\r\nexport default function hppx(options: HppxOptions = {}) {\r\n  const {\r\n    whitelist = [],\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    sources = DEFAULT_SOURCES,\r\n    checkBodyContentType = \"urlencoded\",\r\n    excludePaths = [],\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n    strict = false,\r\n    onPollutionDetected,\r\n    logger,\r\n  } = options;\r\n\r\n  const whitelistArr = normalizeWhitelist(whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelistArr);\r\n\r\n  return function hppxMiddleware(req: any, res: any, next: ExpressLikeNext) {\r\n    try {\r\n      if (shouldExcludePath(req?.path, excludePaths)) return next();\r\n\r\n      let anyPollutionDetected = false;\r\n      const allPollutedKeys: string[] = [];\r\n\r\n      for (const source of sources) {\r\n        /* istanbul ignore next */ if (!req || typeof req !== \"object\") break;\r\n        if (req[source] === undefined) continue;\r\n\r\n        if (source === \"body\") {\r\n          if (checkBodyContentType === \"none\") continue;\r\n          if (checkBodyContentType === \"urlencoded\" && !isUrlEncodedContentType(req)) continue;\r\n        }\r\n\r\n        const part = req[source];\r\n        if (!isPlainObject(part)) continue;\r\n\r\n        // Preprocess: expand dotted and bracketed keys into nested objects\r\n        const expandedPart = expandObjectPaths(part);\r\n\r\n        const pollutedKey = `${source}Polluted`;\r\n        const processedKey = `__hppxProcessed_${source}`;\r\n        const hasProcessedBefore = Boolean((req as any)[processedKey]);\r\n\r\n        if (!hasProcessedBefore) {\r\n          // First pass for this request part: reduce arrays and collect polluted\r\n          const { cleaned, pollutedTree, pollutedKeys } = detectAndReduce(expandedPart, {\r\n            mergeStrategy,\r\n            maxDepth,\r\n            maxKeys,\r\n            trimValues,\r\n            preserveNull,\r\n          });\r\n\r\n          setReqPropertySafe(req, source, cleaned);\r\n\r\n          // Attach polluted object (always present as {} when source processed)\r\n          setReqPropertySafe(req, pollutedKey, pollutedTree);\r\n          (req as any)[processedKey] = true;\r\n\r\n          // Apply whitelist now: move whitelisted arrays back\r\n          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);\r\n\r\n          if (pollutedKeys.length > 0) {\r\n            anyPollutionDetected = true;\r\n            for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);\r\n          }\r\n        } else {\r\n          // Subsequent middleware: only put back whitelisted entries\r\n          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);\r\n          // pollution already accounted for in previous pass\r\n        }\r\n      }\r\n\r\n      if (anyPollutionDetected) {\r\n        if (onPollutionDetected) {\r\n          try {\r\n            onPollutionDetected(req, {\r\n              source: \"query\",\r\n              pollutedKeys: allPollutedKeys,\r\n            });\r\n          } catch (_) {\r\n            /* ignore user callback errors */\r\n          }\r\n        }\r\n        if (strict && res && typeof res.status === \"function\") {\r\n          return res.status(400).json({\r\n            error: \"Bad Request\",\r\n            message: \"HTTP Parameter Pollution detected\",\r\n            pollutedParameters: allPollutedKeys,\r\n            code: \"HPP_DETECTED\",\r\n          });\r\n        }\r\n      }\r\n\r\n      return next();\r\n    } catch (err) {\r\n      if (logger) {\r\n        try {\r\n          logger(err);\r\n        } catch (_) {\r\n          /* noop */\r\n        }\r\n      }\r\n      return next(err);\r\n    }\r\n  };\r\n}\r\n\r\nexport { DANGEROUS_KEYS, DEFAULT_STRATEGY, DEFAULT_SOURCES };\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuCA,IAAM,kBAAmC,CAAC,SAAS,QAAQ,QAAQ;AACnE,IAAM,mBAAkC;AACxC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAExE,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,YAAY,KAA4B;AACpB,MAAI,OAAO,QAAQ,SAAU,QAAO;AAC/D,MAAI,eAAe,IAAI,GAAG,EAAG,QAAO;AACpC,MAAI,IAAI,SAAS,IAAQ,EAAG,QAAO;AACnC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAuB;AAGhD,QAAM,SAAS,IAAI,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,GAAG;AACxD,SAAO,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD;AAEA,SAAS,kBAAkB,KAAuD;AAChF,QAAM,SAAkC,CAAC;AACzC,aAAW,UAAU,OAAO,KAAK,GAAG,GAAG;AACrC,UAAM,UAAU,YAAY,MAAM;AAClC,QAAI,CAAC,QAAS;AACd,UAAM,QAAS,IAAY,MAAM;AAGjC,UAAM,gBAAgB,cAAc,KAAK,IACrC,kBAAkB,KAAgC,IAClD;AAEJ,QAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAClD,YAAM,WAAW,kBAAkB,OAAO;AAC1C,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,QAAQ,UAAU,aAAa;AACrC;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAa,KAAa,OAAsB;AAC1E,MAAI;AACF,UAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;AACxD,QAAI,QAAQ,KAAK,iBAAiB,SAAS,KAAK,aAAa,OAAO;AAElE;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,KAAK,iBAAiB,OAAO;AACxC,aAAO,eAAe,QAAQ,KAAK;AAAA,QACjC;AAAA,QACA,UAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AACD;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACA,MAAI;AACF,WAAO,GAAG,IAAI;AAAA,EAChB,SAAS,GAAG;AAAA,EAEZ;AACF;AAEA,SAAS,cAAiB,OAAa;AACrC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC;AAAA,EAC1C;AACA,MAAI,cAAc,KAAK,GAAG;AACxB,UAAM,MAA+B,CAAC;AACtC,eAAW,KAAK,OAAO,KAAK,KAAK,GAAG;AAClC,UAAI,CAAC,YAAY,CAAC,EAAG;AACrB,UAAI,CAAC,IAAI,cAAe,MAAkC,CAAC,CAAC;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAmB,UAAkC;AACxE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,OAAO,CAAC;AAAA,IACjB,KAAK;AACH,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,OAAO,OAAkB,CAAC,KAAK,MAAM;AAC1C,YAAI,MAAM,QAAQ,CAAC,EAAG,KAAI,KAAK,GAAG,CAAC;AAAA,YAC9B,KAAI,KAAK,CAAC;AACf,eAAO;AAAA,MACT,GAAG,CAAC,CAAC;AAAA,IACP;AACE,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,wBAAwB,KAAmB;AAClD,QAAM,KAAK,OAAO,KAAK,UAAU,cAAc,KAAK,EAAE,EAAE,YAAY;AACpE,SAAO,GAAG,WAAW,mCAAmC;AAC1D;AAEA,SAAS,kBAAkB,MAA0B,cAAiC;AACpF,MAAI,CAAC,QAAQ,aAAa,WAAW,EAAG,QAAO;AAC/C,QAAM,cAAc;AACpB,aAAW,KAAK,cAAc;AAC5B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,UAAI,YAAY,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC,EAAG,QAAO;AAAA,IACrD,WAAW,gBAAgB,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,WAAyC;AACnE,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,MAAI,OAAO,cAAc,SAAU,QAAO,CAAC,SAAS;AACpD,SAAO,UAAU,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ;AACtD;AAEA,SAAS,sBAAsB,WAAqB;AAClD,QAAM,QAAQ,IAAI,IAAI,SAAS;AAC/B,QAAM,WAAW,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,kBAAkB,WAA8B;AAC9C,UAAI,UAAU,WAAW,EAAG,QAAO;AACnC,YAAM,OAAO,UAAU,KAAK,GAAG;AAC/B,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAE5B,YAAM,OAAO,UAAU,UAAU,SAAS,CAAC;AAC3C,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAE5B,iBAAW,KAAK,UAAU;AACxB,YAAI,SAAS,KAAK,KAAK,WAAW,IAAI,GAAG,EAAG,QAAO;AAAA,MACrD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,MAAM,QAAiC,MAAgB,OAAsB;AAEpF,MAAI,KAAK,WAAW,GAAG;AACrB;AAAA,EACF;AACA,MAAI,MAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK;AACxC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,CAAC,cAAc,IAAI,CAAC,CAAC,EAAG,KAAI,CAAC,IAAI,CAAC;AACtC,UAAM,IAAI,CAAC;AAAA,EACb;AACA,QAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,MAAI,OAAO,IAAI;AACjB;AAEA,SAAS,4BACP,SACA,UACA,eACM;AACN,WAAS,KACP,MACA,OAAiB,CAAC,GAClB,QACA;AACA,eAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,YAAM,IAAI,KAAK,CAAC;AAChB,YAAM,UAAU,CAAC,GAAG,MAAM,CAAC;AAC3B,UAAI,cAAc,CAAC,GAAG;AACpB,aAAK,GAA8B,SAAS,IAAI;AAEhD,YAAI,OAAO,KAAK,CAA4B,EAAE,WAAW,GAAG;AAC1D,iBAAQ,KAAa,CAAC;AAAA,QACxB;AAAA,MACF,OAAO;AACL,YAAI,cAAc,OAAO,GAAG;AAE1B,gBAAM,iBAAiB,QAAQ;AAAA,YAAQ,CAAC,QACtC,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG;AAAA,UAC3C;AACA,gBAAM,SAAS,gBAAgB,CAAC;AAChC,iBAAQ,KAAa,CAAC;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,OAAK,QAAQ;AACf;AAEA,SAAS,gBACP,OACA,MAG0C;AAC1C,MAAI,WAAW;AACf,QAAM,WAAoC,CAAC;AAC3C,QAAM,eAAyB,CAAC;AAEhC,WAAS,YAAY,MAAe,OAAiB,CAAC,GAAG,QAAQ,GAAY;AAC3E,QAAI,SAAS,QAAQ,SAAS,OAAW,QAAO,KAAK,eAAe,OAAO;AAE3E,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,YAAM,SAAS,KAAK,IAAI,CAAC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC;AAC1D,UAAI,KAAK,kBAAkB,WAAW;AAEpC,eAAO,YAAY,QAAQ,SAAS;AAAA,MACtC;AAEA,YAAM,UAAU,MAAM,cAAc,IAAI,CAAC;AACzC,mBAAa,KAAK,KAAK,KAAK,GAAG,CAAC;AAChC,YAAM,UAAU,YAAY,QAAQ,KAAK,aAAa;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,cAAc,IAAI,GAAG;AACvB,UAAI,QAAQ,KAAK;AACf,cAAM,IAAI,MAAM,yBAAyB,KAAK,QAAQ,YAAY;AACpE,YAAM,MAA+B,CAAC;AACtC,iBAAW,UAAU,OAAO,KAAK,IAAI,GAAG;AACtC;AACA,YAAI,YAAY,KAAK,WAAW,OAAO,mBAAmB;AACxD,gBAAM,IAAI,MAAM,sBAAsB,KAAK,OAAO,YAAY;AAAA,QAChE;AACA,cAAM,UAAU,YAAY,MAAM;AAClC,YAAI,CAAC,QAAS;AACd,cAAM,QAAS,KAAiC,MAAM;AACtD,cAAM,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC;AACvC,YAAI,QAAQ,YAAY,OAAO,WAAW,QAAQ,CAAC;AACnD,YAAI,OAAO,UAAU,YAAY,KAAK,WAAY,SAAQ,MAAM,KAAK;AACrE,YAAI,OAAO,IAAI;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,cAAc,KAAK;AAClC,QAAM,UAAU,YAAY,QAAQ,CAAC,GAAG,CAAC;AACzC,SAAO,EAAE,SAAS,cAAc,UAAU,aAAa;AACzD;AAEO,SAAS,SACd,OACA,UAA2B,CAAC,GACzB;AAEH,QAAM,gBAAgB,cAAc,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACxE,QAAM,YAAY,mBAAmB,QAAQ,SAAS;AACtD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,SAAS;AAC7D,QAAM;AAAA,IACJ,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB,IAAI;AAGJ,QAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,eAAe;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,8BAA4B,SAAS,cAAc,iBAAiB;AAEpE,SAAO;AACT;AAIe,SAAR,KAAsB,UAAuB,CAAC,GAAG;AACtD,QAAM;AAAA,IACJ,YAAY,CAAC;AAAA,IACb,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,eAAe,CAAC;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,eAAe,mBAAmB,SAAS;AACjD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,YAAY;AAEhE,SAAO,SAAS,eAAe,KAAU,KAAU,MAAuB;AACxE,QAAI;AACF,UAAI,kBAAkB,KAAK,MAAM,YAAY,EAAG,QAAO,KAAK;AAE5D,UAAI,uBAAuB;AAC3B,YAAM,kBAA4B,CAAC;AAEnC,iBAAW,UAAU,SAAS;AACD,YAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AAChE,YAAI,IAAI,MAAM,MAAM,OAAW;AAE/B,YAAI,WAAW,QAAQ;AACrB,cAAI,yBAAyB,OAAQ;AACrC,cAAI,yBAAyB,gBAAgB,CAAC,wBAAwB,GAAG,EAAG;AAAA,QAC9E;AAEA,cAAM,OAAO,IAAI,MAAM;AACvB,YAAI,CAAC,cAAc,IAAI,EAAG;AAG1B,cAAM,eAAe,kBAAkB,IAAI;AAE3C,cAAM,cAAc,GAAG,MAAM;AAC7B,cAAM,eAAe,mBAAmB,MAAM;AAC9C,cAAM,qBAAqB,QAAS,IAAY,YAAY,CAAC;AAE7D,YAAI,CAAC,oBAAoB;AAEvB,gBAAM,EAAE,SAAS,cAAc,aAAa,IAAI,gBAAgB,cAAc;AAAA,YAC5E;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,6BAAmB,KAAK,QAAQ,OAAO;AAGvC,6BAAmB,KAAK,aAAa,YAAY;AACjD,UAAC,IAAY,YAAY,IAAI;AAG7B,sCAA4B,IAAI,MAAM,GAAG,IAAI,WAAW,GAAG,iBAAiB;AAE5E,cAAI,aAAa,SAAS,GAAG;AAC3B,mCAAuB;AACvB,uBAAW,KAAK,aAAc,iBAAgB,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE;AAAA,UACrE;AAAA,QACF,OAAO;AAEL,sCAA4B,IAAI,MAAM,GAAG,IAAI,WAAW,GAAG,iBAAiB;AAAA,QAE9E;AAAA,MACF;AAEA,UAAI,sBAAsB;AACxB,YAAI,qBAAqB;AACvB,cAAI;AACF,gCAAoB,KAAK;AAAA,cACvB,QAAQ;AAAA,cACR,cAAc;AAAA,YAChB,CAAC;AAAA,UACH,SAAS,GAAG;AAAA,UAEZ;AAAA,QACF;AACA,YAAI,UAAU,OAAO,OAAO,IAAI,WAAW,YAAY;AACrD,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS;AAAA,YACT,oBAAoB;AAAA,YACpB,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,UAAI,QAAQ;AACV,YAAI;AACF,iBAAO,GAAG;AAAA,QACZ,SAAS,GAAG;AAAA,QAEZ;AAAA,MACF;AACA,aAAO,KAAK,GAAG;AAAA,IACjB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\r\n * hppx — Superior HTTP Parameter Pollution protection middleware\r\n *\r\n * - Protects against parameter and prototype pollution\r\n * - Supports nested whitelists via dot-notation and leaf matching\r\n * - Merge strategies: keepFirst | keepLast | combine\r\n * - Multiple middleware compatibility: arrays are \"put aside\" once and selectively restored\r\n * - Exposes req.queryPolluted / req.bodyPolluted / req.paramsPolluted\r\n * - TypeScript-first API\r\n */\r\n\r\nexport type RequestSource = \"query\" | \"body\" | \"params\";\r\nexport type MergeStrategy = \"keepFirst\" | \"keepLast\" | \"combine\";\r\n\r\nexport interface SanitizeOptions {\r\n  whitelist?: string[] | string;\r\n  mergeStrategy?: MergeStrategy;\r\n  maxDepth?: number;\r\n  maxKeys?: number;\r\n  maxArrayLength?: number;\r\n  maxKeyLength?: number;\r\n  trimValues?: boolean;\r\n  preserveNull?: boolean;\r\n}\r\n\r\nexport interface HppxOptions extends SanitizeOptions {\r\n  sources?: RequestSource[];\r\n  /** When to process req.body */\r\n  checkBodyContentType?: \"urlencoded\" | \"any\" | \"none\";\r\n  excludePaths?: string[];\r\n  strict?: boolean;\r\n  onPollutionDetected?: (\r\n    req: Record<string, unknown>,\r\n    info: { source: RequestSource; pollutedKeys: string[] },\r\n  ) => void;\r\n  logger?: (err: Error | unknown) => void;\r\n}\r\n\r\nexport interface SanitizedResult<T> {\r\n  cleaned: T;\r\n  pollutedTree: Record<string, unknown>;\r\n  pollutedKeys: string[];\r\n}\r\n\r\nconst DEFAULT_SOURCES: RequestSource[] = [\"query\", \"body\", \"params\"];\r\nconst DEFAULT_STRATEGY: MergeStrategy = \"keepLast\";\r\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\r\n\r\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\r\n  if (value === null || typeof value !== \"object\") return false;\r\n  const proto = Object.getPrototypeOf(value);\r\n  return proto === Object.prototype || proto === null;\r\n}\r\n\r\nfunction sanitizeKey(key: string, maxKeyLength?: number): string | null {\r\n  /* istanbul ignore next */ if (typeof key !== \"string\") return null;\r\n  if (DANGEROUS_KEYS.has(key)) return null;\r\n  if (key.includes(\"\\u0000\")) return null;\r\n  // Prevent excessively long keys that could cause DoS\r\n  const maxLen = maxKeyLength ?? 200;\r\n  if (key.length > maxLen) return null;\r\n  // Prevent keys that are only dots or brackets (malformed) - but allow single dot as it's valid\r\n  if (key.length > 1 && /^[.\\[\\]]+$/.test(key)) return null;\r\n  return key;\r\n}\r\n\r\n// Cache for parsed path segments to improve performance\r\nconst pathSegmentCache = new Map<string, string[]>();\r\n\r\nfunction parsePathSegments(key: string): string[] {\r\n  // Check cache first\r\n  const cached = pathSegmentCache.get(key);\r\n  if (cached) return cached;\r\n\r\n  // Convert bracket notation to dots, then split\r\n  // a[b][c] -> a.b.c\r\n  const dotted = key.replace(/\\]/g, \"\").replace(/\\[/g, \".\");\r\n  const result = dotted.split(\".\").filter((s) => s.length > 0);\r\n\r\n  // Cache the result (limit cache size)\r\n  if (pathSegmentCache.size < 500) {\r\n    pathSegmentCache.set(key, result);\r\n  }\r\n\r\n  return result;\r\n}\r\n\r\nfunction expandObjectPaths(\r\n  obj: Record<string, unknown>,\r\n  maxKeyLength?: number,\r\n): Record<string, unknown> {\r\n  const result: Record<string, unknown> = {};\r\n  for (const rawKey of Object.keys(obj)) {\r\n    const safeKey = sanitizeKey(rawKey, maxKeyLength);\r\n    if (!safeKey) continue;\r\n    const value = obj[rawKey];\r\n\r\n    // Recursively expand nested objects first\r\n    const expandedValue = isPlainObject(value)\r\n      ? expandObjectPaths(value as Record<string, unknown>, maxKeyLength)\r\n      : value;\r\n\r\n    if (safeKey.includes(\".\") || safeKey.includes(\"[\")) {\r\n      const segments = parsePathSegments(safeKey);\r\n      if (segments.length > 0) {\r\n        setIn(result, segments, expandedValue);\r\n        continue;\r\n      }\r\n    }\r\n    result[safeKey] = expandedValue;\r\n  }\r\n  return result;\r\n}\r\n\r\nfunction setReqPropertySafe(target: Record<string, unknown>, key: string, value: unknown): void {\r\n  try {\r\n    const desc = Object.getOwnPropertyDescriptor(target, key);\r\n    if (desc && desc.configurable === false && desc.writable === false) {\r\n      // Non-configurable and not writable: skip\r\n      return;\r\n    }\r\n    if (!desc || desc.configurable !== false) {\r\n      Object.defineProperty(target, key, {\r\n        value,\r\n        writable: true,\r\n        configurable: true,\r\n        enumerable: true,\r\n      });\r\n      return;\r\n    }\r\n  } catch (_) {\r\n    // fall back to assignment below\r\n  }\r\n  try {\r\n    target[key] = value;\r\n  } catch (_) {\r\n    // last resort: skip if cannot assign\r\n  }\r\n}\r\n\r\nfunction safeDeepClone<T>(input: T, maxKeyLength?: number, maxArrayLength?: number): T {\r\n  if (Array.isArray(input)) {\r\n    // Limit array length to prevent memory exhaustion\r\n    const limit = maxArrayLength ?? 1000;\r\n    const limited = input.slice(0, limit);\r\n    return limited.map((v) => safeDeepClone(v, maxKeyLength, maxArrayLength)) as T;\r\n  }\r\n  if (isPlainObject(input)) {\r\n    const out: Record<string, unknown> = {};\r\n    for (const k of Object.keys(input)) {\r\n      if (!sanitizeKey(k, maxKeyLength)) continue;\r\n      out[k] = safeDeepClone((input as Record<string, unknown>)[k], maxKeyLength, maxArrayLength);\r\n    }\r\n    return out as T;\r\n  }\r\n  return input;\r\n}\r\n\r\nfunction mergeValues(values: unknown[], strategy: MergeStrategy): unknown {\r\n  switch (strategy) {\r\n    case \"keepFirst\":\r\n      return values[0];\r\n    case \"keepLast\":\r\n      return values[values.length - 1];\r\n    case \"combine\":\r\n      return values.reduce<unknown[]>((acc, v) => {\r\n        if (Array.isArray(v)) acc.push(...v);\r\n        else acc.push(v);\r\n        return acc;\r\n      }, []);\r\n    default:\r\n      return values[values.length - 1];\r\n  }\r\n}\r\n\r\nfunction isUrlEncodedContentType(req: any): boolean {\r\n  const ct = String(req?.headers?.[\"content-type\"] || \"\").toLowerCase();\r\n  return ct.startsWith(\"application/x-www-form-urlencoded\");\r\n}\r\n\r\nfunction shouldExcludePath(path: string | undefined, excludePaths: string[]): boolean {\r\n  if (!path || excludePaths.length === 0) return false;\r\n  const currentPath = path;\r\n  for (const p of excludePaths) {\r\n    if (p.endsWith(\"*\")) {\r\n      if (currentPath.startsWith(p.slice(0, -1))) return true;\r\n    } else if (currentPath === p) {\r\n      return true;\r\n    }\r\n  }\r\n  return false;\r\n}\r\n\r\nfunction normalizeWhitelist(whitelist?: string[] | string): string[] {\r\n  if (!whitelist) return [];\r\n  if (typeof whitelist === \"string\") return [whitelist];\r\n  return whitelist.filter((w) => typeof w === \"string\");\r\n}\r\n\r\nfunction buildWhitelistHelpers(whitelist: string[]) {\r\n  const exact = new Set(whitelist);\r\n  const prefixes = whitelist.filter((w) => w.length > 0);\r\n  // Pre-build a cache for commonly checked paths for performance\r\n  const pathCache = new Map<string, boolean>();\r\n\r\n  return {\r\n    exact,\r\n    prefixes,\r\n    isWhitelistedPath(pathParts: string[]): boolean {\r\n      if (pathParts.length === 0) return false;\r\n      const full = pathParts.join(\".\");\r\n\r\n      // Check cache first for performance\r\n      const cached = pathCache.get(full);\r\n      if (cached !== undefined) return cached;\r\n\r\n      let result = false;\r\n\r\n      // Exact match\r\n      if (exact.has(full)) {\r\n        result = true;\r\n      }\r\n      // Leaf match\r\n      else if (exact.has(pathParts[pathParts.length - 1]!)) {\r\n        result = true;\r\n      }\r\n      // Prefix match (treat any listed segment as prefix of a subtree)\r\n      else {\r\n        for (const p of prefixes) {\r\n          if (full === p || full.startsWith(p + \".\")) {\r\n            result = true;\r\n            break;\r\n          }\r\n        }\r\n      }\r\n\r\n      // Cache the result (limit cache size to prevent memory issues)\r\n      if (pathCache.size < 1000) {\r\n        pathCache.set(full, result);\r\n      }\r\n\r\n      return result;\r\n    },\r\n  };\r\n}\r\n\r\nfunction setIn(target: Record<string, unknown>, path: string[], value: unknown): void {\r\n  /* istanbul ignore if */\r\n  if (path.length === 0) {\r\n    return;\r\n  }\r\n  let cur: Record<string, unknown> = target;\r\n  for (let i = 0; i < path.length - 1; i++) {\r\n    const k = path[i]!;\r\n    // Additional prototype pollution protection\r\n    if (DANGEROUS_KEYS.has(k)) return;\r\n    if (!isPlainObject(cur[k])) {\r\n      // Create a new plain object to avoid pollution\r\n      cur[k] = {};\r\n    }\r\n    cur = cur[k] as Record<string, unknown>;\r\n  }\r\n  const lastKey = path[path.length - 1]!;\r\n  // Final check on the last key\r\n  if (DANGEROUS_KEYS.has(lastKey)) return;\r\n  cur[lastKey] = value;\r\n}\r\n\r\nfunction moveWhitelistedFromPolluted(\r\n  reqPart: Record<string, unknown>,\r\n  polluted: Record<string, unknown>,\r\n  isWhitelisted: (path: string[]) => boolean,\r\n): void {\r\n  function walk(node: Record<string, unknown>, path: string[] = []) {\r\n    for (const k of Object.keys(node)) {\r\n      const v = node[k];\r\n      const curPath = [...path, k];\r\n      if (isPlainObject(v)) {\r\n        walk(v as Record<string, unknown>, curPath);\r\n        // prune empty objects\r\n        if (Object.keys(v as Record<string, unknown>).length === 0) {\r\n          delete node[k];\r\n        }\r\n      } else {\r\n        if (isWhitelisted(curPath)) {\r\n          // put back into request\r\n          const normalizedPath = curPath.flatMap((seg) =>\r\n            seg.includes(\".\") ? seg.split(\".\") : [seg],\r\n          );\r\n          setIn(reqPart, normalizedPath, v);\r\n          delete node[k];\r\n        }\r\n      }\r\n    }\r\n  }\r\n  walk(polluted);\r\n}\r\n\r\nfunction detectAndReduce(\r\n  input: Record<string, unknown>,\r\n  opts: Required<\r\n    Pick<\r\n      SanitizeOptions,\r\n      | \"mergeStrategy\"\r\n      | \"maxDepth\"\r\n      | \"maxKeys\"\r\n      | \"maxArrayLength\"\r\n      | \"maxKeyLength\"\r\n      | \"trimValues\"\r\n      | \"preserveNull\"\r\n    >\r\n  >,\r\n): SanitizedResult<Record<string, unknown>> {\r\n  let keyCount = 0;\r\n  const polluted: Record<string, unknown> = {};\r\n  const pollutedKeys: string[] = [];\r\n\r\n  function processNode(node: unknown, path: string[] = [], depth = 0): unknown {\r\n    if (node === null || node === undefined) return opts.preserveNull ? node : node;\r\n\r\n    if (Array.isArray(node)) {\r\n      // Limit array length to prevent DoS\r\n      const limit = opts.maxArrayLength ?? 1000;\r\n      const limitedNode = node.slice(0, limit);\r\n\r\n      const mapped = limitedNode.map((v) => processNode(v, path, depth));\r\n      if (opts.mergeStrategy === \"combine\") {\r\n        // combine: do not record pollution, but flatten using mergeValues\r\n        return mergeValues(mapped, \"combine\");\r\n      }\r\n      // Other strategies: record pollution and reduce\r\n      setIn(polluted, path, safeDeepClone(limitedNode, opts.maxKeyLength, opts.maxArrayLength));\r\n      pollutedKeys.push(path.join(\".\"));\r\n      const reduced = mergeValues(mapped, opts.mergeStrategy);\r\n      return reduced;\r\n    }\r\n\r\n    if (isPlainObject(node)) {\r\n      if (depth > opts.maxDepth)\r\n        throw new Error(`Maximum object depth (${opts.maxDepth}) exceeded`);\r\n      const out: Record<string, unknown> = {};\r\n      for (const rawKey of Object.keys(node)) {\r\n        keyCount++;\r\n        if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {\r\n          throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);\r\n        }\r\n        const safeKey = sanitizeKey(rawKey, opts.maxKeyLength);\r\n        if (!safeKey) continue;\r\n        const child = (node as Record<string, unknown>)[rawKey];\r\n        const childPath = path.concat([safeKey]);\r\n        let value = processNode(child, childPath, depth + 1);\r\n        if (typeof value === \"string\" && opts.trimValues) value = value.trim();\r\n        out[safeKey] = value;\r\n      }\r\n      return out;\r\n    }\r\n\r\n    return node;\r\n  }\r\n\r\n  const cloned = safeDeepClone(input, opts.maxKeyLength, opts.maxArrayLength);\r\n  const cleaned = processNode(cloned, [], 0) as Record<string, unknown>;\r\n  return { cleaned, pollutedTree: polluted, pollutedKeys };\r\n}\r\n\r\nexport function sanitize<T extends Record<string, unknown>>(\r\n  input: T,\r\n  options: SanitizeOptions = {},\r\n): T {\r\n  // Normalize and expand keys prior to sanitization\r\n  const maxKeyLength = options.maxKeyLength ?? 200;\r\n  const expandedInput = isPlainObject(input) ? expandObjectPaths(input, maxKeyLength) : input;\r\n  const whitelist = normalizeWhitelist(options.whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);\r\n  const {\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    maxArrayLength = 1000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n  } = options;\r\n\r\n  // First: reduce arrays and collect polluted\r\n  const { cleaned, pollutedTree } = detectAndReduce(expandedInput, {\r\n    mergeStrategy,\r\n    maxDepth,\r\n    maxKeys,\r\n    maxArrayLength,\r\n    maxKeyLength,\r\n    trimValues,\r\n    preserveNull,\r\n  });\r\n\r\n  // Second: move back whitelisted arrays\r\n  moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);\r\n\r\n  return cleaned as T;\r\n}\r\n\r\ntype ExpressLikeNext = (err?: unknown) => void;\r\n\r\nfunction validateOptions(options: HppxOptions): void {\r\n  if (\r\n    options.maxDepth !== undefined &&\r\n    (typeof options.maxDepth !== \"number\" || options.maxDepth < 1 || options.maxDepth > 100)\r\n  ) {\r\n    throw new TypeError(\"maxDepth must be a number between 1 and 100\");\r\n  }\r\n  if (\r\n    options.maxKeys !== undefined &&\r\n    (typeof options.maxKeys !== \"number\" || options.maxKeys < 1)\r\n  ) {\r\n    throw new TypeError(\"maxKeys must be a positive number\");\r\n  }\r\n  if (\r\n    options.maxArrayLength !== undefined &&\r\n    (typeof options.maxArrayLength !== \"number\" || options.maxArrayLength < 1)\r\n  ) {\r\n    throw new TypeError(\"maxArrayLength must be a positive number\");\r\n  }\r\n  if (\r\n    options.maxKeyLength !== undefined &&\r\n    (typeof options.maxKeyLength !== \"number\" ||\r\n      options.maxKeyLength < 1 ||\r\n      options.maxKeyLength > 1000)\r\n  ) {\r\n    throw new TypeError(\"maxKeyLength must be a number between 1 and 1000\");\r\n  }\r\n  if (\r\n    options.mergeStrategy !== undefined &&\r\n    ![\"keepFirst\", \"keepLast\", \"combine\"].includes(options.mergeStrategy)\r\n  ) {\r\n    throw new TypeError(\"mergeStrategy must be 'keepFirst', 'keepLast', or 'combine'\");\r\n  }\r\n  if (options.sources !== undefined && !Array.isArray(options.sources)) {\r\n    throw new TypeError(\"sources must be an array\");\r\n  }\r\n  if (options.sources !== undefined) {\r\n    for (const source of options.sources) {\r\n      if (![\"query\", \"body\", \"params\"].includes(source)) {\r\n        throw new TypeError(\"sources must only contain 'query', 'body', or 'params'\");\r\n      }\r\n    }\r\n  }\r\n  if (\r\n    options.checkBodyContentType !== undefined &&\r\n    ![\"urlencoded\", \"any\", \"none\"].includes(options.checkBodyContentType)\r\n  ) {\r\n    throw new TypeError(\"checkBodyContentType must be 'urlencoded', 'any', or 'none'\");\r\n  }\r\n  if (options.excludePaths !== undefined && !Array.isArray(options.excludePaths)) {\r\n    throw new TypeError(\"excludePaths must be an array\");\r\n  }\r\n}\r\n\r\nexport default function hppx(options: HppxOptions = {}) {\r\n  // Validate options on middleware creation\r\n  validateOptions(options);\r\n\r\n  const {\r\n    whitelist = [],\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    sources = DEFAULT_SOURCES,\r\n    checkBodyContentType = \"urlencoded\",\r\n    excludePaths = [],\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    maxArrayLength = 1000,\r\n    maxKeyLength = 200,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n    strict = false,\r\n    onPollutionDetected,\r\n    logger,\r\n  } = options;\r\n\r\n  const whitelistArr = normalizeWhitelist(whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelistArr);\r\n\r\n  return function hppxMiddleware(req: any, res: any, next: ExpressLikeNext) {\r\n    try {\r\n      if (shouldExcludePath(req?.path, excludePaths)) return next();\r\n\r\n      let anyPollutionDetected = false;\r\n      const allPollutedKeys: string[] = [];\r\n\r\n      for (const source of sources) {\r\n        /* istanbul ignore next */\r\n        if (!req || typeof req !== \"object\") break;\r\n        if (req[source] === undefined) continue;\r\n\r\n        if (source === \"body\") {\r\n          if (checkBodyContentType === \"none\") continue;\r\n          if (checkBodyContentType === \"urlencoded\" && !isUrlEncodedContentType(req)) continue;\r\n        }\r\n\r\n        const part = req[source];\r\n        if (!isPlainObject(part)) continue;\r\n\r\n        // Preprocess: expand dotted and bracketed keys into nested objects\r\n        const expandedPart = expandObjectPaths(part, maxKeyLength);\r\n\r\n        const pollutedKey = `${source}Polluted`;\r\n        const processedKey = `__hppxProcessed_${source}`;\r\n        const hasProcessedBefore = Boolean(req[processedKey]);\r\n\r\n        if (!hasProcessedBefore) {\r\n          // First pass for this request part: reduce arrays and collect polluted\r\n          const { cleaned, pollutedTree, pollutedKeys } = detectAndReduce(expandedPart, {\r\n            mergeStrategy,\r\n            maxDepth,\r\n            maxKeys,\r\n            maxArrayLength,\r\n            maxKeyLength,\r\n            trimValues,\r\n            preserveNull,\r\n          });\r\n\r\n          setReqPropertySafe(req, source, cleaned);\r\n\r\n          // Attach polluted object (always present as {} when source processed)\r\n          setReqPropertySafe(req, pollutedKey, pollutedTree);\r\n          req[processedKey] = true;\r\n\r\n          // Apply whitelist now: move whitelisted arrays back\r\n          const sourceData = req[source];\r\n          const pollutedData = req[pollutedKey];\r\n          if (isPlainObject(sourceData) && isPlainObject(pollutedData)) {\r\n            moveWhitelistedFromPolluted(sourceData, pollutedData, isWhitelistedPath);\r\n          }\r\n\r\n          if (pollutedKeys.length > 0) {\r\n            anyPollutionDetected = true;\r\n            for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);\r\n          }\r\n        } else {\r\n          // Subsequent middleware: only put back whitelisted entries\r\n          const sourceData = req[source];\r\n          const pollutedData = req[pollutedKey];\r\n          if (isPlainObject(sourceData) && isPlainObject(pollutedData)) {\r\n            moveWhitelistedFromPolluted(sourceData, pollutedData, isWhitelistedPath);\r\n          }\r\n          // pollution already accounted for in previous pass\r\n        }\r\n      }\r\n\r\n      if (anyPollutionDetected) {\r\n        if (onPollutionDetected) {\r\n          try {\r\n            // Determine which sources had pollution\r\n            for (const source of sources) {\r\n              const pollutedKey = `${source}Polluted`;\r\n              const pollutedData = req[pollutedKey];\r\n              if (pollutedData && Object.keys(pollutedData).length > 0) {\r\n                const sourcePollutedKeys = allPollutedKeys.filter((k) =>\r\n                  k.startsWith(`${source}.`),\r\n                );\r\n                if (sourcePollutedKeys.length > 0) {\r\n                  onPollutionDetected(req, {\r\n                    source: source,\r\n                    pollutedKeys: sourcePollutedKeys,\r\n                  });\r\n                }\r\n              }\r\n            }\r\n          } catch (_) {\r\n            /* ignore user callback errors */\r\n          }\r\n        }\r\n        if (strict && res && typeof res.status === \"function\") {\r\n          return res.status(400).json({\r\n            error: \"Bad Request\",\r\n            message: \"HTTP Parameter Pollution detected\",\r\n            pollutedParameters: allPollutedKeys,\r\n            code: \"HPP_DETECTED\",\r\n          });\r\n        }\r\n      }\r\n\r\n      return next();\r\n    } catch (err) {\r\n      // Enhanced error handling with detailed logging\r\n      const error = err instanceof Error ? err : new Error(String(err));\r\n\r\n      if (logger) {\r\n        try {\r\n          logger(error);\r\n        } catch (logErr) {\r\n          // If custom logger fails, use console.error as fallback in development\r\n          if (process.env.NODE_ENV !== \"production\") {\r\n            console.error(\"[hppx] Logger failed:\", logErr);\r\n            console.error(\"[hppx] Original error:\", error);\r\n          }\r\n        }\r\n      }\r\n\r\n      // Pass error to next middleware for proper error handling\r\n      return next(error);\r\n    }\r\n  };\r\n}\r\n\r\nexport { DANGEROUS_KEYS, DEFAULT_STRATEGY, DEFAULT_SOURCES };\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4CA,IAAM,kBAAmC,CAAC,SAAS,QAAQ,QAAQ;AACnE,IAAM,mBAAkC;AACxC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAExE,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,YAAY,KAAa,cAAsC;AAC3C,MAAI,OAAO,QAAQ,SAAU,QAAO;AAC/D,MAAI,eAAe,IAAI,GAAG,EAAG,QAAO;AACpC,MAAI,IAAI,SAAS,IAAQ,EAAG,QAAO;AAEnC,QAAM,SAAS,gBAAgB;AAC/B,MAAI,IAAI,SAAS,OAAQ,QAAO;AAEhC,MAAI,IAAI,SAAS,KAAK,aAAa,KAAK,GAAG,EAAG,QAAO;AACrD,SAAO;AACT;AAGA,IAAM,mBAAmB,oBAAI,IAAsB;AAEnD,SAAS,kBAAkB,KAAuB;AAEhD,QAAM,SAAS,iBAAiB,IAAI,GAAG;AACvC,MAAI,OAAQ,QAAO;AAInB,QAAM,SAAS,IAAI,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,GAAG;AACxD,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAG3D,MAAI,iBAAiB,OAAO,KAAK;AAC/B,qBAAiB,IAAI,KAAK,MAAM;AAAA,EAClC;AAEA,SAAO;AACT;AAEA,SAAS,kBACP,KACA,cACyB;AACzB,QAAM,SAAkC,CAAC;AACzC,aAAW,UAAU,OAAO,KAAK,GAAG,GAAG;AACrC,UAAM,UAAU,YAAY,QAAQ,YAAY;AAChD,QAAI,CAAC,QAAS;AACd,UAAM,QAAQ,IAAI,MAAM;AAGxB,UAAM,gBAAgB,cAAc,KAAK,IACrC,kBAAkB,OAAkC,YAAY,IAChE;AAEJ,QAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAClD,YAAM,WAAW,kBAAkB,OAAO;AAC1C,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,QAAQ,UAAU,aAAa;AACrC;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAiC,KAAa,OAAsB;AAC9F,MAAI;AACF,UAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;AACxD,QAAI,QAAQ,KAAK,iBAAiB,SAAS,KAAK,aAAa,OAAO;AAElE;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,KAAK,iBAAiB,OAAO;AACxC,aAAO,eAAe,QAAQ,KAAK;AAAA,QACjC;AAAA,QACA,UAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AACD;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACA,MAAI;AACF,WAAO,GAAG,IAAI;AAAA,EAChB,SAAS,GAAG;AAAA,EAEZ;AACF;AAEA,SAAS,cAAiB,OAAU,cAAuB,gBAA4B;AACrF,MAAI,MAAM,QAAQ,KAAK,GAAG;AAExB,UAAM,QAAQ,kBAAkB;AAChC,UAAM,UAAU,MAAM,MAAM,GAAG,KAAK;AACpC,WAAO,QAAQ,IAAI,CAAC,MAAM,cAAc,GAAG,cAAc,cAAc,CAAC;AAAA,EAC1E;AACA,MAAI,cAAc,KAAK,GAAG;AACxB,UAAM,MAA+B,CAAC;AACtC,eAAW,KAAK,OAAO,KAAK,KAAK,GAAG;AAClC,UAAI,CAAC,YAAY,GAAG,YAAY,EAAG;AACnC,UAAI,CAAC,IAAI,cAAe,MAAkC,CAAC,GAAG,cAAc,cAAc;AAAA,IAC5F;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAmB,UAAkC;AACxE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,OAAO,CAAC;AAAA,IACjB,KAAK;AACH,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,OAAO,OAAkB,CAAC,KAAK,MAAM;AAC1C,YAAI,MAAM,QAAQ,CAAC,EAAG,KAAI,KAAK,GAAG,CAAC;AAAA,YAC9B,KAAI,KAAK,CAAC;AACf,eAAO;AAAA,MACT,GAAG,CAAC,CAAC;AAAA,IACP;AACE,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,wBAAwB,KAAmB;AAClD,QAAM,KAAK,OAAO,KAAK,UAAU,cAAc,KAAK,EAAE,EAAE,YAAY;AACpE,SAAO,GAAG,WAAW,mCAAmC;AAC1D;AAEA,SAAS,kBAAkB,MAA0B,cAAiC;AACpF,MAAI,CAAC,QAAQ,aAAa,WAAW,EAAG,QAAO;AAC/C,QAAM,cAAc;AACpB,aAAW,KAAK,cAAc;AAC5B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,UAAI,YAAY,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC,EAAG,QAAO;AAAA,IACrD,WAAW,gBAAgB,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,WAAyC;AACnE,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,MAAI,OAAO,cAAc,SAAU,QAAO,CAAC,SAAS;AACpD,SAAO,UAAU,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ;AACtD;AAEA,SAAS,sBAAsB,WAAqB;AAClD,QAAM,QAAQ,IAAI,IAAI,SAAS;AAC/B,QAAM,WAAW,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAErD,QAAM,YAAY,oBAAI,IAAqB;AAE3C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,kBAAkB,WAA8B;AAC9C,UAAI,UAAU,WAAW,EAAG,QAAO;AACnC,YAAM,OAAO,UAAU,KAAK,GAAG;AAG/B,YAAM,SAAS,UAAU,IAAI,IAAI;AACjC,UAAI,WAAW,OAAW,QAAO;AAEjC,UAAI,SAAS;AAGb,UAAI,MAAM,IAAI,IAAI,GAAG;AACnB,iBAAS;AAAA,MACX,WAES,MAAM,IAAI,UAAU,UAAU,SAAS,CAAC,CAAE,GAAG;AACpD,iBAAS;AAAA,MACX,OAEK;AACH,mBAAW,KAAK,UAAU;AACxB,cAAI,SAAS,KAAK,KAAK,WAAW,IAAI,GAAG,GAAG;AAC1C,qBAAS;AACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,UAAU,OAAO,KAAM;AACzB,kBAAU,IAAI,MAAM,MAAM;AAAA,MAC5B;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,MAAM,QAAiC,MAAgB,OAAsB;AAEpF,MAAI,KAAK,WAAW,GAAG;AACrB;AAAA,EACF;AACA,MAAI,MAA+B;AACnC,WAAS,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK;AACxC,UAAM,IAAI,KAAK,CAAC;AAEhB,QAAI,eAAe,IAAI,CAAC,EAAG;AAC3B,QAAI,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG;AAE1B,UAAI,CAAC,IAAI,CAAC;AAAA,IACZ;AACA,UAAM,IAAI,CAAC;AAAA,EACb;AACA,QAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AAEpC,MAAI,eAAe,IAAI,OAAO,EAAG;AACjC,MAAI,OAAO,IAAI;AACjB;AAEA,SAAS,4BACP,SACA,UACA,eACM;AACN,WAAS,KAAK,MAA+B,OAAiB,CAAC,GAAG;AAChE,eAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,YAAM,IAAI,KAAK,CAAC;AAChB,YAAM,UAAU,CAAC,GAAG,MAAM,CAAC;AAC3B,UAAI,cAAc,CAAC,GAAG;AACpB,aAAK,GAA8B,OAAO;AAE1C,YAAI,OAAO,KAAK,CAA4B,EAAE,WAAW,GAAG;AAC1D,iBAAO,KAAK,CAAC;AAAA,QACf;AAAA,MACF,OAAO;AACL,YAAI,cAAc,OAAO,GAAG;AAE1B,gBAAM,iBAAiB,QAAQ;AAAA,YAAQ,CAAC,QACtC,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG;AAAA,UAC3C;AACA,gBAAM,SAAS,gBAAgB,CAAC;AAChC,iBAAO,KAAK,CAAC;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,OAAK,QAAQ;AACf;AAEA,SAAS,gBACP,OACA,MAY0C;AAC1C,MAAI,WAAW;AACf,QAAM,WAAoC,CAAC;AAC3C,QAAM,eAAyB,CAAC;AAEhC,WAAS,YAAY,MAAe,OAAiB,CAAC,GAAG,QAAQ,GAAY;AAC3E,QAAI,SAAS,QAAQ,SAAS,OAAW,QAAO,KAAK,eAAe,OAAO;AAE3E,QAAI,MAAM,QAAQ,IAAI,GAAG;AAEvB,YAAM,QAAQ,KAAK,kBAAkB;AACrC,YAAM,cAAc,KAAK,MAAM,GAAG,KAAK;AAEvC,YAAM,SAAS,YAAY,IAAI,CAAC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC;AACjE,UAAI,KAAK,kBAAkB,WAAW;AAEpC,eAAO,YAAY,QAAQ,SAAS;AAAA,MACtC;AAEA,YAAM,UAAU,MAAM,cAAc,aAAa,KAAK,cAAc,KAAK,cAAc,CAAC;AACxF,mBAAa,KAAK,KAAK,KAAK,GAAG,CAAC;AAChC,YAAM,UAAU,YAAY,QAAQ,KAAK,aAAa;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,cAAc,IAAI,GAAG;AACvB,UAAI,QAAQ,KAAK;AACf,cAAM,IAAI,MAAM,yBAAyB,KAAK,QAAQ,YAAY;AACpE,YAAM,MAA+B,CAAC;AACtC,iBAAW,UAAU,OAAO,KAAK,IAAI,GAAG;AACtC;AACA,YAAI,YAAY,KAAK,WAAW,OAAO,mBAAmB;AACxD,gBAAM,IAAI,MAAM,sBAAsB,KAAK,OAAO,YAAY;AAAA,QAChE;AACA,cAAM,UAAU,YAAY,QAAQ,KAAK,YAAY;AACrD,YAAI,CAAC,QAAS;AACd,cAAM,QAAS,KAAiC,MAAM;AACtD,cAAM,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC;AACvC,YAAI,QAAQ,YAAY,OAAO,WAAW,QAAQ,CAAC;AACnD,YAAI,OAAO,UAAU,YAAY,KAAK,WAAY,SAAQ,MAAM,KAAK;AACrE,YAAI,OAAO,IAAI;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,cAAc,OAAO,KAAK,cAAc,KAAK,cAAc;AAC1E,QAAM,UAAU,YAAY,QAAQ,CAAC,GAAG,CAAC;AACzC,SAAO,EAAE,SAAS,cAAc,UAAU,aAAa;AACzD;AAEO,SAAS,SACd,OACA,UAA2B,CAAC,GACzB;AAEH,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,gBAAgB,cAAc,KAAK,IAAI,kBAAkB,OAAO,YAAY,IAAI;AACtF,QAAM,YAAY,mBAAmB,QAAQ,SAAS;AACtD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,SAAS;AAC7D,QAAM;AAAA,IACJ,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB,IAAI;AAGJ,QAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,eAAe;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,8BAA4B,SAAS,cAAc,iBAAiB;AAEpE,SAAO;AACT;AAIA,SAAS,gBAAgB,SAA4B;AACnD,MACE,QAAQ,aAAa,WACpB,OAAO,QAAQ,aAAa,YAAY,QAAQ,WAAW,KAAK,QAAQ,WAAW,MACpF;AACA,UAAM,IAAI,UAAU,6CAA6C;AAAA,EACnE;AACA,MACE,QAAQ,YAAY,WACnB,OAAO,QAAQ,YAAY,YAAY,QAAQ,UAAU,IAC1D;AACA,UAAM,IAAI,UAAU,mCAAmC;AAAA,EACzD;AACA,MACE,QAAQ,mBAAmB,WAC1B,OAAO,QAAQ,mBAAmB,YAAY,QAAQ,iBAAiB,IACxE;AACA,UAAM,IAAI,UAAU,0CAA0C;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,WACxB,OAAO,QAAQ,iBAAiB,YAC/B,QAAQ,eAAe,KACvB,QAAQ,eAAe,MACzB;AACA,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,MACE,QAAQ,kBAAkB,UAC1B,CAAC,CAAC,aAAa,YAAY,SAAS,EAAE,SAAS,QAAQ,aAAa,GACpE;AACA,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,MAAI,QAAQ,YAAY,UAAa,CAAC,MAAM,QAAQ,QAAQ,OAAO,GAAG;AACpE,UAAM,IAAI,UAAU,0BAA0B;AAAA,EAChD;AACA,MAAI,QAAQ,YAAY,QAAW;AACjC,eAAW,UAAU,QAAQ,SAAS;AACpC,UAAI,CAAC,CAAC,SAAS,QAAQ,QAAQ,EAAE,SAAS,MAAM,GAAG;AACjD,cAAM,IAAI,UAAU,wDAAwD;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,yBAAyB,UACjC,CAAC,CAAC,cAAc,OAAO,MAAM,EAAE,SAAS,QAAQ,oBAAoB,GACpE;AACA,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,MAAI,QAAQ,iBAAiB,UAAa,CAAC,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAC9E,UAAM,IAAI,UAAU,+BAA+B;AAAA,EACrD;AACF;AAEe,SAAR,KAAsB,UAAuB,CAAC,GAAG;AAEtD,kBAAgB,OAAO;AAEvB,QAAM;AAAA,IACJ,YAAY,CAAC;AAAA,IACb,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,eAAe,CAAC;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,aAAa;AAAA,IACb,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,eAAe,mBAAmB,SAAS;AACjD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,YAAY;AAEhE,SAAO,SAAS,eAAe,KAAU,KAAU,MAAuB;AACxE,QAAI;AACF,UAAI,kBAAkB,KAAK,MAAM,YAAY,EAAG,QAAO,KAAK;AAE5D,UAAI,uBAAuB;AAC3B,YAAM,kBAA4B,CAAC;AAEnC,iBAAW,UAAU,SAAS;AAE5B,YAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,YAAI,IAAI,MAAM,MAAM,OAAW;AAE/B,YAAI,WAAW,QAAQ;AACrB,cAAI,yBAAyB,OAAQ;AACrC,cAAI,yBAAyB,gBAAgB,CAAC,wBAAwB,GAAG,EAAG;AAAA,QAC9E;AAEA,cAAM,OAAO,IAAI,MAAM;AACvB,YAAI,CAAC,cAAc,IAAI,EAAG;AAG1B,cAAM,eAAe,kBAAkB,MAAM,YAAY;AAEzD,cAAM,cAAc,GAAG,MAAM;AAC7B,cAAM,eAAe,mBAAmB,MAAM;AAC9C,cAAM,qBAAqB,QAAQ,IAAI,YAAY,CAAC;AAEpD,YAAI,CAAC,oBAAoB;AAEvB,gBAAM,EAAE,SAAS,cAAc,aAAa,IAAI,gBAAgB,cAAc;AAAA,YAC5E;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,6BAAmB,KAAK,QAAQ,OAAO;AAGvC,6BAAmB,KAAK,aAAa,YAAY;AACjD,cAAI,YAAY,IAAI;AAGpB,gBAAM,aAAa,IAAI,MAAM;AAC7B,gBAAM,eAAe,IAAI,WAAW;AACpC,cAAI,cAAc,UAAU,KAAK,cAAc,YAAY,GAAG;AAC5D,wCAA4B,YAAY,cAAc,iBAAiB;AAAA,UACzE;AAEA,cAAI,aAAa,SAAS,GAAG;AAC3B,mCAAuB;AACvB,uBAAW,KAAK,aAAc,iBAAgB,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE;AAAA,UACrE;AAAA,QACF,OAAO;AAEL,gBAAM,aAAa,IAAI,MAAM;AAC7B,gBAAM,eAAe,IAAI,WAAW;AACpC,cAAI,cAAc,UAAU,KAAK,cAAc,YAAY,GAAG;AAC5D,wCAA4B,YAAY,cAAc,iBAAiB;AAAA,UACzE;AAAA,QAEF;AAAA,MACF;AAEA,UAAI,sBAAsB;AACxB,YAAI,qBAAqB;AACvB,cAAI;AAEF,uBAAW,UAAU,SAAS;AAC5B,oBAAM,cAAc,GAAG,MAAM;AAC7B,oBAAM,eAAe,IAAI,WAAW;AACpC,kBAAI,gBAAgB,OAAO,KAAK,YAAY,EAAE,SAAS,GAAG;AACxD,sBAAM,qBAAqB,gBAAgB;AAAA,kBAAO,CAAC,MACjD,EAAE,WAAW,GAAG,MAAM,GAAG;AAAA,gBAC3B;AACA,oBAAI,mBAAmB,SAAS,GAAG;AACjC,sCAAoB,KAAK;AAAA,oBACvB;AAAA,oBACA,cAAc;AAAA,kBAChB,CAAC;AAAA,gBACH;AAAA,cACF;AAAA,YACF;AAAA,UACF,SAAS,GAAG;AAAA,UAEZ;AAAA,QACF;AACA,YAAI,UAAU,OAAO,OAAO,IAAI,WAAW,YAAY;AACrD,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS;AAAA,YACT,oBAAoB;AAAA,YACpB,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AAEZ,YAAM,QAAQ,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAEhE,UAAI,QAAQ;AACV,YAAI;AACF,iBAAO,KAAK;AAAA,QACd,SAAS,QAAQ;AAEf,cAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,oBAAQ,MAAM,yBAAyB,MAAM;AAC7C,oBAAQ,MAAM,0BAA0B,KAAK;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAGA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.cts

@@ -15,6 +15,8 @@ interface SanitizeOptions {
     mergeStrategy?: MergeStrategy;
     maxDepth?: number;
     maxKeys?: number;
+    maxArrayLength?: number;
+    maxKeyLength?: number;
     trimValues?: boolean;
     preserveNull?: boolean;
 }
@@ -24,11 +26,11 @@ interface HppxOptions extends SanitizeOptions {
     checkBodyContentType?: "urlencoded" | "any" | "none";
     excludePaths?: string[];
     strict?: boolean;
-    onPollutionDetected?: (req: any, info: {
+    onPollutionDetected?: (req: Record<string, unknown>, info: {
         source: RequestSource;
         pollutedKeys: string[];
     }) => void;
-    logger?: (err: unknown) => void;
+    logger?: (err: Error | unknown) => void;
 }
 interface SanitizedResult<T> {
     cleaned: T;
@@ -39,7 +41,7 @@ declare const DEFAULT_SOURCES: RequestSource[];
 declare const DEFAULT_STRATEGY: MergeStrategy;
 declare const DANGEROUS_KEYS: Set<string>;
 declare function sanitize<T extends Record<string, unknown>>(input: T, options?: SanitizeOptions): T;
-type ExpressLikeNext = (err?: any) => void;
+type ExpressLikeNext = (err?: unknown) => void;
 declare function hppx(options?: HppxOptions): (req: any, res: any, next: ExpressLikeNext) => any;
 
 export { DANGEROUS_KEYS, DEFAULT_SOURCES, DEFAULT_STRATEGY, type HppxOptions, type MergeStrategy, type RequestSource, type SanitizeOptions, type SanitizedResult, hppx as default, sanitize };

package/dist/index.d.ts

@@ -15,6 +15,8 @@ interface SanitizeOptions {
     mergeStrategy?: MergeStrategy;
     maxDepth?: number;
     maxKeys?: number;
+    maxArrayLength?: number;
+    maxKeyLength?: number;
     trimValues?: boolean;
     preserveNull?: boolean;
 }
@@ -24,11 +26,11 @@ interface HppxOptions extends SanitizeOptions {
     checkBodyContentType?: "urlencoded" | "any" | "none";
     excludePaths?: string[];
     strict?: boolean;
-    onPollutionDetected?: (req: any, info: {
+    onPollutionDetected?: (req: Record<string, unknown>, info: {
         source: RequestSource;
         pollutedKeys: string[];
     }) => void;
-    logger?: (err: unknown) => void;
+    logger?: (err: Error | unknown) => void;
 }
 interface SanitizedResult<T> {
     cleaned: T;
@@ -39,7 +41,7 @@ declare const DEFAULT_SOURCES: RequestSource[];
 declare const DEFAULT_STRATEGY: MergeStrategy;
 declare const DANGEROUS_KEYS: Set<string>;
 declare function sanitize<T extends Record<string, unknown>>(input: T, options?: SanitizeOptions): T;
-type ExpressLikeNext = (err?: any) => void;
+type ExpressLikeNext = (err?: unknown) => void;
 declare function hppx(options?: HppxOptions): (req: any, res: any, next: ExpressLikeNext) => any;
 
 export { DANGEROUS_KEYS, DEFAULT_SOURCES, DEFAULT_STRATEGY, type HppxOptions, type MergeStrategy, type RequestSource, type SanitizeOptions, type SanitizedResult, hppx as default, sanitize };

package/dist/index.js

@@ -7,23 +7,33 @@ function isPlainObject(value) {
   const proto = Object.getPrototypeOf(value);
   return proto === Object.prototype || proto === null;
 }
-function sanitizeKey(key) {
+function sanitizeKey(key, maxKeyLength) {
   if (typeof key !== "string") return null;
   if (DANGEROUS_KEYS.has(key)) return null;
   if (key.includes("\0")) return null;
+  const maxLen = maxKeyLength ?? 200;
+  if (key.length > maxLen) return null;
+  if (key.length > 1 && /^[.\[\]]+$/.test(key)) return null;
   return key;
 }
+var pathSegmentCache = /* @__PURE__ */ new Map();
 function parsePathSegments(key) {
+  const cached = pathSegmentCache.get(key);
+  if (cached) return cached;
   const dotted = key.replace(/\]/g, "").replace(/\[/g, ".");
-  return dotted.split(".").filter((s) => s.length > 0);
+  const result = dotted.split(".").filter((s) => s.length > 0);
+  if (pathSegmentCache.size < 500) {
+    pathSegmentCache.set(key, result);
+  }
+  return result;
 }
-function expandObjectPaths(obj) {
+function expandObjectPaths(obj, maxKeyLength) {
   const result = {};
   for (const rawKey of Object.keys(obj)) {
-    const safeKey = sanitizeKey(rawKey);
+    const safeKey = sanitizeKey(rawKey, maxKeyLength);
     if (!safeKey) continue;
     const value = obj[rawKey];
-    const expandedValue = isPlainObject(value) ? expandObjectPaths(value) : value;
+    const expandedValue = isPlainObject(value) ? expandObjectPaths(value, maxKeyLength) : value;
     if (safeKey.includes(".") || safeKey.includes("[")) {
       const segments = parsePathSegments(safeKey);
       if (segments.length > 0) {
@@ -57,15 +67,17 @@ function setReqPropertySafe(target, key, value) {
   } catch (_) {
   }
 }
-function safeDeepClone(input) {
+function safeDeepClone(input, maxKeyLength, maxArrayLength) {
   if (Array.isArray(input)) {
-    return input.map((v) => safeDeepClone(v));
+    const limit = maxArrayLength ?? 1e3;
+    const limited = input.slice(0, limit);
+    return limited.map((v) => safeDeepClone(v, maxKeyLength, maxArrayLength));
   }
   if (isPlainObject(input)) {
     const out = {};
     for (const k of Object.keys(input)) {
-      if (!sanitizeKey(k)) continue;
-      out[k] = safeDeepClone(input[k]);
+      if (!sanitizeKey(k, maxKeyLength)) continue;
+      out[k] = safeDeepClone(input[k], maxKeyLength, maxArrayLength);
     }
     return out;
   }
@@ -111,19 +123,32 @@ function normalizeWhitelist(whitelist) {
 function buildWhitelistHelpers(whitelist) {
   const exact = new Set(whitelist);
   const prefixes = whitelist.filter((w) => w.length > 0);
+  const pathCache = /* @__PURE__ */ new Map();
   return {
     exact,
     prefixes,
     isWhitelistedPath(pathParts) {
       if (pathParts.length === 0) return false;
       const full = pathParts.join(".");
-      if (exact.has(full)) return true;
-      const leaf = pathParts[pathParts.length - 1];
-      if (exact.has(leaf)) return true;
-      for (const p of prefixes) {
-        if (full === p || full.startsWith(p + ".")) return true;
+      const cached = pathCache.get(full);
+      if (cached !== void 0) return cached;
+      let result = false;
+      if (exact.has(full)) {
+        result = true;
+      } else if (exact.has(pathParts[pathParts.length - 1])) {
+        result = true;
+      } else {
+        for (const p of prefixes) {
+          if (full === p || full.startsWith(p + ".")) {
+            result = true;
+            break;
+          }
+        }
+      }
+      if (pathCache.size < 1e3) {
+        pathCache.set(full, result);
       }
-      return false;
+      return result;
     }
   };
 }
@@ -134,19 +159,23 @@ function setIn(target, path, value) {
   let cur = target;
   for (let i = 0; i < path.length - 1; i++) {
     const k = path[i];
-    if (!isPlainObject(cur[k])) cur[k] = {};
+    if (DANGEROUS_KEYS.has(k)) return;
+    if (!isPlainObject(cur[k])) {
+      cur[k] = {};
+    }
     cur = cur[k];
   }
   const lastKey = path[path.length - 1];
+  if (DANGEROUS_KEYS.has(lastKey)) return;
   cur[lastKey] = value;
 }
 function moveWhitelistedFromPolluted(reqPart, polluted, isWhitelisted) {
-  function walk(node, path = [], parent) {
+  function walk(node, path = []) {
     for (const k of Object.keys(node)) {
       const v = node[k];
       const curPath = [...path, k];
       if (isPlainObject(v)) {
-        walk(v, curPath, node);
+        walk(v, curPath);
         if (Object.keys(v).length === 0) {
           delete node[k];
         }
@@ -170,11 +199,13 @@ function detectAndReduce(input, opts) {
   function processNode(node, path = [], depth = 0) {
     if (node === null || node === void 0) return opts.preserveNull ? node : node;
     if (Array.isArray(node)) {
-      const mapped = node.map((v) => processNode(v, path, depth));
+      const limit = opts.maxArrayLength ?? 1e3;
+      const limitedNode = node.slice(0, limit);
+      const mapped = limitedNode.map((v) => processNode(v, path, depth));
       if (opts.mergeStrategy === "combine") {
         return mergeValues(mapped, "combine");
       }
-      setIn(polluted, path, safeDeepClone(node));
+      setIn(polluted, path, safeDeepClone(limitedNode, opts.maxKeyLength, opts.maxArrayLength));
       pollutedKeys.push(path.join("."));
       const reduced = mergeValues(mapped, opts.mergeStrategy);
       return reduced;
@@ -188,7 +219,7 @@ function detectAndReduce(input, opts) {
         if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {
           throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);
         }
-        const safeKey = sanitizeKey(rawKey);
+        const safeKey = sanitizeKey(rawKey, opts.maxKeyLength);
         if (!safeKey) continue;
         const child = node[rawKey];
         const childPath = path.concat([safeKey]);
@@ -200,18 +231,20 @@ function detectAndReduce(input, opts) {
     }
     return node;
   }
-  const cloned = safeDeepClone(input);
+  const cloned = safeDeepClone(input, opts.maxKeyLength, opts.maxArrayLength);
   const cleaned = processNode(cloned, [], 0);
   return { cleaned, pollutedTree: polluted, pollutedKeys };
 }
 function sanitize(input, options = {}) {
-  const expandedInput = isPlainObject(input) ? expandObjectPaths(input) : input;
+  const maxKeyLength = options.maxKeyLength ?? 200;
+  const expandedInput = isPlainObject(input) ? expandObjectPaths(input, maxKeyLength) : input;
   const whitelist = normalizeWhitelist(options.whitelist);
   const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);
   const {
     mergeStrategy = DEFAULT_STRATEGY,
     maxDepth = 20,
     maxKeys = 5e3,
+    maxArrayLength = 1e3,
     trimValues = false,
     preserveNull = true
   } = options;
@@ -219,13 +252,49 @@ function sanitize(input, options = {}) {
     mergeStrategy,
     maxDepth,
     maxKeys,
+    maxArrayLength,
+    maxKeyLength,
     trimValues,
     preserveNull
   });
   moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);
   return cleaned;
 }
+function validateOptions(options) {
+  if (options.maxDepth !== void 0 && (typeof options.maxDepth !== "number" || options.maxDepth < 1 || options.maxDepth > 100)) {
+    throw new TypeError("maxDepth must be a number between 1 and 100");
+  }
+  if (options.maxKeys !== void 0 && (typeof options.maxKeys !== "number" || options.maxKeys < 1)) {
+    throw new TypeError("maxKeys must be a positive number");
+  }
+  if (options.maxArrayLength !== void 0 && (typeof options.maxArrayLength !== "number" || options.maxArrayLength < 1)) {
+    throw new TypeError("maxArrayLength must be a positive number");
+  }
+  if (options.maxKeyLength !== void 0 && (typeof options.maxKeyLength !== "number" || options.maxKeyLength < 1 || options.maxKeyLength > 1e3)) {
+    throw new TypeError("maxKeyLength must be a number between 1 and 1000");
+  }
+  if (options.mergeStrategy !== void 0 && !["keepFirst", "keepLast", "combine"].includes(options.mergeStrategy)) {
+    throw new TypeError("mergeStrategy must be 'keepFirst', 'keepLast', or 'combine'");
+  }
+  if (options.sources !== void 0 && !Array.isArray(options.sources)) {
+    throw new TypeError("sources must be an array");
+  }
+  if (options.sources !== void 0) {
+    for (const source of options.sources) {
+      if (!["query", "body", "params"].includes(source)) {
+        throw new TypeError("sources must only contain 'query', 'body', or 'params'");
+      }
+    }
+  }
+  if (options.checkBodyContentType !== void 0 && !["urlencoded", "any", "none"].includes(options.checkBodyContentType)) {
+    throw new TypeError("checkBodyContentType must be 'urlencoded', 'any', or 'none'");
+  }
+  if (options.excludePaths !== void 0 && !Array.isArray(options.excludePaths)) {
+    throw new TypeError("excludePaths must be an array");
+  }
+}
 function hppx(options = {}) {
+  validateOptions(options);
   const {
     whitelist = [],
     mergeStrategy = DEFAULT_STRATEGY,
@@ -234,6 +303,8 @@ function hppx(options = {}) {
     excludePaths = [],
     maxDepth = 20,
     maxKeys = 5e3,
+    maxArrayLength = 1e3,
+    maxKeyLength = 200,
     trimValues = false,
     preserveNull = true,
     strict = false,
@@ -256,7 +327,7 @@ function hppx(options = {}) {
         }
         const part = req[source];
         if (!isPlainObject(part)) continue;
-        const expandedPart = expandObjectPaths(part);
+        const expandedPart = expandObjectPaths(part, maxKeyLength);
         const pollutedKey = `${source}Polluted`;
         const processedKey = `__hppxProcessed_${source}`;
         const hasProcessedBefore = Boolean(req[processedKey]);
@@ -265,28 +336,49 @@ function hppx(options = {}) {
             mergeStrategy,
             maxDepth,
             maxKeys,
+            maxArrayLength,
+            maxKeyLength,
             trimValues,
             preserveNull
           });
           setReqPropertySafe(req, source, cleaned);
           setReqPropertySafe(req, pollutedKey, pollutedTree);
           req[processedKey] = true;
-          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);
+          const sourceData = req[source];
+          const pollutedData = req[pollutedKey];
+          if (isPlainObject(sourceData) && isPlainObject(pollutedData)) {
+            moveWhitelistedFromPolluted(sourceData, pollutedData, isWhitelistedPath);
+          }
           if (pollutedKeys.length > 0) {
             anyPollutionDetected = true;
             for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);
           }
         } else {
-          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);
+          const sourceData = req[source];
+          const pollutedData = req[pollutedKey];
+          if (isPlainObject(sourceData) && isPlainObject(pollutedData)) {
+            moveWhitelistedFromPolluted(sourceData, pollutedData, isWhitelistedPath);
+          }
         }
       }
       if (anyPollutionDetected) {
         if (onPollutionDetected) {
           try {
-            onPollutionDetected(req, {
-              source: "query",
-              pollutedKeys: allPollutedKeys
-            });
+            for (const source of sources) {
+              const pollutedKey = `${source}Polluted`;
+              const pollutedData = req[pollutedKey];
+              if (pollutedData && Object.keys(pollutedData).length > 0) {
+                const sourcePollutedKeys = allPollutedKeys.filter(
+                  (k) => k.startsWith(`${source}.`)
+                );
+                if (sourcePollutedKeys.length > 0) {
+                  onPollutionDetected(req, {
+                    source,
+                    pollutedKeys: sourcePollutedKeys
+                  });
+                }
+              }
+            }
           } catch (_) {
           }
         }
@@ -301,13 +393,18 @@ function hppx(options = {}) {
       }
       return next();
     } catch (err) {
+      const error = err instanceof Error ? err : new Error(String(err));
       if (logger) {
         try {
-          logger(err);
-        } catch (_) {
+          logger(error);
+        } catch (logErr) {
+          if (process.env.NODE_ENV !== "production") {
+            console.error("[hppx] Logger failed:", logErr);
+            console.error("[hppx] Original error:", error);
+          }
         }
       }
-      return next(err);
+      return next(error);
     }
   };
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\r\n * hppx — Superior HTTP Parameter Pollution protection middleware\r\n *\r\n * - Protects against parameter and prototype pollution\r\n * - Supports nested whitelists via dot-notation and leaf matching\r\n * - Merge strategies: keepFirst | keepLast | combine\r\n * - Multiple middleware compatibility: arrays are \"put aside\" once and selectively restored\r\n * - Exposes req.queryPolluted / req.bodyPolluted / req.paramsPolluted\r\n * - TypeScript-first API\r\n */\r\n\r\nexport type RequestSource = \"query\" | \"body\" | \"params\";\r\nexport type MergeStrategy = \"keepFirst\" | \"keepLast\" | \"combine\";\r\n\r\nexport interface SanitizeOptions {\r\n  whitelist?: string[] | string;\r\n  mergeStrategy?: MergeStrategy;\r\n  maxDepth?: number;\r\n  maxKeys?: number;\r\n  trimValues?: boolean;\r\n  preserveNull?: boolean;\r\n}\r\n\r\nexport interface HppxOptions extends SanitizeOptions {\r\n  sources?: RequestSource[];\r\n  /** When to process req.body */\r\n  checkBodyContentType?: \"urlencoded\" | \"any\" | \"none\";\r\n  excludePaths?: string[];\r\n  strict?: boolean;\r\n  onPollutionDetected?: (req: any, info: { source: RequestSource; pollutedKeys: string[] }) => void;\r\n  logger?: (err: unknown) => void;\r\n}\r\n\r\nexport interface SanitizedResult<T> {\r\n  cleaned: T;\r\n  pollutedTree: Record<string, unknown>;\r\n  pollutedKeys: string[];\r\n}\r\n\r\nconst DEFAULT_SOURCES: RequestSource[] = [\"query\", \"body\", \"params\"];\r\nconst DEFAULT_STRATEGY: MergeStrategy = \"keepLast\";\r\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\r\n\r\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\r\n  if (value === null || typeof value !== \"object\") return false;\r\n  const proto = Object.getPrototypeOf(value);\r\n  return proto === Object.prototype || proto === null;\r\n}\r\n\r\nfunction sanitizeKey(key: string): string | null {\r\n  /* istanbul ignore next */ if (typeof key !== \"string\") return null;\r\n  if (DANGEROUS_KEYS.has(key)) return null;\r\n  if (key.includes(\"\\u0000\")) return null;\r\n  return key;\r\n}\r\n\r\nfunction parsePathSegments(key: string): string[] {\r\n  // Convert bracket notation to dots, then split\r\n  // a[b][c] -> a.b.c\r\n  const dotted = key.replace(/\\]/g, \"\").replace(/\\[/g, \".\");\r\n  return dotted.split(\".\").filter((s) => s.length > 0);\r\n}\r\n\r\nfunction expandObjectPaths(obj: Record<string, unknown>): Record<string, unknown> {\r\n  const result: Record<string, unknown> = {};\r\n  for (const rawKey of Object.keys(obj)) {\r\n    const safeKey = sanitizeKey(rawKey);\r\n    if (!safeKey) continue;\r\n    const value = (obj as any)[rawKey];\r\n\r\n    // Recursively expand nested objects first\r\n    const expandedValue = isPlainObject(value)\r\n      ? expandObjectPaths(value as Record<string, unknown>)\r\n      : value;\r\n\r\n    if (safeKey.includes(\".\") || safeKey.includes(\"[\")) {\r\n      const segments = parsePathSegments(safeKey);\r\n      if (segments.length > 0) {\r\n        setIn(result, segments, expandedValue);\r\n        continue;\r\n      }\r\n    }\r\n    result[safeKey] = expandedValue;\r\n  }\r\n  return result;\r\n}\r\n\r\nfunction setReqPropertySafe(target: any, key: string, value: unknown): void {\r\n  try {\r\n    const desc = Object.getOwnPropertyDescriptor(target, key);\r\n    if (desc && desc.configurable === false && desc.writable === false) {\r\n      // Non-configurable and not writable: skip\r\n      return;\r\n    }\r\n    if (!desc || desc.configurable !== false) {\r\n      Object.defineProperty(target, key, {\r\n        value,\r\n        writable: true,\r\n        configurable: true,\r\n        enumerable: true,\r\n      });\r\n      return;\r\n    }\r\n  } catch (_) {\r\n    // fall back to assignment below\r\n  }\r\n  try {\r\n    target[key] = value;\r\n  } catch (_) {\r\n    // last resort: skip if cannot assign\r\n  }\r\n}\r\n\r\nfunction safeDeepClone<T>(input: T): T {\r\n  if (Array.isArray(input)) {\r\n    return input.map((v) => safeDeepClone(v)) as T;\r\n  }\r\n  if (isPlainObject(input)) {\r\n    const out: Record<string, unknown> = {};\r\n    for (const k of Object.keys(input)) {\r\n      if (!sanitizeKey(k)) continue;\r\n      out[k] = safeDeepClone((input as Record<string, unknown>)[k]);\r\n    }\r\n    return out as T;\r\n  }\r\n  return input;\r\n}\r\n\r\nfunction mergeValues(values: unknown[], strategy: MergeStrategy): unknown {\r\n  switch (strategy) {\r\n    case \"keepFirst\":\r\n      return values[0];\r\n    case \"keepLast\":\r\n      return values[values.length - 1];\r\n    case \"combine\":\r\n      return values.reduce<unknown[]>((acc, v) => {\r\n        if (Array.isArray(v)) acc.push(...v);\r\n        else acc.push(v);\r\n        return acc;\r\n      }, []);\r\n    default:\r\n      return values[values.length - 1];\r\n  }\r\n}\r\n\r\nfunction isUrlEncodedContentType(req: any): boolean {\r\n  const ct = String(req?.headers?.[\"content-type\"] || \"\").toLowerCase();\r\n  return ct.startsWith(\"application/x-www-form-urlencoded\");\r\n}\r\n\r\nfunction shouldExcludePath(path: string | undefined, excludePaths: string[]): boolean {\r\n  if (!path || excludePaths.length === 0) return false;\r\n  const currentPath = path;\r\n  for (const p of excludePaths) {\r\n    if (p.endsWith(\"*\")) {\r\n      if (currentPath.startsWith(p.slice(0, -1))) return true;\r\n    } else if (currentPath === p) {\r\n      return true;\r\n    }\r\n  }\r\n  return false;\r\n}\r\n\r\nfunction normalizeWhitelist(whitelist?: string[] | string): string[] {\r\n  if (!whitelist) return [];\r\n  if (typeof whitelist === \"string\") return [whitelist];\r\n  return whitelist.filter((w) => typeof w === \"string\");\r\n}\r\n\r\nfunction buildWhitelistHelpers(whitelist: string[]) {\r\n  const exact = new Set(whitelist);\r\n  const prefixes = whitelist.filter((w) => w.length > 0);\r\n  return {\r\n    exact,\r\n    prefixes,\r\n    isWhitelistedPath(pathParts: string[]): boolean {\r\n      if (pathParts.length === 0) return false;\r\n      const full = pathParts.join(\".\");\r\n      if (exact.has(full)) return true;\r\n      // leaf match\r\n      const leaf = pathParts[pathParts.length - 1]!;\r\n      if (exact.has(leaf)) return true;\r\n      // prefix match (treat any listed segment as prefix of a subtree)\r\n      for (const p of prefixes) {\r\n        if (full === p || full.startsWith(p + \".\")) return true;\r\n      }\r\n      return false;\r\n    },\r\n  };\r\n}\r\n\r\nfunction setIn(target: Record<string, unknown>, path: string[], value: unknown): void {\r\n  /* istanbul ignore if */\r\n  if (path.length === 0) {\r\n    return;\r\n  }\r\n  let cur: any = target;\r\n  for (let i = 0; i < path.length - 1; i++) {\r\n    const k = path[i]!;\r\n    if (!isPlainObject(cur[k])) cur[k] = {};\r\n    cur = cur[k];\r\n  }\r\n  const lastKey = path[path.length - 1]!;\r\n  cur[lastKey] = value;\r\n}\r\n\r\nfunction moveWhitelistedFromPolluted(\r\n  reqPart: Record<string, unknown>,\r\n  polluted: Record<string, unknown>,\r\n  isWhitelisted: (path: string[]) => boolean,\r\n): void {\r\n  function walk(\r\n    node: Record<string, unknown>,\r\n    path: string[] = [],\r\n    parent?: Record<string, unknown>,\r\n  ) {\r\n    for (const k of Object.keys(node)) {\r\n      const v = node[k];\r\n      const curPath = [...path, k];\r\n      if (isPlainObject(v)) {\r\n        walk(v as Record<string, unknown>, curPath, node);\r\n        // prune empty objects\r\n        if (Object.keys(v as Record<string, unknown>).length === 0) {\r\n          delete (node as any)[k];\r\n        }\r\n      } else {\r\n        if (isWhitelisted(curPath)) {\r\n          // put back into request\r\n          const normalizedPath = curPath.flatMap((seg) =>\r\n            seg.includes(\".\") ? seg.split(\".\") : [seg],\r\n          );\r\n          setIn(reqPart, normalizedPath, v);\r\n          delete (node as any)[k];\r\n        }\r\n      }\r\n    }\r\n  }\r\n  walk(polluted);\r\n}\r\n\r\nfunction detectAndReduce(\r\n  input: Record<string, unknown>,\r\n  opts: Required<\r\n    Pick<SanitizeOptions, \"mergeStrategy\" | \"maxDepth\" | \"maxKeys\" | \"trimValues\" | \"preserveNull\">\r\n  >,\r\n): SanitizedResult<Record<string, unknown>> {\r\n  let keyCount = 0;\r\n  const polluted: Record<string, unknown> = {};\r\n  const pollutedKeys: string[] = [];\r\n\r\n  function processNode(node: unknown, path: string[] = [], depth = 0): unknown {\r\n    if (node === null || node === undefined) return opts.preserveNull ? node : node;\r\n\r\n    if (Array.isArray(node)) {\r\n      const mapped = node.map((v) => processNode(v, path, depth));\r\n      if (opts.mergeStrategy === \"combine\") {\r\n        // combine: do not record pollution, but flatten using mergeValues\r\n        return mergeValues(mapped, \"combine\");\r\n      }\r\n      // Other strategies: record pollution and reduce\r\n      setIn(polluted, path, safeDeepClone(node));\r\n      pollutedKeys.push(path.join(\".\"));\r\n      const reduced = mergeValues(mapped, opts.mergeStrategy);\r\n      return reduced;\r\n    }\r\n\r\n    if (isPlainObject(node)) {\r\n      if (depth > opts.maxDepth)\r\n        throw new Error(`Maximum object depth (${opts.maxDepth}) exceeded`);\r\n      const out: Record<string, unknown> = {};\r\n      for (const rawKey of Object.keys(node)) {\r\n        keyCount++;\r\n        if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {\r\n          throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);\r\n        }\r\n        const safeKey = sanitizeKey(rawKey);\r\n        if (!safeKey) continue;\r\n        const child = (node as Record<string, unknown>)[rawKey];\r\n        const childPath = path.concat([safeKey]);\r\n        let value = processNode(child, childPath, depth + 1);\r\n        if (typeof value === \"string\" && opts.trimValues) value = value.trim();\r\n        out[safeKey] = value;\r\n      }\r\n      return out;\r\n    }\r\n\r\n    return node;\r\n  }\r\n\r\n  const cloned = safeDeepClone(input);\r\n  const cleaned = processNode(cloned, [], 0) as Record<string, unknown>;\r\n  return { cleaned, pollutedTree: polluted, pollutedKeys };\r\n}\r\n\r\nexport function sanitize<T extends Record<string, unknown>>(\r\n  input: T,\r\n  options: SanitizeOptions = {},\r\n): T {\r\n  // Normalize and expand keys prior to sanitization\r\n  const expandedInput = isPlainObject(input) ? expandObjectPaths(input) : input;\r\n  const whitelist = normalizeWhitelist(options.whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);\r\n  const {\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n  } = options;\r\n\r\n  // First: reduce arrays and collect polluted\r\n  const { cleaned, pollutedTree } = detectAndReduce(expandedInput, {\r\n    mergeStrategy,\r\n    maxDepth,\r\n    maxKeys,\r\n    trimValues,\r\n    preserveNull,\r\n  });\r\n\r\n  // Second: move back whitelisted arrays\r\n  moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);\r\n\r\n  return cleaned as T;\r\n}\r\n\r\ntype ExpressLikeNext = (err?: any) => void;\r\n\r\nexport default function hppx(options: HppxOptions = {}) {\r\n  const {\r\n    whitelist = [],\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    sources = DEFAULT_SOURCES,\r\n    checkBodyContentType = \"urlencoded\",\r\n    excludePaths = [],\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n    strict = false,\r\n    onPollutionDetected,\r\n    logger,\r\n  } = options;\r\n\r\n  const whitelistArr = normalizeWhitelist(whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelistArr);\r\n\r\n  return function hppxMiddleware(req: any, res: any, next: ExpressLikeNext) {\r\n    try {\r\n      if (shouldExcludePath(req?.path, excludePaths)) return next();\r\n\r\n      let anyPollutionDetected = false;\r\n      const allPollutedKeys: string[] = [];\r\n\r\n      for (const source of sources) {\r\n        /* istanbul ignore next */ if (!req || typeof req !== \"object\") break;\r\n        if (req[source] === undefined) continue;\r\n\r\n        if (source === \"body\") {\r\n          if (checkBodyContentType === \"none\") continue;\r\n          if (checkBodyContentType === \"urlencoded\" && !isUrlEncodedContentType(req)) continue;\r\n        }\r\n\r\n        const part = req[source];\r\n        if (!isPlainObject(part)) continue;\r\n\r\n        // Preprocess: expand dotted and bracketed keys into nested objects\r\n        const expandedPart = expandObjectPaths(part);\r\n\r\n        const pollutedKey = `${source}Polluted`;\r\n        const processedKey = `__hppxProcessed_${source}`;\r\n        const hasProcessedBefore = Boolean((req as any)[processedKey]);\r\n\r\n        if (!hasProcessedBefore) {\r\n          // First pass for this request part: reduce arrays and collect polluted\r\n          const { cleaned, pollutedTree, pollutedKeys } = detectAndReduce(expandedPart, {\r\n            mergeStrategy,\r\n            maxDepth,\r\n            maxKeys,\r\n            trimValues,\r\n            preserveNull,\r\n          });\r\n\r\n          setReqPropertySafe(req, source, cleaned);\r\n\r\n          // Attach polluted object (always present as {} when source processed)\r\n          setReqPropertySafe(req, pollutedKey, pollutedTree);\r\n          (req as any)[processedKey] = true;\r\n\r\n          // Apply whitelist now: move whitelisted arrays back\r\n          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);\r\n\r\n          if (pollutedKeys.length > 0) {\r\n            anyPollutionDetected = true;\r\n            for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);\r\n          }\r\n        } else {\r\n          // Subsequent middleware: only put back whitelisted entries\r\n          moveWhitelistedFromPolluted(req[source], req[pollutedKey], isWhitelistedPath);\r\n          // pollution already accounted for in previous pass\r\n        }\r\n      }\r\n\r\n      if (anyPollutionDetected) {\r\n        if (onPollutionDetected) {\r\n          try {\r\n            onPollutionDetected(req, {\r\n              source: \"query\",\r\n              pollutedKeys: allPollutedKeys,\r\n            });\r\n          } catch (_) {\r\n            /* ignore user callback errors */\r\n          }\r\n        }\r\n        if (strict && res && typeof res.status === \"function\") {\r\n          return res.status(400).json({\r\n            error: \"Bad Request\",\r\n            message: \"HTTP Parameter Pollution detected\",\r\n            pollutedParameters: allPollutedKeys,\r\n            code: \"HPP_DETECTED\",\r\n          });\r\n        }\r\n      }\r\n\r\n      return next();\r\n    } catch (err) {\r\n      if (logger) {\r\n        try {\r\n          logger(err);\r\n        } catch (_) {\r\n          /* noop */\r\n        }\r\n      }\r\n      return next(err);\r\n    }\r\n  };\r\n}\r\n\r\nexport { DANGEROUS_KEYS, DEFAULT_STRATEGY, DEFAULT_SOURCES };\r\n"],"mappings":";AAuCA,IAAM,kBAAmC,CAAC,SAAS,QAAQ,QAAQ;AACnE,IAAM,mBAAkC;AACxC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAExE,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,YAAY,KAA4B;AACpB,MAAI,OAAO,QAAQ,SAAU,QAAO;AAC/D,MAAI,eAAe,IAAI,GAAG,EAAG,QAAO;AACpC,MAAI,IAAI,SAAS,IAAQ,EAAG,QAAO;AACnC,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAuB;AAGhD,QAAM,SAAS,IAAI,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,GAAG;AACxD,SAAO,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD;AAEA,SAAS,kBAAkB,KAAuD;AAChF,QAAM,SAAkC,CAAC;AACzC,aAAW,UAAU,OAAO,KAAK,GAAG,GAAG;AACrC,UAAM,UAAU,YAAY,MAAM;AAClC,QAAI,CAAC,QAAS;AACd,UAAM,QAAS,IAAY,MAAM;AAGjC,UAAM,gBAAgB,cAAc,KAAK,IACrC,kBAAkB,KAAgC,IAClD;AAEJ,QAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAClD,YAAM,WAAW,kBAAkB,OAAO;AAC1C,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,QAAQ,UAAU,aAAa;AACrC;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAa,KAAa,OAAsB;AAC1E,MAAI;AACF,UAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;AACxD,QAAI,QAAQ,KAAK,iBAAiB,SAAS,KAAK,aAAa,OAAO;AAElE;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,KAAK,iBAAiB,OAAO;AACxC,aAAO,eAAe,QAAQ,KAAK;AAAA,QACjC;AAAA,QACA,UAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AACD;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACA,MAAI;AACF,WAAO,GAAG,IAAI;AAAA,EAChB,SAAS,GAAG;AAAA,EAEZ;AACF;AAEA,SAAS,cAAiB,OAAa;AACrC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC;AAAA,EAC1C;AACA,MAAI,cAAc,KAAK,GAAG;AACxB,UAAM,MAA+B,CAAC;AACtC,eAAW,KAAK,OAAO,KAAK,KAAK,GAAG;AAClC,UAAI,CAAC,YAAY,CAAC,EAAG;AACrB,UAAI,CAAC,IAAI,cAAe,MAAkC,CAAC,CAAC;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAmB,UAAkC;AACxE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,OAAO,CAAC;AAAA,IACjB,KAAK;AACH,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,OAAO,OAAkB,CAAC,KAAK,MAAM;AAC1C,YAAI,MAAM,QAAQ,CAAC,EAAG,KAAI,KAAK,GAAG,CAAC;AAAA,YAC9B,KAAI,KAAK,CAAC;AACf,eAAO;AAAA,MACT,GAAG,CAAC,CAAC;AAAA,IACP;AACE,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,wBAAwB,KAAmB;AAClD,QAAM,KAAK,OAAO,KAAK,UAAU,cAAc,KAAK,EAAE,EAAE,YAAY;AACpE,SAAO,GAAG,WAAW,mCAAmC;AAC1D;AAEA,SAAS,kBAAkB,MAA0B,cAAiC;AACpF,MAAI,CAAC,QAAQ,aAAa,WAAW,EAAG,QAAO;AAC/C,QAAM,cAAc;AACpB,aAAW,KAAK,cAAc;AAC5B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,UAAI,YAAY,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC,EAAG,QAAO;AAAA,IACrD,WAAW,gBAAgB,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,WAAyC;AACnE,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,MAAI,OAAO,cAAc,SAAU,QAAO,CAAC,SAAS;AACpD,SAAO,UAAU,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ;AACtD;AAEA,SAAS,sBAAsB,WAAqB;AAClD,QAAM,QAAQ,IAAI,IAAI,SAAS;AAC/B,QAAM,WAAW,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,kBAAkB,WAA8B;AAC9C,UAAI,UAAU,WAAW,EAAG,QAAO;AACnC,YAAM,OAAO,UAAU,KAAK,GAAG;AAC/B,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAE5B,YAAM,OAAO,UAAU,UAAU,SAAS,CAAC;AAC3C,UAAI,MAAM,IAAI,IAAI,EAAG,QAAO;AAE5B,iBAAW,KAAK,UAAU;AACxB,YAAI,SAAS,KAAK,KAAK,WAAW,IAAI,GAAG,EAAG,QAAO;AAAA,MACrD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,MAAM,QAAiC,MAAgB,OAAsB;AAEpF,MAAI,KAAK,WAAW,GAAG;AACrB;AAAA,EACF;AACA,MAAI,MAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK;AACxC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,CAAC,cAAc,IAAI,CAAC,CAAC,EAAG,KAAI,CAAC,IAAI,CAAC;AACtC,UAAM,IAAI,CAAC;AAAA,EACb;AACA,QAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AACpC,MAAI,OAAO,IAAI;AACjB;AAEA,SAAS,4BACP,SACA,UACA,eACM;AACN,WAAS,KACP,MACA,OAAiB,CAAC,GAClB,QACA;AACA,eAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,YAAM,IAAI,KAAK,CAAC;AAChB,YAAM,UAAU,CAAC,GAAG,MAAM,CAAC;AAC3B,UAAI,cAAc,CAAC,GAAG;AACpB,aAAK,GAA8B,SAAS,IAAI;AAEhD,YAAI,OAAO,KAAK,CAA4B,EAAE,WAAW,GAAG;AAC1D,iBAAQ,KAAa,CAAC;AAAA,QACxB;AAAA,MACF,OAAO;AACL,YAAI,cAAc,OAAO,GAAG;AAE1B,gBAAM,iBAAiB,QAAQ;AAAA,YAAQ,CAAC,QACtC,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG;AAAA,UAC3C;AACA,gBAAM,SAAS,gBAAgB,CAAC;AAChC,iBAAQ,KAAa,CAAC;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,OAAK,QAAQ;AACf;AAEA,SAAS,gBACP,OACA,MAG0C;AAC1C,MAAI,WAAW;AACf,QAAM,WAAoC,CAAC;AAC3C,QAAM,eAAyB,CAAC;AAEhC,WAAS,YAAY,MAAe,OAAiB,CAAC,GAAG,QAAQ,GAAY;AAC3E,QAAI,SAAS,QAAQ,SAAS,OAAW,QAAO,KAAK,eAAe,OAAO;AAE3E,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,YAAM,SAAS,KAAK,IAAI,CAAC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC;AAC1D,UAAI,KAAK,kBAAkB,WAAW;AAEpC,eAAO,YAAY,QAAQ,SAAS;AAAA,MACtC;AAEA,YAAM,UAAU,MAAM,cAAc,IAAI,CAAC;AACzC,mBAAa,KAAK,KAAK,KAAK,GAAG,CAAC;AAChC,YAAM,UAAU,YAAY,QAAQ,KAAK,aAAa;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,cAAc,IAAI,GAAG;AACvB,UAAI,QAAQ,KAAK;AACf,cAAM,IAAI,MAAM,yBAAyB,KAAK,QAAQ,YAAY;AACpE,YAAM,MAA+B,CAAC;AACtC,iBAAW,UAAU,OAAO,KAAK,IAAI,GAAG;AACtC;AACA,YAAI,YAAY,KAAK,WAAW,OAAO,mBAAmB;AACxD,gBAAM,IAAI,MAAM,sBAAsB,KAAK,OAAO,YAAY;AAAA,QAChE;AACA,cAAM,UAAU,YAAY,MAAM;AAClC,YAAI,CAAC,QAAS;AACd,cAAM,QAAS,KAAiC,MAAM;AACtD,cAAM,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC;AACvC,YAAI,QAAQ,YAAY,OAAO,WAAW,QAAQ,CAAC;AACnD,YAAI,OAAO,UAAU,YAAY,KAAK,WAAY,SAAQ,MAAM,KAAK;AACrE,YAAI,OAAO,IAAI;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,cAAc,KAAK;AAClC,QAAM,UAAU,YAAY,QAAQ,CAAC,GAAG,CAAC;AACzC,SAAO,EAAE,SAAS,cAAc,UAAU,aAAa;AACzD;AAEO,SAAS,SACd,OACA,UAA2B,CAAC,GACzB;AAEH,QAAM,gBAAgB,cAAc,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACxE,QAAM,YAAY,mBAAmB,QAAQ,SAAS;AACtD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,SAAS;AAC7D,QAAM;AAAA,IACJ,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB,IAAI;AAGJ,QAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,eAAe;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,8BAA4B,SAAS,cAAc,iBAAiB;AAEpE,SAAO;AACT;AAIe,SAAR,KAAsB,UAAuB,CAAC,GAAG;AACtD,QAAM;AAAA,IACJ,YAAY,CAAC;AAAA,IACb,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,eAAe,CAAC;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,eAAe,mBAAmB,SAAS;AACjD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,YAAY;AAEhE,SAAO,SAAS,eAAe,KAAU,KAAU,MAAuB;AACxE,QAAI;AACF,UAAI,kBAAkB,KAAK,MAAM,YAAY,EAAG,QAAO,KAAK;AAE5D,UAAI,uBAAuB;AAC3B,YAAM,kBAA4B,CAAC;AAEnC,iBAAW,UAAU,SAAS;AACD,YAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AAChE,YAAI,IAAI,MAAM,MAAM,OAAW;AAE/B,YAAI,WAAW,QAAQ;AACrB,cAAI,yBAAyB,OAAQ;AACrC,cAAI,yBAAyB,gBAAgB,CAAC,wBAAwB,GAAG,EAAG;AAAA,QAC9E;AAEA,cAAM,OAAO,IAAI,MAAM;AACvB,YAAI,CAAC,cAAc,IAAI,EAAG;AAG1B,cAAM,eAAe,kBAAkB,IAAI;AAE3C,cAAM,cAAc,GAAG,MAAM;AAC7B,cAAM,eAAe,mBAAmB,MAAM;AAC9C,cAAM,qBAAqB,QAAS,IAAY,YAAY,CAAC;AAE7D,YAAI,CAAC,oBAAoB;AAEvB,gBAAM,EAAE,SAAS,cAAc,aAAa,IAAI,gBAAgB,cAAc;AAAA,YAC5E;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,6BAAmB,KAAK,QAAQ,OAAO;AAGvC,6BAAmB,KAAK,aAAa,YAAY;AACjD,UAAC,IAAY,YAAY,IAAI;AAG7B,sCAA4B,IAAI,MAAM,GAAG,IAAI,WAAW,GAAG,iBAAiB;AAE5E,cAAI,aAAa,SAAS,GAAG;AAC3B,mCAAuB;AACvB,uBAAW,KAAK,aAAc,iBAAgB,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE;AAAA,UACrE;AAAA,QACF,OAAO;AAEL,sCAA4B,IAAI,MAAM,GAAG,IAAI,WAAW,GAAG,iBAAiB;AAAA,QAE9E;AAAA,MACF;AAEA,UAAI,sBAAsB;AACxB,YAAI,qBAAqB;AACvB,cAAI;AACF,gCAAoB,KAAK;AAAA,cACvB,QAAQ;AAAA,cACR,cAAc;AAAA,YAChB,CAAC;AAAA,UACH,SAAS,GAAG;AAAA,UAEZ;AAAA,QACF;AACA,YAAI,UAAU,OAAO,OAAO,IAAI,WAAW,YAAY;AACrD,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS;AAAA,YACT,oBAAoB;AAAA,YACpB,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,UAAI,QAAQ;AACV,YAAI;AACF,iBAAO,GAAG;AAAA,QACZ,SAAS,GAAG;AAAA,QAEZ;AAAA,MACF;AACA,aAAO,KAAK,GAAG;AAAA,IACjB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\r\n * hppx — Superior HTTP Parameter Pollution protection middleware\r\n *\r\n * - Protects against parameter and prototype pollution\r\n * - Supports nested whitelists via dot-notation and leaf matching\r\n * - Merge strategies: keepFirst | keepLast | combine\r\n * - Multiple middleware compatibility: arrays are \"put aside\" once and selectively restored\r\n * - Exposes req.queryPolluted / req.bodyPolluted / req.paramsPolluted\r\n * - TypeScript-first API\r\n */\r\n\r\nexport type RequestSource = \"query\" | \"body\" | \"params\";\r\nexport type MergeStrategy = \"keepFirst\" | \"keepLast\" | \"combine\";\r\n\r\nexport interface SanitizeOptions {\r\n  whitelist?: string[] | string;\r\n  mergeStrategy?: MergeStrategy;\r\n  maxDepth?: number;\r\n  maxKeys?: number;\r\n  maxArrayLength?: number;\r\n  maxKeyLength?: number;\r\n  trimValues?: boolean;\r\n  preserveNull?: boolean;\r\n}\r\n\r\nexport interface HppxOptions extends SanitizeOptions {\r\n  sources?: RequestSource[];\r\n  /** When to process req.body */\r\n  checkBodyContentType?: \"urlencoded\" | \"any\" | \"none\";\r\n  excludePaths?: string[];\r\n  strict?: boolean;\r\n  onPollutionDetected?: (\r\n    req: Record<string, unknown>,\r\n    info: { source: RequestSource; pollutedKeys: string[] },\r\n  ) => void;\r\n  logger?: (err: Error | unknown) => void;\r\n}\r\n\r\nexport interface SanitizedResult<T> {\r\n  cleaned: T;\r\n  pollutedTree: Record<string, unknown>;\r\n  pollutedKeys: string[];\r\n}\r\n\r\nconst DEFAULT_SOURCES: RequestSource[] = [\"query\", \"body\", \"params\"];\r\nconst DEFAULT_STRATEGY: MergeStrategy = \"keepLast\";\r\nconst DANGEROUS_KEYS = new Set([\"__proto__\", \"prototype\", \"constructor\"]);\r\n\r\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\r\n  if (value === null || typeof value !== \"object\") return false;\r\n  const proto = Object.getPrototypeOf(value);\r\n  return proto === Object.prototype || proto === null;\r\n}\r\n\r\nfunction sanitizeKey(key: string, maxKeyLength?: number): string | null {\r\n  /* istanbul ignore next */ if (typeof key !== \"string\") return null;\r\n  if (DANGEROUS_KEYS.has(key)) return null;\r\n  if (key.includes(\"\\u0000\")) return null;\r\n  // Prevent excessively long keys that could cause DoS\r\n  const maxLen = maxKeyLength ?? 200;\r\n  if (key.length > maxLen) return null;\r\n  // Prevent keys that are only dots or brackets (malformed) - but allow single dot as it's valid\r\n  if (key.length > 1 && /^[.\\[\\]]+$/.test(key)) return null;\r\n  return key;\r\n}\r\n\r\n// Cache for parsed path segments to improve performance\r\nconst pathSegmentCache = new Map<string, string[]>();\r\n\r\nfunction parsePathSegments(key: string): string[] {\r\n  // Check cache first\r\n  const cached = pathSegmentCache.get(key);\r\n  if (cached) return cached;\r\n\r\n  // Convert bracket notation to dots, then split\r\n  // a[b][c] -> a.b.c\r\n  const dotted = key.replace(/\\]/g, \"\").replace(/\\[/g, \".\");\r\n  const result = dotted.split(\".\").filter((s) => s.length > 0);\r\n\r\n  // Cache the result (limit cache size)\r\n  if (pathSegmentCache.size < 500) {\r\n    pathSegmentCache.set(key, result);\r\n  }\r\n\r\n  return result;\r\n}\r\n\r\nfunction expandObjectPaths(\r\n  obj: Record<string, unknown>,\r\n  maxKeyLength?: number,\r\n): Record<string, unknown> {\r\n  const result: Record<string, unknown> = {};\r\n  for (const rawKey of Object.keys(obj)) {\r\n    const safeKey = sanitizeKey(rawKey, maxKeyLength);\r\n    if (!safeKey) continue;\r\n    const value = obj[rawKey];\r\n\r\n    // Recursively expand nested objects first\r\n    const expandedValue = isPlainObject(value)\r\n      ? expandObjectPaths(value as Record<string, unknown>, maxKeyLength)\r\n      : value;\r\n\r\n    if (safeKey.includes(\".\") || safeKey.includes(\"[\")) {\r\n      const segments = parsePathSegments(safeKey);\r\n      if (segments.length > 0) {\r\n        setIn(result, segments, expandedValue);\r\n        continue;\r\n      }\r\n    }\r\n    result[safeKey] = expandedValue;\r\n  }\r\n  return result;\r\n}\r\n\r\nfunction setReqPropertySafe(target: Record<string, unknown>, key: string, value: unknown): void {\r\n  try {\r\n    const desc = Object.getOwnPropertyDescriptor(target, key);\r\n    if (desc && desc.configurable === false && desc.writable === false) {\r\n      // Non-configurable and not writable: skip\r\n      return;\r\n    }\r\n    if (!desc || desc.configurable !== false) {\r\n      Object.defineProperty(target, key, {\r\n        value,\r\n        writable: true,\r\n        configurable: true,\r\n        enumerable: true,\r\n      });\r\n      return;\r\n    }\r\n  } catch (_) {\r\n    // fall back to assignment below\r\n  }\r\n  try {\r\n    target[key] = value;\r\n  } catch (_) {\r\n    // last resort: skip if cannot assign\r\n  }\r\n}\r\n\r\nfunction safeDeepClone<T>(input: T, maxKeyLength?: number, maxArrayLength?: number): T {\r\n  if (Array.isArray(input)) {\r\n    // Limit array length to prevent memory exhaustion\r\n    const limit = maxArrayLength ?? 1000;\r\n    const limited = input.slice(0, limit);\r\n    return limited.map((v) => safeDeepClone(v, maxKeyLength, maxArrayLength)) as T;\r\n  }\r\n  if (isPlainObject(input)) {\r\n    const out: Record<string, unknown> = {};\r\n    for (const k of Object.keys(input)) {\r\n      if (!sanitizeKey(k, maxKeyLength)) continue;\r\n      out[k] = safeDeepClone((input as Record<string, unknown>)[k], maxKeyLength, maxArrayLength);\r\n    }\r\n    return out as T;\r\n  }\r\n  return input;\r\n}\r\n\r\nfunction mergeValues(values: unknown[], strategy: MergeStrategy): unknown {\r\n  switch (strategy) {\r\n    case \"keepFirst\":\r\n      return values[0];\r\n    case \"keepLast\":\r\n      return values[values.length - 1];\r\n    case \"combine\":\r\n      return values.reduce<unknown[]>((acc, v) => {\r\n        if (Array.isArray(v)) acc.push(...v);\r\n        else acc.push(v);\r\n        return acc;\r\n      }, []);\r\n    default:\r\n      return values[values.length - 1];\r\n  }\r\n}\r\n\r\nfunction isUrlEncodedContentType(req: any): boolean {\r\n  const ct = String(req?.headers?.[\"content-type\"] || \"\").toLowerCase();\r\n  return ct.startsWith(\"application/x-www-form-urlencoded\");\r\n}\r\n\r\nfunction shouldExcludePath(path: string | undefined, excludePaths: string[]): boolean {\r\n  if (!path || excludePaths.length === 0) return false;\r\n  const currentPath = path;\r\n  for (const p of excludePaths) {\r\n    if (p.endsWith(\"*\")) {\r\n      if (currentPath.startsWith(p.slice(0, -1))) return true;\r\n    } else if (currentPath === p) {\r\n      return true;\r\n    }\r\n  }\r\n  return false;\r\n}\r\n\r\nfunction normalizeWhitelist(whitelist?: string[] | string): string[] {\r\n  if (!whitelist) return [];\r\n  if (typeof whitelist === \"string\") return [whitelist];\r\n  return whitelist.filter((w) => typeof w === \"string\");\r\n}\r\n\r\nfunction buildWhitelistHelpers(whitelist: string[]) {\r\n  const exact = new Set(whitelist);\r\n  const prefixes = whitelist.filter((w) => w.length > 0);\r\n  // Pre-build a cache for commonly checked paths for performance\r\n  const pathCache = new Map<string, boolean>();\r\n\r\n  return {\r\n    exact,\r\n    prefixes,\r\n    isWhitelistedPath(pathParts: string[]): boolean {\r\n      if (pathParts.length === 0) return false;\r\n      const full = pathParts.join(\".\");\r\n\r\n      // Check cache first for performance\r\n      const cached = pathCache.get(full);\r\n      if (cached !== undefined) return cached;\r\n\r\n      let result = false;\r\n\r\n      // Exact match\r\n      if (exact.has(full)) {\r\n        result = true;\r\n      }\r\n      // Leaf match\r\n      else if (exact.has(pathParts[pathParts.length - 1]!)) {\r\n        result = true;\r\n      }\r\n      // Prefix match (treat any listed segment as prefix of a subtree)\r\n      else {\r\n        for (const p of prefixes) {\r\n          if (full === p || full.startsWith(p + \".\")) {\r\n            result = true;\r\n            break;\r\n          }\r\n        }\r\n      }\r\n\r\n      // Cache the result (limit cache size to prevent memory issues)\r\n      if (pathCache.size < 1000) {\r\n        pathCache.set(full, result);\r\n      }\r\n\r\n      return result;\r\n    },\r\n  };\r\n}\r\n\r\nfunction setIn(target: Record<string, unknown>, path: string[], value: unknown): void {\r\n  /* istanbul ignore if */\r\n  if (path.length === 0) {\r\n    return;\r\n  }\r\n  let cur: Record<string, unknown> = target;\r\n  for (let i = 0; i < path.length - 1; i++) {\r\n    const k = path[i]!;\r\n    // Additional prototype pollution protection\r\n    if (DANGEROUS_KEYS.has(k)) return;\r\n    if (!isPlainObject(cur[k])) {\r\n      // Create a new plain object to avoid pollution\r\n      cur[k] = {};\r\n    }\r\n    cur = cur[k] as Record<string, unknown>;\r\n  }\r\n  const lastKey = path[path.length - 1]!;\r\n  // Final check on the last key\r\n  if (DANGEROUS_KEYS.has(lastKey)) return;\r\n  cur[lastKey] = value;\r\n}\r\n\r\nfunction moveWhitelistedFromPolluted(\r\n  reqPart: Record<string, unknown>,\r\n  polluted: Record<string, unknown>,\r\n  isWhitelisted: (path: string[]) => boolean,\r\n): void {\r\n  function walk(node: Record<string, unknown>, path: string[] = []) {\r\n    for (const k of Object.keys(node)) {\r\n      const v = node[k];\r\n      const curPath = [...path, k];\r\n      if (isPlainObject(v)) {\r\n        walk(v as Record<string, unknown>, curPath);\r\n        // prune empty objects\r\n        if (Object.keys(v as Record<string, unknown>).length === 0) {\r\n          delete node[k];\r\n        }\r\n      } else {\r\n        if (isWhitelisted(curPath)) {\r\n          // put back into request\r\n          const normalizedPath = curPath.flatMap((seg) =>\r\n            seg.includes(\".\") ? seg.split(\".\") : [seg],\r\n          );\r\n          setIn(reqPart, normalizedPath, v);\r\n          delete node[k];\r\n        }\r\n      }\r\n    }\r\n  }\r\n  walk(polluted);\r\n}\r\n\r\nfunction detectAndReduce(\r\n  input: Record<string, unknown>,\r\n  opts: Required<\r\n    Pick<\r\n      SanitizeOptions,\r\n      | \"mergeStrategy\"\r\n      | \"maxDepth\"\r\n      | \"maxKeys\"\r\n      | \"maxArrayLength\"\r\n      | \"maxKeyLength\"\r\n      | \"trimValues\"\r\n      | \"preserveNull\"\r\n    >\r\n  >,\r\n): SanitizedResult<Record<string, unknown>> {\r\n  let keyCount = 0;\r\n  const polluted: Record<string, unknown> = {};\r\n  const pollutedKeys: string[] = [];\r\n\r\n  function processNode(node: unknown, path: string[] = [], depth = 0): unknown {\r\n    if (node === null || node === undefined) return opts.preserveNull ? node : node;\r\n\r\n    if (Array.isArray(node)) {\r\n      // Limit array length to prevent DoS\r\n      const limit = opts.maxArrayLength ?? 1000;\r\n      const limitedNode = node.slice(0, limit);\r\n\r\n      const mapped = limitedNode.map((v) => processNode(v, path, depth));\r\n      if (opts.mergeStrategy === \"combine\") {\r\n        // combine: do not record pollution, but flatten using mergeValues\r\n        return mergeValues(mapped, \"combine\");\r\n      }\r\n      // Other strategies: record pollution and reduce\r\n      setIn(polluted, path, safeDeepClone(limitedNode, opts.maxKeyLength, opts.maxArrayLength));\r\n      pollutedKeys.push(path.join(\".\"));\r\n      const reduced = mergeValues(mapped, opts.mergeStrategy);\r\n      return reduced;\r\n    }\r\n\r\n    if (isPlainObject(node)) {\r\n      if (depth > opts.maxDepth)\r\n        throw new Error(`Maximum object depth (${opts.maxDepth}) exceeded`);\r\n      const out: Record<string, unknown> = {};\r\n      for (const rawKey of Object.keys(node)) {\r\n        keyCount++;\r\n        if (keyCount > (opts.maxKeys ?? Number.MAX_SAFE_INTEGER)) {\r\n          throw new Error(`Maximum key count (${opts.maxKeys}) exceeded`);\r\n        }\r\n        const safeKey = sanitizeKey(rawKey, opts.maxKeyLength);\r\n        if (!safeKey) continue;\r\n        const child = (node as Record<string, unknown>)[rawKey];\r\n        const childPath = path.concat([safeKey]);\r\n        let value = processNode(child, childPath, depth + 1);\r\n        if (typeof value === \"string\" && opts.trimValues) value = value.trim();\r\n        out[safeKey] = value;\r\n      }\r\n      return out;\r\n    }\r\n\r\n    return node;\r\n  }\r\n\r\n  const cloned = safeDeepClone(input, opts.maxKeyLength, opts.maxArrayLength);\r\n  const cleaned = processNode(cloned, [], 0) as Record<string, unknown>;\r\n  return { cleaned, pollutedTree: polluted, pollutedKeys };\r\n}\r\n\r\nexport function sanitize<T extends Record<string, unknown>>(\r\n  input: T,\r\n  options: SanitizeOptions = {},\r\n): T {\r\n  // Normalize and expand keys prior to sanitization\r\n  const maxKeyLength = options.maxKeyLength ?? 200;\r\n  const expandedInput = isPlainObject(input) ? expandObjectPaths(input, maxKeyLength) : input;\r\n  const whitelist = normalizeWhitelist(options.whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelist);\r\n  const {\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    maxArrayLength = 1000,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n  } = options;\r\n\r\n  // First: reduce arrays and collect polluted\r\n  const { cleaned, pollutedTree } = detectAndReduce(expandedInput, {\r\n    mergeStrategy,\r\n    maxDepth,\r\n    maxKeys,\r\n    maxArrayLength,\r\n    maxKeyLength,\r\n    trimValues,\r\n    preserveNull,\r\n  });\r\n\r\n  // Second: move back whitelisted arrays\r\n  moveWhitelistedFromPolluted(cleaned, pollutedTree, isWhitelistedPath);\r\n\r\n  return cleaned as T;\r\n}\r\n\r\ntype ExpressLikeNext = (err?: unknown) => void;\r\n\r\nfunction validateOptions(options: HppxOptions): void {\r\n  if (\r\n    options.maxDepth !== undefined &&\r\n    (typeof options.maxDepth !== \"number\" || options.maxDepth < 1 || options.maxDepth > 100)\r\n  ) {\r\n    throw new TypeError(\"maxDepth must be a number between 1 and 100\");\r\n  }\r\n  if (\r\n    options.maxKeys !== undefined &&\r\n    (typeof options.maxKeys !== \"number\" || options.maxKeys < 1)\r\n  ) {\r\n    throw new TypeError(\"maxKeys must be a positive number\");\r\n  }\r\n  if (\r\n    options.maxArrayLength !== undefined &&\r\n    (typeof options.maxArrayLength !== \"number\" || options.maxArrayLength < 1)\r\n  ) {\r\n    throw new TypeError(\"maxArrayLength must be a positive number\");\r\n  }\r\n  if (\r\n    options.maxKeyLength !== undefined &&\r\n    (typeof options.maxKeyLength !== \"number\" ||\r\n      options.maxKeyLength < 1 ||\r\n      options.maxKeyLength > 1000)\r\n  ) {\r\n    throw new TypeError(\"maxKeyLength must be a number between 1 and 1000\");\r\n  }\r\n  if (\r\n    options.mergeStrategy !== undefined &&\r\n    ![\"keepFirst\", \"keepLast\", \"combine\"].includes(options.mergeStrategy)\r\n  ) {\r\n    throw new TypeError(\"mergeStrategy must be 'keepFirst', 'keepLast', or 'combine'\");\r\n  }\r\n  if (options.sources !== undefined && !Array.isArray(options.sources)) {\r\n    throw new TypeError(\"sources must be an array\");\r\n  }\r\n  if (options.sources !== undefined) {\r\n    for (const source of options.sources) {\r\n      if (![\"query\", \"body\", \"params\"].includes(source)) {\r\n        throw new TypeError(\"sources must only contain 'query', 'body', or 'params'\");\r\n      }\r\n    }\r\n  }\r\n  if (\r\n    options.checkBodyContentType !== undefined &&\r\n    ![\"urlencoded\", \"any\", \"none\"].includes(options.checkBodyContentType)\r\n  ) {\r\n    throw new TypeError(\"checkBodyContentType must be 'urlencoded', 'any', or 'none'\");\r\n  }\r\n  if (options.excludePaths !== undefined && !Array.isArray(options.excludePaths)) {\r\n    throw new TypeError(\"excludePaths must be an array\");\r\n  }\r\n}\r\n\r\nexport default function hppx(options: HppxOptions = {}) {\r\n  // Validate options on middleware creation\r\n  validateOptions(options);\r\n\r\n  const {\r\n    whitelist = [],\r\n    mergeStrategy = DEFAULT_STRATEGY,\r\n    sources = DEFAULT_SOURCES,\r\n    checkBodyContentType = \"urlencoded\",\r\n    excludePaths = [],\r\n    maxDepth = 20,\r\n    maxKeys = 5000,\r\n    maxArrayLength = 1000,\r\n    maxKeyLength = 200,\r\n    trimValues = false,\r\n    preserveNull = true,\r\n    strict = false,\r\n    onPollutionDetected,\r\n    logger,\r\n  } = options;\r\n\r\n  const whitelistArr = normalizeWhitelist(whitelist);\r\n  const { isWhitelistedPath } = buildWhitelistHelpers(whitelistArr);\r\n\r\n  return function hppxMiddleware(req: any, res: any, next: ExpressLikeNext) {\r\n    try {\r\n      if (shouldExcludePath(req?.path, excludePaths)) return next();\r\n\r\n      let anyPollutionDetected = false;\r\n      const allPollutedKeys: string[] = [];\r\n\r\n      for (const source of sources) {\r\n        /* istanbul ignore next */\r\n        if (!req || typeof req !== \"object\") break;\r\n        if (req[source] === undefined) continue;\r\n\r\n        if (source === \"body\") {\r\n          if (checkBodyContentType === \"none\") continue;\r\n          if (checkBodyContentType === \"urlencoded\" && !isUrlEncodedContentType(req)) continue;\r\n        }\r\n\r\n        const part = req[source];\r\n        if (!isPlainObject(part)) continue;\r\n\r\n        // Preprocess: expand dotted and bracketed keys into nested objects\r\n        const expandedPart = expandObjectPaths(part, maxKeyLength);\r\n\r\n        const pollutedKey = `${source}Polluted`;\r\n        const processedKey = `__hppxProcessed_${source}`;\r\n        const hasProcessedBefore = Boolean(req[processedKey]);\r\n\r\n        if (!hasProcessedBefore) {\r\n          // First pass for this request part: reduce arrays and collect polluted\r\n          const { cleaned, pollutedTree, pollutedKeys } = detectAndReduce(expandedPart, {\r\n            mergeStrategy,\r\n            maxDepth,\r\n            maxKeys,\r\n            maxArrayLength,\r\n            maxKeyLength,\r\n            trimValues,\r\n            preserveNull,\r\n          });\r\n\r\n          setReqPropertySafe(req, source, cleaned);\r\n\r\n          // Attach polluted object (always present as {} when source processed)\r\n          setReqPropertySafe(req, pollutedKey, pollutedTree);\r\n          req[processedKey] = true;\r\n\r\n          // Apply whitelist now: move whitelisted arrays back\r\n          const sourceData = req[source];\r\n          const pollutedData = req[pollutedKey];\r\n          if (isPlainObject(sourceData) && isPlainObject(pollutedData)) {\r\n            moveWhitelistedFromPolluted(sourceData, pollutedData, isWhitelistedPath);\r\n          }\r\n\r\n          if (pollutedKeys.length > 0) {\r\n            anyPollutionDetected = true;\r\n            for (const k of pollutedKeys) allPollutedKeys.push(`${source}.${k}`);\r\n          }\r\n        } else {\r\n          // Subsequent middleware: only put back whitelisted entries\r\n          const sourceData = req[source];\r\n          const pollutedData = req[pollutedKey];\r\n          if (isPlainObject(sourceData) && isPlainObject(pollutedData)) {\r\n            moveWhitelistedFromPolluted(sourceData, pollutedData, isWhitelistedPath);\r\n          }\r\n          // pollution already accounted for in previous pass\r\n        }\r\n      }\r\n\r\n      if (anyPollutionDetected) {\r\n        if (onPollutionDetected) {\r\n          try {\r\n            // Determine which sources had pollution\r\n            for (const source of sources) {\r\n              const pollutedKey = `${source}Polluted`;\r\n              const pollutedData = req[pollutedKey];\r\n              if (pollutedData && Object.keys(pollutedData).length > 0) {\r\n                const sourcePollutedKeys = allPollutedKeys.filter((k) =>\r\n                  k.startsWith(`${source}.`),\r\n                );\r\n                if (sourcePollutedKeys.length > 0) {\r\n                  onPollutionDetected(req, {\r\n                    source: source,\r\n                    pollutedKeys: sourcePollutedKeys,\r\n                  });\r\n                }\r\n              }\r\n            }\r\n          } catch (_) {\r\n            /* ignore user callback errors */\r\n          }\r\n        }\r\n        if (strict && res && typeof res.status === \"function\") {\r\n          return res.status(400).json({\r\n            error: \"Bad Request\",\r\n            message: \"HTTP Parameter Pollution detected\",\r\n            pollutedParameters: allPollutedKeys,\r\n            code: \"HPP_DETECTED\",\r\n          });\r\n        }\r\n      }\r\n\r\n      return next();\r\n    } catch (err) {\r\n      // Enhanced error handling with detailed logging\r\n      const error = err instanceof Error ? err : new Error(String(err));\r\n\r\n      if (logger) {\r\n        try {\r\n          logger(error);\r\n        } catch (logErr) {\r\n          // If custom logger fails, use console.error as fallback in development\r\n          if (process.env.NODE_ENV !== \"production\") {\r\n            console.error(\"[hppx] Logger failed:\", logErr);\r\n            console.error(\"[hppx] Original error:\", error);\r\n          }\r\n        }\r\n      }\r\n\r\n      // Pass error to next middleware for proper error handling\r\n      return next(error);\r\n    }\r\n  };\r\n}\r\n\r\nexport { DANGEROUS_KEYS, DEFAULT_STRATEGY, DEFAULT_SOURCES };\r\n"],"mappings":";AA4CA,IAAM,kBAAmC,CAAC,SAAS,QAAQ,QAAQ;AACnE,IAAM,mBAAkC;AACxC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,aAAa,CAAC;AAExE,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAEA,SAAS,YAAY,KAAa,cAAsC;AAC3C,MAAI,OAAO,QAAQ,SAAU,QAAO;AAC/D,MAAI,eAAe,IAAI,GAAG,EAAG,QAAO;AACpC,MAAI,IAAI,SAAS,IAAQ,EAAG,QAAO;AAEnC,QAAM,SAAS,gBAAgB;AAC/B,MAAI,IAAI,SAAS,OAAQ,QAAO;AAEhC,MAAI,IAAI,SAAS,KAAK,aAAa,KAAK,GAAG,EAAG,QAAO;AACrD,SAAO;AACT;AAGA,IAAM,mBAAmB,oBAAI,IAAsB;AAEnD,SAAS,kBAAkB,KAAuB;AAEhD,QAAM,SAAS,iBAAiB,IAAI,GAAG;AACvC,MAAI,OAAQ,QAAO;AAInB,QAAM,SAAS,IAAI,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,GAAG;AACxD,QAAM,SAAS,OAAO,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAG3D,MAAI,iBAAiB,OAAO,KAAK;AAC/B,qBAAiB,IAAI,KAAK,MAAM;AAAA,EAClC;AAEA,SAAO;AACT;AAEA,SAAS,kBACP,KACA,cACyB;AACzB,QAAM,SAAkC,CAAC;AACzC,aAAW,UAAU,OAAO,KAAK,GAAG,GAAG;AACrC,UAAM,UAAU,YAAY,QAAQ,YAAY;AAChD,QAAI,CAAC,QAAS;AACd,UAAM,QAAQ,IAAI,MAAM;AAGxB,UAAM,gBAAgB,cAAc,KAAK,IACrC,kBAAkB,OAAkC,YAAY,IAChE;AAEJ,QAAI,QAAQ,SAAS,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AAClD,YAAM,WAAW,kBAAkB,OAAO;AAC1C,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,QAAQ,UAAU,aAAa;AACrC;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAiC,KAAa,OAAsB;AAC9F,MAAI;AACF,UAAM,OAAO,OAAO,yBAAyB,QAAQ,GAAG;AACxD,QAAI,QAAQ,KAAK,iBAAiB,SAAS,KAAK,aAAa,OAAO;AAElE;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,KAAK,iBAAiB,OAAO;AACxC,aAAO,eAAe,QAAQ,KAAK;AAAA,QACjC;AAAA,QACA,UAAU;AAAA,QACV,cAAc;AAAA,QACd,YAAY;AAAA,MACd,CAAC;AACD;AAAA,IACF;AAAA,EACF,SAAS,GAAG;AAAA,EAEZ;AACA,MAAI;AACF,WAAO,GAAG,IAAI;AAAA,EAChB,SAAS,GAAG;AAAA,EAEZ;AACF;AAEA,SAAS,cAAiB,OAAU,cAAuB,gBAA4B;AACrF,MAAI,MAAM,QAAQ,KAAK,GAAG;AAExB,UAAM,QAAQ,kBAAkB;AAChC,UAAM,UAAU,MAAM,MAAM,GAAG,KAAK;AACpC,WAAO,QAAQ,IAAI,CAAC,MAAM,cAAc,GAAG,cAAc,cAAc,CAAC;AAAA,EAC1E;AACA,MAAI,cAAc,KAAK,GAAG;AACxB,UAAM,MAA+B,CAAC;AACtC,eAAW,KAAK,OAAO,KAAK,KAAK,GAAG;AAClC,UAAI,CAAC,YAAY,GAAG,YAAY,EAAG;AACnC,UAAI,CAAC,IAAI,cAAe,MAAkC,CAAC,GAAG,cAAc,cAAc;AAAA,IAC5F;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAmB,UAAkC;AACxE,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,OAAO,CAAC;AAAA,IACjB,KAAK;AACH,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,OAAO,OAAkB,CAAC,KAAK,MAAM;AAC1C,YAAI,MAAM,QAAQ,CAAC,EAAG,KAAI,KAAK,GAAG,CAAC;AAAA,YAC9B,KAAI,KAAK,CAAC;AACf,eAAO;AAAA,MACT,GAAG,CAAC,CAAC;AAAA,IACP;AACE,aAAO,OAAO,OAAO,SAAS,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,wBAAwB,KAAmB;AAClD,QAAM,KAAK,OAAO,KAAK,UAAU,cAAc,KAAK,EAAE,EAAE,YAAY;AACpE,SAAO,GAAG,WAAW,mCAAmC;AAC1D;AAEA,SAAS,kBAAkB,MAA0B,cAAiC;AACpF,MAAI,CAAC,QAAQ,aAAa,WAAW,EAAG,QAAO;AAC/C,QAAM,cAAc;AACpB,aAAW,KAAK,cAAc;AAC5B,QAAI,EAAE,SAAS,GAAG,GAAG;AACnB,UAAI,YAAY,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC,EAAG,QAAO;AAAA,IACrD,WAAW,gBAAgB,GAAG;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,WAAyC;AACnE,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,MAAI,OAAO,cAAc,SAAU,QAAO,CAAC,SAAS;AACpD,SAAO,UAAU,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ;AACtD;AAEA,SAAS,sBAAsB,WAAqB;AAClD,QAAM,QAAQ,IAAI,IAAI,SAAS;AAC/B,QAAM,WAAW,UAAU,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAErD,QAAM,YAAY,oBAAI,IAAqB;AAE3C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,kBAAkB,WAA8B;AAC9C,UAAI,UAAU,WAAW,EAAG,QAAO;AACnC,YAAM,OAAO,UAAU,KAAK,GAAG;AAG/B,YAAM,SAAS,UAAU,IAAI,IAAI;AACjC,UAAI,WAAW,OAAW,QAAO;AAEjC,UAAI,SAAS;AAGb,UAAI,MAAM,IAAI,IAAI,GAAG;AACnB,iBAAS;AAAA,MACX,WAES,MAAM,IAAI,UAAU,UAAU,SAAS,CAAC,CAAE,GAAG;AACpD,iBAAS;AAAA,MACX,OAEK;AACH,mBAAW,KAAK,UAAU;AACxB,cAAI,SAAS,KAAK,KAAK,WAAW,IAAI,GAAG,GAAG;AAC1C,qBAAS;AACT;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAGA,UAAI,UAAU,OAAO,KAAM;AACzB,kBAAU,IAAI,MAAM,MAAM;AAAA,MAC5B;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,MAAM,QAAiC,MAAgB,OAAsB;AAEpF,MAAI,KAAK,WAAW,GAAG;AACrB;AAAA,EACF;AACA,MAAI,MAA+B;AACnC,WAAS,IAAI,GAAG,IAAI,KAAK,SAAS,GAAG,KAAK;AACxC,UAAM,IAAI,KAAK,CAAC;AAEhB,QAAI,eAAe,IAAI,CAAC,EAAG;AAC3B,QAAI,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG;AAE1B,UAAI,CAAC,IAAI,CAAC;AAAA,IACZ;AACA,UAAM,IAAI,CAAC;AAAA,EACb;AACA,QAAM,UAAU,KAAK,KAAK,SAAS,CAAC;AAEpC,MAAI,eAAe,IAAI,OAAO,EAAG;AACjC,MAAI,OAAO,IAAI;AACjB;AAEA,SAAS,4BACP,SACA,UACA,eACM;AACN,WAAS,KAAK,MAA+B,OAAiB,CAAC,GAAG;AAChE,eAAW,KAAK,OAAO,KAAK,IAAI,GAAG;AACjC,YAAM,IAAI,KAAK,CAAC;AAChB,YAAM,UAAU,CAAC,GAAG,MAAM,CAAC;AAC3B,UAAI,cAAc,CAAC,GAAG;AACpB,aAAK,GAA8B,OAAO;AAE1C,YAAI,OAAO,KAAK,CAA4B,EAAE,WAAW,GAAG;AAC1D,iBAAO,KAAK,CAAC;AAAA,QACf;AAAA,MACF,OAAO;AACL,YAAI,cAAc,OAAO,GAAG;AAE1B,gBAAM,iBAAiB,QAAQ;AAAA,YAAQ,CAAC,QACtC,IAAI,SAAS,GAAG,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG;AAAA,UAC3C;AACA,gBAAM,SAAS,gBAAgB,CAAC;AAChC,iBAAO,KAAK,CAAC;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,OAAK,QAAQ;AACf;AAEA,SAAS,gBACP,OACA,MAY0C;AAC1C,MAAI,WAAW;AACf,QAAM,WAAoC,CAAC;AAC3C,QAAM,eAAyB,CAAC;AAEhC,WAAS,YAAY,MAAe,OAAiB,CAAC,GAAG,QAAQ,GAAY;AAC3E,QAAI,SAAS,QAAQ,SAAS,OAAW,QAAO,KAAK,eAAe,OAAO;AAE3E,QAAI,MAAM,QAAQ,IAAI,GAAG;AAEvB,YAAM,QAAQ,KAAK,kBAAkB;AACrC,YAAM,cAAc,KAAK,MAAM,GAAG,KAAK;AAEvC,YAAM,SAAS,YAAY,IAAI,CAAC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC;AACjE,UAAI,KAAK,kBAAkB,WAAW;AAEpC,eAAO,YAAY,QAAQ,SAAS;AAAA,MACtC;AAEA,YAAM,UAAU,MAAM,cAAc,aAAa,KAAK,cAAc,KAAK,cAAc,CAAC;AACxF,mBAAa,KAAK,KAAK,KAAK,GAAG,CAAC;AAChC,YAAM,UAAU,YAAY,QAAQ,KAAK,aAAa;AACtD,aAAO;AAAA,IACT;AAEA,QAAI,cAAc,IAAI,GAAG;AACvB,UAAI,QAAQ,KAAK;AACf,cAAM,IAAI,MAAM,yBAAyB,KAAK,QAAQ,YAAY;AACpE,YAAM,MAA+B,CAAC;AACtC,iBAAW,UAAU,OAAO,KAAK,IAAI,GAAG;AACtC;AACA,YAAI,YAAY,KAAK,WAAW,OAAO,mBAAmB;AACxD,gBAAM,IAAI,MAAM,sBAAsB,KAAK,OAAO,YAAY;AAAA,QAChE;AACA,cAAM,UAAU,YAAY,QAAQ,KAAK,YAAY;AACrD,YAAI,CAAC,QAAS;AACd,cAAM,QAAS,KAAiC,MAAM;AACtD,cAAM,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC;AACvC,YAAI,QAAQ,YAAY,OAAO,WAAW,QAAQ,CAAC;AACnD,YAAI,OAAO,UAAU,YAAY,KAAK,WAAY,SAAQ,MAAM,KAAK;AACrE,YAAI,OAAO,IAAI;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,cAAc,OAAO,KAAK,cAAc,KAAK,cAAc;AAC1E,QAAM,UAAU,YAAY,QAAQ,CAAC,GAAG,CAAC;AACzC,SAAO,EAAE,SAAS,cAAc,UAAU,aAAa;AACzD;AAEO,SAAS,SACd,OACA,UAA2B,CAAC,GACzB;AAEH,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,gBAAgB,cAAc,KAAK,IAAI,kBAAkB,OAAO,YAAY,IAAI;AACtF,QAAM,YAAY,mBAAmB,QAAQ,SAAS;AACtD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,SAAS;AAC7D,QAAM;AAAA,IACJ,gBAAgB;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,eAAe;AAAA,EACjB,IAAI;AAGJ,QAAM,EAAE,SAAS,aAAa,IAAI,gBAAgB,eAAe;AAAA,IAC/D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAGD,8BAA4B,SAAS,cAAc,iBAAiB;AAEpE,SAAO;AACT;AAIA,SAAS,gBAAgB,SAA4B;AACnD,MACE,QAAQ,aAAa,WACpB,OAAO,QAAQ,aAAa,YAAY,QAAQ,WAAW,KAAK,QAAQ,WAAW,MACpF;AACA,UAAM,IAAI,UAAU,6CAA6C;AAAA,EACnE;AACA,MACE,QAAQ,YAAY,WACnB,OAAO,QAAQ,YAAY,YAAY,QAAQ,UAAU,IAC1D;AACA,UAAM,IAAI,UAAU,mCAAmC;AAAA,EACzD;AACA,MACE,QAAQ,mBAAmB,WAC1B,OAAO,QAAQ,mBAAmB,YAAY,QAAQ,iBAAiB,IACxE;AACA,UAAM,IAAI,UAAU,0CAA0C;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,WACxB,OAAO,QAAQ,iBAAiB,YAC/B,QAAQ,eAAe,KACvB,QAAQ,eAAe,MACzB;AACA,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,MACE,QAAQ,kBAAkB,UAC1B,CAAC,CAAC,aAAa,YAAY,SAAS,EAAE,SAAS,QAAQ,aAAa,GACpE;AACA,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,MAAI,QAAQ,YAAY,UAAa,CAAC,MAAM,QAAQ,QAAQ,OAAO,GAAG;AACpE,UAAM,IAAI,UAAU,0BAA0B;AAAA,EAChD;AACA,MAAI,QAAQ,YAAY,QAAW;AACjC,eAAW,UAAU,QAAQ,SAAS;AACpC,UAAI,CAAC,CAAC,SAAS,QAAQ,QAAQ,EAAE,SAAS,MAAM,GAAG;AACjD,cAAM,IAAI,UAAU,wDAAwD;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACA,MACE,QAAQ,yBAAyB,UACjC,CAAC,CAAC,cAAc,OAAO,MAAM,EAAE,SAAS,QAAQ,oBAAoB,GACpE;AACA,UAAM,IAAI,UAAU,6DAA6D;AAAA,EACnF;AACA,MAAI,QAAQ,iBAAiB,UAAa,CAAC,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAC9E,UAAM,IAAI,UAAU,+BAA+B;AAAA,EACrD;AACF;AAEe,SAAR,KAAsB,UAAuB,CAAC,GAAG;AAEtD,kBAAgB,OAAO;AAEvB,QAAM;AAAA,IACJ,YAAY,CAAC;AAAA,IACb,gBAAgB;AAAA,IAChB,UAAU;AAAA,IACV,uBAAuB;AAAA,IACvB,eAAe,CAAC;AAAA,IAChB,WAAW;AAAA,IACX,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,aAAa;AAAA,IACb,eAAe;AAAA,IACf,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,eAAe,mBAAmB,SAAS;AACjD,QAAM,EAAE,kBAAkB,IAAI,sBAAsB,YAAY;AAEhE,SAAO,SAAS,eAAe,KAAU,KAAU,MAAuB;AACxE,QAAI;AACF,UAAI,kBAAkB,KAAK,MAAM,YAAY,EAAG,QAAO,KAAK;AAE5D,UAAI,uBAAuB;AAC3B,YAAM,kBAA4B,CAAC;AAEnC,iBAAW,UAAU,SAAS;AAE5B,YAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,YAAI,IAAI,MAAM,MAAM,OAAW;AAE/B,YAAI,WAAW,QAAQ;AACrB,cAAI,yBAAyB,OAAQ;AACrC,cAAI,yBAAyB,gBAAgB,CAAC,wBAAwB,GAAG,EAAG;AAAA,QAC9E;AAEA,cAAM,OAAO,IAAI,MAAM;AACvB,YAAI,CAAC,cAAc,IAAI,EAAG;AAG1B,cAAM,eAAe,kBAAkB,MAAM,YAAY;AAEzD,cAAM,cAAc,GAAG,MAAM;AAC7B,cAAM,eAAe,mBAAmB,MAAM;AAC9C,cAAM,qBAAqB,QAAQ,IAAI,YAAY,CAAC;AAEpD,YAAI,CAAC,oBAAoB;AAEvB,gBAAM,EAAE,SAAS,cAAc,aAAa,IAAI,gBAAgB,cAAc;AAAA,YAC5E;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAED,6BAAmB,KAAK,QAAQ,OAAO;AAGvC,6BAAmB,KAAK,aAAa,YAAY;AACjD,cAAI,YAAY,IAAI;AAGpB,gBAAM,aAAa,IAAI,MAAM;AAC7B,gBAAM,eAAe,IAAI,WAAW;AACpC,cAAI,cAAc,UAAU,KAAK,cAAc,YAAY,GAAG;AAC5D,wCAA4B,YAAY,cAAc,iBAAiB;AAAA,UACzE;AAEA,cAAI,aAAa,SAAS,GAAG;AAC3B,mCAAuB;AACvB,uBAAW,KAAK,aAAc,iBAAgB,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE;AAAA,UACrE;AAAA,QACF,OAAO;AAEL,gBAAM,aAAa,IAAI,MAAM;AAC7B,gBAAM,eAAe,IAAI,WAAW;AACpC,cAAI,cAAc,UAAU,KAAK,cAAc,YAAY,GAAG;AAC5D,wCAA4B,YAAY,cAAc,iBAAiB;AAAA,UACzE;AAAA,QAEF;AAAA,MACF;AAEA,UAAI,sBAAsB;AACxB,YAAI,qBAAqB;AACvB,cAAI;AAEF,uBAAW,UAAU,SAAS;AAC5B,oBAAM,cAAc,GAAG,MAAM;AAC7B,oBAAM,eAAe,IAAI,WAAW;AACpC,kBAAI,gBAAgB,OAAO,KAAK,YAAY,EAAE,SAAS,GAAG;AACxD,sBAAM,qBAAqB,gBAAgB;AAAA,kBAAO,CAAC,MACjD,EAAE,WAAW,GAAG,MAAM,GAAG;AAAA,gBAC3B;AACA,oBAAI,mBAAmB,SAAS,GAAG;AACjC,sCAAoB,KAAK;AAAA,oBACvB;AAAA,oBACA,cAAc;AAAA,kBAChB,CAAC;AAAA,gBACH;AAAA,cACF;AAAA,YACF;AAAA,UACF,SAAS,GAAG;AAAA,UAEZ;AAAA,QACF;AACA,YAAI,UAAU,OAAO,OAAO,IAAI,WAAW,YAAY;AACrD,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,OAAO;AAAA,YACP,SAAS;AAAA,YACT,oBAAoB;AAAA,YACpB,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAEA,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AAEZ,YAAM,QAAQ,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAEhE,UAAI,QAAQ;AACV,YAAI;AACF,iBAAO,KAAK;AAAA,QACd,SAAS,QAAQ;AAEf,cAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,oBAAQ,MAAM,yBAAyB,MAAM;AAC7C,oBAAQ,MAAM,0BAA0B,KAAK;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAGA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hppx",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Superior HTTP Parameter Pollution protection middleware with modern TypeScript, robust sanitizer, and extensive tests.",
   "license": "MIT",
   "author": "Hiprax",
@@ -47,6 +47,18 @@
     "lint": "eslint \"{src,tests}/**/*.{ts,tsx}\"",
     "format": "prettier --write \"**/*.{ts,tsx,js,json,md,yml,yaml}\""
   },
+  "keywords": [
+    "hpp",
+    "http",
+    "parameter",
+    "pollution",
+    "protection",
+    "middleware",
+    "typescript",
+    "nodejs",
+    "express",
+    "security"
+  ],
   "devDependencies": {
     "@types/express": "^5.0.5",
     "@types/jest": "^30.0.0",