mdefender-pro 1.2.0 → 1.2.2

package/index.js

@@ -1,40 +1,84 @@
 'use strict';
 
-const axios = require('axios');
+const http = require('http');
+const https = require('https');
 const path = require('path');
 const fs = require('fs');
 const crypto = require('crypto');
+const { URL } = require('url');
+
+const httpAgent = new http.Agent({ keepAlive: true, timeout: 5000 });
+const httpsAgent = new https.Agent({ keepAlive: true, timeout: 5000 });
+
+// In-memory cache for bundled block page with mtime check
+let cachedDefaultTemplate = null;
+let cachedTemplateMtime = 0;
+
+function getDefaultTemplate() {
+  try {
+    const templatePath = path.join(__dirname, 'block-page.html');
+    if (fs.existsSync(templatePath)) {
+      const stats = fs.statSync(templatePath);
+      if (cachedDefaultTemplate === null || stats.mtimeMs > cachedTemplateMtime) {
+        cachedDefaultTemplate = fs.readFileSync(templatePath, 'utf8');
+        cachedTemplateMtime = stats.mtimeMs;
+      }
+    } else {
+      cachedDefaultTemplate = '';
+    }
+  } catch (e) {
+    if (!cachedDefaultTemplate) cachedDefaultTemplate = '';
+  }
+  return cachedDefaultTemplate;
+}
 
 const DEFAULT_CONFIG = {
   apiKey: '',
   domain: '',
-  apiEndpoint: 'https://mdefender-pro.onrender.com',
+  apiEndpoint: 'http://127.0.0.1:8000',
   mode: 'block',         // 'block' | 'monitor' | 'off'
   blockStatusCode: 403,
   timeout: 5000,
   maxBodySize: 1024 * 1024, // 1MB
   logBlocked: true,
-  customBlockPage: null,     // path to custom HTML file
+  customBlockPage: null,
   skipPaths: ['/health', '/favicon.ico'],
   skipUserAgents: [],
   skipMethods: [],
-  headers: true,             // forward original headers
-  onError: 'allow',          // 'allow' | 'block' - what to do if API is unreachable
+  headers: true,
+  onError: 'allow',      // 'allow' | 'block'
 };
 
 function loadConfig(overrides = {}) {
   let fileConfig = {};
   
+  // Try config-loader
+  try {
+    const configLoader = require('./config-loader');
+    const loaded = configLoader.load();
+    if (loaded) fileConfig = loaded;
+  } catch (e) {}
+
   // Try mdefender.config.js
-  const jsPath = path.resolve(process.cwd(), 'mdefender.config.js');
-  if (fs.existsSync(jsPath)) {
-    fileConfig = require(jsPath);
+  if (!fileConfig.apiKey) {
+    const jsPath = path.resolve(process.cwd(), 'mdefender.config.js');
+    if (fs.existsSync(jsPath)) {
+      try {
+        fileConfig = require(jsPath);
+      } catch (e) {
+        console.warn('[MDefender] Failed reading mdefender.config.js:', e.message);
+      }
+    }
   }
   
   // Try mdefender.json
-  const jsonPath = path.resolve(process.cwd(), 'mdefender.json');
-  if (!fileConfig.apiKey && fs.existsSync(jsonPath)) {
-    fileConfig = JSON.parse(fs.readFileSync(jsonPath, 'utf-8'));
+  if (!fileConfig.apiKey) {
+    const jsonPath = path.resolve(process.cwd(), 'mdefender.json');
+    if (fs.existsSync(jsonPath)) {
+      try {
+        fileConfig = JSON.parse(fs.readFileSync(jsonPath, 'utf-8'));
+      } catch (e) {}
+    }
   }
   
   // Try package.json "mdefender" key
@@ -45,154 +89,154 @@ function loadConfig(overrides = {}) {
     } catch (e) {}
   }
 
-  return { ...DEFAULT_CONFIG, ...fileConfig, ...overrides };
+  // Environment variables
+  const envConfig = {};
+  if (process.env.MDEFENDER_API_KEY) envConfig.apiKey = process.env.MDEFENDER_API_KEY;
+  if (process.env.MDEFENDER_DOMAIN) envConfig.domain = process.env.MDEFENDER_DOMAIN;
+  if (process.env.MDEFENDER_API_ENDPOINT || process.env.MDEFENDER_ENDPOINT) {
+    envConfig.apiEndpoint = process.env.MDEFENDER_API_ENDPOINT || process.env.MDEFENDER_ENDPOINT;
+  }
+  if (process.env.MDEFENDER_MODE) envConfig.mode = process.env.MDEFENDER_MODE;
+
+  return { ...DEFAULT_CONFIG, ...fileConfig, ...envConfig, ...overrides };
 }
 
 function getClientIP(req) {
-  return req.headers['x-forwarded-for']?.split(',')[0]?.trim()
-    || req.headers['x-real-ip']
+  const forwarded = req.headers['x-forwarded-for'];
+  if (forwarded) {
+    return forwarded.split(',')[0].trim();
+  }
+  return req.headers['x-real-ip']
     || req.connection?.remoteAddress
     || req.socket?.remoteAddress
-    || 'unknown';
+    || '127.0.0.1';
 }
 
-function buildPayload(req, config) {
-  const ip = getClientIP(req);
-  const originalUrl = req.originalUrl || req.url;
-  const parsedUrl = new URL(originalUrl, `http://${req.headers.host || 'localhost'}`);
-  
-  const payload = {
-    domain: config.domain,
-    method: req.method,
-    url: parsedUrl.pathname,
-    query_string: parsedUrl.search || '',
-    query_params: Object.fromEntries(parsedUrl.searchParams),
-    ip: ip,
-    headers: config.headers ? req.headers : {},
-    user_agent: req.headers['user-agent'] || '',
-    referer: req.headers['referer'] || req.headers['referrer'] || '',
-    content_type: req.headers['content-type'] || '',
-    body: '',
-    body_fields: {},
-    body_field_values: '',
-    timestamp: new Date().toISOString(),
-  };
+function extractBody(req) {
+  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) {
+    return { raw: '', fields: {}, values: '' };
+  }
+
+  if (req.body) {
+    if (typeof req.body === 'object') {
+      try {
+        const raw = JSON.stringify(req.body);
+        const values = Object.values(req.body).map(v => typeof v === 'object' ? JSON.stringify(v) : String(v)).join(' ');
+        return { raw, fields: req.body, values };
+      } catch (e) {
+        return { raw: '', fields: {}, values: '' };
+      }
+    }
+    const str = String(req.body);
+    return { raw: str, fields: {}, values: str };
+  }
 
-  return payload;
+  return { raw: '', fields: {}, values: '' };
 }
 
-function readBody(req, maxBytes) {
-  return new Promise((resolve) => {
-    if (req.body) {
-      if (typeof req.body === 'string') return resolve(req.body);
-      if (typeof req.body === 'object') return resolve(JSON.stringify(req.body));
-      return resolve(String(req.body));
-    }
+function sendAnalyzeRequest(endpointUrl, apiKey, data, timeoutMs = 5000) {
+  return new Promise((resolve, reject) => {
+    try {
+      const parsed = new URL('/api/analyze', endpointUrl);
+      const postData = JSON.stringify(data);
+      const isHttps = parsed.protocol === 'https:';
+      const transport = isHttps ? https : http;
+      const agent = isHttps ? httpsAgent : httpAgent;
 
-    let body = '';
-    maxBytes = maxBytes || 1024 * 1024;
-    let bytesRead = 0;
-
-    const onData = (chunk) => {
-      bytesRead += chunk.length;
-      if (bytesRead > maxBytes) {
-        req.removeListener('data', onData);
-        req.removeListener('end', onEnd);
-        resolve(body);
-        return;
-      }
-      body += chunk.toString();
-    };
-
-    const onEnd = () => {
-      req.removeListener('data', onData);
-      resolve(body);
-    };
-
-    req.on('data', onData);
-    req.on('end', onEnd);
-
-    // If stream already ended
-    if (req.readableEnded || req.complete) {
-      req.removeListener('data', onData);
-      req.removeListener('end', onEnd);
-      resolve(body);
+      const options = {
+        hostname: parsed.hostname,
+        port: parsed.port || (isHttps ? 443 : 80),
+        path: parsed.pathname,
+        method: 'POST',
+        agent: agent,
+        timeout: timeoutMs,
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': Buffer.byteLength(postData),
+          'Authorization': `Bearer ${apiKey}`,
+          'X-MDefender-Version': '1.1.0'
+        }
+      };
+
+      const req = transport.request(options, (res) => {
+        let body = '';
+        res.setEncoding('utf8');
+        res.on('data', (chunk) => { body += chunk; });
+        res.on('end', () => {
+          try {
+            const json = JSON.parse(body);
+            resolve({ statusCode: res.statusCode, data: json });
+          } catch (e) {
+            resolve({ statusCode: res.statusCode, data: { status: res.statusCode === 200 ? 'allowed' : 'error', raw: body } });
+          }
+        });
+      });
+
+      req.on('error', (err) => {
+        reject(err);
+      });
+
+      req.on('timeout', () => {
+        req.destroy(new Error(`WAF request timed out after ${timeoutMs}ms`));
+      });
+
+      req.write(postData);
+      req.end();
+    } catch (err) {
+      reject(err);
     }
   });
 }
 
-function parseBody(body, contentType) {
-  if (!body) return { fields: {}, values: '' };
-  
-  try {
-    if (contentType && contentType.includes('application/json')) {
-      const parsed = JSON.parse(body);
-      return { fields: parsed, values: Object.values(parsed).join(' ') };
-    }
-    if (contentType && contentType.includes('application/x-www-form-urlencoded')) {
-      const params = new URLSearchParams(body);
-      const fields = Object.fromEntries(params);
-      return { fields, values: Object.values(fields).join(' ') };
-    }
-  } catch (e) {}
-  
-  return { fields: {}, values: body };
+function escapeHtml(str) {
+  if (!str) return '';
+  return String(str)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
 }
 
-function renderBlockPage(config, result) {
-  if (config.customBlockPage && fs.existsSync(config.customBlockPage)) {
-    return fs.readFileSync(config.customBlockPage, 'utf-8');
+function renderBlockPage(config, result, req) {
+  let template = '';
+  if (config.customBlockPage) {
+    try {
+      if (fs.existsSync(config.customBlockPage)) {
+        template = fs.readFileSync(config.customBlockPage, 'utf-8');
+      }
+    } catch (e) {}
   }
   
-  const attackType = result.attack_type || 'Unknown';
-  const confidence = result.confidence || 0;
-  const referenceId = result.reference_id || crypto.randomUUID();
-  
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Access Blocked - MDefender Pro</title>
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    body { min-height: 100vh; display: flex; align-items: center; justify-content: center;
-      background: linear-gradient(135deg, #1a1a2e 0%, #16213e 50%, #0f3460 100%);
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-      color: #fff; }
-    .container { text-align: center; padding: 40px; max-width: 600px; }
-    .icon { font-size: 80px; margin-bottom: 20px; opacity: 0.9; }
-    h1 { font-size: 28px; margin-bottom: 12px; font-weight: 700; }
-    .subtitle { font-size: 16px; color: rgba(255,255,255,0.7); margin-bottom: 30px; }
-    .details { background: rgba(255,255,255,0.08); border-radius: 12px; padding: 20px;
-      text-align: left; margin-bottom: 30px; backdrop-filter: blur(10px); }
-    .details p { font-size: 14px; color: rgba(255,255,255,0.8); margin: 8px 0; }
-    .details strong { color: #e74c3c; }
-    .footer { font-size: 12px; color: rgba(255,255,255,0.4); }
-  </style>
-</head>
-<body>
-  <div class="container">
-    <div class="icon">&#x1F6AB;</div>
-    <h1>Access Blocked</h1>
-    <p class="subtitle">This request has been blocked by MDefender Pro WAF</p>
-    <div class="details">
-      <p><strong>Attack Type:</strong> ${attackType}</p>
-      <p><strong>Confidence:</strong> ${(confidence * 100).toFixed(1)}%</p>
-      <p><strong>Reference ID:</strong> ${referenceId}</p>
-      <p><strong>Time:</strong> ${new Date().toISOString()}</p>
-    </div>
-    <p class="footer">MDefender Pro - Web Application Firewall</p>
-  </div>
-</body>
-</html>`;
+  if (!template) {
+    template = getDefaultTemplate();
+  }
+
+  const attackType = result.attack_type || 'Malicious Payload Detected';
+  const clientIp = getClientIP(req);
+  const reason = result.reason || result.message || 'Request blocked by MDefender Pro WAF security policies.';
+  const referenceId = result.reference_id || ('MDF-' + crypto.randomBytes(4).toString('hex').toUpperCase());
+  const timestamp = new Date().toISOString().replace('T', ' ').slice(0, 19);
+  const siteName = config.domain || req.headers.host || 'Protected Website';
+
+  if (!template) {
+    return `<!DOCTYPE html><html><head><title>403 Access Denied</title></head><body style="background:#060913;color:#fff;font-family:sans-serif;padding:40px;text-align:center"><h1>403 Forbidden</h1><p>${escapeHtml(reason)}</p><p>Incident ID: ${escapeHtml(referenceId)}</p></body></html>`;
+  }
+
+  return template
+    .replace(/\{\{(REFERENCE_ID|reference_id)\}\}/g, escapeHtml(referenceId))
+    .replace(/\{\{(ATTACK_TYPE|attack_type)\}\}/g, escapeHtml(attackType))
+    .replace(/\{\{(CLIENT_IP|client_ip)\}\}/g, escapeHtml(clientIp))
+    .replace(/\{\{(SITE_NAME|site_name|website_name)\}\}/g, escapeHtml(siteName))
+    .replace(/\{\{(TIMESTAMP|timestamp)\}\}/g, escapeHtml(timestamp))
+    .replace(/\{\{(REASON|reason)\}\}/g, escapeHtml(reason));
 }
 
 function mdefender(overrides = {}) {
   const config = loadConfig(overrides);
 
   if (!config.apiKey) {
-    console.error('[MDefender] ERROR: No API key provided. Set it in mdefender.config.js or pass it as an option.');
+    console.error('[MDefender] WARNING: No API key provided. Running in bypass mode.');
     return (req, res, next) => next();
   }
 
@@ -200,92 +244,89 @@ function mdefender(overrides = {}) {
     return (req, res, next) => next();
   }
 
-  const client = axios.create({
-    baseURL: config.apiEndpoint,
-    timeout: config.timeout,
-    headers: {
-      'Authorization': `Bearer ${config.apiKey}`,
-      'Content-Type': 'application/json',
-      'X-MDefender-Version': '1.2.0',
-    },
-  });
+  console.log(`[MDefender] WAF active & protecting domain: "${config.domain || 'default'}" via ${config.apiEndpoint}`);
+
+  // Warm-up in-memory block page template cache on initialization
+  getDefaultTemplate();
 
   return async function mdefenderMiddleware(req, res, next) {
-    // Skip certain paths
-    if (config.skipPaths.some(p => req.url.startsWith(p))) return next();
+    // 1. Skip paths
+    const urlPath = (req.originalUrl || req.url || '').split('?')[0];
+    if (config.skipPaths.some(p => urlPath.startsWith(p))) return next();
     
-    // Skip certain methods
+    // 2. Skip methods
     if (config.skipMethods.includes(req.method)) return next();
     
-    // Skip certain user agents
+    // 3. Skip user agents
     const ua = req.headers['user-agent'] || '';
     if (config.skipUserAgents.some(s => ua.toLowerCase().includes(s.toLowerCase()))) return next();
 
     try {
-      // Read and parse request body
-      const rawBody = await readBody(req, config.maxBodySize);
-      const contentType = req.headers['content-type'] || '';
-      const { fields, values } = parseBody(rawBody, contentType);
-      
-      // Build payload
-      const payload = buildPayload(req, config);
-      payload.body = rawBody;
-      payload.body_fields = fields;
-      payload.body_field_values = values;
-
-      // Send to MDefender API
-      const response = await client.post('/api/analyze', {
-        request: payload,
-        domain: config.domain,
-      });
-
-      const result = response.data;
+      const clientIp = getClientIP(req);
+      const host = req.headers.host || 'localhost';
+      const parsedUrl = new URL(req.originalUrl || req.url, `http://${host}`);
+      const bodyInfo = extractBody(req);
 
-      if (result.status === 'blocked') {
-        if (config.mode === 'monitor') {
-          // Monitor mode: log but don't block
-          console.log(`[MDefender] MONITOR: ${req.method} ${req.url} - ${result.attack_type} (${(result.confidence * 100).toFixed(1)}%) - ALLOWED (monitor mode)`);
-          req.mdefender = {
-            status: 'monitor',
-            threat_score: result.confidence || 0,
-            attack_type: result.attack_type || null,
-            request_id: result.reference_id || null,
-          };
-          return next();
+      const payload = {
+        domain: config.domain || host.split(':')[0],
+        request: {
+          method: req.method,
+          url: parsedUrl.pathname,
+          query_string: parsedUrl.search || '',
+          query_params: Object.fromEntries(parsedUrl.searchParams),
+          ip: clientIp,
+          headers: req.headers || {},
+          user_agent: ua,
+          referer: req.headers['referer'] || req.headers['referrer'] || '',
+          content_type: req.headers['content-type'] || '',
+          body: bodyInfo.raw,
+          body_fields: bodyInfo.fields,
+          body_field_values: bodyInfo.values,
+          timestamp: new Date().toISOString(),
         }
+      };
 
-        // Block mode: block the request
+      const resp = await sendAnalyzeRequest(config.apiEndpoint, config.apiKey, payload, config.timeout);
+      const result = resp.data;
+
+      if (result.status === 'blocked') {
         if (config.logBlocked) {
-          console.log(`[MDefender] BLOCKED ${req.method} ${req.url} - ${result.attack_type} (${(result.confidence * 100).toFixed(1)}%)`);
+          console.warn(`[MDefender] BLOCKED ${req.method} ${parsedUrl.pathname} - ${result.attack_type || 'Malicious Payload'} (${((result.confidence || 0.95) * 100).toFixed(0)}%) [IP: ${clientIp}]`);
         }
         
-        const blockPage = result.block_page || renderBlockPage(config, result);
-        res.writeHead(config.blockStatusCode, {
+        const blockPage = result.block_page || renderBlockPage(config, result, req);
+        const headers = {
           'Content-Type': 'text/html; charset=utf-8',
           'X-MDefender-Status': 'blocked',
           'X-MDefender-Attack-Type': result.attack_type || 'unknown',
-        });
+          'X-MDefender-Ref': result.reference_id || 'MDF-BLOCKED',
+        };
+        if (req.headers.origin) {
+          headers['Access-Control-Allow-Origin'] = req.headers.origin;
+          headers['Access-Control-Allow-Credentials'] = 'true';
+        }
+        res.writeHead(config.blockStatusCode || 403, headers);
         return res.end(blockPage);
       }
 
-      // Request is safe - attach result to request for downstream use
+      // Safe request
       req.mdefender = {
         status: 'allowed',
         threat_score: result.threat_score || 0,
-        request_id: result.request_id || null,
+        reference_id: result.reference_id || null,
       };
 
       return next();
 
     } catch (error) {
-      console.error(`[MDefender] API Error: ${error.message}`);
+      console.error(`[MDefender] WAF Warning: ${error.message}`);
       
       if (config.onError === 'block') {
         res.writeHead(503, { 'Content-Type': 'text/html' });
-        return res.end('<html><body><h1>Service Temporarily Unavailable</h1><p>WAF service is currently unreachable. Please try again later.</p></body></html>');
+        return res.end('<h1>503 Service Unavailable</h1><p>WAF security service unreachable.</p>');
       }
       
-      // Default: allow request on error
+      // Default: Fail-safe allow legitimate traffic to continue
       return next();
     }
   };
@@ -293,5 +334,6 @@ function mdefender(overrides = {}) {
 
 mdefender.loadConfig = loadConfig;
 mdefender.DEFAULT_CONFIG = DEFAULT_CONFIG;
+mdefender.sendAnalyzeRequest = sendAnalyzeRequest;
 
 module.exports = mdefender;

package/package.json

@@ -1,46 +1,57 @@
-{
-  "name": "mdefender-pro",
-  "version": "1.2.0",
-  "description": "MDefender Pro - Web Application Firewall middleware for Node.js/Express. Protects against XSS, SQLi, CSRF, and other OWASP Top 10 attacks.",
-  "main": "index.js",
-  "types": "index.d.ts",
-  "keywords": [
-    "waf",
-    "web-application-firewall",
-    "security",
-    "firewall",
-    "xss",
-    "sqli",
-    "csrf",
-    "protection",
-    "middleware",
-    "express",
-    "nodejs",
-    "owasp"
-  ],
-  "author": "MDefender Pro",
-  "license": "MIT",
-  "engines": {
-    "node": ">=14.0.0"
-  },
-  "dependencies": {
-    "axios": "^1.6.0"
-  },
-  "peerDependencies": {
-    "express": ">=4.0.0"
-  },
-  "files": [
-    "index.js",
-    "index.d.ts",
-    "README.md",
-    "config-loader.js"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/mahabub251595/mdefender-pro.git"
-  },
-  "homepage": "https://mdefender-pro-6e3r.onrender.com",
-  "bugs": {
-    "url": "https://github.com/mahabub251595/mdefender-pro/issues"
-  }
-}
+{
+  "name": "mdefender-pro",
+  "version": "1.2.2",
+  "description": "MDefender Pro - Web Application Firewall middleware for Node.js/Express. Protects against XSS, SQLi, CSRF, and other OWASP Top 10 attacks.",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "keywords": [
+    "waf",
+    "web-application-firewall",
+    "security",
+    "firewall",
+    "xss",
+    "sqli",
+    "csrf",
+    "protection",
+    "middleware",
+    "express",
+    "nodejs",
+    "owasp"
+  ],
+  "author": "MDefender Pro",
+  "license": "MIT",
+  "engines": {
+    "node": ">=14.0.0"
+  },
+  "bin": {
+    "mdefender-pro": "bin/mdefender.js"
+  },
+  "dependencies": {},
+  "peerDependencies": {
+    "express": "^4.18.0 || ^5.0.0"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "README.md",
+    "config-loader.js",
+    "client.mjs",
+    "vite.js",
+    "vite.mjs",
+    "block-page.html",
+    "bin"
+  ],
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.mjs",
+    "./vite": "./vite.mjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mdefender/mdefender.git"
+  },
+  "homepage": "https://mdefender-pro-6e3r.onrender.com",
+  "bugs": {
+    "url": "https://github.com/mdefender/mdefender/issues"
+  }
+}

package/vite.js

@@ -0,0 +1,18 @@
+// vite.js - Official MDefender Pro Vite Plugin (CJS)
+const mdefender = require('./index.js');
+
+function mdefenderVite(options = {}) {
+  const middleware = mdefender(options);
+  return {
+    name: 'mdefender-vite-plugin',
+    configureServer(server) {
+      server.middlewares.use(middleware);
+    },
+    configurePreviewServer(server) {
+      server.middlewares.use(middleware);
+    }
+  };
+}
+
+module.exports = { mdefenderVite };
+module.exports.default = mdefenderVite;