mdefender-pro 1.2.4 → 1.2.5

package/index.js

@@ -35,7 +35,7 @@ function getDefaultTemplate() {
 const DEFAULT_CONFIG = {
   apiKey: '',
   domain: '',
-  apiEndpoint: 'https://mdefenderapi.onrender.com',
+  apiEndpoint: process.env.MDEFENDER_API_ENDPOINT || 'http://localhost:8000',
   mode: 'block',         // 'block' | 'monitor' | 'off'
   blockStatusCode: 403,
   timeout: 10000,
@@ -292,6 +292,7 @@ function mdefender(overrides = {}) {
       };
 
       const resp = await sendAnalyzeRequest(config.apiEndpoint, config.apiKey, payload, config.timeout);
+      const result = resp && resp.data ? resp.data : {};
       const isBlocked = Boolean(
         result && (
           result.decision === 'BLOCK' ||
@@ -349,4 +350,11 @@ mdefender.DEFAULT_CONFIG = DEFAULT_CONFIG;
 mdefender.sendAnalyzeRequest = sendAnalyzeRequest;
 
 module.exports = mdefender;
+
+try {
+  const { autoHook } = require('./auto');
+  mdefender.autoHook = autoHook;
+} catch (e) {}
+
+
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mdefender-pro",
-  "version": "1.2.4",
+  "version": "1.2.5",
   "description": "MDefender Pro - Web Application Firewall middleware for Node.js/Express. Protects against XSS, SQLi, CSRF, and other OWASP Top 10 attacks.",
   "main": "index.js",
   "types": "index.d.ts",
@@ -32,6 +32,7 @@
   },
   "files": [
     "index.js",
+    "auto.js",
     "index.d.ts",
     "README.md",
     "config-loader.js",
@@ -43,6 +44,7 @@
   ],
   "exports": {
     ".": "./index.js",
+    "./auto": "./auto.js",
     "./client": "./client.mjs",
     "./vite": "./vite.mjs"
   },
@@ -50,7 +52,6 @@
     "type": "git",
     "url": "git+https://github.com/mdefender/mdefender.git"
   },
-  "homepage": "https://mdefenderapi.onrender.com",
   "bugs": {
     "url": "https://github.com/mdefender/mdefender/issues"
   }

package/vite.js

@@ -1,15 +1,58 @@
 // vite.js - Official MDefender Pro Vite Plugin (CJS)
+'use strict';
+
 const mdefender = require('./index.js');
 
 function mdefenderVite(options = {}) {
   const middleware = mdefender(options);
+  
   return {
     name: 'mdefender-vite-plugin',
     configureServer(server) {
-      server.middlewares.use(middleware);
+      if (server && server.middlewares) {
+        server.middlewares.use(middleware);
+      }
     },
     configurePreviewServer(server) {
-      server.middlewares.use(middleware);
+      if (server && server.middlewares) {
+        server.middlewares.use(middleware);
+      }
+    },
+    transformIndexHtml(html) {
+      const inlineGuard = [
+        '<script>',
+        '(function(){',
+        '  try {',
+        '    var raw = (window.location.search || "") + " " + (window.location.hash || "");',
+        '    if (!raw.trim()) return;',
+        '    var norm = raw;',
+        '    try { norm = decodeURIComponent(norm); } catch(e){}',
+        '    try { norm = decodeURIComponent(norm); } catch(e){}',
+        '    var p = [',
+        '      /<\\s*(?:script|iframe|object|embed|svg|img|math)\\b/i,',
+        '      /\\bon(?:error|load|click|mouseover|focus|submit)\\s*=/i,',
+        '      /\\b(?:javascript|data\\s*:\\s*text\\/html)\\s*:/i,',
+        '      /\\b(?:alert|eval|confirm|prompt|document\\.cookie)\\s*\\(/i,',
+        '      /\\bUNION\\s+(?:ALL\\s+)?SELECT\\b/i,',
+        '      /(?:\'|"|\\b)\\s*(?:OR|AND)\\s+[\'"]?([a-zA-Z0-9_\\-]+)[\'"]?\\s*=\\s*[\'"]?\\1/i,',
+        '      /(?:--|#|\\/\\*).*?(?:DROP|ALTER|INSERT|DELETE|UPDATE|EXEC)/i,',
+        '      /(?:\\.\\.\\/|\\.\\.\\\\|etc\\/passwd|etc\\/shadow|win\\.ini|boot\\.ini)/i,',
+        '      /(?:169\\.254\\.169\\.254|metadata\\.google\\.internal|=(?:https?:\\/\\/)?(?:127\\.0\\.0\\.1|169\\.254|localhost|0\\.0\\.0\\.0))/i,',
+        '      /(?:;|\\||\\|\\||&&|`|\\$\\()\\s*(?:cat|ls|id|whoami|powershell|cmd|sh|bash|wget|curl)\\b/i,',
+        '      /(?:ignore\\s+all\\s+(?:previous|prior)\\s+instructions|system\\s+override|DAN\\s+mode)/i',
+        '    ];',
+        '    for (var i = 0; i < p.length; i++) {',
+        '      if (p[i].test(norm)) {',
+        '        try { window.stop(); } catch(e){}',
+        '        break;',
+        '      }',
+        '    }',
+        '  } catch(e){}',
+        '})();',
+        '</script>'
+      ].join('\\n');
+
+      return html.replace('<head>', '<head>\\n' + inlineGuard);
     }
   };
 }