mdefender-pro 1.2.5 → 1.2.7

package/README.md

@@ -10,11 +10,11 @@
 
 ## Key Features
 
-- 🛡️ **Zero Setup Cyber Block Page**: Bundled automatically with the package — no external HTML or static file hosting required.
-- ⚡ **Sub-Millisecond In-Memory Caching**: Template and rules are cached in memory for instantaneous rendering (<5ms).
-- 🔑 **Flexible API Key Authentication**: Configure via `mdefender.config.js`, interactive CLI (`npx mdefender-pro init`), environment variables, or inline parameters.
-- 🚦 **Fail-Open Safety Mechanism**: If cloud telemetry times out, legitimate traffic passes smoothly without blocking customers.
-- 📦 **Zero External Runtime Dependencies**: Pure Node.js standard libraries (`http`, `https`, `crypto`).
+- **Zero Setup Cyber Block Page**: Bundled automatically with the package &mdash; no external HTML or static file hosting required.
+- **Sub-Millisecond In-Memory Caching**: Template and rules are cached in memory for instantaneous rendering (<5ms).
+- **Flexible API Key Authentication**: Configure via `mdefender.config.js`, interactive CLI (`npx mdefender-pro init`), environment variables, or inline parameters.
+- **Fail-Open Safety Mechanism**: If cloud telemetry times out, legitimate traffic passes smoothly without blocking customers.
+- **Zero External Runtime Dependencies**: Pure Node.js standard libraries (`http`, `https`, `crypto`).
 
 ---
 

package/auto.js

@@ -35,7 +35,7 @@ function autoHook() {
     return;
   }
 
-  console.log(`\x1b[36m\x1b[1m🛡️ [MDefender Pro] Zero-Code WAF Protection Active\x1b[0m`);
+  console.log(`\x1b[36m\x1b[1m[MDefender Pro] Zero-Code WAF Protection Active\x1b[0m`);
   console.log(`\x1b[90m   Inspection Endpoint: ${activeConfig.apiEndpoint}\x1b[0m`);
   console.log(`\x1b[90m   Protected Domain   : ${activeConfig.domain || 'auto-detect'}\x1b[0m`);
   console.log(`\x1b[90m   Defense Mode       : ${activeConfig.mode.toUpperCase()}\x1b[0m\n`);

package/bin/mdefender.js

@@ -9,7 +9,7 @@ const args = process.argv.slice(2);
 const command = args[0] || 'help';
 
 console.log(`\n\x1b[36m\x1b[1m====================================================\x1b[0m`);
-console.log(`\x1b[36m\x1b[1m       🛡️  MDefender Pro — Zero-Code WAF CLI       \x1b[0m`);
+console.log(`\x1b[36m\x1b[1m          MDefender Pro — Zero-Code WAF CLI         \x1b[0m`);
 console.log(`\x1b[36m\x1b[1m====================================================\x1b[0m\n`);
 
 if (command === 'run' || command === 'start') {

package/block-page.html

@@ -369,7 +369,7 @@
                 const refBox = document.getElementById('ref-id-box');
                 if (refBox) {
                     const originalHtml = refBox.innerHTML;
-                    refBox.innerHTML = 'COPIED TO CLIPBOARD! ✅';
+                    refBox.innerHTML = 'COPIED TO CLIPBOARD';
                     refBox.style.color = '#10b981';
                     refBox.style.borderColor = '#10b981';
                     refBox.style.background = '#ecfdf5';

package/client.mjs

@@ -463,18 +463,7 @@ export function renderOfficialBlockPage(attackType, refId, domain) {
     } catch (e) {}
 }
 
-// 0ms Instant URL Inspection on Script Load
-if (typeof window !== 'undefined' && typeof document !== 'undefined') {
-    const rawTarget = normalizeInput(window.location.search + ' ' + window.location.hash);
-    if (rawTarget.trim()) {
-        for (const pattern of ATTACK_PATTERNS) {
-            if (pattern.regex.test(rawTarget)) {
-                renderOfficialBlockPage(pattern.type);
-                throw new Error(`[MDefender WAF] Attack blocked on load (0ms): ${pattern.type}`);
-            }
-        }
-    }
-}
+// Client-side initialization requires explicit initWaf() with apiKey
 
 /**
  * Initialize MDefender Pro WAF client-side protection for SPAs & Frontend Websites.
@@ -492,6 +481,20 @@ export function initWaf(options = {}) {
     const backendUrl = (options.backendUrl || 'http://localhost:8000').replace(/\/+$/, '');
     const domain = options.domain || window.location.hostname || 'localhost';
 
+    // 0. Auto-inspect current page URL on load (e.g. ?q=<script> or ?id=1 UNION SELECT)
+    try {
+        const currentUrlParams = (window.location.search || '') + ' ' + (window.location.hash || '');
+        if (currentUrlParams.trim()) {
+            const normUrl = normalizeInput(currentUrlParams);
+            for (const pattern of ATTACK_PATTERNS) {
+                if (pattern.regex.test(normUrl)) {
+                    renderOfficialBlockPage(pattern.type, null, domain);
+                    return;
+                }
+            }
+        }
+    } catch (e) {}
+
     // 1. Wrap window.fetch for outgoing requests
     const originalFetch = window.fetch;
     window.fetch = async (input, init, ...args) => {
@@ -502,6 +505,7 @@ export function initWaf(options = {}) {
             else if (url.includes('#')) targetParamStr = url.substring(url.indexOf('#'));
         } catch (e) {}
 
+        // Inspect URL
         if (targetParamStr) {
             const normParams = normalizeInput(targetParamStr);
             for (const pattern of ATTACK_PATTERNS) {
@@ -512,14 +516,36 @@ export function initWaf(options = {}) {
             }
         }
 
+        // Inspect Body if POST/PUT
+        if (init && init.body) {
+            try {
+                const bodyStr = typeof init.body === 'string' ? init.body : JSON.stringify(init.body);
+                const normBody = normalizeInput(bodyStr);
+                for (const pattern of ATTACK_PATTERNS) {
+                    if (pattern.regex.test(normBody)) {
+                        renderOfficialBlockPage(pattern.type, null, domain);
+                        throw new Error(`[MDefender WAF] Outgoing payload attack blocked: ${pattern.type}`);
+                    }
+                }
+            } catch (e) {}
+        }
+
         try {
             const response = await originalFetch(input, init, ...args);
             if (response.status === 403) {
                 const clone = response.clone();
                 try {
                     const text = await clone.text();
-                    if (text.includes('403') && (text.includes('MDefender') || text.includes('Access Denied'))) {
-                        renderOfficialBlockPage('Cross-Site Scripting (XSS)', null, domain);
+                    const statusHeader = response.headers.get('x-mdefender-status');
+                    const attackHeader = response.headers.get('x-mdefender-attack-type');
+                    const refHeader = response.headers.get('x-mdefender-ref');
+                    if (statusHeader === 'blocked' || text.includes('403') || text.includes('MDefender') || text.includes('Access Denied')) {
+                        if (text.includes('<!DOCTYPE html>') || text.includes('<html')) {
+                            try { window.stop(); } catch (e) {}
+                            document.documentElement.innerHTML = text;
+                        } else {
+                            renderOfficialBlockPage(attackHeader || 'Cross-Site Scripting (XSS)', refHeader, domain);
+                        }
                     }
                 } catch (e) {}
             }
@@ -529,7 +555,7 @@ export function initWaf(options = {}) {
         }
     };
 
-    // 2. Wrap XMLHttpRequest
+    // 2. Wrap XMLHttpRequest (Used by Axios, Redux Toolkit Query, etc.)
     const originalOpen = XMLHttpRequest.prototype.open;
     XMLHttpRequest.prototype.open = function (method, url, ...rest) {
         let targetParamStr = '';
@@ -549,6 +575,44 @@ export function initWaf(options = {}) {
         }
         return originalOpen.apply(this, [method, url, ...rest]);
     };
+
+    const originalSend = XMLHttpRequest.prototype.send;
+    XMLHttpRequest.prototype.send = function (body) {
+        if (body) {
+            try {
+                const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
+                const normBody = normalizeInput(bodyStr);
+                for (const pattern of ATTACK_PATTERNS) {
+                    if (pattern.regex.test(normBody)) {
+                        renderOfficialBlockPage(pattern.type, null, domain);
+                        throw new Error(`[MDefender WAF] XHR payload attack blocked: ${pattern.type}`);
+                    }
+                }
+            } catch (e) {}
+        }
+
+        // Intercept 403 Forbidden responses from backend WAF
+        this.addEventListener('load', function () {
+            if (this.status === 403) {
+                try {
+                    const resp = this.responseText || '';
+                    const statusHeader = this.getResponseHeader('X-MDefender-Status');
+                    const attackHeader = this.getResponseHeader('X-MDefender-Attack-Type');
+                    const refHeader = this.getResponseHeader('X-MDefender-Ref');
+                    if (statusHeader === 'blocked' || resp.includes('403') || resp.includes('MDefender') || resp.includes('Access Denied')) {
+                        if (resp.includes('<!DOCTYPE html>') || resp.includes('<html')) {
+                            try { window.stop(); } catch (e) {}
+                            document.documentElement.innerHTML = resp;
+                        } else {
+                            renderOfficialBlockPage(attackHeader || 'Security Rule Violation', refHeader, domain);
+                        }
+                    }
+                } catch (e) {}
+            }
+        });
+
+        return originalSend.apply(this, arguments);
+    };
 }
 
 export default { initWaf, renderOfficialBlockPage };

package/index.js

@@ -158,7 +158,7 @@ function sendAnalyzeRequest(endpointUrl, apiKey, data, timeoutMs = 5000) {
           'Content-Type': 'application/json',
           'Content-Length': Buffer.byteLength(postData),
           'Authorization': `Bearer ${apiKey}`,
-          'X-MDefender-Version': '1.2.4'
+          'X-MDefender-Version': '1.2.6'
         }
       };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mdefender-pro",
-  "version": "1.2.5",
+  "version": "1.2.7",
   "description": "MDefender Pro - Web Application Firewall middleware for Node.js/Express. Protects against XSS, SQLi, CSRF, and other OWASP Top 10 attacks.",
   "main": "index.js",
   "types": "index.d.ts",