securenow 5.8.1 → 5.9.0

package/cli/auth.js

@@ -10,7 +10,7 @@ function openBrowser(url) {
   try {
     const platform = process.platform;
     if (platform === 'darwin') execFileSync('open', [url], { stdio: 'ignore' });
-    else if (platform === 'win32') execFileSync('cmd', ['/c', 'start', '', url], { stdio: 'ignore' });
+    else if (platform === 'win32') execFileSync('rundll32', ['url.dll,FileProtocolHandler', url], { stdio: 'ignore' });
     else execFileSync('xdg-open', [url], { stdio: 'ignore' });
     return true;
   } catch {

package/cli/config.js

@@ -32,6 +32,12 @@ function loadJSON(filepath) {
 function saveJSON(filepath, data) {
   ensureDir();
   fs.writeFileSync(filepath, JSON.stringify(data, null, 2), { encoding: 'utf8', mode: 0o600 });
+  if (process.platform === 'win32') {
+    try {
+      const { execFileSync } = require('child_process');
+      execFileSync('icacls', [filepath, '/inheritance:r', '/grant:r', `${process.env.USERNAME}:F`], { stdio: 'ignore' });
+    } catch (_) {}
+  }
 }
 
 function loadConfig() {

package/free-trial-banner.js

@@ -107,7 +107,8 @@ function patchHttpForBanner() {
       if (res._snIsHtml === undefined) {
         var ct = res.getHeader('content-type');
         var ce = res.getHeader('content-encoding');
-        res._snIsHtml = !!(ct && String(ct).includes('text/html') && !ce);
+        var csp = res.getHeader('content-security-policy');
+        res._snIsHtml = !!(ct && String(ct).includes('text/html') && !ce && !csp);
       }
       if (!res._snIsHtml) {
         res._snBannerDone = true;
@@ -136,6 +137,11 @@ function patchHttpForBanner() {
         if (modified !== chunk) {
           var enc = typeof encoding === 'function' ? 'utf8' : encoding;
           var callback = typeof encoding === 'function' ? encoding : cb;
+          try {
+            if (this.getHeader('content-length')) {
+              this.setHeader('content-length', Buffer.byteLength(modified));
+            }
+          } catch (_) { /* headers already sent */ }
           return _origWrite.call(this, modified, enc, callback);
         }
       } catch (_) { /* never break the app */ }

package/nextjs-auto-capture.js

@@ -33,7 +33,7 @@ function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
   
-  for (const key in redacted) {
+  for (const key of Object.keys(redacted)) {
     const lowerKey = key.toLowerCase();
     
     if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {

package/nextjs-middleware.js

@@ -27,12 +27,16 @@ const DEFAULT_SENSITIVE_FIELDS = [
 /**
  * Redact sensitive fields from an object
  */
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   if (!obj || typeof obj !== 'object') return obj;
   
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
   
-  for (const key in redacted) {
+  for (const key of Object.keys(redacted)) {
     const lowerKey = key.toLowerCase();
     
     if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {
@@ -54,9 +58,10 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   let redacted = query;
   
   sensitiveFields.forEach(field => {
+    const escaped = escapeRegex(field);
     const patterns = [
-      new RegExp(`(${field}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
-      new RegExp(`(${field}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
+      new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
+      new RegExp(`(${escaped}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
     ];
     
     patterns.forEach(pattern => {

package/nextjs-wrapper.js

@@ -32,7 +32,7 @@ function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
   
-  for (const key in redacted) {
+  for (const key of Object.keys(redacted)) {
     const lowerKey = key.toLowerCase();
     
     if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "5.8.1",
+  "version": "5.9.0",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",
   "main": "register.js",

package/tracing.js

@@ -53,6 +53,10 @@ const DEFAULT_SENSITIVE_FIELDS = [
   'card', 'cardnumber', 'ccv', 'cvc', 'cvv', 'ssn', 'pin',
 ];
 
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 /**
  * Redact sensitive fields from an object
  */
@@ -61,7 +65,7 @@ function redactSensitiveData(obj, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   
   const redacted = Array.isArray(obj) ? [...obj] : { ...obj };
   
-  for (const key in redacted) {
+  for (const key of Object.keys(redacted)) {
     const lowerKey = key.toLowerCase();
     
     if (sensitiveFields.some(field => lowerKey.includes(field.toLowerCase()))) {
@@ -84,10 +88,10 @@ function redactGraphQLQuery(query, sensitiveFields = DEFAULT_SENSITIVE_FIELDS) {
   
   // Redact sensitive fields in GraphQL arguments and variables
   sensitiveFields.forEach(field => {
-    // Match patterns: field: "value" or field: 'value' or field:"value"
+    const escaped = escapeRegex(field);
     const patterns = [
-      new RegExp(`(${field}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
-      new RegExp(`(${field}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
+      new RegExp(`(${escaped}\\s*:\\s*["'])([^"']+)(["'])`, 'gi'),
+      new RegExp(`(${escaped}\\s*:\\s*)([^\\s,})\n]+)`, 'gi'),
     ];
     
     patterns.forEach(pattern => {
@@ -118,7 +122,7 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
   const boundary = extractBoundary(contentType);
   if (!boundary) { onComplete({ error: 'BOUNDARY_NOT_FOUND' }); return; }
 
-  const result = { fields: {}, files: [] };
+  const result = { fields: Object.create(null), files: [] };
   let totalSize = 0;
   let buf = Buffer.alloc(0);
 
@@ -139,7 +143,7 @@ function collectMultipartMeta(request, contentType, sensitiveFields, maxTextFiel
   let textVal = '';
 
   function flushPart() {
-    if (!fldName) return;
+    if (!fldName || fldName === '__proto__' || fldName === 'constructor' || fldName === 'prototype') return;
     if (isFile) {
       result.files.push({ field: fldName, filename: fName, contentType: pCT || 'unknown', size: bodyBytes });
     } else {
@@ -316,7 +320,7 @@ for (const n of (env('SECURENOW_DISABLE_INSTRUMENTATIONS') || '').split(',').map
 
 // -------- Body Capture Configuration --------
 const captureBody = String(env('SECURENOW_CAPTURE_BODY')) === '1' || String(env('SECURENOW_CAPTURE_BODY')).toLowerCase() === 'true';
-const maxBodySize = parseInt(env('SECURENOW_MAX_BODY_SIZE') || '10240'); // 10KB default
+const maxBodySize = Math.max(1024, parseInt(env('SECURENOW_MAX_BODY_SIZE'), 10) || 10240);
 const customSensitiveFields = (env('SECURENOW_SENSITIVE_FIELDS') || '').split(',').map(s => s.trim()).filter(Boolean);
 const allSensitiveFields = [...DEFAULT_SENSITIVE_FIELDS, ...customSensitiveFields];
 
@@ -328,7 +332,7 @@ const captureMultipart = String(env('SECURENOW_CAPTURE_MULTIPART')) === '1' || S
 // This prevents end-users from spoofing their IP via custom headers.
 const os = require('os');
 const LOOPBACK_RE = /^(127\.|::1$|::ffff:127\.)/;
-const PRIVATE_IP_RE = /^(127\.|::1|::ffff:127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|fc|fd)/;
+const PRIVATE_IP_RE = /^(127\.|::1$|::ffff:127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|f[cd][0-9a-f]{2}:)/;
 const trustedProxyCsv = (env('SECURENOW_TRUSTED_PROXIES') || '').trim();
 const trustedProxySet = trustedProxyCsv ? new Set(trustedProxyCsv.split(',').map(s => s.trim()).filter(Boolean)) : null;
 
@@ -443,9 +447,9 @@ const httpInstrumentation = new HttpInstrumentation({
                   });
                 }
               } catch (e) {
-                // Parse error: capture as-is (truncated)
-                span.setAttribute('http.request.body', body.substring(0, 1000));
+                span.setAttribute('http.request.body', '[UNPARSEABLE - REDACTED FOR SAFETY]');
                 span.setAttribute('http.request.body.parse_error', true);
+                span.setAttribute('http.request.body.size', size);
               }
             } else if (size > maxBodySize) {
               span.setAttribute('http.request.body', `[TOO LARGE: ${size} bytes]`);

package/web-vite.mjs

@@ -55,10 +55,20 @@ const baseName = rawBase || null;
 const noUuid = String(env('SECURENOW_NO_UUID')) === '1' || String(env('SECURENOW_NO_UUID')).toLowerCase() === 'true';
 const strict = String(env('SECURENOW_STRICT')) === '1' || String(env('SECURENOW_STRICT')).toLowerCase() === 'true';
 
-// Simple UUID v4 (no crypto dependency needed)
 function uuidv4(): string {
-  const rnd = (n = 16) => Array.from({ length: n }, () => Math.floor(Math.random() * 16).toString(16)).join('');
-  return `${rnd(8)}-${rnd(4)}-4${rnd(3)}-${((8 + Math.random()*4)|0).toString(16)}${rnd(3)}-${rnd(12)}`;
+  if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+    return crypto.randomUUID();
+  }
+  const bytes = new Uint8Array(16);
+  if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
+    crypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < 16; i++) bytes[i] = Math.floor(Math.random() * 256);
+  }
+  bytes[6] = (bytes[6] & 0x0f) | 0x40;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+  const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+  return `${hex.slice(0,8)}-${hex.slice(8,12)}-${hex.slice(12,16)}-${hex.slice(16,20)}-${hex.slice(20)}`;
 }
 
 let serviceName: string;
@@ -124,11 +134,11 @@ export function startSecurenowWeb() {
       new DocumentLoadInstrumentation(),
       new UserInteractionInstrumentation(),
       new FetchInstrumentation({
-        propagateTraceHeaderCorsUrls: [/.*/],
+        propagateTraceHeaderCorsUrls: [new RegExp(`^${location.origin.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`)],
         ignoreUrls: [/\/vite\/hmr/, /^chrome-extension:\/\//, /sockjs/],
       }),
       new XMLHttpRequestInstrumentation({
-        propagateTraceHeaderCorsUrls: [/.*/],
+        propagateTraceHeaderCorsUrls: [new RegExp(`^${location.origin.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`)],
       }),
     ],
   });