snow-flow 1.3.25 → 1.3.28

package/dist/utils/flow-structure-builder.js

@@ -64,7 +64,7 @@ function generateFlowComponents(flowDefinition, flowSysId) {
         type: 'flow',
         status: 'published',
         active: true,
-        run_as: 'system',
+        run_as: 'user', // 🔒 SEC-001 FIX: Default to 'user' to prevent privilege escalation
         sys_class_name: 'sys_hub_flow',
         table: flowDefinition.table,
         category: 'custom',

package/dist/utils/servicenow-client.js

@@ -10,6 +10,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceNowClient = void 0;
 const axios_1 = __importDefault(require("axios"));
+const https_1 = __importDefault(require("https"));
 const snow_oauth_1 = require("./snow-oauth");
 const action_type_cache_1 = require("./action-type-cache");
 const snow_flow_config_js_1 = require("../config/snow-flow-config.js");
@@ -25,12 +26,59 @@ class ServiceNowClient {
         this.lastTokenRefresh = 0;
         this.logger = new logger_1.Logger('ServiceNowClient');
         this.oauth = new snow_oauth_1.ServiceNowOAuth();
+        // 🔒 SSL/TLS Certificate Validation Fix: Add proper HTTPS agent with certificate validation
+        const httpsAgent = new https_1.default.Agent({
+            rejectUnauthorized: true, // Enforce certificate validation
+            checkServerIdentity: (hostname, cert) => {
+                // Custom certificate validation for ServiceNow instances
+                // Allow *.service-now.com and user-configured instances
+                const validHosts = [
+                    /.*\.service-now\.com$/,
+                    /.*\.servicenow\.com$/
+                ];
+                // Get configured instance hostname
+                const instanceUrl = process.env.SNOW_INSTANCE;
+                if (instanceUrl) {
+                    try {
+                        const instanceHostname = new URL(instanceUrl.startsWith('http') ? instanceUrl : `https://${instanceUrl}`).hostname;
+                        validHosts.push(new RegExp(`^${instanceHostname.replace(/\./g, '\\.')}$`));
+                    }
+                    catch (error) {
+                        // Invalid URL format, rely on default validation
+                    }
+                }
+                // Check if hostname matches allowed patterns
+                if (validHosts.some(pattern => pattern.test(hostname))) {
+                    return undefined; // Valid hostname
+                }
+                // For development/testing environments, allow localhost/127.0.0.1
+                if (process.env.NODE_ENV === 'development' &&
+                    (hostname === 'localhost' || hostname === '127.0.0.1' || hostname.startsWith('192.168.'))) {
+                    return undefined;
+                }
+                return new Error(`Certificate hostname mismatch: ${hostname} not allowed`);
+            },
+            // secureProtocol removed to avoid conflict with minVersion/maxVersion
+            ciphers: [
+                'ECDHE-RSA-AES128-GCM-SHA256',
+                'ECDHE-RSA-AES256-GCM-SHA384',
+                'ECDHE-RSA-AES128-SHA256',
+                'ECDHE-RSA-AES256-SHA384'
+            ].join(':'), // Only allow secure ciphers
+            honorCipherOrder: true,
+            maxVersion: 'TLSv1.3',
+            minVersion: 'TLSv1.2'
+        });
         this.client = axios_1.default.create({
             timeout: snow_flow_config_js_1.snowFlowConfig.servicenow.timeout,
             headers: {
                 'Content-Type': 'application/json',
                 'Accept': 'application/json'
-            }
+            },
+            httpsAgent, // Use secure HTTPS agent with certificate validation
+            // Additional security headers
+            maxRedirects: 5,
+            validateStatus: (status) => status < 400 // Reject 4xx and 5xx by default
         });
         // 🔧 CRITICAL FIX: Add makeRequest method to Axios instance to fix phantom calls
         // Some code expects makeRequest to exist on this.client (the Axios instance)
@@ -1328,7 +1376,7 @@ snow_create_flow({
                 active: true, // Always create as active
                 internal_name: this.sanitizeInternalName(flow.name),
                 category: flow.category || 'custom',
-                run_as: flow.run_as || 'system', // 🔧 FIX: Default to 'system' for proper execution
+                run_as: flow.run_as || 'user', // 🔒 SEC-001 FIX: Default to 'user' to prevent privilege escalation
                 status: 'published', // 🔧 FIX: Ensure flow is published, not draft
                 validated: true, // 🔧 FIX: Mark as validated to allow activation
                 // Include complete flow definition to prevent corruption

package/dist/utils/snow-oauth.js

@@ -21,10 +21,33 @@ const snow_flow_config_js_1 = require("../config/snow-flow-config.js");
 const unified_auth_store_js_1 = require("./unified-auth-store.js");
 class ServiceNowOAuth {
     constructor() {
+        // 🔒 SEC-002 FIX: Add rate limiting to prevent authentication bypass attacks
+        this.lastTokenRequest = 0;
+        this.tokenRequestCount = 0;
+        this.TOKEN_REQUEST_WINDOW_MS = 60000; // 1 minute window
+        this.MAX_TOKEN_REQUESTS_PER_WINDOW = 10; // Max 10 token requests per minute
         // Store tokens in user's home directory
         const configDir = process.env.SNOW_FLOW_HOME || (0, path_1.join)(os_1.default.homedir(), '.snow-flow');
         this.tokenPath = (0, path_1.join)(configDir, 'auth.json');
     }
+    /**
+     * 🔒 SEC-002 FIX: Check rate limiting for token requests to prevent brute force attacks
+     */
+    checkTokenRequestRateLimit() {
+        const now = Date.now();
+        // Reset counter if window has passed
+        if (now - this.lastTokenRequest > this.TOKEN_REQUEST_WINDOW_MS) {
+            this.tokenRequestCount = 0;
+            this.lastTokenRequest = now;
+        }
+        // Check if within rate limit
+        if (this.tokenRequestCount >= this.MAX_TOKEN_REQUESTS_PER_WINDOW) {
+            console.warn('🔒 Rate limit exceeded: Too many token requests. Please wait before retrying.');
+            return false;
+        }
+        this.tokenRequestCount++;
+        return true;
+    }
     /**
      * Generate a random state parameter for CSRF protection
      */
@@ -62,8 +85,27 @@ class ServiceNowOAuth {
     /**
      * Initialize OAuth flow - opens browser and handles callback
      */
+    /**
+     * 🔧 CRIT-002 FIX: Normalize instance URL to prevent trailing slash 400 errors
+     */
+    normalizeInstanceUrl(instance) {
+        // Remove any trailing slashes that cause 400 errors
+        let normalized = instance.replace(/\/+$/, '');
+        // Add https:// if missing
+        if (!normalized.startsWith('http://') && !normalized.startsWith('https://')) {
+            normalized = `https://${normalized}`;
+        }
+        // Ensure .service-now.com suffix if it's just the instance name
+        if (!normalized.includes('.service-now.com') && !normalized.includes('localhost') && !normalized.includes('127.0.0.1')) {
+            const instanceName = normalized.replace('https://', '').replace('http://', '');
+            normalized = `https://${instanceName}.service-now.com`;
+        }
+        return normalized;
+    }
     async authenticate(instance, clientId, clientSecret) {
         try {
+            // 🔧 CRIT-002 FIX: Apply URL normalization
+            const normalizedInstance = this.normalizeInstanceUrl(instance);
             // Validate client secret format
             const secretValidation = this.validateClientSecret(clientSecret);
             if (!secretValidation.valid) {
@@ -94,15 +136,15 @@ class ServiceNowOAuth {
                     error: `Port ${port} is already in use. Please free up the port and try again.`
                 };
             }
-            // Store credentials temporarily (remove trailing slash from instance)
+            // Store credentials temporarily with normalized instance
             this.credentials = {
-                instance: instance.replace(/\/$/, ''),
+                instance: normalizedInstance.replace('https://', '').replace('http://', ''),
                 clientId,
                 clientSecret,
                 redirectUri
             };
             console.log('🚀 Starting ServiceNow OAuth flow...');
-            console.log(`📋 Instance: ${instance}`);
+            console.log(`📋 Instance: ${normalizedInstance}`);
             console.log(`🔐 Client ID: ${clientId}`);
             console.log(`🔗 Redirect URI: ${redirectUri}`);
             // Generate state parameter for CSRF protection
@@ -110,18 +152,18 @@ class ServiceNowOAuth {
             // Generate PKCE parameters
             this.generatePKCE();
             // Generate authorization URL
-            const authUrl = this.generateAuthUrl(instance, clientId, redirectUri);
+            const authUrl = this.generateAuthUrl(this.credentials.instance, clientId, redirectUri);
             console.log('\n🌐 Authorization URL generated:');
             console.log(`${authUrl}\n`);
             // Start local server to handle callback
             const authResult = await this.startCallbackServer(redirectUri, port);
             if (authResult.success && authResult.accessToken) {
-                // Save tokens
+                // Save tokens with normalized instance
                 await this.saveTokens({
                     accessToken: authResult.accessToken,
                     refreshToken: authResult.refreshToken || '',
                     expiresIn: authResult.expiresIn || 3600,
-                    instance: instance.replace(/\/$/, ''),
+                    instance: this.credentials.instance,
                     clientId,
                     clientSecret
                 });
@@ -303,6 +345,13 @@ class ServiceNowOAuth {
      */
     async exchangeCodeForTokens(code) {
         try {
+            // 🔒 SEC-002 FIX: Apply rate limiting to prevent authentication bypass attacks
+            if (!this.checkTokenRequestRateLimit()) {
+                return {
+                    success: false,
+                    error: 'Rate limit exceeded. Too many token requests. Please wait 1 minute before retrying.'
+                };
+            }
             const tokenUrl = `https://${this.credentials.instance}/oauth_token.do`;
             const response = await axios_1.default.post(tokenUrl, new URLSearchParams({
                 grant_type: 'authorization_code',
@@ -314,7 +363,8 @@ class ServiceNowOAuth {
             }), {
                 headers: {
                     'Content-Type': 'application/x-www-form-urlencoded'
-                }
+                },
+                timeout: 15000 // 🔒 SEC-002 FIX: 15 second timeout to prevent hanging requests
             });
             const data = response.data;
             if (data.access_token) {
@@ -434,6 +484,13 @@ class ServiceNowOAuth {
      */
     async refreshAccessToken(tokens) {
         try {
+            // 🔒 SEC-002 FIX: Apply rate limiting to prevent authentication bypass attacks
+            if (!this.checkTokenRequestRateLimit()) {
+                return {
+                    success: false,
+                    error: 'Rate limit exceeded. Too many token requests. Please wait 1 minute before retrying.'
+                };
+            }
             // If no tokens provided, load from file
             if (!tokens) {
                 tokens = await this.loadTokens();
@@ -453,7 +510,8 @@ class ServiceNowOAuth {
             }), {
                 headers: {
                     'Content-Type': 'application/x-www-form-urlencoded'
-                }
+                },
+                timeout: 15000 // 🔒 SEC-002 FIX: 15 second timeout to prevent hanging requests
             });
             const data = response.data;
             if (data.access_token) {

package/dist/utils/xml-first-flow-generator.js

@@ -453,6 +453,12 @@ class XMLFirstFlowGenerator {
     getActionTypeId(actionType) {
         return exports.ACTION_TYPE_SYS_IDS[actionType] || exports.ACTION_TYPE_SYS_IDS['script'];
     }
+    /**
+     * Generate complete Flow XML - alias for backward compatibility
+     */
+    generateCompleteFlowXML(flowDef) {
+        return this.generateFlowUpdateSetXML(flowDef);
+    }
     /**
      * Save XML to file
      */

package/dist/version.js

@@ -7,12 +7,24 @@ exports.VERSION_INFO = exports.VERSION = void 0;
 exports.getVersionString = getVersionString;
 exports.getLatestFeatures = getLatestFeatures;
 exports.isLatestVersion = isLatestVersion;
-exports.VERSION = '1.3.23';
+exports.VERSION = '1.3.27';
 exports.VERSION_INFO = {
     version: exports.VERSION,
     name: 'Snow-Flow',
     description: 'ServiceNow Queen Agent - Hive-Mind Intelligence for ServiceNow Development',
     features: {
+        '1.3.27': [
+            '🤖 AUTONOMOUS SYSTEMS: All 4 autonomous systems now ENABLED BY DEFAULT in swarm command!',
+            '✅ SELF-DOCUMENTING: Automatic documentation generation and updates (default: enabled)',
+            '💰 COST OPTIMIZATION: AI-driven cost management with auto-optimization (default: enabled)',
+            '🔐 COMPLIANCE MONITORING: Multi-framework compliance with auto-remediation (default: enabled)',
+            '🏥 SELF-HEALING: Predictive failure detection with automatic recovery (default: enabled)',
+            '⚙️ FLEXIBLE CONTROL: Use --no-autonomous-* flags to disable specific systems',
+            '🚫 GLOBAL DISABLE: Use --no-autonomous-all to disable all autonomous systems',
+            '💪 FORCE OVERRIDE: Use --autonomous-all to force enable all (overrides --no- flags)',
+            '🎯 PERFECT ORCHESTRATOR: True "één command voor alles" - zero manual intervention needed!',
+            'Based on user request: "oke maar kunnen we het niet als standaard aanzetten dat al deze dingen beschikbaar zijn?"'
+        ],
         '1.3.16': [
             '🔄 VERSION BUMP: Clean version update for npm publish',
             '✨ INCLUDES: All improvements from v1.3.15',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snow-flow",
-  "version": "1.3.25",
+  "version": "1.3.28",
   "description": "ServiceNow Queen Agent - Hive-Mind Intelligence for ServiceNow Development inspired by claude-flow. Transform complex workflows into elegant one-command orchestration.",
   "main": "dist/index.js",
   "type": "commonjs",