verdaccio-security-filter 1.3.0 → 1.3.1

package/README.md

@@ -2,6 +2,7 @@
 
 Advanced security filter plugin for Verdaccio with **dual-layer protection architecture** combining middleware interception and metadata filtering for comprehensive package security.
 
+[![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://stand-with-ukraine.pp.ua)
 [![npm version](https://img.shields.io/npm/v/verdaccio-security-filter.svg)](https://www.npmjs.com/package/verdaccio-security-filter)
 [![npm downloads](https://img.shields.io/npm/dm/verdaccio-security-filter.svg)](https://www.npmjs.com/package/verdaccio-security-filter)
 [![CI](https://github.com/ponomarenko/verdaccio-security-filter/actions/workflows/ci.yml/badge.svg)](https://github.com/ponomarenko/verdaccio-security-filter/actions/workflows/ci.yml)

package/build/index.d.ts

@@ -77,6 +77,11 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
      * @private
      */
     private _getAppliedRules;
+    /**
+     * Cleanup plugin resources
+     * Should be called when Verdaccio shuts down
+     */
+    destroy(): void;
 }
 export { SecurityLogger } from './lib/logger';
 export { MetricsCollector } from './lib/metrics';

package/build/index.js

@@ -290,79 +290,33 @@ class SecurityFilterPlugin {
                     // Check if package should be blocked
                     const blockResult = yield this._checkPackageBlock(packageName);
                     if (blockResult.blocked) {
-                        // Intercept the response
-                        const originalSend = res.send;
-                        const originalJson = res.json;
-                        // eslint-disable-next-line @typescript-eslint/no-this-alias
-                        const self = this;
-                        // Override res.json to intercept JSON responses
-                        res.json = function (body) {
-                            if (body && typeof body === 'object' && body.name === packageName) {
-                                // This is package metadata - modify it to show blocked info
-                                self.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
-                                self.logger.info(`[Middleware] Modifying response to show blocking info`);
-                                const blockedResponse = {
-                                    name: packageName,
-                                    versions: {},
-                                    'dist-tags': {},
-                                    security: {
-                                        blocked: true,
-                                        reason: blockResult.reason,
-                                        plugin: {
-                                            name: 'verdaccio-security-filter',
-                                            version: '1.0.0',
-                                            mode: self.config.mode || 'blacklist',
-                                        },
-                                        blockedAt: new Date().toISOString(),
-                                        rules: self._getAppliedRules(packageName),
-                                        message: `This package has been blocked by security filter: ${blockResult.reason}`,
-                                        contact: 'Please contact your registry administrator for more information',
-                                    },
-                                    _security: {
-                                        blocked: true,
-                                        reason: blockResult.reason,
-                                        blockedBy: 'verdaccio-security-filter',
-                                        blockedAt: new Date().toISOString(),
-                                    }
-                                };
-                                return originalJson.call(this, blockedResponse);
-                            }
-                            return originalJson.call(this, body);
-                        };
-                        // Override res.send for non-JSON responses
-                        res.send = function (body) {
-                            if (typeof body === 'string') {
-                                try {
-                                    const parsed = JSON.parse(body);
-                                    if (parsed && parsed.name === packageName) {
-                                        self.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
-                                        const blockedResponse = {
-                                            name: packageName,
-                                            versions: {},
-                                            'dist-tags': {},
-                                            security: {
-                                                blocked: true,
-                                                reason: blockResult.reason,
-                                                plugin: {
-                                                    name: 'verdaccio-security-filter',
-                                                    version: '1.0.0',
-                                                    mode: self.config.mode || 'blacklist',
-                                                },
-                                                blockedAt: new Date().toISOString(),
-                                                rules: self._getAppliedRules(packageName),
-                                                message: `This package has been blocked by security filter: ${blockResult.reason}`,
-                                                contact: 'Please contact your registry administrator for more information',
-                                            }
-                                        };
-                                        return originalSend.call(this, JSON.stringify(blockedResponse));
-                                    }
-                                }
-                                catch (_a) {
-                                    // Not JSON, pass through
-                                }
+                        this.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
+                        const blockedResponse = {
+                            name: packageName,
+                            versions: {},
+                            'dist-tags': {},
+                            security: {
+                                blocked: true,
+                                reason: blockResult.reason,
+                                plugin: {
+                                    name: 'verdaccio-security-filter',
+                                    version: '1.0.0',
+                                    mode: this.config.mode || 'blacklist',
+                                },
+                                blockedAt: new Date().toISOString(),
+                                rules: this._getAppliedRules(packageName),
+                                message: `This package has been blocked by security filter: ${blockResult.reason}`,
+                                contact: 'Please contact your registry administrator for more information',
+                            },
+                            _security: {
+                                blocked: true,
+                                reason: blockResult.reason,
+                                blockedBy: 'verdaccio-security-filter',
+                                blockedAt: new Date().toISOString(),
                             }
-                            return originalSend.call(this, body);
                         };
+                        res.status(200).json(blockedResponse);
+                        return;
                     }
                     else {
                         this.logger.info(`[Middleware] [OK] ALLOWED METADATA: ${packageName}`);
@@ -406,16 +360,24 @@ class SecurityFilterPlugin {
                             rules: this._getAppliedRules(packageName),
                         } });
                 }
-                // 2. CVE Check - check all versions
+                // 2. CVE Check - check versions in controlled batches
                 if ((_a = this.config.cveCheck) === null || _a === void 0 ? void 0 : _a.enabled) {
                     const versions = Object.keys(packageInfo.versions || {});
                     const vulnerableVersions = [];
-                    for (const version of versions) {
-                        const cveResult = yield this.cveChecker.checkPackage(packageName, version);
-                        if (cveResult.isVulnerable) {
-                            vulnerableVersions.push(version);
-                            this.logger.warn(`[filter_metadata] CVE found in ${packageName}@${version}: ${cveResult.vulnerabilities.length} vulnerabilities`);
-                        }
+                    const BATCH_SIZE = 10;
+                    for (let i = 0; i < versions.length; i += BATCH_SIZE) {
+                        const batch = versions.slice(i, i + BATCH_SIZE);
+                        const results = yield Promise.allSettled(batch.map(version => this.cveChecker.checkPackage(packageName, version)));
+                        results.forEach((result, index) => {
+                            if (result.status === 'fulfilled' && result.value.isVulnerable) {
+                                const version = batch[index];
+                                vulnerableVersions.push(version);
+                                this.logger.warn(`[filter_metadata] CVE found in ${packageName}@${version}: ${result.value.vulnerabilities.length} vulnerabilities`);
+                            }
+                            else if (result.status === 'rejected') {
+                                this.logger.error(`[filter_metadata] CVE check failed for ${packageName}@${batch[index]}: ${result.reason}`);
+                            }
+                        });
                     }
                     // If configured to auto-block and vulnerabilities found
                     if (this.config.cveCheck.autoBlock && vulnerableVersions.length > 0) {
@@ -610,6 +572,21 @@ class SecurityFilterPlugin {
         }
         return rules;
     }
+    /**
+     * Cleanup plugin resources
+     * Should be called when Verdaccio shuts down
+     */
+    destroy() {
+        this.logger.info('[Cleanup] Shutting down security filter plugin');
+        try {
+            this.cveChecker.destroy();
+            this.metrics.cleanup();
+            this.logger.info('[Cleanup] Plugin resources cleaned up successfully');
+        }
+        catch (error) {
+            this.logger.error(`[Cleanup] Error during cleanup: ${error.message}`);
+        }
+    }
 }
 exports.default = SecurityFilterPlugin;
 // Export utility classes for testing

package/build/lib/cve-checker.d.ts

@@ -6,6 +6,9 @@ export declare class CVEChecker {
     private config;
     private cache;
     private lastUpdate;
+    private readonly MAX_CACHE_SIZE;
+    private saveTimer;
+    private readonly SAVE_DEBOUNCE_MS;
     constructor(config?: CVECheckConfig);
     /**
      * Check if a package version has known vulnerabilities
@@ -37,11 +40,19 @@ export declare class CVEChecker {
      */
     private loadCache;
     /**
-     * Save cache to disk
+     * Debounced save cache to reduce I/O operations
+     */
+    private debouncedSaveCache;
+    /**
+     * Save cache to disk immediately
      */
     private saveCache;
     /**
      * Clear cache
      */
     clearCache(): void;
+    /**
+     * Cleanup resources
+     */
+    destroy(): void;
 }

package/build/lib/cve-checker.js

@@ -45,13 +45,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CVEChecker = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const lru_cache_1 = require("./lru-cache");
 /**
  * CVE Checker that integrates with vulnerability databases
  */
 class CVEChecker {
     constructor(config) {
-        this.cache = new Map();
         this.lastUpdate = 0;
+        this.MAX_CACHE_SIZE = 1000;
+        this.saveTimer = null;
+        this.SAVE_DEBOUNCE_MS = 5000;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             databases: (config === null || config === void 0 ? void 0 : config.databases) || ['osv'],
@@ -60,6 +63,7 @@ class CVEChecker {
             updateInterval: (config === null || config === void 0 ? void 0 : config.updateInterval) || 24,
             cacheDir: (config === null || config === void 0 ? void 0 : config.cacheDir) || './.security-cache',
         };
+        this.cache = new lru_cache_1.LRUCache(this.MAX_CACHE_SIZE);
         if (this.config.enabled) {
             this.loadCache();
         }
@@ -96,7 +100,7 @@ class CVEChecker {
             };
             // Cache result
             this.cache.set(cacheKey, result);
-            this.saveCache();
+            this.debouncedSaveCache();
             return result;
         });
     }
@@ -243,7 +247,11 @@ class CVEChecker {
             if (fs.existsSync(cacheFile)) {
                 const data = fs.readFileSync(cacheFile, 'utf8');
                 const parsed = JSON.parse(data);
-                this.cache = new Map(Object.entries(parsed.cache));
+                const entries = Object.entries(parsed.cache);
+                const sortedEntries = entries.slice(-this.MAX_CACHE_SIZE);
+                sortedEntries.forEach(([key, value]) => {
+                    this.cache.set(key, value);
+                });
                 this.lastUpdate = parsed.lastUpdate || 0;
             }
         }
@@ -253,7 +261,19 @@ class CVEChecker {
         }
     }
     /**
-     * Save cache to disk
+     * Debounced save cache to reduce I/O operations
+     */
+    debouncedSaveCache() {
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+        }
+        this.saveTimer = setTimeout(() => {
+            this.saveCache();
+            this.saveTimer = null;
+        }, this.SAVE_DEBOUNCE_MS);
+    }
+    /**
+     * Save cache to disk immediately
      */
     saveCache() {
         try {
@@ -263,7 +283,7 @@ class CVEChecker {
                 fs.mkdirSync(dir, { recursive: true });
             }
             const data = {
-                cache: Object.fromEntries(this.cache),
+                cache: Object.fromEntries(this.cache.entries()),
                 lastUpdate: Date.now(),
             };
             fs.writeFileSync(cacheFile, JSON.stringify(data, null, 2), 'utf8');
@@ -282,5 +302,16 @@ class CVEChecker {
         this.lastUpdate = 0;
         this.saveCache();
     }
+    /**
+     * Cleanup resources
+     */
+    destroy() {
+        if (this.saveTimer) {
+            clearTimeout(this.saveTimer);
+            this.saveTimer = null;
+        }
+        this.saveCache();
+        this.cache.clear();
+    }
 }
 exports.CVEChecker = CVEChecker;

package/build/lib/lru-cache.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Simple LRU (Least Recently Used) Cache implementation with size limits
+ */
+export declare class LRUCache<K, V> {
+    private cache;
+    private readonly maxSize;
+    constructor(maxSize?: number);
+    get(key: K): V | undefined;
+    set(key: K, value: V): void;
+    has(key: K): boolean;
+    delete(key: K): boolean;
+    clear(): void;
+    get size(): number;
+    entries(): IterableIterator<[K, V]>;
+}

package/build/lib/lru-cache.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LRUCache = void 0;
+/**
+ * Simple LRU (Least Recently Used) Cache implementation with size limits
+ */
+class LRUCache {
+    constructor(maxSize = 1000) {
+        this.cache = new Map();
+        this.maxSize = maxSize;
+    }
+    get(key) {
+        if (!this.cache.has(key)) {
+            return undefined;
+        }
+        const value = this.cache.get(key);
+        this.cache.delete(key);
+        this.cache.set(key, value);
+        return value;
+    }
+    set(key, value) {
+        if (this.cache.has(key)) {
+            this.cache.delete(key);
+        }
+        else if (this.cache.size >= this.maxSize) {
+            const firstKey = this.cache.keys().next().value;
+            if (firstKey !== undefined) {
+                this.cache.delete(firstKey);
+            }
+        }
+        this.cache.set(key, value);
+    }
+    has(key) {
+        return this.cache.has(key);
+    }
+    delete(key) {
+        return this.cache.delete(key);
+    }
+    clear() {
+        this.cache.clear();
+    }
+    get size() {
+        return this.cache.size;
+    }
+    entries() {
+        return this.cache.entries();
+    }
+}
+exports.LRUCache = LRUCache;

package/build/lib/metrics.d.ts

@@ -6,6 +6,7 @@ export declare class MetricsCollector {
     private config;
     private metricsBuffer;
     private readonly bufferSize;
+    private readonly maxBufferSize;
     constructor(config?: MetricsConfig);
     /**
      * Record a security event

package/build/lib/metrics.js

@@ -43,6 +43,7 @@ class MetricsCollector {
     constructor(config) {
         this.metricsBuffer = [];
         this.bufferSize = 100;
+        this.maxBufferSize = 500;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             output: (config === null || config === void 0 ? void 0 : config.output) || 'stdout',
@@ -56,6 +57,9 @@ class MetricsCollector {
         if (!this.config.enabled) {
             return;
         }
+        if (this.metricsBuffer.length >= this.maxBufferSize) {
+            this.flush();
+        }
         this.metricsBuffer.push(event);
         if (this.metricsBuffer.length >= this.bufferSize) {
             this.flush();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",