verdaccio-security-filter 1.3.1 → 1.3.3

package/build/index.d.ts

@@ -2,15 +2,6 @@ import { IPluginMiddleware, IPluginStorageFilter, PluginOptions, IBasicAuth, ISt
 import { Application } from 'express';
 import { SecurityConfig } from './types';
 import { SecurityLogger } from './lib/logger';
-/**
- * Security Filter Plugin for Verdaccio
- * Works with both middleware and filter interfaces for complete protection
- * Compatible with Verdaccio 6.x and 7.x
- *
- * Two-layer protection:
- * - Layer 1 (filter_metadata): CVE/License/Age checks when metadata is available
- * - Layer 2 (middleware): Whitelist/Pattern/Scope checks + tarball blocking
- */
 export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityConfig>, IPluginStorageFilter<SecurityConfig> {
     logger: SecurityLogger;
     config: SecurityConfig;
@@ -21,66 +12,17 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     private readonly licenseChecker;
     private readonly packageAgeChecker;
     private readonly authorChecker;
-    /**
-     * Creates a new SecurityFilterPlugin instance
-     * @param {SecurityConfig} config - Plugin configuration
-     * @param {PluginOptions} options - Verdaccio plugin options
-     */
     constructor(config: SecurityConfig, options: PluginOptions<SecurityConfig>);
-    /**
-     * Parse and validate version range rules
-     * @private
-     */
     private _parseVersionRangeRules;
-    /**
-     * Log initialization details
-     * @private
-     */
     private _logInitialization;
-    /**
-     * Get list of enabled features
-     * @private
-     */
     private _getEnabledFeatures;
-    /**
-     * Check if package name matches blocked patterns
-     * @private
-     */
     private _isBlockedByPattern;
-    /**
-     * Check if package scope is allowed
-     * @private
-     */
     private _isScopeAllowed;
-    /**
-     * Get version range rule for a specific package and version
-     * @private
-     */
     private _getVersionRangeRule;
-    /**
-     * Register Express middleware to intercept package requests
-     * Intercepts both metadata and tarball requests
-     */
     register_middlewares(app: Application, _auth: IBasicAuth<SecurityConfig>, _storage: IStorageManager<SecurityConfig>): void;
-    /**
-     * Filter package metadata before returning to client
-     * This provides CVE, License, and Age checking when metadata is available
-     */
     filter_metadata(packageInfo: Package): Promise<Package>;
-    /**
-     * Check if package should be blocked (used by middleware)
-     * @private
-     */
     private _checkPackageBlock;
-    /**
-     * Get applied security rules for a package
-     * @private
-     */
     private _getAppliedRules;
-    /**
-     * Cleanup plugin resources
-     * Should be called when Verdaccio shuts down
-     */
     destroy(): void;
 }
 export { SecurityLogger } from './lib/logger';

package/build/index.js

@@ -54,24 +54,9 @@ const cve_checker_1 = require("./lib/cve-checker");
 const license_checker_1 = require("./lib/license-checker");
 const package_age_checker_1 = require("./lib/package-age-checker");
 const author_checker_1 = require("./lib/author-checker");
-/**
- * Security Filter Plugin for Verdaccio
- * Works with both middleware and filter interfaces for complete protection
- * Compatible with Verdaccio 6.x and 7.x
- *
- * Two-layer protection:
- * - Layer 1 (filter_metadata): CVE/License/Age checks when metadata is available
- * - Layer 2 (middleware): Whitelist/Pattern/Scope checks + tarball blocking
- */
 class SecurityFilterPlugin {
-    /**
-     * Creates a new SecurityFilterPlugin instance
-     * @param {SecurityConfig} config - Plugin configuration
-     * @param {PluginOptions} options - Verdaccio plugin options
-     */
     constructor(config, options) {
         this.config = config || {};
-        // Set default error handling strategy if not provided
         if (!this.config.errorHandling) {
             this.config.errorHandling = {
                 onFilterError: 'fail-open',
@@ -79,23 +64,18 @@ class SecurityFilterPlugin {
                 onLicenseCheckError: 'fail-open',
             };
         }
-        // Initialize enhanced logger
         this.logger = new logger_1.SecurityLogger(options.logger, this.config.logger);
-        // Initialize metrics collector
         this.metrics = new metrics_1.MetricsCollector(this.config.metrics);
-        // Initialize whitelist checker
         this.whitelistChecker = new whitelist_checker_1.WhitelistChecker(this.config.whitelist);
-        // Initialize security checkers
         this.cveChecker = new cve_checker_1.CVEChecker(this.config.cveCheck);
         this.licenseChecker = new license_checker_1.LicenseChecker(this.config.licenses);
         this.packageAgeChecker = new package_age_checker_1.PackageAgeChecker(this.config.packageAge);
         this.authorChecker = new author_checker_1.AuthorChecker(this.config.authorFilter);
-        // Security rules configuration
         this.securityRules = {
             blockedVersions: this.config.blockedVersions || [],
             blockedPatterns: this.config.blockedPatterns || [],
             minPackageSize: this.config.minPackageSize || 0,
-            maxPackageSize: this.config.maxPackageSize || 100 * 1024 * 1024, // 100MB
+            maxPackageSize: this.config.maxPackageSize || 100 * 1024 * 1024,
             allowedScopes: this.config.allowedScopes || [],
             blockedScopes: this.config.blockedScopes || [],
             enforceChecksum: this.config.enforceChecksum !== false,
@@ -103,10 +83,6 @@ class SecurityFilterPlugin {
         };
         this._logInitialization();
     }
-    /**
-     * Parse and validate version range rules
-     * @private
-     */
     _parseVersionRangeRules(rules) {
         return rules.map((rule, index) => {
             if (!rule.package || !rule.range || !rule.strategy) {
@@ -117,7 +93,6 @@ class SecurityFilterPlugin {
                 this.logger.warn(`Fallback strategy requires fallbackVersion for ${rule.package}, skipping`);
                 return null;
             }
-            // Validate semver range
             try {
                 const validRange = semver.validRange(rule.range);
                 if (!validRange) {
@@ -132,10 +107,6 @@ class SecurityFilterPlugin {
             return rule;
         }).filter((rule) => rule !== null);
     }
-    /**
-     * Log initialization details
-     * @private
-     */
     _logInitialization() {
         var _a;
         const features = this._getEnabledFeatures();
@@ -159,10 +130,6 @@ class SecurityFilterPlugin {
             this.logger.info(`Author filtering enabled: ${summary.blockedAuthors} authors, ${summary.blockedEmails} emails, ${summary.blockedRegions} regions blocked`);
         }
     }
-    /**
-     * Get list of enabled features
-     * @private
-     */
     _getEnabledFeatures() {
         var _a, _b, _c, _d, _e;
         const features = [];
@@ -188,40 +155,25 @@ class SecurityFilterPlugin {
             features.push('scope-blocking');
         return features;
     }
-    /**
-     * Check if package name matches blocked patterns
-     * @private
-     */
     _isBlockedByPattern(packageName) {
         return this.securityRules.blockedPatterns.some(pattern => {
             const regex = new RegExp(pattern);
             return regex.test(packageName);
         });
     }
-    /**
-     * Check if package scope is allowed
-     * @private
-     */
     _isScopeAllowed(packageName) {
-        // If not a scoped package, check if allowedScopes is empty
         if (!packageName.startsWith('@')) {
             return this.securityRules.allowedScopes.length === 0;
         }
         const scope = packageName.split('/')[0];
-        // Check blacklist
         if (this.securityRules.blockedScopes.includes(scope)) {
             return false;
         }
-        // Check whitelist (if exists)
         if (this.securityRules.allowedScopes.length > 0) {
             return this.securityRules.allowedScopes.includes(scope);
         }
         return true;
     }
-    /**
-     * Get version range rule for a specific package and version
-     * @private
-     */
     _getVersionRangeRule(packageName, version) {
         return this.securityRules.versionRangeRules.find(rule => {
             if (rule.package !== packageName) {
@@ -236,43 +188,28 @@ class SecurityFilterPlugin {
             }
         }) || null;
     }
-    /**
-     * Register Express middleware to intercept package requests
-     * Intercepts both metadata and tarball requests
-     */
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     register_middlewares(app, _auth, _storage) {
         this.logger.info('[Middleware] Registering security filter middleware');
         this.logger.info(`[Middleware] Config mode: ${this.config.mode || 'NOT SET'}`);
-        // Middleware to intercept all package requests
         app.use((req, res, next) => __awaiter(this, void 0, void 0, function* () {
             try {
-                // Extract package name and version from URL
-                // Tarball URLs: /:package/-/:filename.tgz
-                // Scoped tarball URLs: /@scope/:package/-/:filename.tgz
-                // Metadata URLs: /:package or /@scope/:package
                 const urlMatch = req.url.match(/^\/(@[^/]+\/)?([^/]+)(?:\/-\/([^/]+\.tgz))?/);
                 if (!urlMatch) {
-                    // Not a package-related request, pass through
                     this.logger.debug(`[Middleware] Non-package request: ${req.method} ${req.url}`);
                     return next();
                 }
                 const scope = urlMatch[1] || '';
                 const packageName = scope + urlMatch[2];
                 const tarballFile = urlMatch[3];
-                // Extract version from tarball filename if present
                 let version;
                 if (tarballFile) {
-                    // This is a tarball download request - block it immediately
                     const versionMatch = tarballFile.match(/-([\d.]+(?:-[a-zA-Z0-9.]+)?)\.tgz$/);
                     version = versionMatch ? versionMatch[1] : undefined;
                     this.logger.info(`[Middleware] TARBALL REQUEST: ${packageName}@${version || 'unknown'}`);
-                    // Apply all security checks for tarball downloads
                     const blockResult = yield this._checkPackageBlock(packageName, version);
                     if (blockResult.blocked) {
                         this.logger.warn(`[Middleware] [X] BLOCKED TARBALL: ${packageName}@${version || '*'} - ${blockResult.reason}`);
                         this.metrics.recordBlock(packageName, version || '*', blockResult.reason);
-                        // Return 403 Forbidden with detailed error
                         res.status(403).json({
                             error: 'Package blocked by security filter',
                             package: packageName,
@@ -285,9 +222,7 @@ class SecurityFilterPlugin {
                     this.logger.info(`[Middleware] [OK] ALLOWED TARBALL: ${packageName}@${version || 'unknown'}`);
                 }
                 else {
-                    // This is a metadata request - intercept response and modify it
                     this.logger.info(`[Middleware] METADATA REQUEST: ${packageName} - will intercept response`);
-                    // Check if package should be blocked
                     const blockResult = yield this._checkPackageBlock(packageName);
                     if (blockResult.blocked) {
                         this.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
@@ -322,7 +257,6 @@ class SecurityFilterPlugin {
                         this.logger.info(`[Middleware] [OK] ALLOWED METADATA: ${packageName}`);
                     }
                 }
-                // Continue to next middleware
                 next();
             }
             catch (error) {
@@ -332,22 +266,16 @@ class SecurityFilterPlugin {
         }));
         this.logger.info('[Middleware] Security filter middleware registered successfully');
     }
-    /**
-     * Filter package metadata before returning to client
-     * This provides CVE, License, and Age checking when metadata is available
-     */
     filter_metadata(packageInfo) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d, _e, _f, _g, _h;
             const packageName = packageInfo.name;
             this.logger.info(`[filter_metadata] --> Processing: ${packageName}`);
             try {
-                // 1. Whitelist/blacklist check (basic filtering)
                 const blockResult = yield this._checkPackageBlock(packageName);
                 if (blockResult.blocked) {
                     this.logger.warn(`[filter_metadata] BLOCKED: ${packageName}@* - ${blockResult.reason}`);
                     this.metrics.recordBlock(packageName, '*', blockResult.reason);
-                    // Return empty versions with security field
                     return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
                             blocked: true,
                             reason: blockResult.reason,
@@ -360,7 +288,6 @@ class SecurityFilterPlugin {
                             rules: this._getAppliedRules(packageName),
                         } });
                 }
-                // 2. CVE Check - check versions in controlled batches
                 if ((_a = this.config.cveCheck) === null || _a === void 0 ? void 0 : _a.enabled) {
                     const versions = Object.keys(packageInfo.versions || {});
                     const vulnerableVersions = [];
@@ -379,7 +306,6 @@ class SecurityFilterPlugin {
                             }
                         });
                     }
-                    // If configured to auto-block and vulnerabilities found
                     if (this.config.cveCheck.autoBlock && vulnerableVersions.length > 0) {
                         const reason = `Package has ${vulnerableVersions.length} vulnerable version(s)`;
                         this.logger.warn(`[filter_metadata] CVE BLOCKED: ${packageName} - ${reason}`);
@@ -396,7 +322,6 @@ class SecurityFilterPlugin {
                             } });
                     }
                 }
-                // 3. License Check - check latest version
                 if (this.config.licenses && this.config.licenses.allowed && this.config.licenses.allowed.length > 0) {
                     const latestVersion = (_b = packageInfo['dist-tags']) === null || _b === void 0 ? void 0 : _b.latest;
                     if (latestVersion && ((_c = packageInfo.versions) === null || _c === void 0 ? void 0 : _c[latestVersion])) {
@@ -418,7 +343,6 @@ class SecurityFilterPlugin {
                         }
                     }
                 }
-                // 4. Package Age Check
                 if ((_d = this.config.packageAge) === null || _d === void 0 ? void 0 : _d.enabled) {
                     const ageResult = this.packageAgeChecker.checkPackageAge(packageInfo);
                     if (!ageResult.allowed && !ageResult.warnOnly) {
@@ -439,7 +363,6 @@ class SecurityFilterPlugin {
                         this.logger.warn(`[filter_metadata] AGE WARNING: ${packageName} - ${ageResult.reason} (warn-only mode)`);
                     }
                 }
-                // 5. Author Filter Check
                 if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled) {
                     const latestVersion = (_f = packageInfo['dist-tags']) === null || _f === void 0 ? void 0 : _f.latest;
                     if (latestVersion && ((_g = packageInfo.versions) === null || _g === void 0 ? void 0 : _g[latestVersion])) {
@@ -499,34 +422,25 @@ class SecurityFilterPlugin {
             }
         });
     }
-    /**
-     * Check if package should be blocked (used by middleware)
-     * @private
-     */
     _checkPackageBlock(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
-            // 1. Whitelist mode
             if (this.config.mode === 'whitelist') {
                 const whitelistCheck = this.whitelistChecker.isWhitelisted(packageName, version);
                 if (!whitelistCheck.allowed) {
                     return { blocked: true, reason: whitelistCheck.reason || 'Package is not in whitelist' };
                 }
             }
-            // 2. Blocked patterns
             if (this._isBlockedByPattern(packageName)) {
                 return { blocked: true, reason: 'Package name matches blocked pattern' };
             }
-            // 3. Scopes
             if (!this._isScopeAllowed(packageName)) {
                 return { blocked: true, reason: 'Package scope not allowed' };
             }
-            // 4. Exact version blocking
             if (version) {
                 const versionKey = `${packageName}@${version}`;
                 if (this.securityRules.blockedVersions.includes(versionKey)) {
                     return { blocked: true, reason: 'Exact version match in blocklist' };
                 }
-                // 5. Version range rules
                 const rangeRule = this._getVersionRangeRule(packageName, version);
                 if (rangeRule && rangeRule.strategy === 'block') {
                     return { blocked: true, reason: `Version matches blocked range: ${rangeRule.range}` };
@@ -535,13 +449,8 @@ class SecurityFilterPlugin {
             return { blocked: false, reason: '' };
         });
     }
-    /**
-     * Get applied security rules for a package
-     * @private
-     */
     _getAppliedRules(packageName) {
         const rules = {};
-        // Check which rules apply to this package
         if (this.config.mode === 'whitelist') {
             rules.mode = 'whitelist';
             rules.whitelisted = false;
@@ -572,10 +481,6 @@ class SecurityFilterPlugin {
         }
         return rules;
     }
-    /**
-     * Cleanup plugin resources
-     * Should be called when Verdaccio shuts down
-     */
     destroy() {
         this.logger.info('[Cleanup] Shutting down security filter plugin');
         try {
@@ -589,7 +494,6 @@ class SecurityFilterPlugin {
     }
 }
 exports.default = SecurityFilterPlugin;
-// Export utility classes for testing
 var logger_2 = require("./lib/logger");
 Object.defineProperty(exports, "SecurityLogger", { enumerable: true, get: function () { return logger_2.SecurityLogger; } });
 var metrics_2 = require("./lib/metrics");

package/build/lib/author-checker.d.ts

@@ -1,9 +1,5 @@
 import { Version } from '@verdaccio/types';
 import { AuthorFilterConfig, AuthorCheckResult } from '../types';
-/**
- * AuthorChecker validates package authors and maintainers
- * against configured security policies.
- */
 export declare class AuthorChecker {
     private readonly config?;
     private readonly blockedAuthors;
@@ -13,25 +9,10 @@ export declare class AuthorChecker {
     private readonly blockedEmailDomains;
     private readonly regionDomainMap;
     constructor(config?: AuthorFilterConfig);
-    /**
-     * Check if package author/maintainer is allowed
-     */
     checkAuthor(versionData: Version): AuthorCheckResult;
-    /**
-     * Extract author information from package version data
-     */
     private _extractAuthors;
-    /**
-     * Normalize author data to AuthorInfo format
-     */
     private _normalizeAuthor;
-    /**
-     * Check a single author against all blocking rules
-     */
     private _checkSingleAuthor;
-    /**
-     * Get summary of configuration
-     */
     getSummary(): {
         enabled: boolean;
         blockedAuthors: number;

package/build/lib/author-checker.js

@@ -1,23 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorChecker = void 0;
-/**
- * Region to TLD mapping for email domain filtering
- */
 const REGION_DOMAINS = {
     'ru': ['.ru', 'yandex.ru', 'mail.ru', 'rambler.ru', 'ya.ru', 'bk.ru', 'list.ru'],
     'cn': ['.cn', 'qq.com', '163.com', '126.com', 'sina.com', 'sohu.com'],
     'by': ['.by', 'tut.by', 'mail.by'],
-    'kp': ['.kp'], // North Korea
-    'ir': ['.ir'], // Iran
-    'sy': ['.sy'], // Syria
-    'cu': ['.cu'], // Cuba
-    'sd': ['.sd'], // Sudan
+    'kp': ['.kp'],
+    'ir': ['.ir'],
+    'sy': ['.sy'],
+    'cu': ['.cu'],
+    'sd': ['.sd'],
 };
-/**
- * AuthorChecker validates package authors and maintainers
- * against configured security policies.
- */
 class AuthorChecker {
     constructor(config) {
         this.config = config;
@@ -34,9 +27,6 @@ class AuthorChecker {
             this.regionDomainMap.set(region.toLowerCase(), new Set(domains));
         });
     }
-    /**
-     * Check if package author/maintainer is allowed
-     */
     checkAuthor(versionData) {
         var _a;
         if (!((_a = this.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
@@ -61,9 +51,6 @@ class AuthorChecker {
         }
         return { allowed: true };
     }
-    /**
-     * Extract author information from package version data
-     */
     _extractAuthors(versionData) {
         const authors = [];
         if (versionData.author) {
@@ -81,9 +68,6 @@ class AuthorChecker {
         }
         return authors;
     }
-    /**
-     * Normalize author data to AuthorInfo format
-     */
     _normalizeAuthor(author) {
         if (typeof author === 'string') {
             const emailMatch = author.match(/<([^>]+)>/);
@@ -99,11 +83,7 @@ class AuthorChecker {
             url: author.url,
         };
     }
-    /**
-     * Check a single author against all blocking rules
-     */
     _checkSingleAuthor(author) {
-        // Check blocked author names
         if (author.name) {
             const normalizedName = author.name.toLowerCase().trim();
             if (this.blockedAuthors.has(normalizedName)) {
@@ -125,7 +105,6 @@ class AuthorChecker {
                 }
             }
         }
-        // Check blocked emails
         if (author.email) {
             const normalizedEmail = author.email.toLowerCase().trim();
             if (this.blockedEmails.has(normalizedEmail)) {
@@ -146,7 +125,6 @@ class AuthorChecker {
                     };
                 }
             }
-            // Check blocked email domains
             for (const domain of this.blockedEmailDomains) {
                 if (normalizedEmail.endsWith(domain) || normalizedEmail.includes(`@${domain}`)) {
                     return {
@@ -157,7 +135,6 @@ class AuthorChecker {
                     };
                 }
             }
-            // Check blocked regions
             for (const [region, domains] of this.regionDomainMap.entries()) {
                 for (const domain of domains) {
                     if (normalizedEmail.endsWith(domain) ||
@@ -175,9 +152,6 @@ class AuthorChecker {
         }
         return { allowed: true };
     }
-    /**
-     * Get summary of configuration
-     */
     getSummary() {
         var _a;
         return {

package/build/lib/cve-checker.d.ts

@@ -1,7 +1,4 @@
 import { CVECheckConfig, CVECheckResult } from '../types';
-/**
- * CVE Checker that integrates with vulnerability databases
- */
 export declare class CVEChecker {
     private config;
     private cache;
@@ -10,49 +7,15 @@ export declare class CVEChecker {
     private saveTimer;
     private readonly SAVE_DEBOUNCE_MS;
     constructor(config?: CVECheckConfig);
-    /**
-     * Check if a package version has known vulnerabilities
-     */
     checkPackage(packageName: string, version: string): Promise<CVECheckResult>;
-    /**
-     * Fetch vulnerabilities from configured databases
-     */
     private fetchVulnerabilities;
-    /**
-     * Fetch vulnerabilities from OSV (Open Source Vulnerabilities) database
-     * https://osv.dev/
-     */
     private fetchFromOSV;
-    /**
-     * Sleep utility for retry delays
-     */
     private sleep;
-    /**
-     * Map OSV severity to our severity levels
-     */
     private mapOSVSeverity;
-    /**
-     * Check if cache is stale
-     */
     private isCacheStale;
-    /**
-     * Load cache from disk
-     */
     private loadCache;
-    /**
-     * Debounced save cache to reduce I/O operations
-     */
     private debouncedSaveCache;
-    /**
-     * Save cache to disk immediately
-     */
     private saveCache;
-    /**
-     * Clear cache
-     */
     clearCache(): void;
-    /**
-     * Cleanup resources
-     */
     destroy(): void;
 }