xypriss 9.10.19 → 9.10.21

package/dist/src/middleware/built-in/security/CommandInjectionDetector.d.ts

@@ -1,40 +0,0 @@
-/**
- * Command Injection Detection Module
- *
- * Detects and prevents OS command injection attacks with
- * intelligent context-aware false positive reduction
- */
-import { SecurityDetectionResult, SecurityModuleConfig, ContextInfo } from './types';
-interface CommandInjectionConfig extends SecurityModuleConfig {
-    allowedCommands?: string[];
-    contextualAnalysis?: boolean;
-}
-declare class CommandInjectionDetector {
-    private config;
-    private readonly highRiskPatterns;
-    private readonly mediumRiskPatterns;
-    constructor(config?: CommandInjectionConfig);
-    /**
-     * Detect command injection attempts
-     */
-    detect(input: string | null | undefined, context?: ContextInfo): SecurityDetectionResult;
-    /**
-     * Sanitize input by removing command injection sequences
-     */
-    private sanitizeInput;
-    /**
-     * Analyze context to reduce false positives
-     */
-    private analyzeContext;
-    /**
-     * Calculate legitimacy score
-     */
-    private calculateLegitimacyScore;
-    private getHighRiskPatternName;
-    private getHighRiskWeight;
-    private logAttempt;
-    updateConfig(newConfig: Partial<CommandInjectionConfig>): void;
-    getConfig(): Required<CommandInjectionConfig>;
-}
-export default CommandInjectionDetector;
-//# sourceMappingURL=CommandInjectionDetector.d.ts.map

package/dist/src/middleware/built-in/security/CommandInjectionDetector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CommandInjectionDetector.d.ts","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/CommandInjectionDetector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAErF,UAAU,sBAAuB,SAAQ,oBAAoB;IACzD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,cAAM,wBAAwB;IAC1B,OAAO,CAAC,MAAM,CAAmC;IAGjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAyB/B;IAGF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CASjC;gBAEU,MAAM,GAAE,sBAA2B;IAa/C;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,uBAAuB;IA0ExF;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;OAEG;IACH,OAAO,CAAC,cAAc;IA2BtB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,UAAU;IASlB,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI;IAI9D,SAAS,IAAI,QAAQ,CAAC,sBAAsB,CAAC;CAGhD;AAED,eAAe,wBAAwB,CAAC"}

package/dist/src/middleware/built-in/security/CommandInjectionDetector.js

@@ -1,212 +0,0 @@
-/**
- * Command Injection Detection Module
- *
- * Detects and prevents OS command injection attacks with
- * intelligent context-aware false positive reduction
- */
-class CommandInjectionDetector {
-    constructor(config = {}) {
-        // High-risk command injection patterns
-        this.highRiskPatterns = [
-            // Command chaining
-            /[;&|`]\s*(ls|cat|wget|curl|nc|netcat|bash|sh|cmd|powershell|eval|exec)/gi,
-            // Command substitution
-            /\$\(.*?\)/g,
-            /`.*?`/g,
-            // Pipe to dangerous commands
-            /\|\s*(bash|sh|cmd|powershell|python|perl|ruby|node)/gi,
-            // Redirection with dangerous commands
-            /[<>]\s*(\/etc\/|\/bin\/|C:\\)/gi,
-            // Encoded command injection
-            /%0a|%0d|%09/gi, // newline, carriage return, tab
-            // Dangerous system commands
-            /(rm\s+-rf|del\s+\/|format\s+|mkfs|dd\s+if=)/gi,
-            // Network commands
-            /(wget|curl|nc|netcat|telnet|ssh|ftp)\s+/gi,
-            // Eval/exec patterns
-            /(eval|exec|system|passthru|shell_exec|popen)\s*\(/gi,
-        ];
-        // Medium-risk patterns
-        this.mediumRiskPatterns = [
-            // Shell metacharacters
-            /[;&|`$()]/g,
-            // Redirection operators
-            /[<>]/g,
-            // Common command names (could be legitimate text)
-            /\b(ls|cat|echo|pwd|cd|mkdir|touch|grep|find|chmod|chown)\b/gi,
-        ];
-        this.config = {
-            enabled: config.enabled ?? true,
-            strictMode: config.strictMode ?? false,
-            logAttempts: config.logAttempts ?? true,
-            blockOnDetection: config.blockOnDetection ?? true,
-            falsePositiveThreshold: config.falsePositiveThreshold ?? 0.7,
-            customPatterns: config.customPatterns ?? [],
-            allowedCommands: config.allowedCommands ?? [],
-            contextualAnalysis: config.contextualAnalysis ?? true,
-        };
-    }
-    /**
-     * Detect command injection attempts
-     */
-    detect(input, context) {
-        if (!input || typeof input !== 'string') {
-            return {
-                isMalicious: false,
-                confidence: 0,
-                detectedPatterns: [],
-                riskLevel: 'LOW',
-            };
-        }
-        const result = {
-            isMalicious: false,
-            confidence: 0,
-            detectedPatterns: [],
-            sanitizedInput: input,
-            riskLevel: 'LOW',
-        };
-        // High-risk pattern detection
-        let highRiskScore = 0;
-        this.highRiskPatterns.forEach((pattern, index) => {
-            const matches = input.match(pattern);
-            if (matches) {
-                const patternName = this.getHighRiskPatternName(index);
-                result.detectedPatterns.push(`${patternName}: ${matches.join(', ')}`);
-                highRiskScore += this.getHighRiskWeight(index);
-            }
-        });
-        // Medium-risk pattern detection with context
-        let mediumRiskScore = 0;
-        if (this.config.contextualAnalysis && context) {
-            mediumRiskScore = this.analyzeContext(input, context);
-        }
-        else {
-            this.mediumRiskPatterns.forEach((pattern) => {
-                const matches = input.match(pattern);
-                if (matches) {
-                    mediumRiskScore += 0.1 * matches.length;
-                }
-            });
-        }
-        // Legitimacy checks
-        const legitimacyScore = this.calculateLegitimacyScore(input);
-        // Calculate final confidence
-        result.confidence = Math.max(0, highRiskScore + mediumRiskScore * 0.3 - legitimacyScore);
-        result.confidence = Math.min(result.confidence, 1.0);
-        // Determine risk level
-        if (result.confidence >= 0.9) {
-            result.riskLevel = 'CRITICAL';
-            result.isMalicious = true;
-        }
-        else if (result.confidence >= this.config.falsePositiveThreshold) {
-            result.riskLevel = 'HIGH';
-            result.isMalicious = true;
-        }
-        else if (result.confidence >= 0.4) {
-            result.riskLevel = 'MEDIUM';
-            result.isMalicious = false;
-        }
-        // Sanitize input
-        if (result.confidence >= 0.4) {
-            result.sanitizedInput = this.sanitizeInput(input);
-        }
-        // Log attempts
-        if (this.config.logAttempts && result.confidence >= 0.7) {
-            this.logAttempt(input, result);
-        }
-        return result;
-    }
-    /**
-     * Sanitize input by removing command injection sequences
-     */
-    sanitizeInput(input) {
-        let sanitized = input;
-        // Remove command chaining characters
-        sanitized = sanitized.replace(/[;&|`]/g, '');
-        // Remove command substitution
-        sanitized = sanitized.replace(/\$\(.*?\)/g, '');
-        // Remove backticks
-        sanitized = sanitized.replace(/`/g, '');
-        // Remove redirection operators
-        sanitized = sanitized.replace(/[<>]/g, '');
-        // Remove encoded newlines/tabs
-        sanitized = sanitized.replace(/%0a|%0d|%09/gi, '');
-        return sanitized.trim();
-    }
-    /**
-     * Analyze context to reduce false positives
-     */
-    analyzeContext(input, context) {
-        let score = 0;
-        // Check if this is a code/technical field where commands might be legitimate
-        const technicalContexts = ['code', 'script', 'command', 'terminal', 'shell'];
-        const isTechnicalContext = technicalContexts.some(ctx => context.fieldName?.toLowerCase().includes(ctx) ||
-            context.fieldType?.toLowerCase().includes(ctx));
-        this.mediumRiskPatterns.forEach((pattern, index) => {
-            const matches = input.match(pattern);
-            if (matches) {
-                let patternScore = 0.1 * matches.length;
-                // Reduce score for technical contexts
-                if (isTechnicalContext && index > 1) {
-                    patternScore *= 0.2; // Reduce by 80% for command names in technical fields
-                }
-                score += patternScore;
-            }
-        });
-        return score;
-    }
-    /**
-     * Calculate legitimacy score
-     */
-    calculateLegitimacyScore(input) {
-        let score = 0;
-        // Natural language indicators
-        const words = input.split(/\s+/);
-        if (words.length > 3 && words.every(w => /^[a-zA-Z]+$/.test(w))) {
-            score += 0.3; // Looks like natural text
-        }
-        // No shell metacharacters
-        if (!/[;&|`$()<>]/.test(input)) {
-            score += 0.2;
-        }
-        // Reasonable length for user input
-        if (input.length > 10 && input.length < 200) {
-            score += 0.1;
-        }
-        return Math.min(score, 0.5);
-    }
-    getHighRiskPatternName(index) {
-        const names = [
-            'Command chaining',
-            'Command substitution ($())',
-            'Backtick substitution',
-            'Pipe to shell',
-            'Redirection to system paths',
-            'Encoded injection',
-            'Dangerous system commands',
-            'Network commands',
-            'Eval/exec functions',
-        ];
-        return names[index] || `High-risk pattern ${index}`;
-    }
-    getHighRiskWeight(index) {
-        const weights = [0.9, 0.9, 0.9, 0.8, 0.7, 0.6, 0.9, 0.7, 0.9];
-        return weights[index] || 0.7;
-    }
-    logAttempt(input, result) {
-        console.warn('[CommandInjection] Attack detected:', {
-            timestamp: new Date().toISOString(),
-            input: input.substring(0, 100),
-            confidence: result.confidence,
-            patterns: result.detectedPatterns,
-        });
-    }
-    updateConfig(newConfig) {
-        this.config = { ...this.config, ...newConfig };
-    }
-    getConfig() {
-        return { ...this.config };
-    }
-}
-export default CommandInjectionDetector;
-//# sourceMappingURL=CommandInjectionDetector.js.map

package/dist/src/middleware/built-in/security/CommandInjectionDetector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"CommandInjectionDetector.js","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/CommandInjectionDetector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,wBAAwB;IA2C1B,YAAY,SAAiC,EAAE;QAxC/C,uCAAuC;QACtB,qBAAgB,GAAG;YAChC,mBAAmB;YACnB,0EAA0E;YAE1E,uBAAuB;YACvB,YAAY;YACZ,QAAQ;YAER,6BAA6B;YAC7B,uDAAuD;YAEvD,sCAAsC;YACtC,iCAAiC;YAEjC,4BAA4B;YAC5B,eAAe,EAAE,gCAAgC;YAEjD,4BAA4B;YAC5B,+CAA+C;YAE/C,mBAAmB;YACnB,2CAA2C;YAE3C,qBAAqB;YACrB,qDAAqD;SACxD,CAAC;QAEF,uBAAuB;QACN,uBAAkB,GAAG;YAClC,uBAAuB;YACvB,YAAY;YAEZ,wBAAwB;YACxB,OAAO;YAEP,kDAAkD;YAClD,8DAA8D;SACjE,CAAC;QAGE,IAAI,CAAC,MAAM,GAAG;YACV,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,GAAG;YAC5D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAC3C,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,EAAE;YAC7C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,IAAI;SACxD,CAAC;IACN,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAgC,EAAE,OAAqB;QAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO;gBACH,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,CAAC;gBACb,gBAAgB,EAAE,EAAE;gBACpB,SAAS,EAAE,KAAK;aACnB,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,CAAC;YACb,gBAAgB,EAAE,EAAE;YACpB,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,KAAK;SACnB,CAAC;QAEF,8BAA8B;QAC9B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtE,aAAa,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACnD,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,6CAA6C;QAC7C,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,OAAO,EAAE,CAAC;YAC5C,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBACxC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,OAAO,EAAE,CAAC;oBACV,eAAe,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC5C,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QAED,oBAAoB;QACpB,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAE7D,6BAA6B;QAC7B,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,eAAe,GAAG,GAAG,GAAG,eAAe,CAAC,CAAC;QACzF,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAErD,uBAAuB;QACvB,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC;YAC9B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YAC1B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC/B,CAAC;QAED,iBAAiB;QACjB,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAa;QAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,qCAAqC;QACrC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7C,8BAA8B;QAC9B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAEhD,mBAAmB;QACnB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAExC,+BAA+B;QAC/B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAE3C,+BAA+B;QAC/B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAEnD,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,KAAa,EAAE,OAAoB;QACtD,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,6EAA6E;QAC7E,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpD,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9C,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CACjD,CAAC;QAEF,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,OAAO,EAAE,CAAC;gBACV,IAAI,YAAY,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;gBAExC,sCAAsC;gBACtC,IAAI,kBAAkB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBAClC,YAAY,IAAI,GAAG,CAAC,CAAC,sDAAsD;gBAC/E,CAAC;gBAED,KAAK,IAAI,YAAY,CAAC;YAC1B,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,KAAa;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,8BAA8B;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,KAAK,IAAI,GAAG,CAAC,CAAC,0BAA0B;QAC5C,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,IAAI,GAAG,CAAC;QACjB,CAAC;QAED,mCAAmC;QACnC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,KAAK,IAAI,GAAG,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAEO,sBAAsB,CAAC,KAAa;QACxC,MAAM,KAAK,GAAG;YACV,kBAAkB;YAClB,4BAA4B;YAC5B,uBAAuB;YACvB,eAAe;YACf,6BAA6B;YAC7B,mBAAmB;YACnB,2BAA2B;YAC3B,kBAAkB;YAClB,qBAAqB;SACxB,CAAC;QACF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,qBAAqB,KAAK,EAAE,CAAC;IACxD,CAAC;IAEO,iBAAiB,CAAC,KAAa;QACnC,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;IACjC,CAAC;IAEO,UAAU,CAAC,KAAa,EAAE,MAA+B;QAC7D,OAAO,CAAC,IAAI,CAAC,qCAAqC,EAAE;YAChD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,gBAAgB;SACpC,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,SAA0C;QACnD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,SAAS;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC;CACJ;AAED,eAAe,wBAAwB,CAAC"}

package/dist/src/middleware/built-in/security/HoneypotTarpit.d.ts

@@ -1,204 +0,0 @@
-export declare class HoneypotTarpit {
-    /**
-     * Maximum accepted path length (bytes).
-     * Paths exceeding this length are treated as traps to neutralize buffer-probing
-     * attacks before any string processing occurs.
-     *
-     * @internal
-     */
-    private static readonly MAX_PATH_LENGTH;
-    /**
-     * High-confidence exact paths that are **never** legitimate in any modern
-     * web application. All entries are lowercase; comparison is performed against
-     * a lowercased, normalized path.
-     *
-     * Sources: OWASP Top-10 scanner payloads, Shodan query signatures,
-     * Nuclei template library, Metasploit auxiliary scanner modules.
-     *
-     * @internal
-     */
-    private static readonly EXACT_TRAPS;
-    /**
-     * Path prefixes whose entire subtree should be considered traps.
-     * A request for `/.git/logs/HEAD` is just as dangerous as one for `/.git/config`.
-     *
-     * Rules are matched with a trailing-slash anchor to avoid collisions
-     * (e.g. `/.gitignore` must **not** match the `/.git/` prefix rule).
-     *
-     * @internal
-     */
-    private static readonly PREFIX_TRAPS;
-    /**
-     * File extensions that are exclusively associated with scanner probes or
-     * sensitive file types that should **never** be served over HTTP in any
-     * legitimate modern application.
-     *
-     * Deliberately conservative — common extensions like `.php`, `.bak`, or
-     * `.log` are excluded because they *may* be intentionally served by some
-     * apps. Only zero-ambiguity extensions are listed here.
-     *
-     * @internal
-     */
-    private static readonly SUFFIX_TRAPS;
-    /**
-     * Discrete path segments (surrounded by `/` boundaries or at string edges)
-     * that indicate well-known scanner probes regardless of their position in
-     * the path hierarchy.
-     *
-     * Each entry is matched as a full segment to prevent substring collisions
-     * (e.g. `"admin"` must not trap `/admin-panel` but must trap `/api/admin`).
-     *
-     * @internal
-     */
-    private static readonly SEGMENT_TRAPS;
-    /**
-     * Determines whether a raw URI path matches any known honeypot trap signature.
-     *
-     * The method is intentionally **stateless and synchronous** to guarantee
-     * sub-millisecond latency even under high-volume scanner floods. It applies
-     * a four-stage pipeline internally (see module-level docs) and returns as
-     * soon as the first positive match is found.
-     *
-     * #### False-positive safeguards
-     * - Input is sanitized and validated before any rule is evaluated.
-     * - Path normalization resolves all encoding tricks before matching.
-     * - All rules are scoped to patterns that are unambiguously malicious.
-     * - Broad wildcard rules (e.g. "all `.php` files") are deliberately absent.
-     *
-     * @param {string} rawPath - The raw, un-normalized URI path from the incoming
-     *   request (e.g. `req.url` in Node.js `http.IncomingMessage`). Query strings
-     *   and fragments are accepted but stripped before evaluation.
-     * @returns {boolean} `true` if the path matches a trap and the request should
-     *   be handed to {@link handleTrap}; `false` if the path appears legitimate.
-     *
-     * @example
-     * ```typescript
-     * HoneypotTarpit.isTrap("/.env");                 // true
-     * HoneypotTarpit.isTrap("/.env%2elocal");         // true  (encoded bypass)
-     * HoneypotTarpit.isTrap("/api/v1/users");         // false
-     * HoneypotTarpit.isTrap("/assets/logo.png");      // false
-     * HoneypotTarpit.isTrap("/../.env");              // true  (traversal bypass)
-     * ```
-     */
-    static isTrap(rawPath: string): boolean;
-    /**
-     * Sends a minimal HTTP 403 Forbidden response and terminates the connection.
-     *
-     * The response is intentionally bare — no body, no `Content-Type`, no
-     * application-level headers — to minimize bandwidth consumption and avoid
-     * leaking server fingerprint information to the scanner.
-     *
-     * #### Why 403 and not a socket destroy?
-     * Destroying the raw socket (`req.socket.destroy()`) is tempting but unsafe
-     * when the Node.js process sits behind a reverse proxy (nginx, Caddy, HAProxy)
-     * or uses keep-alive connection pooling, because the socket may be shared
-     * across multiple logical HTTP requests. A 403 + `res.end()` correctly closes
-     * only the current HTTP transaction without disrupting the underlying TCP
-     * connection pool.
-     *
-     * @param {object} req - The raw incoming request object. Compatible with
-     *   `http.IncomingMessage`, `Http2ServerRequest`, and Fastify/Express
-     *   request wrappers. Not used directly but accepted for API symmetry and
-     *   future extensibility (e.g. logging, rate-limiting by IP).
-     * @param {object} res - The raw outgoing response object. Must expose
-     *   `writeHead(statusCode: number): void` and `end(): void`. Compatible
-     *   with `http.ServerResponse`, `Http2ServerResponse`, and most framework
-     *   response wrappers.
-     * @returns {void}
-     *
-     * @example
-     * ```typescript
-     * app.use((req, res, next) => {
-     *   if (HoneypotTarpit.isTrap(req.url)) {
-     *     return HoneypotTarpit.handleTrap(req, res);
-     *   }
-     *   next();
-     * });
-     * ```
-     */
-    static handleTrap(req: {
-        socket?: unknown;
-    }, res: {
-        writeHead?: (status: number) => void;
-        end?: () => void;
-    }): void;
-    /**
-     * Validates that the raw path is a non-empty string within the accepted
-     * length budget.
-     *
-     * Paths that fail this check (wrong type, empty, or suspiciously long) are
-     * themselves indicators of malicious probing and should be treated as traps
-     * by the caller.
-     *
-     * @param {unknown} value - The raw value received from the request object.
-     * @returns {boolean} `true` if the value is a safe, processable string;
-     *   `false` if it should be rejected immediately.
-     *
-     * @internal
-     */
-    private static sanitizeInput;
-    /**
-     * Layer 1 — Exact path match.
-     *
-     * Performs an O(1) `Set` lookup against {@link EXACT_TRAPS}. This is the
-     * most performant check and handles the vast majority of scanner probes,
-     * which tend to request well-known canonical paths verbatim.
-     *
-     * @param {string} normalizedPath - The fully normalized, lowercase path.
-     * @returns {boolean} `true` if the path is an exact trap match.
-     *
-     * @internal
-     */
-    private static matchesExactTrap;
-    /**
-     * Layer 2 — Directory prefix match.
-     *
-     * Tests whether the normalized path starts with any entry from
-     * {@link PREFIX_TRAPS}. This catches requests for any sub-resource within
-     * a sensitive directory (e.g. `/.git/logs/HEAD`, `/.ssh/known_hosts`).
-     *
-     * Each prefix entry is stored with a trailing `/` to prevent false positives
-     * from partial name collisions (e.g. `/.gitignore` must not match the
-     * `/.git/` prefix).
-     *
-     * @param {string} normalizedPath - The fully normalized, lowercase path.
-     * @returns {boolean} `true` if the path falls under a trapped directory.
-     *
-     * @internal
-     */
-    private static matchesPrefixTrap;
-    /**
-     * Layer 3 — File extension (suffix) match.
-     *
-     * Extracts the file extension from the final path segment and checks it
-     * against {@link SUFFIX_TRAPS}. Only the extension of the *filename* is
-     * considered; directory components are ignored to prevent collisions like
-     * `/certs-info/page` matching `.certs`.
-     *
-     * The comparison is performed on the already-lowercased normalized path,
-     * so no additional case folding is required here.
-     *
-     * @param {string} normalizedPath - The fully normalized, lowercase path.
-     * @returns {boolean} `true` if the file extension is a known trap extension.
-     *
-     * @internal
-     */
-    private static matchesSuffixTrap;
-    /**
-     * Layer 4 — Path segment match.
-     *
-     * Splits the normalized path into discrete segments and checks each one
-     * against {@link SEGMENT_TRAPS}. This catches scanner payloads embedded
-     * at arbitrary depths (e.g. `/api/v2/actuator`, `/proxy/wp-login.php`).
-     *
-     * Matching on full segments (rather than substrings) prevents false positives
-     * such as `/administration` matching a rule for `admin`.
-     *
-     * @param {string} normalizedPath - The fully normalized, lowercase path.
-     * @returns {boolean} `true` if any path segment matches a known trap segment.
-     *
-     * @internal
-     */
-    private static matchesSegmentTrap;
-}
-//# sourceMappingURL=HoneypotTarpit.d.ts.map

package/dist/src/middleware/built-in/security/HoneypotTarpit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"HoneypotTarpit.d.ts","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/HoneypotTarpit.ts"],"names":[],"mappings":"AAmEA,qBAAa,cAAc;IAKvB;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAQ;IAM/C;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAmIhC;IAMH;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAejC;IAMH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAcjC;IAMH;;;;;;;;;OASG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAalC;IAMH;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;WACW,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAiB9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;WACW,UAAU,CACpB,GAAG,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EACzB,GAAG,EAAE;QAAE,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;KAAE,GAChE,IAAI;IAkBP;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAY5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAShC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAUhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,MAAM,CAAC,kBAAkB;CASpC"}