xypriss 9.10.19 → 9.10.21

package/dist/src/middleware/built-in/security/HoneypotTarpit.js

@@ -1,505 +0,0 @@
-/**
- * @module HoneypotTarpit
- * @version 2.0.0
- *
- * A hardened, zero-false-positive honeypot tarpit designed to instantly identify
- * and neutralize connections from malicious bots, vulnerability scanners, and
- * automated exploit frameworks (e.g. Shodan crawlers, Nuclei, WPScan, Metasploit).
- *
- * ### Architecture
- * Detection is performed in a layered pipeline, ordered from cheapest to most
- * specific, so the most common attacks are rejected at the very first check:
- *
- * ```
- * raw path
- *   │
- *   ▼
- * [1] sanitizeInput()       — rejects null / non-string / oversized paths
- *   │
- *   ▼
- * [2] normalizePath()       — decodes percent-encoding, collapses traversal
- *                             sequences, removes redundant slashes
- *   │
- *   ▼
- * [3] matchesExactTrap()    — O(1) Set lookup for highest-confidence paths
- *   │
- *   ▼
- * [4] matchesPrefixTrap()   — catches sub-paths under sensitive directories
- *   │
- *   ▼
- * [5] matchesSuffixTrap()   — catches files by dangerous extension
- *   │
- *   ▼
- * [6] matchesSegmentTrap()  — catches scanner-specific path segments
- *   │
- *   ▼
- * result → true (trap) | false (safe)
- * ```
- *
- * ### Design Principles
- * - **Zero false positives**: every rule targets patterns that are *never* used
- *   by legitimate production applications. Generic extensions like `.php` are
- *   intentionally excluded; only high-signal, context-specific signatures are used.
- * - **Bypass resistance**: the normalizer resolves URL encoding, path traversal
- *   (`../`), and duplicate slashes before any rule is evaluated.
- * - **O(1) hot path**: the most common scanner payloads hit a `Set` lookup and
- *   return immediately with no iteration cost.
- * - **No public surface expansion**: all detection helpers are `private static`,
- *   keeping the public API surface identical to v1.
- *
- * ### Security Benefits
- * - Bypasses all expensive application routing, regex matching, and payload parsing.
- * - Responds with a bare 403 before any middleware, session, or DB code runs.
- * - Saves server CPU and Node.js event-loop headroom under automated attack.
- *
- * @example
- * ```typescript
- * // Middleware usage (Express / Fastify raw handler)
- * app.use((req, res, next) => {
- *   if (HoneypotTarpit.isTrap(req.url)) {
- *     return HoneypotTarpit.handleTrap(req, res);
- *   }
- *   next();
- * });
- * ```
- */
-import { UriNormalizer } from "./UriNormalizer";
-export class HoneypotTarpit {
-    // ─────────────────────────────────────────────────────────────────────────
-    // Public API
-    // ─────────────────────────────────────────────────────────────────────────
-    /**
-     * Determines whether a raw URI path matches any known honeypot trap signature.
-     *
-     * The method is intentionally **stateless and synchronous** to guarantee
-     * sub-millisecond latency even under high-volume scanner floods. It applies
-     * a four-stage pipeline internally (see module-level docs) and returns as
-     * soon as the first positive match is found.
-     *
-     * #### False-positive safeguards
-     * - Input is sanitized and validated before any rule is evaluated.
-     * - Path normalization resolves all encoding tricks before matching.
-     * - All rules are scoped to patterns that are unambiguously malicious.
-     * - Broad wildcard rules (e.g. "all `.php` files") are deliberately absent.
-     *
-     * @param {string} rawPath - The raw, un-normalized URI path from the incoming
-     *   request (e.g. `req.url` in Node.js `http.IncomingMessage`). Query strings
-     *   and fragments are accepted but stripped before evaluation.
-     * @returns {boolean} `true` if the path matches a trap and the request should
-     *   be handed to {@link handleTrap}; `false` if the path appears legitimate.
-     *
-     * @example
-     * ```typescript
-     * HoneypotTarpit.isTrap("/.env");                 // true
-     * HoneypotTarpit.isTrap("/.env%2elocal");         // true  (encoded bypass)
-     * HoneypotTarpit.isTrap("/api/v1/users");         // false
-     * HoneypotTarpit.isTrap("/assets/logo.png");      // false
-     * HoneypotTarpit.isTrap("/../.env");              // true  (traversal bypass)
-     * ```
-     */
-    static isTrap(rawPath) {
-        if (!HoneypotTarpit.sanitizeInput(rawPath)) {
-            // Malformed or oversized paths are themselves a signal of probing.
-            return true;
-        }
-        const pathPart = rawPath.split(/[?#]/)[0];
-        const normalized = UriNormalizer.normalizePath(pathPart).toLowerCase();
-        return (HoneypotTarpit.matchesExactTrap(normalized) ||
-            HoneypotTarpit.matchesPrefixTrap(normalized) ||
-            HoneypotTarpit.matchesSuffixTrap(normalized) ||
-            HoneypotTarpit.matchesSegmentTrap(normalized));
-    }
-    /**
-     * Sends a minimal HTTP 403 Forbidden response and terminates the connection.
-     *
-     * The response is intentionally bare — no body, no `Content-Type`, no
-     * application-level headers — to minimize bandwidth consumption and avoid
-     * leaking server fingerprint information to the scanner.
-     *
-     * #### Why 403 and not a socket destroy?
-     * Destroying the raw socket (`req.socket.destroy()`) is tempting but unsafe
-     * when the Node.js process sits behind a reverse proxy (nginx, Caddy, HAProxy)
-     * or uses keep-alive connection pooling, because the socket may be shared
-     * across multiple logical HTTP requests. A 403 + `res.end()` correctly closes
-     * only the current HTTP transaction without disrupting the underlying TCP
-     * connection pool.
-     *
-     * @param {object} req - The raw incoming request object. Compatible with
-     *   `http.IncomingMessage`, `Http2ServerRequest`, and Fastify/Express
-     *   request wrappers. Not used directly but accepted for API symmetry and
-     *   future extensibility (e.g. logging, rate-limiting by IP).
-     * @param {object} res - The raw outgoing response object. Must expose
-     *   `writeHead(statusCode: number): void` and `end(): void`. Compatible
-     *   with `http.ServerResponse`, `Http2ServerResponse`, and most framework
-     *   response wrappers.
-     * @returns {void}
-     *
-     * @example
-     * ```typescript
-     * app.use((req, res, next) => {
-     *   if (HoneypotTarpit.isTrap(req.url)) {
-     *     return HoneypotTarpit.handleTrap(req, res);
-     *   }
-     *   next();
-     * });
-     * ```
-     */
-    static handleTrap(req, res) {
-        try {
-            if (typeof res.writeHead === "function") {
-                res.writeHead(403);
-            }
-            if (typeof res.end === "function") {
-                res.end();
-            }
-        }
-        catch {
-            // Failsafe: swallow all errors — the goal is merely to drop the
-            // connection. Any exception here means the socket is already gone.
-        }
-    }
-    // ─────────────────────────────────────────────────────────────────────────
-    // Private — Input Validation
-    // ─────────────────────────────────────────────────────────────────────────
-    /**
-     * Validates that the raw path is a non-empty string within the accepted
-     * length budget.
-     *
-     * Paths that fail this check (wrong type, empty, or suspiciously long) are
-     * themselves indicators of malicious probing and should be treated as traps
-     * by the caller.
-     *
-     * @param {unknown} value - The raw value received from the request object.
-     * @returns {boolean} `true` if the value is a safe, processable string;
-     *   `false` if it should be rejected immediately.
-     *
-     * @internal
-     */
-    static sanitizeInput(value) {
-        return (typeof value === "string" &&
-            value.length > 0 &&
-            value.length <= HoneypotTarpit.MAX_PATH_LENGTH);
-    }
-    // ─────────────────────────────────────────────────────────────────────────
-    // Private — Match Layers
-    // ─────────────────────────────────────────────────────────────────────────
-    /**
-     * Layer 1 — Exact path match.
-     *
-     * Performs an O(1) `Set` lookup against {@link EXACT_TRAPS}. This is the
-     * most performant check and handles the vast majority of scanner probes,
-     * which tend to request well-known canonical paths verbatim.
-     *
-     * @param {string} normalizedPath - The fully normalized, lowercase path.
-     * @returns {boolean} `true` if the path is an exact trap match.
-     *
-     * @internal
-     */
-    static matchesExactTrap(normalizedPath) {
-        return HoneypotTarpit.EXACT_TRAPS.has(normalizedPath);
-    }
-    /**
-     * Layer 2 — Directory prefix match.
-     *
-     * Tests whether the normalized path starts with any entry from
-     * {@link PREFIX_TRAPS}. This catches requests for any sub-resource within
-     * a sensitive directory (e.g. `/.git/logs/HEAD`, `/.ssh/known_hosts`).
-     *
-     * Each prefix entry is stored with a trailing `/` to prevent false positives
-     * from partial name collisions (e.g. `/.gitignore` must not match the
-     * `/.git/` prefix).
-     *
-     * @param {string} normalizedPath - The fully normalized, lowercase path.
-     * @returns {boolean} `true` if the path falls under a trapped directory.
-     *
-     * @internal
-     */
-    static matchesPrefixTrap(normalizedPath) {
-        for (const prefix of HoneypotTarpit.PREFIX_TRAPS) {
-            if (normalizedPath.startsWith(prefix)) {
-                return true;
-            }
-        }
-        return false;
-    }
-    /**
-     * Layer 3 — File extension (suffix) match.
-     *
-     * Extracts the file extension from the final path segment and checks it
-     * against {@link SUFFIX_TRAPS}. Only the extension of the *filename* is
-     * considered; directory components are ignored to prevent collisions like
-     * `/certs-info/page` matching `.certs`.
-     *
-     * The comparison is performed on the already-lowercased normalized path,
-     * so no additional case folding is required here.
-     *
-     * @param {string} normalizedPath - The fully normalized, lowercase path.
-     * @returns {boolean} `true` if the file extension is a known trap extension.
-     *
-     * @internal
-     */
-    static matchesSuffixTrap(normalizedPath) {
-        const lastSegment = normalizedPath.split("/").pop() ?? "";
-        const dotIndex = lastSegment.lastIndexOf(".");
-        if (dotIndex === -1) {
-            return false; // No extension present.
-        }
-        const extension = lastSegment.slice(dotIndex); // e.g. ".pem"
-        return HoneypotTarpit.SUFFIX_TRAPS.has(extension);
-    }
-    /**
-     * Layer 4 — Path segment match.
-     *
-     * Splits the normalized path into discrete segments and checks each one
-     * against {@link SEGMENT_TRAPS}. This catches scanner payloads embedded
-     * at arbitrary depths (e.g. `/api/v2/actuator`, `/proxy/wp-login.php`).
-     *
-     * Matching on full segments (rather than substrings) prevents false positives
-     * such as `/administration` matching a rule for `admin`.
-     *
-     * @param {string} normalizedPath - The fully normalized, lowercase path.
-     * @returns {boolean} `true` if any path segment matches a known trap segment.
-     *
-     * @internal
-     */
-    static matchesSegmentTrap(normalizedPath) {
-        const segments = normalizedPath.split("/").filter(Boolean);
-        for (const segment of segments) {
-            if (HoneypotTarpit.SEGMENT_TRAPS.has(segment)) {
-                return true;
-            }
-        }
-        return false;
-    }
-}
-// ─────────────────────────────────────────────────────────────────────────
-// Constants
-// ─────────────────────────────────────────────────────────────────────────
-/**
- * Maximum accepted path length (bytes).
- * Paths exceeding this length are treated as traps to neutralize buffer-probing
- * attacks before any string processing occurs.
- *
- * @internal
- */
-HoneypotTarpit.MAX_PATH_LENGTH = 2048;
-// ─────────────────────────────────────────────────────────────────────────
-// Trap Signatures — Exact Paths
-// ─────────────────────────────────────────────────────────────────────────
-/**
- * High-confidence exact paths that are **never** legitimate in any modern
- * web application. All entries are lowercase; comparison is performed against
- * a lowercased, normalized path.
- *
- * Sources: OWASP Top-10 scanner payloads, Shodan query signatures,
- * Nuclei template library, Metasploit auxiliary scanner modules.
- *
- * @internal
- */
-HoneypotTarpit.EXACT_TRAPS = new Set([
-    // ── Credentials & Secrets ─────────────────────────────────────────
-    "/.env",
-    "/.env.local",
-    "/.env.production",
-    "/.env.staging",
-    "/.env.development",
-    "/.env.test",
-    "/.env.backup",
-    "/.env.bak",
-    "/.env.old",
-    "/.env.orig",
-    "/.env.example", // may contain real secrets in misconfigured repos
-    "/.aws/credentials",
-    "/.aws/config",
-    "/.ssh/id_rsa",
-    "/.ssh/id_dsa",
-    "/.ssh/id_ecdsa",
-    "/.ssh/id_ed25519",
-    "/.ssh/authorized_keys",
-    "/.ssh/known_hosts",
-    "/.netrc",
-    "/.htpasswd",
-    "/.pgpass",
-    // ── Git / Version Control ─────────────────────────────────────────
-    "/.git",
-    "/.git/config",
-    "/.git/head",
-    "/.git/index",
-    "/.git/packed-refs",
-    "/.git/refs/heads/main",
-    "/.git/refs/heads/master",
-    "/.gitconfig",
-    "/.svn/entries",
-    "/.hg/hgrc",
-    // ── Cloud & Infrastructure Config ─────────────────────────────────
-    "/docker-compose.yml",
-    "/docker-compose.yaml",
-    "/.dockerenv",
-    "/dockerfile",
-    "/kubernetes.yml",
-    "/k8s.yml",
-    "/terraform.tfvars",
-    "/.terraform/terraform.tfstate",
-    // ── Application Config Files ──────────────────────────────────────
-    "/config.json",
-    "/config.yml",
-    "/config.yaml",
-    "/settings.json",
-    "/appsettings.json",
-    "/appsettings.production.json",
-    "/web.config",
-    "/app.config",
-    "/database.yml",
-    "/secrets.yml",
-    // ── Dependency & Build Artefacts ──────────────────────────────────
-    "/composer.lock",
-    "/composer.json",
-    "/package.json",
-    "/package-lock.json",
-    "/yarn.lock",
-    "/gemfile.lock",
-    "/pipfile.lock",
-    "/poetry.lock",
-    "/cargo.lock",
-    "/go.sum",
-    // ── IDE & Editor Files ────────────────────────────────────────────
-    "/.vscode/sftp.json",
-    "/.vscode/launch.json",
-    "/.idea/dataSources.xml",
-    "/.idea/workspace.xml",
-    // ── PHP / WordPress ───────────────────────────────────────────────
-    "/wp-login.php",
-    "/wp-admin",
-    "/wp-config.php",
-    "/wp-config.php.bak",
-    "/wp-config.php.orig",
-    "/wp-config.php.save",
-    "/wp-config-sample.php",
-    "/xmlrpc.php",
-    "/phpinfo.php",
-    "/php.ini",
-    "/php-fpm.conf",
-    // ── Spring Boot / Java Actuator ───────────────────────────────────
-    "/actuator",
-    "/actuator/env",
-    "/actuator/health",
-    "/actuator/info",
-    "/actuator/mappings",
-    "/actuator/beans",
-    "/actuator/configprops",
-    "/actuator/dump",
-    "/actuator/shutdown",
-    "/env", // standalone Spring env endpoint
-    "/heapdump",
-    "/trace",
-    // ── Common CMS / Admin Panels ─────────────────────────────────────
-    "/admin",
-    "/administrator",
-    "/phpmyadmin",
-    "/pma",
-    "/adminer",
-    "/adminer.php",
-    "/typo3",
-    "/joomla",
-    "/drupal",
-    "/magento",
-    "/manager/html", // Tomcat manager
-    // ── macOS / OS Artefacts ──────────────────────────────────────────
-    "/.ds_store",
-    "/thumbs.db",
-    "/desktop.ini",
-    // ── Backup & Dump Files ───────────────────────────────────────────
-    "/backup.sql",
-    "/dump.sql",
-    "/database.sql",
-    "/db.sql",
-    "/backup.zip",
-    "/backup.tar.gz",
-    "/www.zip",
-    "/site.tar.gz",
-]);
-// ─────────────────────────────────────────────────────────────────────────
-// Trap Signatures — Directory Prefixes
-// ─────────────────────────────────────────────────────────────────────────
-/**
- * Path prefixes whose entire subtree should be considered traps.
- * A request for `/.git/logs/HEAD` is just as dangerous as one for `/.git/config`.
- *
- * Rules are matched with a trailing-slash anchor to avoid collisions
- * (e.g. `/.gitignore` must **not** match the `/.git/` prefix rule).
- *
- * @internal
- */
-HoneypotTarpit.PREFIX_TRAPS = new Set([
-    "/.git/",
-    "/.svn/",
-    "/.hg/",
-    "/.ssh/",
-    "/.aws/",
-    "/.vscode/",
-    "/.idea/",
-    "/wp-includes/",
-    "/wp-content/plugins/",
-    "/wp-admin/",
-    "/actuator/",
-    "/proc/", // Linux /proc LFI attempts
-    "/etc/", // /etc/passwd, /etc/shadow LFI attempts
-    "/var/log/", // log file LFI
-]);
-// ─────────────────────────────────────────────────────────────────────────
-// Trap Signatures — File Extensions
-// ─────────────────────────────────────────────────────────────────────────
-/**
- * File extensions that are exclusively associated with scanner probes or
- * sensitive file types that should **never** be served over HTTP in any
- * legitimate modern application.
- *
- * Deliberately conservative — common extensions like `.php`, `.bak`, or
- * `.log` are excluded because they *may* be intentionally served by some
- * apps. Only zero-ambiguity extensions are listed here.
- *
- * @internal
- */
-HoneypotTarpit.SUFFIX_TRAPS = new Set([
-    ".pem", // TLS private keys / certificates
-    ".p12", // PKCS#12 keystores
-    ".pfx", // Personal Information Exchange (Windows keystore)
-    ".key", // Generic private keys
-    ".crt", // X.509 certificates (when accessed directly)
-    ".cer", // Alternative certificate extension
-    ".jks", // Java KeyStore
-    ".id_rsa", // SSH private key variants with compound extensions
-    ".htaccess", // Apache access control — never a user-facing resource
-    ".htpasswd", // Apache password file
-    ".DS_Store", // macOS metadata (case-normalised before comparison)
-    ".tfstate", // Terraform state (may contain secrets)
-    ".tfvars", // Terraform variable files (often contain secrets)
-]);
-// ─────────────────────────────────────────────────────────────────────────
-// Trap Signatures — Path Segments
-// ─────────────────────────────────────────────────────────────────────────
-/**
- * Discrete path segments (surrounded by `/` boundaries or at string edges)
- * that indicate well-known scanner probes regardless of their position in
- * the path hierarchy.
- *
- * Each entry is matched as a full segment to prevent substring collisions
- * (e.g. `"admin"` must not trap `/admin-panel` but must trap `/api/admin`).
- *
- * @internal
- */
-HoneypotTarpit.SEGMENT_TRAPS = new Set([
-    "phpmyadmin",
-    "pma",
-    "adminer",
-    "wp-login.php",
-    "xmlrpc.php",
-    "phpinfo.php",
-    ".env",
-    ".git",
-    ".svn",
-    ".hg",
-    "actuator",
-    "heapdump",
-]);
-//# sourceMappingURL=HoneypotTarpit.js.map

package/dist/src/middleware/built-in/security/HoneypotTarpit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"HoneypotTarpit.js","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/HoneypotTarpit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,OAAO,cAAc;IA2PvB,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,MAAM,CAAC,MAAM,CAAC,OAAe;QAChC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,mEAAmE;YACnE,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEvE,OAAO,CACH,cAAc,CAAC,gBAAgB,CAAC,UAAU,CAAC;YAC3C,cAAc,CAAC,iBAAiB,CAAC,UAAU,CAAC;YAC5C,cAAc,CAAC,iBAAiB,CAAC,UAAU,CAAC;YAC5C,cAAc,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAChD,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACI,MAAM,CAAC,UAAU,CACpB,GAAyB,EACzB,GAA+D;QAE/D,IAAI,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAChC,GAAG,CAAC,GAAG,EAAE,CAAC;YACd,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,gEAAgE;YAChE,mEAAmE;QACvE,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAE5E;;;;;;;;;;;;;OAaG;IACK,MAAM,CAAC,aAAa,CAAC,KAAc;QACvC,OAAO,CACH,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,eAAe,CACjD,CAAC;IACN,CAAC;IAED,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAE5E;;;;;;;;;;;OAWG;IACK,MAAM,CAAC,gBAAgB,CAAC,cAAsB;QAClD,OAAO,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,iBAAiB,CAAC,cAAsB;QACnD,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,iBAAiB,CAAC,cAAsB;QACnD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,CAAC,wBAAwB;QAC1C,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;QAC7D,OAAO,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,MAAM,CAAC,kBAAkB,CAAC,cAAsB;QACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;;AAxdD,4EAA4E;AAC5E,YAAY;AACZ,4EAA4E;AAE5E;;;;;;GAMG;AACqB,8BAAe,GAAG,IAAI,CAAC;AAE/C,4EAA4E;AAC5E,gCAAgC;AAChC,4EAA4E;AAE5E;;;;;;;;;GASG;AACqB,0BAAW,GAAG,IAAI,GAAG,CAAS;IAClD,qEAAqE;IACrE,OAAO;IACP,aAAa;IACb,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,cAAc;IACd,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe,EAAE,kDAAkD;IACnE,mBAAmB;IACnB,cAAc;IACd,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,SAAS;IACT,YAAY;IACZ,UAAU;IAEV,qEAAqE;IACrE,OAAO;IACP,cAAc;IACd,YAAY;IACZ,aAAa;IACb,mBAAmB;IACnB,uBAAuB;IACvB,yBAAyB;IACzB,aAAa;IACb,eAAe;IACf,WAAW;IAEX,qEAAqE;IACrE,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,UAAU;IACV,mBAAmB;IACnB,+BAA+B;IAE/B,qEAAqE;IACrE,cAAc;IACd,aAAa;IACb,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,8BAA8B;IAC9B,aAAa;IACb,aAAa;IACb,eAAe;IACf,cAAc;IAEd,qEAAqE;IACrE,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,oBAAoB;IACpB,YAAY;IACZ,eAAe;IACf,eAAe;IACf,cAAc;IACd,aAAa;IACb,SAAS;IAET,qEAAqE;IACrE,oBAAoB;IACpB,sBAAsB;IACtB,wBAAwB;IACxB,sBAAsB;IAEtB,qEAAqE;IACrE,eAAe;IACf,WAAW;IACX,gBAAgB;IAChB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,uBAAuB;IACvB,aAAa;IACb,cAAc;IACd,UAAU;IACV,eAAe;IAEf,qEAAqE;IACrE,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,oBAAoB;IACpB,iBAAiB;IACjB,uBAAuB;IACvB,gBAAgB;IAChB,oBAAoB;IACpB,MAAM,EAAE,iCAAiC;IACzC,WAAW;IACX,QAAQ;IAER,qEAAqE;IACrE,QAAQ;IACR,gBAAgB;IAChB,aAAa;IACb,MAAM;IACN,UAAU;IACV,cAAc;IACd,QAAQ;IACR,SAAS;IACT,SAAS;IACT,UAAU;IACV,eAAe,EAAE,iBAAiB;IAElC,qEAAqE;IACrE,YAAY;IACZ,YAAY;IACZ,cAAc;IAEd,qEAAqE;IACrE,aAAa;IACb,WAAW;IACX,eAAe;IACf,SAAS;IACT,aAAa;IACb,gBAAgB;IAChB,UAAU;IACV,cAAc;CACjB,CAAC,CAAC;AAEH,4EAA4E;AAC5E,uCAAuC;AACvC,4EAA4E;AAE5E;;;;;;;;GAQG;AACqB,2BAAY,GAAG,IAAI,GAAG,CAAS;IACnD,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,SAAS;IACT,eAAe;IACf,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,QAAQ,EAAE,2BAA2B;IACrC,OAAO,EAAE,wCAAwC;IACjD,WAAW,EAAE,eAAe;CAC/B,CAAC,CAAC;AAEH,4EAA4E;AAC5E,oCAAoC;AACpC,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACqB,2BAAY,GAAG,IAAI,GAAG,CAAS;IACnD,MAAM,EAAE,kCAAkC;IAC1C,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,mDAAmD;IAC3D,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,8CAA8C;IACtD,MAAM,EAAE,oCAAoC;IAC5C,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,oDAAoD;IAC/D,WAAW,EAAE,uDAAuD;IACpE,WAAW,EAAE,uBAAuB;IACpC,WAAW,EAAE,qDAAqD;IAClE,UAAU,EAAE,wCAAwC;IACpD,SAAS,EAAE,mDAAmD;CACjE,CAAC,CAAC;AAEH,4EAA4E;AAC5E,kCAAkC;AAClC,4EAA4E;AAE5E;;;;;;;;;GASG;AACqB,4BAAa,GAAG,IAAI,GAAG,CAAS;IACpD,YAAY;IACZ,KAAK;IACL,SAAS;IACT,cAAc;IACd,YAAY;IACZ,aAAa;IACb,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,UAAU;IACV,UAAU;CACb,CAAC,CAAC"}

package/dist/src/middleware/built-in/security/LDAPInjectionDetector.d.ts

@@ -1,17 +0,0 @@
-/**
- * LDAP Injection Detection Module
- *
- * Detects and prevents LDAP injection attacks
- */
-import { SecurityDetectionResult, SecurityModuleConfig } from './types';
-declare class LDAPInjectionDetector {
-    private config;
-    private readonly injectionPatterns;
-    constructor(config?: SecurityModuleConfig);
-    detect(input: string | null | undefined): SecurityDetectionResult;
-    private sanitize;
-    updateConfig(newConfig: Partial<SecurityModuleConfig>): void;
-    getConfig(): Required<SecurityModuleConfig>;
-}
-export default LDAPInjectionDetector;
-//# sourceMappingURL=LDAPInjectionDetector.d.ts.map

package/dist/src/middleware/built-in/security/LDAPInjectionDetector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"LDAPInjectionDetector.d.ts","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/LDAPInjectionDetector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAExE,cAAM,qBAAqB;IACvB,OAAO,CAAC,MAAM,CAAiC;IAG/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAgBhC;gBAEU,MAAM,GAAE,oBAAyB;IAW7C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,uBAAuB;IAoDjE,OAAO,CAAC,QAAQ;IAUhB,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,IAAI;IAI5D,SAAS,IAAI,QAAQ,CAAC,oBAAoB,CAAC;CAG9C;AAED,eAAe,qBAAqB,CAAC"}

package/dist/src/middleware/built-in/security/LDAPInjectionDetector.js

@@ -1,93 +0,0 @@
-/**
- * LDAP Injection Detection Module
- *
- * Detects and prevents LDAP injection attacks
- */
-class LDAPInjectionDetector {
-    constructor(config = {}) {
-        // LDAP injection patterns
-        this.injectionPatterns = [
-            // LDAP filter metacharacters
-            /[*()\\|&]/g,
-            // Null byte
-            /\x00/g,
-            // LDAP filter injection attempts
-            /\)\s*\(\s*\|/gi, // )( | pattern
-            /\)\s*\(\s*&/gi, // )( & pattern
-            // Wildcard abuse
-            /\*{2,}/g,
-            // DN injection
-            /,\s*(cn|ou|dc|o)=/gi,
-        ];
-        this.config = {
-            enabled: config.enabled ?? true,
-            strictMode: config.strictMode ?? false,
-            logAttempts: config.logAttempts ?? true,
-            blockOnDetection: config.blockOnDetection ?? true,
-            falsePositiveThreshold: config.falsePositiveThreshold ?? 0.6,
-            customPatterns: config.customPatterns ?? [],
-        };
-    }
-    detect(input) {
-        if (!input || typeof input !== 'string') {
-            return {
-                isMalicious: false,
-                confidence: 0,
-                detectedPatterns: [],
-                riskLevel: 'LOW',
-            };
-        }
-        const result = {
-            isMalicious: false,
-            confidence: 0,
-            detectedPatterns: [],
-            sanitizedInput: input,
-            riskLevel: 'LOW',
-        };
-        let riskScore = 0;
-        this.injectionPatterns.forEach((pattern, index) => {
-            const matches = input.match(pattern);
-            if (matches) {
-                result.detectedPatterns.push(`LDAP metacharacter: ${matches.join(', ')}`);
-                riskScore += 0.3 * matches.length;
-            }
-        });
-        result.confidence = Math.min(riskScore, 1.0);
-        if (result.confidence >= 0.7) {
-            result.riskLevel = 'HIGH';
-            result.isMalicious = true;
-        }
-        else if (result.confidence >= this.config.falsePositiveThreshold) {
-            result.riskLevel = 'MEDIUM';
-            result.isMalicious = this.config.strictMode;
-        }
-        if (result.confidence >= 0.3) {
-            result.sanitizedInput = this.sanitize(input);
-        }
-        if (this.config.logAttempts && result.confidence >= 0.6) {
-            console.warn('[LDAP] Injection attempt detected:', {
-                timestamp: new Date().toISOString(),
-                input: input.substring(0, 100),
-                confidence: result.confidence,
-            });
-        }
-        return result;
-    }
-    sanitize(input) {
-        // Escape LDAP special characters
-        return input
-            .replace(/\\/g, '\\5c')
-            .replace(/\*/g, '\\2a')
-            .replace(/\(/g, '\\28')
-            .replace(/\)/g, '\\29')
-            .replace(/\x00/g, '\\00');
-    }
-    updateConfig(newConfig) {
-        this.config = { ...this.config, ...newConfig };
-    }
-    getConfig() {
-        return { ...this.config };
-    }
-}
-export default LDAPInjectionDetector;
-//# sourceMappingURL=LDAPInjectionDetector.js.map

package/dist/src/middleware/built-in/security/LDAPInjectionDetector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"LDAPInjectionDetector.js","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/LDAPInjectionDetector.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,qBAAqB;IAsBvB,YAAY,SAA+B,EAAE;QAnB7C,0BAA0B;QACT,sBAAiB,GAAG;YACjC,6BAA6B;YAC7B,YAAY;YAEZ,YAAY;YACZ,OAAO;YAEP,iCAAiC;YACjC,gBAAgB,EAAE,eAAe;YACjC,eAAe,EAAE,eAAe;YAEhC,iBAAiB;YACjB,SAAS;YAET,eAAe;YACf,qBAAqB;SACxB,CAAC;QAGE,IAAI,CAAC,MAAM,GAAG;YACV,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,GAAG;YAC5D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SAC9C,CAAC;IACN,CAAC;IAED,MAAM,CAAC,KAAgC;QACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO;gBACH,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,CAAC;gBACb,gBAAgB,EAAE,EAAE;gBACpB,SAAS,EAAE,KAAK;aACnB,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,CAAC;YACb,gBAAgB,EAAE,EAAE;YACpB,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,KAAK;SACnB,CAAC;QAEF,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1E,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;YACtC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE7C,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YAC1B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAChD,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;aAChC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC1B,iCAAiC;QACjC,OAAO,KAAK;aACP,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACtB,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,SAAwC;QACjD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,SAAS;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC;CACJ;AAED,eAAe,qBAAqB,CAAC"}