xypriss 9.10.19 → 9.10.21

package/dist/src/middleware/built-in/security/PathTraversalDetector.d.ts

@@ -1,44 +0,0 @@
-/**
- * Path Traversal Detection Module
- *
- * Detects and prevents directory traversal attacks with intelligent
- * false positive avoidance for legitimate file paths
- */
-import { SecurityDetectionResult, SecurityModuleConfig, ContextInfo } from './types';
-interface PathTraversalConfig extends SecurityModuleConfig {
-    allowedPaths?: string[];
-    allowedExtensions?: string[];
-    maxDepth?: number;
-}
-declare class PathTraversalDetector {
-    private config;
-    private readonly highRiskPatterns;
-    private readonly mediumRiskPatterns;
-    constructor(config?: PathTraversalConfig);
-    /**
-     * Detect path traversal attempts
-     */
-    detect(path: string | null | undefined, context?: ContextInfo): SecurityDetectionResult;
-    /**
-     * Sanitize path by removing traversal sequences
-     */
-    private sanitizePath;
-    /**
-     * Check if path is in allowed paths
-     */
-    private isAllowedPath;
-    /**
-     * Calculate path depth
-     */
-    private calculatePathDepth;
-    /**
-     * Calculate legitimacy score
-     */
-    private calculateLegitimacyScore;
-    private getHighRiskPatternName;
-    private logAttempt;
-    updateConfig(newConfig: Partial<PathTraversalConfig>): void;
-    getConfig(): Required<PathTraversalConfig>;
-}
-export default PathTraversalDetector;
-//# sourceMappingURL=PathTraversalDetector.d.ts.map

package/dist/src/middleware/built-in/security/PathTraversalDetector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PathTraversalDetector.d.ts","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/PathTraversalDetector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAErF,UAAU,mBAAoB,SAAQ,oBAAoB;IACtD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,cAAM,qBAAqB;IACvB,OAAO,CAAC,MAAM,CAAgC;IAG9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAwB/B;IAGF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAYjC;gBAEU,MAAM,GAAE,mBAAwB;IAc5C;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,uBAAuB;IAkFvF;;OAEG;IACH,OAAO,CAAC,YAAY;IAwBpB;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAM1B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAyBhC,OAAO,CAAC,sBAAsB;IAc9B,OAAO,CAAC,UAAU;IASlB,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,IAAI;IAI3D,SAAS,IAAI,QAAQ,CAAC,mBAAmB,CAAC;CAG7C;AAED,eAAe,qBAAqB,CAAC"}

package/dist/src/middleware/built-in/security/PathTraversalDetector.js

@@ -1,209 +0,0 @@
-/**
- * Path Traversal Detection Module
- *
- * Detects and prevents directory traversal attacks with intelligent
- * false positive avoidance for legitimate file paths
- */
-class PathTraversalDetector {
-    constructor(config = {}) {
-        // High-risk path traversal patterns
-        this.highRiskPatterns = [
-            // Classic traversal with multiple levels
-            /(\.\.[\/\\]){2,}/g,
-            // URL encoded traversal
-            /(%2e%2e[\/\\]|%2e%2e%2f|%2e%2e%5c)/gi,
-            // Double URL encoded
-            /(%252e%252e[\/\\]|%252e%252e%252f)/gi,
-            // Unicode/UTF-8 encoded
-            /(\.\.%c0%af|\.\.%c1%9c)/gi,
-            // Null byte injection
-            /\.\.[\/\\].*%00/g,
-            // Absolute paths (Unix/Windows)
-            /^(\/|\\\\|[a-zA-Z]:\\)/,
-            // System directories
-            /(\/etc\/|\/proc\/|\/sys\/|\/dev\/|C:\\Windows\\|C:\\Program Files\\)/gi,
-            // Traversal with encoded slashes
-            /\.\.(%2f|%5c)/gi,
-        ];
-        // Medium-risk patterns (context-dependent)
-        this.mediumRiskPatterns = [
-            // Single parent directory reference
-            /\.\.[\/\\]/g,
-            // Hidden files (Unix)
-            /\/\.[^\/]+/g,
-            // Backup files
-            /\.(bak|backup|old|tmp|swp)$/gi,
-            // Config files
-            /\.(conf|config|ini|env)$/gi,
-        ];
-        this.config = {
-            enabled: config.enabled ?? true,
-            strictMode: config.strictMode ?? false,
-            logAttempts: config.logAttempts ?? true,
-            blockOnDetection: config.blockOnDetection ?? true,
-            falsePositiveThreshold: config.falsePositiveThreshold ?? 0.6,
-            customPatterns: config.customPatterns ?? [],
-            allowedPaths: config.allowedPaths ?? [],
-            allowedExtensions: config.allowedExtensions ?? ['.jpg', '.png', '.pdf', '.txt'],
-            maxDepth: config.maxDepth ?? 3,
-        };
-    }
-    /**
-     * Detect path traversal attempts
-     */
-    detect(path, context) {
-        if (!path || typeof path !== 'string') {
-            return {
-                isMalicious: false,
-                confidence: 0,
-                detectedPatterns: [],
-                riskLevel: 'LOW',
-            };
-        }
-        const result = {
-            isMalicious: false,
-            confidence: 0,
-            detectedPatterns: [],
-            sanitizedInput: path,
-            riskLevel: 'LOW',
-        };
-        // Check if path is in allowed paths
-        if (this.isAllowedPath(path)) {
-            return result;
-        }
-        // High-risk pattern detection
-        let highRiskScore = 0;
-        this.highRiskPatterns.forEach((pattern, index) => {
-            const matches = path.match(pattern);
-            if (matches) {
-                const patternName = this.getHighRiskPatternName(index);
-                result.detectedPatterns.push(`${patternName}: ${matches.join(', ')}`);
-                highRiskScore += 0.8;
-            }
-        });
-        // Medium-risk pattern detection
-        let mediumRiskScore = 0;
-        this.mediumRiskPatterns.forEach((pattern) => {
-            const matches = path.match(pattern);
-            if (matches) {
-                mediumRiskScore += 0.2 * matches.length;
-            }
-        });
-        // Calculate depth
-        const depth = this.calculatePathDepth(path);
-        if (depth > this.config.maxDepth) {
-            result.detectedPatterns.push(`Excessive depth: ${depth}`);
-            mediumRiskScore += 0.3;
-        }
-        // Legitimacy checks
-        const legitimacyScore = this.calculateLegitimacyScore(path);
-        // Calculate final confidence
-        result.confidence = Math.max(0, highRiskScore + mediumRiskScore * 0.4 - legitimacyScore);
-        result.confidence = Math.min(result.confidence, 1.0);
-        // Determine risk level
-        if (result.confidence >= 0.8) {
-            result.riskLevel = 'CRITICAL';
-            result.isMalicious = true;
-        }
-        else if (result.confidence >= this.config.falsePositiveThreshold) {
-            result.riskLevel = 'HIGH';
-            result.isMalicious = true;
-        }
-        else if (result.confidence >= 0.3) {
-            result.riskLevel = 'MEDIUM';
-            result.isMalicious = false;
-        }
-        // Sanitize path
-        if (result.confidence >= 0.3) {
-            result.sanitizedInput = this.sanitizePath(path);
-        }
-        // Log attempts
-        if (this.config.logAttempts && result.confidence >= 0.7) {
-            this.logAttempt(path, result);
-        }
-        return result;
-    }
-    /**
-     * Sanitize path by removing traversal sequences
-     */
-    sanitizePath(path) {
-        let sanitized = path;
-        // Remove all traversal sequences
-        sanitized = sanitized.replace(/\.\.[\/\\]/g, '');
-        // Remove URL encoded traversal
-        sanitized = sanitized.replace(/%2e%2e[\/\\%]/gi, '');
-        // Remove null bytes
-        sanitized = sanitized.replace(/%00/g, '');
-        // Normalize slashes
-        sanitized = sanitized.replace(/[\\]/g, '/');
-        // Remove duplicate slashes
-        sanitized = sanitized.replace(/\/+/g, '/');
-        // Remove leading slash if present
-        sanitized = sanitized.replace(/^\//, '');
-        return sanitized;
-    }
-    /**
-     * Check if path is in allowed paths
-     */
-    isAllowedPath(path) {
-        return this.config.allowedPaths.some(allowed => path.startsWith(allowed));
-    }
-    /**
-     * Calculate path depth
-     */
-    calculatePathDepth(path) {
-        const normalized = path.replace(/[\\]/g, '/');
-        const parts = normalized.split('/').filter(p => p && p !== '.');
-        return parts.length;
-    }
-    /**
-     * Calculate legitimacy score
-     */
-    calculateLegitimacyScore(path) {
-        let score = 0;
-        // Check for allowed extensions
-        const hasAllowedExt = this.config.allowedExtensions.some(ext => path.toLowerCase().endsWith(ext));
-        if (hasAllowedExt) {
-            score += 0.3;
-        }
-        // Simple filename pattern (no traversal)
-        if (/^[a-zA-Z0-9_\-\.]+$/.test(path)) {
-            score += 0.3;
-        }
-        // Reasonable path depth
-        const depth = this.calculatePathDepth(path);
-        if (depth <= 2) {
-            score += 0.2;
-        }
-        return Math.min(score, 0.5);
-    }
-    getHighRiskPatternName(index) {
-        const names = [
-            'Multiple traversal sequences',
-            'URL encoded traversal',
-            'Double URL encoded traversal',
-            'Unicode encoded traversal',
-            'Null byte injection',
-            'Absolute path',
-            'System directory access',
-            'Encoded slash traversal',
-        ];
-        return names[index] || `High-risk pattern ${index}`;
-    }
-    logAttempt(path, result) {
-        console.warn('[PathTraversal] Attack detected:', {
-            timestamp: new Date().toISOString(),
-            path: path.substring(0, 100),
-            confidence: result.confidence,
-            patterns: result.detectedPatterns,
-        });
-    }
-    updateConfig(newConfig) {
-        this.config = { ...this.config, ...newConfig };
-    }
-    getConfig() {
-        return { ...this.config };
-    }
-}
-export default PathTraversalDetector;
-//# sourceMappingURL=PathTraversalDetector.js.map

package/dist/src/middleware/built-in/security/PathTraversalDetector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PathTraversalDetector.js","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/PathTraversalDetector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,MAAM,qBAAqB;IA6CvB,YAAY,SAA8B,EAAE;QA1C5C,oCAAoC;QACnB,qBAAgB,GAAG;YAChC,yCAAyC;YACzC,mBAAmB;YAEnB,wBAAwB;YACxB,sCAAsC;YAEtC,qBAAqB;YACrB,sCAAsC;YAEtC,wBAAwB;YACxB,2BAA2B;YAE3B,sBAAsB;YACtB,kBAAkB;YAElB,gCAAgC;YAChC,wBAAwB;YAExB,qBAAqB;YACrB,wEAAwE;YAExE,iCAAiC;YACjC,iBAAiB;SACpB,CAAC;QAEF,2CAA2C;QAC1B,uBAAkB,GAAG;YAClC,oCAAoC;YACpC,aAAa;YAEb,sBAAsB;YACtB,aAAa;YAEb,eAAe;YACf,+BAA+B;YAE/B,eAAe;YACf,4BAA4B;SAC/B,CAAC;QAGE,IAAI,CAAC,MAAM,GAAG;YACV,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;YACtC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;YACjD,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,IAAI,GAAG;YAC5D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAC3C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/E,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;SACjC,CAAC;IACN,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAA+B,EAAE,OAAqB;QACzD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO;gBACH,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,CAAC;gBACb,gBAAgB,EAAE,EAAE;gBACpB,SAAS,EAAE,KAAK;aACnB,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAA4B;YACpC,WAAW,EAAE,KAAK;YAClB,UAAU,EAAE,CAAC;YACb,gBAAgB,EAAE,EAAE;YACpB,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,KAAK;SACnB,CAAC;QAEF,oCAAoC;QACpC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,8BAA8B;QAC9B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBACvD,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtE,aAAa,IAAI,GAAG,CAAC;YACzB,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,gCAAgC;QAChC,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACV,eAAe,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;YAC5C,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kBAAkB;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAC;YAC1D,eAAe,IAAI,GAAG,CAAC;QAC3B,CAAC;QAED,oBAAoB;QACpB,MAAM,eAAe,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAE5D,6BAA6B;QAC7B,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,eAAe,GAAG,GAAG,GAAG,eAAe,CAAC,CAAC;QACzF,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAErD,uBAAuB;QACvB,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC;YAC9B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YAC1B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC/B,CAAC;QAED,gBAAgB;QAChB,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,IAAY;QAC7B,IAAI,SAAS,GAAG,IAAI,CAAC;QAErB,iCAAiC;QACjC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAEjD,+BAA+B;QAC/B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAErD,oBAAoB;QACpB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE1C,oBAAoB;QACpB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE5C,2BAA2B;QAC3B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE3C,kCAAkC;QAClC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEzC,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAC3B,CAAC;IACN,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,IAAY;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,IAAY;QACzC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,+BAA+B;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3D,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CACnC,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,KAAK,IAAI,GAAG,CAAC;QACjB,CAAC;QAED,yCAAyC;QACzC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,IAAI,GAAG,CAAC;QACjB,CAAC;QAED,wBAAwB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACb,KAAK,IAAI,GAAG,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAEO,sBAAsB,CAAC,KAAa;QACxC,MAAM,KAAK,GAAG;YACV,8BAA8B;YAC9B,uBAAuB;YACvB,8BAA8B;YAC9B,2BAA2B;YAC3B,qBAAqB;YACrB,eAAe;YACf,yBAAyB;YACzB,yBAAyB;SAC5B,CAAC;QACF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,qBAAqB,KAAK,EAAE,CAAC;IACxD,CAAC;IAEO,UAAU,CAAC,IAAY,EAAE,MAA+B;QAC5D,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC7C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YAC5B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,gBAAgB;SACpC,CAAC,CAAC;IACP,CAAC;IAED,YAAY,CAAC,SAAuC;QAChD,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACnD,CAAC;IAED,SAAS;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC;CACJ;AAED,eAAe,qBAAqB,CAAC"}

package/dist/src/middleware/built-in/security/RequestSignatureProtector.d.ts

@@ -1,128 +0,0 @@
-/**
- * XyRS - XyPriss Request Signature Protector
- * Validates request signatures for API authentication
- * Uses a predefined header name with developer-configured secret value
- * Enhanced with robust validation and security measures
- */
-import { Logger } from "../../../shared/logger/Logger";
-import { RequestSignatureConfig } from "./types";
-export declare class RequestSignatureProtector {
-    private config;
-    private readonly HEADER_NAME;
-    private logger;
-    private failedAttempts;
-    private readonly SECRET_HASH;
-    private readonly CLEANUP_INTERVAL;
-    private cleanupTimer?;
-    constructor(options: RequestSignatureConfig, logger?: Logger);
-    /**
-     * Get the request signature middleware function
-     */
-    getMiddleware(): (req: any, res: any, next: any) => void;
-    /**
-     * Handle incoming request and validate signature
-     */
-    private handleRequest;
-    /**
-     * Extract client identifier for rate limiting (IP-based)
-     */
-    private extractClientIdentifier;
-    /**
-     * Sanitize client identifier
-     */
-    private sanitizeClientId;
-    /**
-     * Strictly extract signature header with no fallbacks
-     */
-    private extractSignatureHeader;
-    /**
-     * Validate header length to prevent DoS attacks
-     */
-    private validateHeaderLength;
-    /**
-     * Detect suspicious patterns in header value
-     */
-    private containsSuspiciousPatterns;
-    /**
-     * Process signature value based on configuration
-     */
-    private processSignatureValue;
-    /**
-     * Compare signatures with optional timing-safe comparison
-     */
-    private compareSignatures;
-    /**
-     * Timing-safe string comparison to prevent timing attacks
-     */
-    private timingSafeEqual;
-    /**
-     * Check if client is currently blocked due to failed attempts
-     */
-    private isClientBlocked;
-    /**
-     * Record failed authentication attempt
-     */
-    private recordFailedAttempt;
-    /**
-     * Clear failed attempts for a client
-     */
-    private clearFailedAttempts;
-    /**
-     * Validate secret meets security requirements
-     */
-    private validateSecret;
-    /**
-     * Detect weak/predictable secrets
-     */
-    private isWeakSecret;
-    /**
-     * Hash secret for internal verification
-     */
-    private hashSecret;
-    /**
-     * Start cleanup timer for failed attempts
-     */
-    private startCleanupTimer;
-    /**
-     * Clean up expired failed attempt records
-     */
-    private cleanupExpiredAttempts;
-    /**
-     * Block the request with appropriate error response
-     */
-    private blockRequest;
-    /**
-     * Log security events
-     */
-    private logSecurityEvent;
-    /**
-     * Update configuration with strict validation
-     */
-    updateConfig(newConfig: Partial<RequestSignatureConfig>): void;
-    /**
-     * Get current configuration (without exposing the secret)
-     */
-    getConfig(): Omit<RequestSignatureConfig, "secret"> & {
-        hasSecret: boolean;
-    };
-    /**
-     * Get the header name used for signatures
-     */
-    getHeaderName(): string;
-    /**
-     * Validate if a signature would be accepted (for testing)
-     */
-    validateSignature(signature: string): boolean;
-    /**
-     * Get statistics about failed attempts (for monitoring)
-     */
-    getSecurityStats(): {
-        trackedClients: number;
-        blockedClients: number;
-    };
-    /**
-     * Cleanup resources
-     */
-    destroy(): void;
-}
-//# sourceMappingURL=RequestSignatureProtector.d.ts.map

package/dist/src/middleware/built-in/security/RequestSignatureProtector.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RequestSignatureProtector.d.ts","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/RequestSignatureProtector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAEvD,OAAO,EAAiB,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAGhE,qBAAa,yBAAyB;IAClC,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,cAAc,CAAyC;IAC/D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,MAAM;IA4C5D;;OAEG;IACI,aAAa,UACH,GAAG,OAAO,GAAG,QAAQ,GAAG;IAKzC;;OAEG;IACH,OAAO,CAAC,aAAa;IAiGrB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAa/B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAQxB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAclC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAI7B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAgBzB;;OAEG;IACH,OAAO,CAAC,eAAe;IAoBvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgBvB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA6C3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAI3B;;OAEG;IACH,OAAO,CAAC,cAAc;IA+BtB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAMlB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAoB9B;;OAEG;IACH,OAAO,CAAC,YAAY;IA0CpB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;OAEG;IACI,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI;IAQrE;;OAEG;IACI,SAAS,IAAI,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,GAAG;QACzD,SAAS,EAAE,OAAO,CAAC;KACtB;IAmBD;;OAEG;IACI,aAAa,IAAI,MAAM;IAI9B;;OAEG;IACI,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAwBpD;;OAEG;IACI,gBAAgB,IAAI;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;KAC1B;IAgBD;;OAEG;IACI,OAAO,IAAI,IAAI;CAMzB"}