xypriss 9.11.13 → 9.12.0

package/dist/src/middleware/built-in/security/HoneypotTarpit.js

@@ -0,0 +1,551 @@
+/**
+ * @module HoneypotTarpit
+ * @version 2.0.0
+ *
+ * A hardened, zero-false-positive honeypot tarpit designed to instantly identify
+ * and neutralize connections from malicious bots, vulnerability scanners, and
+ * automated exploit frameworks (e.g. Shodan crawlers, Nuclei, WPScan, Metasploit).
+ *
+ * ### Architecture
+ * Detection is performed in a layered pipeline, ordered from cheapest to most
+ * specific, so the most common attacks are rejected at the very first check:
+ *
+ * ```
+ * raw path
+ *   │
+ *   ▼
+ * [1] sanitizeInput()       — rejects null / non-string / oversized paths
+ *   │
+ *   ▼
+ * [2] normalizePath()       — decodes percent-encoding, collapses traversal
+ *                             sequences, removes redundant slashes
+ *   │
+ *   ▼
+ * [3] matchesExactTrap()    — O(1) Set lookup for highest-confidence paths
+ *   │
+ *   ▼
+ * [4] matchesPrefixTrap()   — catches sub-paths under sensitive directories
+ *   │
+ *   ▼
+ * [5] matchesSuffixTrap()   — catches files by dangerous extension
+ *   │
+ *   ▼
+ * [6] matchesSegmentTrap()  — catches scanner-specific path segments
+ *   │
+ *   ▼
+ * result → true (trap) | false (safe)
+ * ```
+ *
+ * ### Design Principles
+ * - **Zero false positives**: every rule targets patterns that are *never* used
+ *   by legitimate production applications. Generic extensions like `.php` are
+ *   intentionally excluded; only high-signal, context-specific signatures are used.
+ * - **Bypass resistance**: the normalizer resolves URL encoding, path traversal
+ *   (`../`), and duplicate slashes before any rule is evaluated.
+ * - **O(1) hot path**: the most common scanner payloads hit a `Set` lookup and
+ *   return immediately with no iteration cost.
+ * - **No public surface expansion**: all detection helpers are `private static`,
+ *   keeping the public API surface identical to v1.
+ *
+ * ### Security Benefits
+ * - Bypasses all expensive application routing, regex matching, and payload parsing.
+ * - Responds with a bare 403 before any middleware, session, or DB code runs.
+ * - Saves server CPU and Node.js event-loop headroom under automated attack.
+ *
+ * @example
+ * ```typescript
+ * // Middleware usage (Express / Fastify raw handler)
+ * app.use((req, res, next) => {
+ *   if (HoneypotTarpit.isTrap(req.url)) {
+ *     return HoneypotTarpit.handleTrap(req, res);
+ *   }
+ *   next();
+ * });
+ * ```
+ */
+import { UriNormalizer } from "./UriNormalizer";
+export class HoneypotTarpit {
+    /**
+     * Registers custom trap patterns to expand the honeypot surface.
+     *
+     * @param {object} custom - Object containing custom patterns to trap.
+     */
+    static registerCustomTraps(custom) {
+        if (custom.exact)
+            custom.exact.forEach(p => this.CUSTOM_EXACT_TRAPS.add(p.toLowerCase()));
+        if (custom.prefixes)
+            custom.prefixes.forEach(p => this.CUSTOM_PREFIX_TRAPS.add(p.toLowerCase()));
+        if (custom.suffixes)
+            custom.suffixes.forEach(p => this.CUSTOM_SUFFIX_TRAPS.add(p.toLowerCase()));
+        if (custom.segments)
+            custom.segments.forEach(p => this.CUSTOM_SEGMENT_TRAPS.add(p.toLowerCase()));
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Public API
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Determines whether a raw URI path matches any known honeypot trap signature.
+     *
+     * The method is intentionally **stateless and synchronous** to guarantee
+     * sub-millisecond latency even under high-volume scanner floods. It applies
+     * a four-stage pipeline internally (see module-level docs) and returns as
+     * soon as the first positive match is found.
+     *
+     * #### False-positive safeguards
+     * - Input is sanitized and validated before any rule is evaluated.
+     * - Path normalization resolves all encoding tricks before matching.
+     * - All rules are scoped to patterns that are unambiguously malicious.
+     * - Broad wildcard rules (e.g. "all `.php` files") are deliberately absent.
+     *
+     * @param {string} rawPath - The raw, un-normalized URI path from the incoming
+     *   request (e.g. `req.url` in Node.js `http.IncomingMessage`). Query strings
+     *   and fragments are accepted but stripped before evaluation.
+     * @returns {boolean} `true` if the path matches a trap and the request should
+     *   be handed to {@link handleTrap}; `false` if the path appears legitimate.
+     *
+     * @example
+     * ```typescript
+     * HoneypotTarpit.isTrap("/.env");                 // true
+     * HoneypotTarpit.isTrap("/.env%2elocal");         // true  (encoded bypass)
+     * HoneypotTarpit.isTrap("/api/v1/users");         // false
+     * HoneypotTarpit.isTrap("/assets/logo.png");      // false
+     * HoneypotTarpit.isTrap("/../.env");              // true  (traversal bypass)
+     * ```
+     */
+    static isTrap(rawPath) {
+        if (!HoneypotTarpit.sanitizeInput(rawPath)) {
+            // Malformed or oversized paths are themselves a signal of probing.
+            return true;
+        }
+        const pathPart = rawPath.split(/[?#]/)[0];
+        const normalized = UriNormalizer.normalizePath(pathPart).toLowerCase();
+        return (HoneypotTarpit.matchesExactTrap(normalized) ||
+            HoneypotTarpit.matchesPrefixTrap(normalized) ||
+            HoneypotTarpit.matchesSuffixTrap(normalized) ||
+            HoneypotTarpit.matchesSegmentTrap(normalized) ||
+            HoneypotTarpit.CUSTOM_EXACT_TRAPS.has(normalized) ||
+            HoneypotTarpit.matchesCustomPrefix(normalized) ||
+            HoneypotTarpit.matchesCustomSuffix(normalized) ||
+            HoneypotTarpit.matchesCustomSegment(normalized));
+    }
+    static matchesCustomPrefix(path) {
+        for (const p of this.CUSTOM_PREFIX_TRAPS)
+            if (path.startsWith(p))
+                return true;
+        return false;
+    }
+    static matchesCustomSuffix(path) {
+        const last = path.split("/").pop() ?? "";
+        for (const s of this.CUSTOM_SUFFIX_TRAPS)
+            if (last.endsWith(s))
+                return true;
+        return false;
+    }
+    static matchesCustomSegment(path) {
+        const segments = path.split("/").filter(Boolean);
+        for (const s of segments)
+            if (this.CUSTOM_SEGMENT_TRAPS.has(s))
+                return true;
+        return false;
+    }
+    /**
+     * Sends a minimal HTTP 403 Forbidden response and terminates the connection.
+     *
+     * The response is intentionally bare — no body, no `Content-Type`, no
+     * application-level headers — to minimize bandwidth consumption and avoid
+     * leaking server fingerprint information to the scanner.
+     *
+     * #### Why 403 and not a socket destroy?
+     * Destroying the raw socket (`req.socket.destroy()`) is tempting but unsafe
+     * when the Node.js process sits behind a reverse proxy (nginx, Caddy, HAProxy)
+     * or uses keep-alive connection pooling, because the socket may be shared
+     * across multiple logical HTTP requests. A 403 + `res.end()` correctly closes
+     * only the current HTTP transaction without disrupting the underlying TCP
+     * connection pool.
+     *
+     * @param {object} req - The raw incoming request object. Compatible with
+     *   `http.IncomingMessage`, `Http2ServerRequest`, and Fastify/Express
+     *   request wrappers. Not used directly but accepted for API symmetry and
+     *   future extensibility (e.g. logging, rate-limiting by IP).
+     * @param {object} res - The raw outgoing response object. Must expose
+     *   `writeHead(statusCode: number): void` and `end(): void`. Compatible
+     *   with `http.ServerResponse`, `Http2ServerResponse`, and most framework
+     *   response wrappers.
+     * @returns {void}
+     *
+     * @example
+     * ```typescript
+     * app.use((req, res, next) => {
+     *   if (HoneypotTarpit.isTrap(req.url)) {
+     *     return HoneypotTarpit.handleTrap(req, res);
+     *   }
+     *   next();
+     * });
+     * ```
+     */
+    static handleTrap(req, res) {
+        try {
+            if (typeof res.writeHead === "function") {
+                res.writeHead(403);
+            }
+            if (typeof res.end === "function") {
+                res.end();
+            }
+        }
+        catch {
+            // Failsafe: swallow all errors — the goal is merely to drop the
+            // connection. Any exception here means the socket is already gone.
+        }
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Private — Input Validation
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Validates that the raw path is a non-empty string within the accepted
+     * length budget.
+     *
+     * Paths that fail this check (wrong type, empty, or suspiciously long) are
+     * themselves indicators of malicious probing and should be treated as traps
+     * by the caller.
+     *
+     * @param {unknown} value - The raw value received from the request object.
+     * @returns {boolean} `true` if the value is a safe, processable string;
+     *   `false` if it should be rejected immediately.
+     *
+     * @internal
+     */
+    static sanitizeInput(value) {
+        return (typeof value === "string" &&
+            value.length > 0 &&
+            value.length <= HoneypotTarpit.MAX_PATH_LENGTH);
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Private — Match Layers
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Layer 1 — Exact path match.
+     *
+     * Performs an O(1) `Set` lookup against {@link EXACT_TRAPS}. This is the
+     * most performant check and handles the vast majority of scanner probes,
+     * which tend to request well-known canonical paths verbatim.
+     *
+     * @param {string} normalizedPath - The fully normalized, lowercase path.
+     * @returns {boolean} `true` if the path is an exact trap match.
+     *
+     * @internal
+     */
+    static matchesExactTrap(normalizedPath) {
+        return HoneypotTarpit.EXACT_TRAPS.has(normalizedPath);
+    }
+    /**
+     * Layer 2 — Directory prefix match.
+     *
+     * Tests whether the normalized path starts with any entry from
+     * {@link PREFIX_TRAPS}. This catches requests for any sub-resource within
+     * a sensitive directory (e.g. `/.git/logs/HEAD`, `/.ssh/known_hosts`).
+     *
+     * Each prefix entry is stored with a trailing `/` to prevent false positives
+     * from partial name collisions (e.g. `/.gitignore` must not match the
+     * `/.git/` prefix).
+     *
+     * @param {string} normalizedPath - The fully normalized, lowercase path.
+     * @returns {boolean} `true` if the path falls under a trapped directory.
+     *
+     * @internal
+     */
+    static matchesPrefixTrap(normalizedPath) {
+        for (const prefix of HoneypotTarpit.PREFIX_TRAPS) {
+            if (normalizedPath.startsWith(prefix)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Layer 3 — File extension (suffix) match.
+     *
+     * Extracts the file extension from the final path segment and checks it
+     * against {@link SUFFIX_TRAPS}. Only the extension of the *filename* is
+     * considered; directory components are ignored to prevent collisions like
+     * `/certs-info/page` matching `.certs`.
+     *
+     * The comparison is performed on the already-lowercased normalized path,
+     * so no additional case folding is required here.
+     *
+     * @param {string} normalizedPath - The fully normalized, lowercase path.
+     * @returns {boolean} `true` if the file extension is a known trap extension.
+     *
+     * @internal
+     */
+    static matchesSuffixTrap(normalizedPath) {
+        const lastSegment = normalizedPath.split("/").pop() ?? "";
+        const dotIndex = lastSegment.lastIndexOf(".");
+        if (dotIndex === -1) {
+            return false; // No extension present.
+        }
+        const extension = lastSegment.slice(dotIndex); // e.g. ".pem"
+        return HoneypotTarpit.SUFFIX_TRAPS.has(extension);
+    }
+    /**
+     * Layer 4 — Path segment match.
+     *
+     * Splits the normalized path into discrete segments and checks each one
+     * against {@link SEGMENT_TRAPS}. This catches scanner payloads embedded
+     * at arbitrary depths (e.g. `/api/v2/actuator`, `/proxy/wp-login.php`).
+     *
+     * Matching on full segments (rather than substrings) prevents false positives
+     * such as `/administration` matching a rule for `admin`.
+     *
+     * @param {string} normalizedPath - The fully normalized, lowercase path.
+     * @returns {boolean} `true` if any path segment matches a known trap segment.
+     *
+     * @internal
+     */
+    static matchesSegmentTrap(normalizedPath) {
+        const segments = normalizedPath.split("/").filter(Boolean);
+        for (const segment of segments) {
+            if (HoneypotTarpit.SEGMENT_TRAPS.has(segment)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Constants
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Maximum accepted path length (bytes).
+ * Paths exceeding this length are treated as traps to neutralize buffer-probing
+ * attacks before any string processing occurs.
+ *
+ * @internal
+ */
+HoneypotTarpit.MAX_PATH_LENGTH = 2048;
+// ─────────────────────────────────────────────────────────────────────────
+// Trap Signatures — Exact Paths
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * High-confidence exact paths that are **never** legitimate in any modern
+ * web application. All entries are lowercase; comparison is performed against
+ * a lowercased, normalized path.
+ *
+ * Sources: OWASP Top-10 scanner payloads, Shodan query signatures,
+ * Nuclei template library, Metasploit auxiliary scanner modules.
+ *
+ * @internal
+ */
+HoneypotTarpit.EXACT_TRAPS = new Set([
+    // ── Credentials & Secrets ─────────────────────────────────────────
+    "/.env",
+    "/.env.local",
+    "/.env.production",
+    "/.env.staging",
+    "/.env.development",
+    "/.env.test",
+    "/.env.backup",
+    "/.env.bak",
+    "/.env.old",
+    "/.env.orig",
+    "/.env.example", // may contain real secrets in misconfigured repos
+    "/.aws/credentials",
+    "/.aws/config",
+    "/.ssh/id_rsa",
+    "/.ssh/id_dsa",
+    "/.ssh/id_ecdsa",
+    "/.ssh/id_ed25519",
+    "/.ssh/authorized_keys",
+    "/.ssh/known_hosts",
+    "/.netrc",
+    "/.htpasswd",
+    "/.pgpass",
+    // ── Git / Version Control ─────────────────────────────────────────
+    "/.git",
+    "/.git/config",
+    "/.git/head",
+    "/.git/index",
+    "/.git/packed-refs",
+    "/.git/refs/heads/main",
+    "/.git/refs/heads/master",
+    "/.gitconfig",
+    "/.svn/entries",
+    "/.hg/hgrc",
+    // ── Cloud & Infrastructure Config ─────────────────────────────────
+    "/docker-compose.yml",
+    "/docker-compose.yaml",
+    "/.dockerenv",
+    "/dockerfile",
+    "/kubernetes.yml",
+    "/k8s.yml",
+    "/terraform.tfvars",
+    "/.terraform/terraform.tfstate",
+    // ── Application Config Files ──────────────────────────────────────
+    "/config.json",
+    "/config.yml",
+    "/config.yaml",
+    "/settings.json",
+    "/appsettings.json",
+    "/appsettings.production.json",
+    "/web.config",
+    "/app.config",
+    "/database.yml",
+    "/secrets.yml",
+    // ── Dependency & Build Artefacts ──────────────────────────────────
+    "/composer.lock",
+    "/composer.json",
+    "/package.json",
+    "/package-lock.json",
+    "/yarn.lock",
+    "/gemfile.lock",
+    "/pipfile.lock",
+    "/poetry.lock",
+    "/cargo.lock",
+    "/go.sum",
+    // ── IDE & Editor Files ────────────────────────────────────────────
+    "/.vscode/sftp.json",
+    "/.vscode/launch.json",
+    "/.idea/dataSources.xml",
+    "/.idea/workspace.xml",
+    // ── PHP / WordPress ───────────────────────────────────────────────
+    "/wp-login.php",
+    "/wp-admin",
+    "/wp-config.php",
+    "/wp-config.php.bak",
+    "/wp-config.php.orig",
+    "/wp-config.php.save",
+    "/wp-config-sample.php",
+    "/xmlrpc.php",
+    "/phpinfo.php",
+    "/php.ini",
+    "/php-fpm.conf",
+    // ── Spring Boot / Java Actuator ───────────────────────────────────
+    "/actuator",
+    "/actuator/env",
+    "/actuator/health",
+    "/actuator/info",
+    "/actuator/mappings",
+    "/actuator/beans",
+    "/actuator/configprops",
+    "/actuator/dump",
+    "/actuator/shutdown",
+    "/env", // standalone Spring env endpoint
+    "/heapdump",
+    "/trace",
+    // ── Common CMS / Admin Panels ─────────────────────────────────────
+    "/admin",
+    "/administrator",
+    "/phpmyadmin",
+    "/pma",
+    "/adminer",
+    "/adminer.php",
+    "/typo3",
+    "/joomla",
+    "/drupal",
+    "/magento",
+    "/manager/html", // Tomcat manager
+    // ── macOS / OS Artefacts ──────────────────────────────────────────
+    "/.ds_store",
+    "/thumbs.db",
+    "/desktop.ini",
+    // ── Backup & Dump Files ───────────────────────────────────────────
+    "/backup.sql",
+    "/dump.sql",
+    "/database.sql",
+    "/db.sql",
+    "/backup.zip",
+    "/backup.tar.gz",
+    "/www.zip",
+    "/site.tar.gz",
+]);
+// ─────────────────────────────────────────────────────────────────────────
+// Trap Signatures — Directory Prefixes
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Path prefixes whose entire subtree should be considered traps.
+ * A request for `/.git/logs/HEAD` is just as dangerous as one for `/.git/config`.
+ *
+ * Rules are matched with a trailing-slash anchor to avoid collisions
+ * (e.g. `/.gitignore` must **not** match the `/.git/` prefix rule).
+ *
+ * @internal
+ */
+HoneypotTarpit.PREFIX_TRAPS = new Set([
+    "/.git/",
+    "/.svn/",
+    "/.hg/",
+    "/.ssh/",
+    "/.aws/",
+    "/.vscode/",
+    "/.idea/",
+    "/wp-includes/",
+    "/wp-content/plugins/",
+    "/wp-admin/",
+    "/actuator/",
+    "/proc/", // Linux /proc LFI attempts
+    "/etc/", // /etc/passwd, /etc/shadow LFI attempts
+    "/var/log/", // log file LFI
+]);
+// ─────────────────────────────────────────────────────────────────────────
+// Trap Signatures — File Extensions
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * File extensions that are exclusively associated with scanner probes or
+ * sensitive file types that should **never** be served over HTTP in any
+ * legitimate modern application.
+ *
+ * Deliberately conservative — common extensions like `.php`, `.bak`, or
+ * `.log` are excluded because they *may* be intentionally served by some
+ * apps. Only zero-ambiguity extensions are listed here.
+ *
+ * @internal
+ */
+HoneypotTarpit.SUFFIX_TRAPS = new Set([
+    ".pem", // TLS private keys / certificates
+    ".p12", // PKCS#12 keystores
+    ".pfx", // Personal Information Exchange (Windows keystore)
+    ".key", // Generic private keys
+    ".crt", // X.509 certificates (when accessed directly)
+    ".cer", // Alternative certificate extension
+    ".jks", // Java KeyStore
+    ".id_rsa", // SSH private key variants with compound extensions
+    ".htaccess", // Apache access control — never a user-facing resource
+    ".htpasswd", // Apache password file
+    ".DS_Store", // macOS metadata (case-normalised before comparison)
+    ".tfstate", // Terraform state (may contain secrets)
+    ".tfvars", // Terraform variable files (often contain secrets)
+]);
+// ─────────────────────────────────────────────────────────────────────────
+// Trap Signatures — Path Segments
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Discrete path segments (surrounded by `/` boundaries or at string edges)
+ * that indicate well-known scanner probes regardless of their position in
+ * the path hierarchy.
+ *
+ * Each entry is matched as a full segment to prevent substring collisions
+ * (e.g. `"admin"` must not trap `/admin-panel` but must trap `/api/admin`).
+ *
+ * @internal
+ */
+HoneypotTarpit.SEGMENT_TRAPS = new Set([
+    "phpmyadmin",
+    "pma",
+    "adminer",
+    "wp-login.php",
+    "xmlrpc.php",
+    "phpinfo.php",
+    ".env",
+    ".git",
+    ".svn",
+    ".hg",
+    "actuator",
+    "heapdump",
+]);
+/**
+ * Custom user-defined traps registered at runtime.
+ */
+HoneypotTarpit.CUSTOM_EXACT_TRAPS = new Set();
+HoneypotTarpit.CUSTOM_PREFIX_TRAPS = new Set();
+HoneypotTarpit.CUSTOM_SUFFIX_TRAPS = new Set();
+HoneypotTarpit.CUSTOM_SEGMENT_TRAPS = new Set();
+//# sourceMappingURL=HoneypotTarpit.js.map

package/dist/src/middleware/built-in/security/HoneypotTarpit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HoneypotTarpit.js","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/HoneypotTarpit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,OAAO,cAAc;IAmQvB;;;;OAIG;IACI,MAAM,CAAC,mBAAmB,CAAC,MAKjC;QACG,IAAI,MAAM,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACI,MAAM,CAAC,MAAM,CAAC,OAAe;QAChC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,mEAAmE;YACnE,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAEvE,OAAO,CACH,cAAc,CAAC,gBAAgB,CAAC,UAAU,CAAC;YAC3C,cAAc,CAAC,iBAAiB,CAAC,UAAU,CAAC;YAC5C,cAAc,CAAC,iBAAiB,CAAC,UAAU,CAAC;YAC5C,cAAc,CAAC,kBAAkB,CAAC,UAAU,CAAC;YAC7C,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;YACjD,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC9C,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC9C,cAAc,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAClD,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAAC,IAAY;QAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,mBAAmB;YAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9E,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAAC,IAAY;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,mBAAmB;YAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,oBAAoB,CAAC,IAAY;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACI,MAAM,CAAC,UAAU,CACpB,GAAyB,EACzB,GAA+D;QAE/D,IAAI,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAChC,GAAG,CAAC,GAAG,EAAE,CAAC;YACd,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,gEAAgE;YAChE,mEAAmE;QACvE,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,6BAA6B;IAC7B,4EAA4E;IAE5E;;;;;;;;;;;;;OAaG;IACK,MAAM,CAAC,aAAa,CAAC,KAAc;QACvC,OAAO,CACH,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,eAAe,CACjD,CAAC;IACN,CAAC;IAED,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAE5E;;;;;;;;;;;OAWG;IACK,MAAM,CAAC,gBAAgB,CAAC,cAAsB;QAClD,OAAO,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,iBAAiB,CAAC,cAAsB;QACnD,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,MAAM,CAAC,iBAAiB,CAAC,cAAsB;QACnD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,CAAC,wBAAwB;QAC1C,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;QAC7D,OAAO,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,MAAM,CAAC,kBAAkB,CAAC,cAAsB;QACpD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;;AAtgBD,4EAA4E;AAC5E,YAAY;AACZ,4EAA4E;AAE5E;;;;;;GAMG;AACqB,8BAAe,GAAG,IAAI,CAAC;AAE/C,4EAA4E;AAC5E,gCAAgC;AAChC,4EAA4E;AAE5E;;;;;;;;;GASG;AACqB,0BAAW,GAAG,IAAI,GAAG,CAAS;IAClD,qEAAqE;IACrE,OAAO;IACP,aAAa;IACb,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,cAAc;IACd,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe,EAAE,kDAAkD;IACnE,mBAAmB;IACnB,cAAc;IACd,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,kBAAkB;IAClB,uBAAuB;IACvB,mBAAmB;IACnB,SAAS;IACT,YAAY;IACZ,UAAU;IAEV,qEAAqE;IACrE,OAAO;IACP,cAAc;IACd,YAAY;IACZ,aAAa;IACb,mBAAmB;IACnB,uBAAuB;IACvB,yBAAyB;IACzB,aAAa;IACb,eAAe;IACf,WAAW;IAEX,qEAAqE;IACrE,qBAAqB;IACrB,sBAAsB;IACtB,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,UAAU;IACV,mBAAmB;IACnB,+BAA+B;IAE/B,qEAAqE;IACrE,cAAc;IACd,aAAa;IACb,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,8BAA8B;IAC9B,aAAa;IACb,aAAa;IACb,eAAe;IACf,cAAc;IAEd,qEAAqE;IACrE,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,oBAAoB;IACpB,YAAY;IACZ,eAAe;IACf,eAAe;IACf,cAAc;IACd,aAAa;IACb,SAAS;IAET,qEAAqE;IACrE,oBAAoB;IACpB,sBAAsB;IACtB,wBAAwB;IACxB,sBAAsB;IAEtB,qEAAqE;IACrE,eAAe;IACf,WAAW;IACX,gBAAgB;IAChB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,uBAAuB;IACvB,aAAa;IACb,cAAc;IACd,UAAU;IACV,eAAe;IAEf,qEAAqE;IACrE,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,oBAAoB;IACpB,iBAAiB;IACjB,uBAAuB;IACvB,gBAAgB;IAChB,oBAAoB;IACpB,MAAM,EAAE,iCAAiC;IACzC,WAAW;IACX,QAAQ;IAER,qEAAqE;IACrE,QAAQ;IACR,gBAAgB;IAChB,aAAa;IACb,MAAM;IACN,UAAU;IACV,cAAc;IACd,QAAQ;IACR,SAAS;IACT,SAAS;IACT,UAAU;IACV,eAAe,EAAE,iBAAiB;IAElC,qEAAqE;IACrE,YAAY;IACZ,YAAY;IACZ,cAAc;IAEd,qEAAqE;IACrE,aAAa;IACb,WAAW;IACX,eAAe;IACf,SAAS;IACT,aAAa;IACb,gBAAgB;IAChB,UAAU;IACV,cAAc;CACjB,CAAC,CAAC;AAEH,4EAA4E;AAC5E,uCAAuC;AACvC,4EAA4E;AAE5E;;;;;;;;GAQG;AACqB,2BAAY,GAAG,IAAI,GAAG,CAAS;IACnD,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,SAAS;IACT,eAAe;IACf,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,QAAQ,EAAE,2BAA2B;IACrC,OAAO,EAAE,wCAAwC;IACjD,WAAW,EAAE,eAAe;CAC/B,CAAC,CAAC;AAEH,4EAA4E;AAC5E,oCAAoC;AACpC,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACqB,2BAAY,GAAG,IAAI,GAAG,CAAS;IACnD,MAAM,EAAE,kCAAkC;IAC1C,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,mDAAmD;IAC3D,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,8CAA8C;IACtD,MAAM,EAAE,oCAAoC;IAC5C,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,oDAAoD;IAC/D,WAAW,EAAE,uDAAuD;IACpE,WAAW,EAAE,uBAAuB;IACpC,WAAW,EAAE,qDAAqD;IAClE,UAAU,EAAE,wCAAwC;IACpD,SAAS,EAAE,mDAAmD;CACjE,CAAC,CAAC;AAEH,4EAA4E;AAC5E,kCAAkC;AAClC,4EAA4E;AAE5E;;;;;;;;;GASG;AACqB,4BAAa,GAAG,IAAI,GAAG,CAAS;IACpD,YAAY;IACZ,KAAK;IACL,SAAS;IACT,cAAc;IACd,YAAY;IACZ,aAAa;IACb,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,UAAU;IACV,UAAU;CACb,CAAC,CAAC;AAEH;;GAEG;AACY,iCAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;AACvC,kCAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AACxC,kCAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AACxC,mCAAoB,GAAG,IAAI,GAAG,EAAU,CAAC"}

package/dist/src/middleware/built-in/security/MaliciousUrlScanner.d.ts

@@ -0,0 +1,14 @@
+import { RequestHandler } from "../../../types/types";
+import { MaliciousUrlScannerConfig } from "../../../types/mod/security";
+import { Logger } from "../../../shared/logger/Logger";
+export declare class MaliciousUrlScanner {
+    /**
+     * Middleware for scanning incoming URLs for malicious payloads (XSS, Path Traversal, etc.)
+     *
+     * @param config Configuration for the URL Scanner
+     * @param logger Logger instance
+     * @returns RequestHandler middleware
+     */
+    static middleware(config?: boolean | MaliciousUrlScannerConfig, logger?: Logger): RequestHandler;
+}
+//# sourceMappingURL=MaliciousUrlScanner.d.ts.map

package/dist/src/middleware/built-in/security/MaliciousUrlScanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MaliciousUrlScanner.d.ts","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAEvD,qBAAa,mBAAmB;IAC5B;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CACb,MAAM,GAAE,OAAO,GAAG,yBAAiC,EACnD,MAAM,CAAC,EAAE,MAAM,GAChB,cAAc;CAiEpB"}

package/dist/src/middleware/built-in/security/MaliciousUrlScanner.js

@@ -0,0 +1,71 @@
+import { __strl__ } from "strulink";
+export class MaliciousUrlScanner {
+    /**
+     * Middleware for scanning incoming URLs for malicious payloads (XSS, Path Traversal, etc.)
+     *
+     * @param config Configuration for the URL Scanner
+     * @param logger Logger instance
+     * @returns RequestHandler middleware
+     */
+    static middleware(config = false, logger) {
+        // Normalize config
+        let scannerConfig = {};
+        if (typeof config === "boolean") {
+            if (!config)
+                return (req, res, next) => next?.();
+            scannerConfig = { enabled: true, mode: "block" };
+        }
+        else {
+            scannerConfig = config;
+        }
+        if (scannerConfig.enabled === false) {
+            return (req, res, next) => next?.();
+        }
+        const mode = scannerConfig.mode || "block";
+        const options = scannerConfig.options || {
+            minScore: 40,
+            sensitivity: 1.0,
+            advanced: {
+                maxEncodingLayers: 3,
+                entropyThreshold: 4.8
+            }
+        };
+        return async (req, res, next) => {
+            try {
+                // Reconstruct full URL to scan everything including path and query
+                const protocol = req.headers["x-forwarded-proto"] || "http";
+                const host = req.headers.host || "localhost";
+                const fullUrl = `${protocol}://${host}${req.originalUrl || req.url}`;
+                const result = await __strl__.scanUrl(fullUrl, options);
+                if (result.isMalicious) {
+                    const reasons = result.detectedPatterns.map(p => p.type).join(", ");
+                    const logMessage = `[MaliciousUrlScanner] Detected malicious URL (Score: ${result.score}). Reasons: ${reasons}. URL: ${req.url}`;
+                    if (logger) {
+                        logger.warn("security", logMessage);
+                    }
+                    else {
+                        console.warn(logMessage);
+                    }
+                    if (mode === "block") {
+                        res.status(403).json({
+                            error: "Forbidden",
+                            code: "EMALICIOUSURL",
+                            message: "The request was blocked due to suspected malicious payload."
+                        });
+                        return;
+                    }
+                }
+                next?.();
+            }
+            catch (err) {
+                if (logger) {
+                    logger.error("security", "Failed to scan URL for malicious payloads", err);
+                }
+                // Fail open or fail closed? Usually fail closed for security, but fail open to avoid breaking app if strulink crashes.
+                // We'll call next() to fail open.
+                next?.();
+            }
+        };
+    }
+}
+//# sourceMappingURL=MaliciousUrlScanner.js.map

package/dist/src/middleware/built-in/security/MaliciousUrlScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MaliciousUrlScanner.js","sourceRoot":"","sources":["../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAMpC,MAAM,OAAO,mBAAmB;IAC5B;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CACb,SAA8C,KAAK,EACnD,MAAe;QAEf,mBAAmB;QACnB,IAAI,aAAa,GAA8B,EAAE,CAAC;QAElD,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACrD,CAAC;aAAM,CAAC;YACJ,aAAa,GAAG,MAAM,CAAC;QAC3B,CAAC;QAED,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAClC,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO,CAAC;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI;YACrC,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,GAAG;YAChB,QAAQ,EAAE;gBACN,iBAAiB,EAAE,CAAC;gBACpB,gBAAgB,EAAE,GAAG;aACxB;SACJ,CAAC;QAEF,OAAO,KAAK,EAAE,GAAkB,EAAE,GAAmB,EAAE,IAAmB,EAAE,EAAE;YAC1E,IAAI,CAAC;gBACD,mEAAmE;gBACnE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC;gBAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;gBAC7C,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAExD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrB,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpE,MAAM,UAAU,GAAG,wDAAwD,MAAM,CAAC,KAAK,eAAe,OAAO,UAAU,GAAG,CAAC,GAAG,EAAE,CAAC;oBAEjI,IAAI,MAAM,EAAE,CAAC;wBACT,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;oBACxC,CAAC;yBAAM,CAAC;wBACJ,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC7B,CAAC;oBAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;wBACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;4BACjB,KAAK,EAAE,WAAW;4BAClB,IAAI,EAAE,eAAe;4BACrB,OAAO,EAAE,6DAA6D;yBACzE,CAAC,CAAC;wBACH,OAAO;oBACX,CAAC;gBACL,CAAC;gBAED,IAAI,EAAE,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAI,MAAM,EAAE,CAAC;oBACT,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC,CAAC;gBACxF,CAAC;gBACD,uHAAuH;gBACvH,kCAAkC;gBAClC,IAAI,EAAE,EAAE,CAAC;YACb,CAAC;QACL,CAAC,CAAC;IACN,CAAC;CACJ"}