xypriss 9.12.44 → 9.12.46

package/dist/cjs/src/middleware/built-in/security/MaliciousUrlScanner.js

@@ -2,6 +2,9 @@
 
 var strulink = require('strulink');
 
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const HASH_REGEX = /^[0-9a-f]{16,64}$/i;
+const SAFE_PARAM_REGEX = /^[a-zA-Z0-9_\-.~%]+$/;
 class MaliciousUrlScanner {
     /**
      * Middleware for scanning incoming URLs for malicious payloads (XSS, Path Traversal, etc.)
@@ -25,37 +28,83 @@ class MaliciousUrlScanner {
             return (req, res, next) => next?.();
         }
         const mode = scannerConfig.mode || "block";
-        const options = scannerConfig.options || {
-            minScore: 40,
+        const options = {
+            minScore: 70,
             sensitivity: 1.0,
+            enableEntropyAnalysis: false, // Disabled by default to prevent false positives on UUIDs and hash IDs
+            ...scannerConfig.options,
             advanced: {
                 maxEncodingLayers: 3,
-                entropyThreshold: 4.8
-            }
+                entropyThreshold: 5.5,
+                ...scannerConfig.options?.advanced,
+            },
         };
         return async (req, res, next) => {
             try {
+                const reqPath = req.path || (req.url ? req.url.split("?")[0] : "");
+                // Check excluded paths
+                if (scannerConfig.excludePaths && scannerConfig.excludePaths.length > 0) {
+                    for (const pattern of scannerConfig.excludePaths) {
+                        if (typeof pattern === "string") {
+                            if (pattern.endsWith("/**")) {
+                                const prefix = pattern.slice(0, -3);
+                                if (reqPath === prefix || reqPath.startsWith(prefix + "/")) {
+                                    return next?.();
+                                }
+                            }
+                            else if (pattern.endsWith("/*")) {
+                                const prefix = pattern.slice(0, -2);
+                                if (reqPath === prefix || reqPath.startsWith(prefix + "/")) {
+                                    return next?.();
+                                }
+                            }
+                            else if (reqPath === pattern || reqPath.startsWith(pattern)) {
+                                return next?.();
+                            }
+                        }
+                        else if (pattern instanceof RegExp && pattern.test(reqPath)) {
+                            return next?.();
+                        }
+                    }
+                }
                 // Reconstruct full URL to scan everything including path and query
                 const protocol = req.headers["x-forwarded-proto"] || "http";
                 const host = req.headers.host || "localhost";
                 const fullUrl = `${protocol}://${host}${req.originalUrl || req.url}`;
                 const result = await strulink.__strl__.scanUrl(fullUrl, options);
                 if (result.isMalicious) {
-                    const reasons = result.detectedPatterns.map(p => p.type).join(", ");
-                    const logMessage = `[MaliciousUrlScanner] Detected malicious URL (Score: ${result.score}). Reasons: ${reasons}. URL: ${req.url}`;
-                    if (logger) {
-                        logger.warn("security", logMessage);
-                    }
-                    else {
-                        console.warn(logMessage);
-                    }
-                    if (mode === "block") {
-                        res.status(403).json({
-                            error: "Forbidden",
-                            code: "EMALICIOUSURL",
-                            message: "The request was blocked due to suspected malicious payload."
-                        });
-                        return;
+                    // Filter heuristic false positives on standard UUIDs, hashes, and benign params
+                    const genuinePatterns = (result.detectedPatterns || []).filter((p) => {
+                        if (scannerConfig.ignorePatterns?.includes(p.type)) {
+                            return false;
+                        }
+                        if (p.type === "encoded_payload" || p.pattern === "high_entropy") {
+                            const val = p.matchedValue || "";
+                            if (UUID_REGEX.test(val) || HASH_REGEX.test(val) || SAFE_PARAM_REGEX.test(val)) {
+                                return false;
+                            }
+                        }
+                        return true;
+                    });
+                    if (genuinePatterns.length > 0) {
+                        const reasons = genuinePatterns.map((p) => p.type).join(", ");
+                        const logMessage = `[MaliciousUrlScanner] Detected malicious URL (Score: ${result.score}). Reasons: ${reasons}. URL: ${req.url}`;
+                        if (logger) {
+                            logger.warn("security", logMessage);
+                        }
+                        else {
+                            console.warn(logMessage);
+                        }
+                        if (mode === "block") {
+                            if (!res.headersSent && !res.writableEnded) {
+                                res.status(403).json({
+                                    error: "Forbidden",
+                                    code: "EMALICIOUSURL",
+                                    message: "The request was blocked due to suspected malicious payload."
+                                });
+                            }
+                            return;
+                        }
                     }
                 }
                 next?.();
@@ -64,8 +113,6 @@ class MaliciousUrlScanner {
                 if (logger) {
                     logger.error("security", "Failed to scan URL for malicious payloads", err);
                 }
-                // Fail open or fail closed? Usually fail closed for security, but fail open to avoid breaking app if strulink crashes.
-                // We'll call next() to fail open.
                 next?.();
             }
         };

package/dist/cjs/src/middleware/built-in/security/MaliciousUrlScanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"MaliciousUrlScanner.js","sources":["../../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"sourcesContent":[null],"names":["__strl__"],"mappings":";;;;MAMa,mBAAmB,CAAA;AAC5B;;;;;;AAMG;AACH,IAAA,OAAO,UAAU,CACb,MAAA,GAA8C,KAAK,EACnD,MAAe,EAAA;;QAGf,IAAI,aAAa,GAA8B,EAAE;AAEjD,QAAA,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE;AAC7B,YAAA,IAAI,CAAC,MAAM;AAAE,gBAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;YAC9F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpD;aAAO;YACH,aAAa,GAAG,MAAM;QAC1B;AAEA,QAAA,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE;AACjC,YAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;QACrF;AAEA,QAAA,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO;AAC1C,QAAA,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI;AACrC,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,WAAW,EAAE,GAAG;AAChB,YAAA,QAAQ,EAAE;AACN,gBAAA,iBAAiB,EAAE,CAAC;AACpB,gBAAA,gBAAgB,EAAE;AACrB;SACJ;QAED,OAAO,OAAO,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAI;AAC1E,YAAA,IAAI;;gBAEA,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;AAC5C,gBAAA,MAAM,OAAO,GAAG,CAAA,EAAG,QAAQ,MAAM,IAAI,CAAA,EAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE;gBAEpE,MAAM,MAAM,GAAG,MAAMA,iBAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;AAEvD,gBAAA,IAAI,MAAM,CAAC,WAAW,EAAE;oBACpB,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACnE,oBAAA,MAAM,UAAU,GAAG,CAAA,qDAAA,EAAwD,MAAM,CAAC,KAAK,CAAA,YAAA,EAAe,OAAO,CAAA,OAAA,EAAU,GAAG,CAAC,GAAG,EAAE;oBAEhI,IAAI,MAAM,EAAE;AACR,wBAAA,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;oBACvC;yBAAO;AACH,wBAAA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC5B;AAEA,oBAAA,IAAI,IAAI,KAAK,OAAO,EAAE;AAClB,wBAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACjB,4BAAA,KAAK,EAAE,WAAW;AAClB,4BAAA,IAAI,EAAE,eAAe;AACrB,4BAAA,OAAO,EAAE;AACZ,yBAAA,CAAC;wBACF;oBACJ;gBACJ;gBAEA,IAAI,IAAI;YACZ;YAAE,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,EAAE;oBACR,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC;gBACvF;;;gBAGA,IAAI,IAAI;YACZ;AACJ,QAAA,CAAC;IACL;AACH;;;;"}
+{"version":3,"file":"MaliciousUrlScanner.js","sources":["../../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"sourcesContent":[null],"names":["__strl__"],"mappings":";;;;AAMA,MAAM,UAAU,GAAG,iEAAiE;AACpF,MAAM,UAAU,GAAG,oBAAoB;AACvC,MAAM,gBAAgB,GAAG,sBAAsB;MAElC,mBAAmB,CAAA;AAC5B;;;;;;AAMG;AACH,IAAA,OAAO,UAAU,CACb,MAAA,GAA8C,KAAK,EACnD,MAAe,EAAA;;QAGf,IAAI,aAAa,GAA8B,EAAE;AAEjD,QAAA,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE;AAC7B,YAAA,IAAI,CAAC,MAAM;AAAE,gBAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;YAC9F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpD;aAAO;YACH,aAAa,GAAG,MAAM;QAC1B;AAEA,QAAA,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE;AACjC,YAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;QACrF;AAEA,QAAA,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO;AAC1C,QAAA,MAAM,OAAO,GAAG;AACZ,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,WAAW,EAAE,GAAG;YAChB,qBAAqB,EAAE,KAAK;YAC5B,GAAG,aAAa,CAAC,OAAO;AACxB,YAAA,QAAQ,EAAE;AACN,gBAAA,iBAAiB,EAAE,CAAC;AACpB,gBAAA,gBAAgB,EAAE,GAAG;AACrB,gBAAA,GAAI,aAAa,CAAC,OAAe,EAAE,QAAQ;AAC9C,aAAA;SACJ;QAED,OAAO,OAAO,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAI;AAC1E,YAAA,IAAI;AACA,gBAAA,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;;AAGlE,gBAAA,IAAI,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;AACrE,oBAAA,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,YAAY,EAAE;AAC9C,wBAAA,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE;AAC7B,4BAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gCACzB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;AAAO,iCAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;iCAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;gCAC3D,OAAO,IAAI,IAAI;4BACnB;wBACJ;6BAAO,IAAI,OAAO,YAAY,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;4BAC3D,OAAO,IAAI,IAAI;wBACnB;oBACJ;gBACJ;;gBAGA,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;AAC5C,gBAAA,MAAM,OAAO,GAAG,CAAA,EAAG,QAAQ,MAAM,IAAI,CAAA,EAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE;gBAEpE,MAAM,MAAM,GAAG,MAAMA,iBAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAc,CAAC;AAE9D,gBAAA,IAAI,MAAM,CAAC,WAAW,EAAE;;AAEpB,oBAAA,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAM,KAAI;wBACtE,IAAI,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;AAChD,4BAAA,OAAO,KAAK;wBAChB;AACA,wBAAA,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc,EAAE;AAC9D,4BAAA,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE;4BAChC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AAC5E,gCAAA,OAAO,KAAK;4BAChB;wBACJ;AACA,wBAAA,OAAO,IAAI;AACf,oBAAA,CAAC,CAAC;AAEF,oBAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAM,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AAClE,wBAAA,MAAM,UAAU,GAAG,CAAA,qDAAA,EAAwD,MAAM,CAAC,KAAK,CAAA,YAAA,EAAe,OAAO,CAAA,OAAA,EAAU,GAAG,CAAC,GAAG,EAAE;wBAEhI,IAAI,MAAM,EAAE;AACR,4BAAA,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;wBACvC;6BAAO;AACH,4BAAA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;wBAC5B;AAEA,wBAAA,IAAI,IAAI,KAAK,OAAO,EAAE;4BAClB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;AACxC,gCAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACjB,oCAAA,KAAK,EAAE,WAAW;AAClB,oCAAA,IAAI,EAAE,eAAe;AACrB,oCAAA,OAAO,EAAE;AACZ,iCAAA,CAAC;4BACN;4BACA;wBACJ;oBACJ;gBACJ;gBAEA,IAAI,IAAI;YACZ;YAAE,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,EAAE;oBACR,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC;gBACvF;gBACA,IAAI,IAAI;YACZ;AACJ,QAAA,CAAC;IACL;AACH;;;;"}

package/dist/cjs/src/server/routing/modules/registry.js

@@ -121,8 +121,12 @@ function mountRouter(mountPath, subRouter, internalState) {
                         handler: entry.handler,
                     };
                 }
+                // NOTE: Do NOT inject `path: normalizedMountPath` here for unscoped/route-level middleware
+                // or guards (e.g. guards from router.group() or RichRouteOptions).
+                // Injecting a strict path prefix here causes HttpServer to filter out the middleware
+                // on parameterized/nested routes (e.g. /client-api/groups/:groupId).
+                // Ref: https://github.com/Nehonix-Team/XyPriss/issues/40
                 return {
-                    path: normalizedMountPath,
                     handler: entry.handler,
                 };
             });

package/dist/cjs/src/server/routing/modules/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sources":["../../../../../../src/server/routing/modules/registry.ts"],"sourcesContent":[null],"names":["path","normalizePath","isValidPath","resolveCondition","middleware","createGuardMiddleware","compileRoutePattern","createCacheMiddleware","wrapWithLifecycle","nextRouteId","detectStatusCodes","joinPaths"],"mappings":";;;;;;AAuCA;;AAEG;AACG,SAAU,YAAY,CACxB,MAAqB,EACrB,MAAc,EACdA,MAAY,EACZ,IAAW,EACX,aAMC,EAAA;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACvC,QAAA,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;IAC7D;IACA,IAAI,CAACA,MAAI,IAAI,OAAOA,MAAI,KAAK,QAAQ,EAAE;AACnC,QAAA,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;IAC5D;AACA,IAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3C,MAAM,IAAI,KAAK,CACX,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAIA,MAAI,CAAA,+BAAA,CAAiC,CAC3D;IACL;AAEA,IAAA,IAAI,WAAyC;AAC7C,IAAA,IAAI,QAA+C;AAEnD,IAAA,IACI,IAAI,CAAC,MAAM,IAAI,CAAC;AAChB,QAAA,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;AAC3B,QAAA,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvB,QAAA,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAC/B;AACE,QAAA,WAAW,GAAG,IAAI,CAAC,CAAC,CAAqB;AACzC,QAAA,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5B;SAAO;QACH,QAAQ,GAAG,IAAI;IACnB;AAEA,IAAA,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACX,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAIA,MAAI,CAAA,wCAAA,CAA0C,CACpE;IACL;AAEA,IAAA,MAAM,cAAc,GAAGC,kBAAa,CAACD,MAAI,CAAC;AAE1C,IAAA,IAAI,CAACE,gBAAW,CAAC,cAAc,CAAC,EAAE;AAC9B,QAAA,MAAM,IAAI,KAAK,CAAC,wBAAwBF,MAAI,CAAA,CAAE,CAAC;IACnD;AAEA,IAAA,MAAM,MAAM,GAAGG,wBAAgB,CAC3B,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,eAAe,CAChC;IACD,MAAMC,YAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAyB;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAiB;AAE7D,IAAA,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE;QAC/B,MAAM,IAAI,KAAK,CACX,CAAA,2CAAA,EAA8C,MAAM,CAAA,CAAA,EAAIJ,MAAI,CAAA,CAAE,CACjE;IACL;;AAGA,IAAA,MAAM,WAAW,GAAG,WAAW,EAAE,MAAM;AACvC,IAAA,IAAI,eAA+C;IAEnD,IAAI,WAAW,EAAE;QACb,eAAe,GAAGK,6BAAqB,CACnC,WAAW,EACX,aAAa,CAAC,MAAM,CACvB;IACL;AAEA,IAAA,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAGC,wBAAmB,CACjE,cAAc,EACd,aAAa,CAAC,OAAO,CACxB;IAED,MAAM,sBAAsB,GAAsBF,YAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AACrE,QAAA,OAAO,EAAE,CAAC;AACb,KAAA,CAAC,CAAC;IAEH,IAAI,eAAe,EAAE;QACjB,sBAAsB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAChE;AAEA,IAAA,IAAI,WAAW,EAAE,KAAK,EAAE;QACpB,sBAAsB,CAAC,OAAO,CAAC;AAC3B,YAAA,OAAO,EAAEG,gCAAqB,CAAC,WAAW,CAAC,KAAK,CAAC;AACpD,SAAA,CAAC;IACN;IAEA,IAAI,YAAY,GAAG,OAAO;AAC1B,IAAA,IAAI,WAAW,EAAE,SAAS,EAAE;QACxB,YAAY,GAAGC,4BAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAQ;IAC3E;AAEA,IAAA,MAAM,kBAAkB,GAAG;QACvB,GAAG,aAAa,CAAC,UAAU;AAC3B,QAAA,GAAG,sBAAsB;KAC5B;AAED,IAAA,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,OAAO,GACR,WAAW,EAAE,IAAI,EAAE,OAA8B,IAAI,eAAe;AAEzE,IAAA,MAAM,KAAK,GAAwB;QAC/B,EAAE,EAAEC,mBAAW,EAAE;AACjB,QAAA,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;AAC5B,QAAA,IAAI,EAAE,cAAc;AACpB,QAAA,YAAY,EAAE,cAAc;AAC5B,QAAA,OAAO,EAAE,YAAY;AACrB,QAAA,UAAU,EAAE,kBAAkB;QAC9B,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,MAAM,EAAE,WAAW,EAAE,MAAM;QAC3B,SAAS,EAAE,WAAW,EAAE,SAAS;QACjC,SAAS,EAAE,WAAW,EAAE,SAAS;QACjC,KAAK,EAAE,WAAW,EAAE,KAAK;QACzB,IAAI,EAAE,WAAW,EAAE,IAAI;QACvB,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,IAAIC,4BAAiB,CAAC,OAAO,CAAC;AACrE,QAAA,QAAQ,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC;QACpC,MAAM;QACN,OAAO;KACV;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAC9C,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CACrC;AACD,IAAA,IAAI,WAAW,KAAK,EAAE,EAAE;AACpB,QAAA,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IACpC;SAAO;QACH,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC;IACtD;AAEA,IAAA,aAAa,CAAC,MAAM,CAAC,KAAK,CACtB,QAAQ,EACR,CAAA,aAAA,EAAgB,KAAK,CAAC,EAAE,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,CAAE;SACnD,OAAO,GAAG,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,CAAG,GAAG,EAAE,CAAC;SAChC,MAAM,GAAG,EAAE,GAAG,aAAa,CAAC,CACpC;AACL;AAEA;;AAEG;SACa,WAAW,CACvB,SAAiB,EACjB,SAA0B,EAC1B,aAMC,EAAA;IAED,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,UAAU,EAAE;AAC5D,QAAA,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;IACvD;AAEA,IAAA,MAAM,mBAAmB,GAAGT,kBAAa,CAAC,SAAS,CAAC;IAEpD,SAAS,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,KAAI;AACvC,QAAA,IAAI;YACA,MAAM,QAAQ,GAAGU,cAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC;AACnE,YAAA,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAC3CL,wBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC;YAExD,MAAM,iBAAiB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,KAAI;AACrD,gBAAA,IAAI,KAAK,CAAC,IAAI,EAAE;oBACZ,OAAO;wBACH,IAAI,EAAEK,cAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC;wBAChD,OAAO,EAAE,KAAK,CAAC,OAAO;qBACzB;gBACL;gBACA,OAAO;AACH,oBAAA,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACzB;AACL,YAAA,CAAC,CAAC;AAEF,YAAA,MAAM,kBAAkB,GAAG;gBACvB,GAAG,aAAa,CAAC,UAAU;AAC3B,gBAAA,GAAG,iBAAiB;aACvB;AAED,YAAA,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO;AACrC,YAAA,MAAM,YAAY,GAAwB;AACtC,gBAAA,GAAG,KAAK;AACR,gBAAA,IAAI,EAAE,QAAQ;AACd,gBAAA,YAAY,EAAE,QAAQ;gBACtB,OAAO;gBACP,UAAU;gBACV,gBAAgB;AAChB,gBAAA,UAAU,EAAE,kBAAkB;gBAC9B,OAAO,EAAE,CACL,GAAkB,EAClB,GAAmB,EACnB,IAAS,KACT;AACA,oBAAA,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE;oBACrC,GAAG,CAAC,OAAO,GAAGA,cAAS,CAAC,WAAW,EAAE,mBAAmB,CAAC;oBACzD,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;gBAC1C,CAAC;aACJ;AAED,YAAA,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAC3C;QAAE,OAAO,KAAK,EAAE;AACZ,YAAA,aAAa,CAAC,MAAM,CAAC,KAAK,CACtB,QAAQ,EACR,CAAA,sBAAA,EAAyB,KAAK,CAAC,MAAM,CAAA,CAAA,EAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAA,CAAE,CAClE;AACD,YAAA,MAAM,KAAK;QACf;AACJ,IAAA,CAAC,CAAC;AACN;;;;;"}
+{"version":3,"file":"registry.js","sources":["../../../../../../src/server/routing/modules/registry.ts"],"sourcesContent":[null],"names":["path","normalizePath","isValidPath","resolveCondition","middleware","createGuardMiddleware","compileRoutePattern","createCacheMiddleware","wrapWithLifecycle","nextRouteId","detectStatusCodes","joinPaths"],"mappings":";;;;;;AAuCA;;AAEG;AACG,SAAU,YAAY,CACxB,MAAqB,EACrB,MAAc,EACdA,MAAY,EACZ,IAAW,EACX,aAMC,EAAA;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACvC,QAAA,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;IAC7D;IACA,IAAI,CAACA,MAAI,IAAI,OAAOA,MAAI,KAAK,QAAQ,EAAE;AACnC,QAAA,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;IAC5D;AACA,IAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3C,MAAM,IAAI,KAAK,CACX,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAIA,MAAI,CAAA,+BAAA,CAAiC,CAC3D;IACL;AAEA,IAAA,IAAI,WAAyC;AAC7C,IAAA,IAAI,QAA+C;AAEnD,IAAA,IACI,IAAI,CAAC,MAAM,IAAI,CAAC;AAChB,QAAA,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;AAC3B,QAAA,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvB,QAAA,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAC/B;AACE,QAAA,WAAW,GAAG,IAAI,CAAC,CAAC,CAAqB;AACzC,QAAA,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5B;SAAO;QACH,QAAQ,GAAG,IAAI;IACnB;AAEA,IAAA,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACX,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAIA,MAAI,CAAA,wCAAA,CAA0C,CACpE;IACL;AAEA,IAAA,MAAM,cAAc,GAAGC,kBAAa,CAACD,MAAI,CAAC;AAE1C,IAAA,IAAI,CAACE,gBAAW,CAAC,cAAc,CAAC,EAAE;AAC9B,QAAA,MAAM,IAAI,KAAK,CAAC,wBAAwBF,MAAI,CAAA,CAAE,CAAC;IACnD;AAEA,IAAA,MAAM,MAAM,GAAGG,wBAAgB,CAC3B,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,eAAe,CAChC;IACD,MAAMC,YAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAyB;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAiB;AAE7D,IAAA,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE;QAC/B,MAAM,IAAI,KAAK,CACX,CAAA,2CAAA,EAA8C,MAAM,CAAA,CAAA,EAAIJ,MAAI,CAAA,CAAE,CACjE;IACL;;AAGA,IAAA,MAAM,WAAW,GAAG,WAAW,EAAE,MAAM;AACvC,IAAA,IAAI,eAA+C;IAEnD,IAAI,WAAW,EAAE;QACb,eAAe,GAAGK,6BAAqB,CACnC,WAAW,EACX,aAAa,CAAC,MAAM,CACvB;IACL;AAEA,IAAA,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAGC,wBAAmB,CACjE,cAAc,EACd,aAAa,CAAC,OAAO,CACxB;IAED,MAAM,sBAAsB,GAAsBF,YAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AACrE,QAAA,OAAO,EAAE,CAAC;AACb,KAAA,CAAC,CAAC;IAEH,IAAI,eAAe,EAAE;QACjB,sBAAsB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAChE;AAEA,IAAA,IAAI,WAAW,EAAE,KAAK,EAAE;QACpB,sBAAsB,CAAC,OAAO,CAAC;AAC3B,YAAA,OAAO,EAAEG,gCAAqB,CAAC,WAAW,CAAC,KAAK,CAAC;AACpD,SAAA,CAAC;IACN;IAEA,IAAI,YAAY,GAAG,OAAO;AAC1B,IAAA,IAAI,WAAW,EAAE,SAAS,EAAE;QACxB,YAAY,GAAGC,4BAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAQ;IAC3E;AAEA,IAAA,MAAM,kBAAkB,GAAG;QACvB,GAAG,aAAa,CAAC,UAAU;AAC3B,QAAA,GAAG,sBAAsB;KAC5B;AAED,IAAA,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,OAAO,GACR,WAAW,EAAE,IAAI,EAAE,OAA8B,IAAI,eAAe;AAEzE,IAAA,MAAM,KAAK,GAAwB;QAC/B,EAAE,EAAEC,mBAAW,EAAE;AACjB,QAAA,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;AAC5B,QAAA,IAAI,EAAE,cAAc;AACpB,QAAA,YAAY,EAAE,cAAc;AAC5B,QAAA,OAAO,EAAE,YAAY;AACrB,QAAA,UAAU,EAAE,kBAAkB;QAC9B,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,MAAM,EAAE,WAAW,EAAE,MAAM;QAC3B,SAAS,EAAE,WAAW,EAAE,SAAS;QACjC,SAAS,EAAE,WAAW,EAAE,SAAS;QACjC,KAAK,EAAE,WAAW,EAAE,KAAK;QACzB,IAAI,EAAE,WAAW,EAAE,IAAI;QACvB,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,IAAIC,4BAAiB,CAAC,OAAO,CAAC;AACrE,QAAA,QAAQ,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC;QACpC,MAAM;QACN,OAAO;KACV;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAC9C,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CACrC;AACD,IAAA,IAAI,WAAW,KAAK,EAAE,EAAE;AACpB,QAAA,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IACpC;SAAO;QACH,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC;IACtD;AAEA,IAAA,aAAa,CAAC,MAAM,CAAC,KAAK,CACtB,QAAQ,EACR,CAAA,aAAA,EAAgB,KAAK,CAAC,EAAE,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,CAAE;SACnD,OAAO,GAAG,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,CAAG,GAAG,EAAE,CAAC;SAChC,MAAM,GAAG,EAAE,GAAG,aAAa,CAAC,CACpC;AACL;AAEA;;AAEG;SACa,WAAW,CACvB,SAAiB,EACjB,SAA0B,EAC1B,aAMC,EAAA;IAED,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,UAAU,EAAE;AAC5D,QAAA,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;IACvD;AAEA,IAAA,MAAM,mBAAmB,GAAGT,kBAAa,CAAC,SAAS,CAAC;IAEpD,SAAS,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,KAAI;AACvC,QAAA,IAAI;YACA,MAAM,QAAQ,GAAGU,cAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC;AACnE,YAAA,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAC3CL,wBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC;YAExD,MAAM,iBAAiB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,KAAI;AACrD,gBAAA,IAAI,KAAK,CAAC,IAAI,EAAE;oBACZ,OAAO;wBACH,IAAI,EAAEK,cAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC;wBAChD,OAAO,EAAE,KAAK,CAAC,OAAO;qBACzB;gBACL;;;;;;gBAMA,OAAO;oBACH,OAAO,EAAE,KAAK,CAAC,OAAO;iBACzB;AACL,YAAA,CAAC,CAAC;AAEF,YAAA,MAAM,kBAAkB,GAAG;gBACvB,GAAG,aAAa,CAAC,UAAU;AAC3B,gBAAA,GAAG,iBAAiB;aACvB;AAED,YAAA,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO;AACrC,YAAA,MAAM,YAAY,GAAwB;AACtC,gBAAA,GAAG,KAAK;AACR,gBAAA,IAAI,EAAE,QAAQ;AACd,gBAAA,YAAY,EAAE,QAAQ;gBACtB,OAAO;gBACP,UAAU;gBACV,gBAAgB;AAChB,gBAAA,UAAU,EAAE,kBAAkB;gBAC9B,OAAO,EAAE,CACL,GAAkB,EAClB,GAAmB,EACnB,IAAS,KACT;AACA,oBAAA,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE;oBACrC,GAAG,CAAC,OAAO,GAAGA,cAAS,CAAC,WAAW,EAAE,mBAAmB,CAAC;oBACzD,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;gBAC1C,CAAC;aACJ;AAED,YAAA,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAC3C;QAAE,OAAO,KAAK,EAAE;AACZ,YAAA,aAAa,CAAC,MAAM,CAAC,KAAK,CACtB,QAAQ,EACR,CAAA,sBAAA,EAAyB,KAAK,CAAC,MAAM,CAAA,CAAA,EAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAA,CAAE,CAClE;AACD,YAAA,MAAM,KAAK;QACf;AACJ,IAAA,CAAC,CAAC;AACN;;;;;"}

package/dist/esm/src/middleware/built-in/security/MaliciousUrlScanner.js

@@ -1,5 +1,8 @@
 import { __strl__ } from 'strulink';
 
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const HASH_REGEX = /^[0-9a-f]{16,64}$/i;
+const SAFE_PARAM_REGEX = /^[a-zA-Z0-9_\-.~%]+$/;
 class MaliciousUrlScanner {
     /**
      * Middleware for scanning incoming URLs for malicious payloads (XSS, Path Traversal, etc.)
@@ -23,37 +26,83 @@ class MaliciousUrlScanner {
             return (req, res, next) => next?.();
         }
         const mode = scannerConfig.mode || "block";
-        const options = scannerConfig.options || {
-            minScore: 40,
+        const options = {
+            minScore: 70,
             sensitivity: 1.0,
+            enableEntropyAnalysis: false, // Disabled by default to prevent false positives on UUIDs and hash IDs
+            ...scannerConfig.options,
             advanced: {
                 maxEncodingLayers: 3,
-                entropyThreshold: 4.8
-            }
+                entropyThreshold: 5.5,
+                ...scannerConfig.options?.advanced,
+            },
         };
         return async (req, res, next) => {
             try {
+                const reqPath = req.path || (req.url ? req.url.split("?")[0] : "");
+                // Check excluded paths
+                if (scannerConfig.excludePaths && scannerConfig.excludePaths.length > 0) {
+                    for (const pattern of scannerConfig.excludePaths) {
+                        if (typeof pattern === "string") {
+                            if (pattern.endsWith("/**")) {
+                                const prefix = pattern.slice(0, -3);
+                                if (reqPath === prefix || reqPath.startsWith(prefix + "/")) {
+                                    return next?.();
+                                }
+                            }
+                            else if (pattern.endsWith("/*")) {
+                                const prefix = pattern.slice(0, -2);
+                                if (reqPath === prefix || reqPath.startsWith(prefix + "/")) {
+                                    return next?.();
+                                }
+                            }
+                            else if (reqPath === pattern || reqPath.startsWith(pattern)) {
+                                return next?.();
+                            }
+                        }
+                        else if (pattern instanceof RegExp && pattern.test(reqPath)) {
+                            return next?.();
+                        }
+                    }
+                }
                 // Reconstruct full URL to scan everything including path and query
                 const protocol = req.headers["x-forwarded-proto"] || "http";
                 const host = req.headers.host || "localhost";
                 const fullUrl = `${protocol}://${host}${req.originalUrl || req.url}`;
                 const result = await __strl__.scanUrl(fullUrl, options);
                 if (result.isMalicious) {
-                    const reasons = result.detectedPatterns.map(p => p.type).join(", ");
-                    const logMessage = `[MaliciousUrlScanner] Detected malicious URL (Score: ${result.score}). Reasons: ${reasons}. URL: ${req.url}`;
-                    if (logger) {
-                        logger.warn("security", logMessage);
-                    }
-                    else {
-                        console.warn(logMessage);
-                    }
-                    if (mode === "block") {
-                        res.status(403).json({
-                            error: "Forbidden",
-                            code: "EMALICIOUSURL",
-                            message: "The request was blocked due to suspected malicious payload."
-                        });
-                        return;
+                    // Filter heuristic false positives on standard UUIDs, hashes, and benign params
+                    const genuinePatterns = (result.detectedPatterns || []).filter((p) => {
+                        if (scannerConfig.ignorePatterns?.includes(p.type)) {
+                            return false;
+                        }
+                        if (p.type === "encoded_payload" || p.pattern === "high_entropy") {
+                            const val = p.matchedValue || "";
+                            if (UUID_REGEX.test(val) || HASH_REGEX.test(val) || SAFE_PARAM_REGEX.test(val)) {
+                                return false;
+                            }
+                        }
+                        return true;
+                    });
+                    if (genuinePatterns.length > 0) {
+                        const reasons = genuinePatterns.map((p) => p.type).join(", ");
+                        const logMessage = `[MaliciousUrlScanner] Detected malicious URL (Score: ${result.score}). Reasons: ${reasons}. URL: ${req.url}`;
+                        if (logger) {
+                            logger.warn("security", logMessage);
+                        }
+                        else {
+                            console.warn(logMessage);
+                        }
+                        if (mode === "block") {
+                            if (!res.headersSent && !res.writableEnded) {
+                                res.status(403).json({
+                                    error: "Forbidden",
+                                    code: "EMALICIOUSURL",
+                                    message: "The request was blocked due to suspected malicious payload."
+                                });
+                            }
+                            return;
+                        }
                     }
                 }
                 next?.();
@@ -62,8 +111,6 @@ class MaliciousUrlScanner {
                 if (logger) {
                     logger.error("security", "Failed to scan URL for malicious payloads", err);
                 }
-                // Fail open or fail closed? Usually fail closed for security, but fail open to avoid breaking app if strulink crashes.
-                // We'll call next() to fail open.
                 next?.();
             }
         };

package/dist/esm/src/middleware/built-in/security/MaliciousUrlScanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"MaliciousUrlScanner.js","sources":["../../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"sourcesContent":[null],"names":[],"mappings":";;MAMa,mBAAmB,CAAA;AAC5B;;;;;;AAMG;AACH,IAAA,OAAO,UAAU,CACb,MAAA,GAA8C,KAAK,EACnD,MAAe,EAAA;;QAGf,IAAI,aAAa,GAA8B,EAAE;AAEjD,QAAA,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE;AAC7B,YAAA,IAAI,CAAC,MAAM;AAAE,gBAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;YAC9F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpD;aAAO;YACH,aAAa,GAAG,MAAM;QAC1B;AAEA,QAAA,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE;AACjC,YAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;QACrF;AAEA,QAAA,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO;AAC1C,QAAA,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI;AACrC,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,WAAW,EAAE,GAAG;AAChB,YAAA,QAAQ,EAAE;AACN,gBAAA,iBAAiB,EAAE,CAAC;AACpB,gBAAA,gBAAgB,EAAE;AACrB;SACJ;QAED,OAAO,OAAO,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAI;AAC1E,YAAA,IAAI;;gBAEA,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;AAC5C,gBAAA,MAAM,OAAO,GAAG,CAAA,EAAG,QAAQ,MAAM,IAAI,CAAA,EAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE;gBAEpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;AAEvD,gBAAA,IAAI,MAAM,CAAC,WAAW,EAAE;oBACpB,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACnE,oBAAA,MAAM,UAAU,GAAG,CAAA,qDAAA,EAAwD,MAAM,CAAC,KAAK,CAAA,YAAA,EAAe,OAAO,CAAA,OAAA,EAAU,GAAG,CAAC,GAAG,EAAE;oBAEhI,IAAI,MAAM,EAAE;AACR,wBAAA,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;oBACvC;yBAAO;AACH,wBAAA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;oBAC5B;AAEA,oBAAA,IAAI,IAAI,KAAK,OAAO,EAAE;AAClB,wBAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACjB,4BAAA,KAAK,EAAE,WAAW;AAClB,4BAAA,IAAI,EAAE,eAAe;AACrB,4BAAA,OAAO,EAAE;AACZ,yBAAA,CAAC;wBACF;oBACJ;gBACJ;gBAEA,IAAI,IAAI;YACZ;YAAE,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,EAAE;oBACR,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC;gBACvF;;;gBAGA,IAAI,IAAI;YACZ;AACJ,QAAA,CAAC;IACL;AACH;;;;"}
+{"version":3,"file":"MaliciousUrlScanner.js","sources":["../../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAMA,MAAM,UAAU,GAAG,iEAAiE;AACpF,MAAM,UAAU,GAAG,oBAAoB;AACvC,MAAM,gBAAgB,GAAG,sBAAsB;MAElC,mBAAmB,CAAA;AAC5B;;;;;;AAMG;AACH,IAAA,OAAO,UAAU,CACb,MAAA,GAA8C,KAAK,EACnD,MAAe,EAAA;;QAGf,IAAI,aAAa,GAA8B,EAAE;AAEjD,QAAA,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE;AAC7B,YAAA,IAAI,CAAC,MAAM;AAAE,gBAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;YAC9F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpD;aAAO;YACH,aAAa,GAAG,MAAM;QAC1B;AAEA,QAAA,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE;AACjC,YAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;QACrF;AAEA,QAAA,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO;AAC1C,QAAA,MAAM,OAAO,GAAG;AACZ,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,WAAW,EAAE,GAAG;YAChB,qBAAqB,EAAE,KAAK;YAC5B,GAAG,aAAa,CAAC,OAAO;AACxB,YAAA,QAAQ,EAAE;AACN,gBAAA,iBAAiB,EAAE,CAAC;AACpB,gBAAA,gBAAgB,EAAE,GAAG;AACrB,gBAAA,GAAI,aAAa,CAAC,OAAe,EAAE,QAAQ;AAC9C,aAAA;SACJ;QAED,OAAO,OAAO,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAI;AAC1E,YAAA,IAAI;AACA,gBAAA,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;;AAGlE,gBAAA,IAAI,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;AACrE,oBAAA,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,YAAY,EAAE;AAC9C,wBAAA,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE;AAC7B,4BAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gCACzB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;AAAO,iCAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;iCAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;gCAC3D,OAAO,IAAI,IAAI;4BACnB;wBACJ;6BAAO,IAAI,OAAO,YAAY,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;4BAC3D,OAAO,IAAI,IAAI;wBACnB;oBACJ;gBACJ;;gBAGA,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;AAC5C,gBAAA,MAAM,OAAO,GAAG,CAAA,EAAG,QAAQ,MAAM,IAAI,CAAA,EAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE;gBAEpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAc,CAAC;AAE9D,gBAAA,IAAI,MAAM,CAAC,WAAW,EAAE;;AAEpB,oBAAA,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAM,KAAI;wBACtE,IAAI,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;AAChD,4BAAA,OAAO,KAAK;wBAChB;AACA,wBAAA,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc,EAAE;AAC9D,4BAAA,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE;4BAChC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AAC5E,gCAAA,OAAO,KAAK;4BAChB;wBACJ;AACA,wBAAA,OAAO,IAAI;AACf,oBAAA,CAAC,CAAC;AAEF,oBAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAM,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AAClE,wBAAA,MAAM,UAAU,GAAG,CAAA,qDAAA,EAAwD,MAAM,CAAC,KAAK,CAAA,YAAA,EAAe,OAAO,CAAA,OAAA,EAAU,GAAG,CAAC,GAAG,EAAE;wBAEhI,IAAI,MAAM,EAAE;AACR,4BAAA,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;wBACvC;6BAAO;AACH,4BAAA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;wBAC5B;AAEA,wBAAA,IAAI,IAAI,KAAK,OAAO,EAAE;4BAClB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;AACxC,gCAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACjB,oCAAA,KAAK,EAAE,WAAW;AAClB,oCAAA,IAAI,EAAE,eAAe;AACrB,oCAAA,OAAO,EAAE;AACZ,iCAAA,CAAC;4BACN;4BACA;wBACJ;oBACJ;gBACJ;gBAEA,IAAI,IAAI;YACZ;YAAE,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,EAAE;oBACR,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC;gBACvF;gBACA,IAAI,IAAI;YACZ;AACJ,QAAA,CAAC;IACL;AACH;;;;"}

package/dist/esm/src/server/routing/modules/registry.js

@@ -119,8 +119,12 @@ function mountRouter(mountPath, subRouter, internalState) {
                         handler: entry.handler,
                     };
                 }
+                // NOTE: Do NOT inject `path: normalizedMountPath` here for unscoped/route-level middleware
+                // or guards (e.g. guards from router.group() or RichRouteOptions).
+                // Injecting a strict path prefix here causes HttpServer to filter out the middleware
+                // on parameterized/nested routes (e.g. /client-api/groups/:groupId).
+                // Ref: https://github.com/Nehonix-Team/XyPriss/issues/40
                 return {
-                    path: normalizedMountPath,
                     handler: entry.handler,
                 };
             });

package/dist/esm/src/server/routing/modules/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sources":["../../../../../../src/server/routing/modules/registry.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAuCA;;AAEG;AACG,SAAU,YAAY,CACxB,MAAqB,EACrB,MAAc,EACd,IAAY,EACZ,IAAW,EACX,aAMC,EAAA;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACvC,QAAA,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;IAC7D;IACA,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AACnC,QAAA,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;IAC5D;AACA,IAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3C,MAAM,IAAI,KAAK,CACX,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,+BAAA,CAAiC,CAC3D;IACL;AAEA,IAAA,IAAI,WAAyC;AAC7C,IAAA,IAAI,QAA+C;AAEnD,IAAA,IACI,IAAI,CAAC,MAAM,IAAI,CAAC;AAChB,QAAA,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;AAC3B,QAAA,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvB,QAAA,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAC/B;AACE,QAAA,WAAW,GAAG,IAAI,CAAC,CAAC,CAAqB;AACzC,QAAA,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5B;SAAO;QACH,QAAQ,GAAG,IAAI;IACnB;AAEA,IAAA,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACX,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,wCAAA,CAA0C,CACpE;IACL;AAEA,IAAA,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC;AAE1C,IAAA,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE;AAC9B,QAAA,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAA,CAAE,CAAC;IACnD;AAEA,IAAA,MAAM,MAAM,GAAG,gBAAgB,CAC3B,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,eAAe,CAChC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAyB;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAiB;AAE7D,IAAA,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE;QAC/B,MAAM,IAAI,KAAK,CACX,CAAA,2CAAA,EAA8C,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CACjE;IACL;;AAGA,IAAA,MAAM,WAAW,GAAG,WAAW,EAAE,MAAM;AACvC,IAAA,IAAI,eAA+C;IAEnD,IAAI,WAAW,EAAE;QACb,eAAe,GAAG,qBAAqB,CACnC,WAAW,EACX,aAAa,CAAC,MAAM,CACvB;IACL;AAEA,IAAA,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,mBAAmB,CACjE,cAAc,EACd,aAAa,CAAC,OAAO,CACxB;IAED,MAAM,sBAAsB,GAAsB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AACrE,QAAA,OAAO,EAAE,CAAC;AACb,KAAA,CAAC,CAAC;IAEH,IAAI,eAAe,EAAE;QACjB,sBAAsB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAChE;AAEA,IAAA,IAAI,WAAW,EAAE,KAAK,EAAE;QACpB,sBAAsB,CAAC,OAAO,CAAC;AAC3B,YAAA,OAAO,EAAE,qBAAqB,CAAC,WAAW,CAAC,KAAK,CAAC;AACpD,SAAA,CAAC;IACN;IAEA,IAAI,YAAY,GAAG,OAAO;AAC1B,IAAA,IAAI,WAAW,EAAE,SAAS,EAAE;QACxB,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAQ;IAC3E;AAEA,IAAA,MAAM,kBAAkB,GAAG;QACvB,GAAG,aAAa,CAAC,UAAU;AAC3B,QAAA,GAAG,sBAAsB;KAC5B;AAED,IAAA,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,OAAO,GACR,WAAW,EAAE,IAAI,EAAE,OAA8B,IAAI,eAAe;AAEzE,IAAA,MAAM,KAAK,GAAwB;QAC/B,EAAE,EAAE,WAAW,EAAE;AACjB,QAAA,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;AAC5B,QAAA,IAAI,EAAE,cAAc;AACpB,QAAA,YAAY,EAAE,cAAc;AAC5B,QAAA,OAAO,EAAE,YAAY;AACrB,QAAA,UAAU,EAAE,kBAAkB;QAC9B,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,MAAM,EAAE,WAAW,EAAE,MAAM;QAC3B,SAAS,EAAE,WAAW,EAAE,SAAS;QACjC,SAAS,EAAE,WAAW,EAAE,SAAS;QACjC,KAAK,EAAE,WAAW,EAAE,KAAK;QACzB,IAAI,EAAE,WAAW,EAAE,IAAI;QACvB,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,IAAI,iBAAiB,CAAC,OAAO,CAAC;AACrE,QAAA,QAAQ,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC;QACpC,MAAM;QACN,OAAO;KACV;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAC9C,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CACrC;AACD,IAAA,IAAI,WAAW,KAAK,EAAE,EAAE;AACpB,QAAA,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IACpC;SAAO;QACH,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC;IACtD;AAEA,IAAA,aAAa,CAAC,MAAM,CAAC,KAAK,CACtB,QAAQ,EACR,CAAA,aAAA,EAAgB,KAAK,CAAC,EAAE,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,CAAE;SACnD,OAAO,GAAG,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,CAAG,GAAG,EAAE,CAAC;SAChC,MAAM,GAAG,EAAE,GAAG,aAAa,CAAC,CACpC;AACL;AAEA;;AAEG;SACa,WAAW,CACvB,SAAiB,EACjB,SAA0B,EAC1B,aAMC,EAAA;IAED,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,UAAU,EAAE;AAC5D,QAAA,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;IACvD;AAEA,IAAA,MAAM,mBAAmB,GAAG,aAAa,CAAC,SAAS,CAAC;IAEpD,SAAS,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,KAAI;AACvC,QAAA,IAAI;YACA,MAAM,QAAQ,GAAG,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC;AACnE,YAAA,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAC3C,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC;YAExD,MAAM,iBAAiB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,KAAI;AACrD,gBAAA,IAAI,KAAK,CAAC,IAAI,EAAE;oBACZ,OAAO;wBACH,IAAI,EAAE,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC;wBAChD,OAAO,EAAE,KAAK,CAAC,OAAO;qBACzB;gBACL;gBACA,OAAO;AACH,oBAAA,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,KAAK,CAAC,OAAO;iBACzB;AACL,YAAA,CAAC,CAAC;AAEF,YAAA,MAAM,kBAAkB,GAAG;gBACvB,GAAG,aAAa,CAAC,UAAU;AAC3B,gBAAA,GAAG,iBAAiB;aACvB;AAED,YAAA,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO;AACrC,YAAA,MAAM,YAAY,GAAwB;AACtC,gBAAA,GAAG,KAAK;AACR,gBAAA,IAAI,EAAE,QAAQ;AACd,gBAAA,YAAY,EAAE,QAAQ;gBACtB,OAAO;gBACP,UAAU;gBACV,gBAAgB;AAChB,gBAAA,UAAU,EAAE,kBAAkB;gBAC9B,OAAO,EAAE,CACL,GAAkB,EAClB,GAAmB,EACnB,IAAS,KACT;AACA,oBAAA,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE;oBACrC,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,mBAAmB,CAAC;oBACzD,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;gBAC1C,CAAC;aACJ;AAED,YAAA,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAC3C;QAAE,OAAO,KAAK,EAAE;AACZ,YAAA,aAAa,CAAC,MAAM,CAAC,KAAK,CACtB,QAAQ,EACR,CAAA,sBAAA,EAAyB,KAAK,CAAC,MAAM,CAAA,CAAA,EAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAA,CAAE,CAClE;AACD,YAAA,MAAM,KAAK;QACf;AACJ,IAAA,CAAC,CAAC;AACN;;;;"}
+{"version":3,"file":"registry.js","sources":["../../../../../../src/server/routing/modules/registry.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;AAuCA;;AAEG;AACG,SAAU,YAAY,CACxB,MAAqB,EACrB,MAAc,EACd,IAAY,EACZ,IAAW,EACX,aAMC,EAAA;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;AACvC,QAAA,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC;IAC7D;IACA,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AACnC,QAAA,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;IAC5D;AACA,IAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE;QAC3C,MAAM,IAAI,KAAK,CACX,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,+BAAA,CAAiC,CAC3D;IACL;AAEA,IAAA,IAAI,WAAyC;AAC7C,IAAA,IAAI,QAA+C;AAEnD,IAAA,IACI,IAAI,CAAC,MAAM,IAAI,CAAC;AAChB,QAAA,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;AAC3B,QAAA,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAChB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvB,QAAA,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,EAC/B;AACE,QAAA,WAAW,GAAG,IAAI,CAAC,CAAC,CAAqB;AACzC,QAAA,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5B;SAAO;QACH,QAAQ,GAAG,IAAI;IACnB;AAEA,IAAA,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;QACvB,MAAM,IAAI,KAAK,CACX,CAAA,MAAA,EAAS,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,wCAAA,CAA0C,CACpE;IACL;AAEA,IAAA,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC;AAE1C,IAAA,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE;AAC9B,QAAA,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAA,CAAE,CAAC;IACnD;AAEA,IAAA,MAAM,MAAM,GAAG,gBAAgB,CAC3B,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,eAAe,CAChC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAyB;IAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAiB;AAE7D,IAAA,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE;QAC/B,MAAM,IAAI,KAAK,CACX,CAAA,2CAAA,EAA8C,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CACjE;IACL;;AAGA,IAAA,MAAM,WAAW,GAAG,WAAW,EAAE,MAAM;AACvC,IAAA,IAAI,eAA+C;IAEnD,IAAI,WAAW,EAAE;QACb,eAAe,GAAG,qBAAqB,CACnC,WAAW,EACX,aAAa,CAAC,MAAM,CACvB;IACL;AAEA,IAAA,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,mBAAmB,CACjE,cAAc,EACd,aAAa,CAAC,OAAO,CACxB;IAED,MAAM,sBAAsB,GAAsB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AACrE,QAAA,OAAO,EAAE,CAAC;AACb,KAAA,CAAC,CAAC;IAEH,IAAI,eAAe,EAAE;QACjB,sBAAsB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAChE;AAEA,IAAA,IAAI,WAAW,EAAE,KAAK,EAAE;QACpB,sBAAsB,CAAC,OAAO,CAAC;AAC3B,YAAA,OAAO,EAAE,qBAAqB,CAAC,WAAW,CAAC,KAAK,CAAC;AACpD,SAAA,CAAC;IACN;IAEA,IAAI,YAAY,GAAG,OAAO;AAC1B,IAAA,IAAI,WAAW,EAAE,SAAS,EAAE;QACxB,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAQ;IAC3E;AAEA,IAAA,MAAM,kBAAkB,GAAG;QACvB,GAAG,aAAa,CAAC,UAAU;AAC3B,QAAA,GAAG,sBAAsB;KAC5B;AAED,IAAA,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,OAAO,GACR,WAAW,EAAE,IAAI,EAAE,OAA8B,IAAI,eAAe;AAEzE,IAAA,MAAM,KAAK,GAAwB;QAC/B,EAAE,EAAE,WAAW,EAAE;AACjB,QAAA,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;AAC5B,QAAA,IAAI,EAAE,cAAc;AACpB,QAAA,YAAY,EAAE,cAAc;AAC5B,QAAA,OAAO,EAAE,YAAY;AACrB,QAAA,UAAU,EAAE,kBAAkB;QAC9B,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,MAAM,EAAE,WAAW,EAAE,MAAM;QAC3B,SAAS,EAAE,WAAW,EAAE,SAAS;QACjC,SAAS,EAAE,WAAW,EAAE,SAAS;QACjC,KAAK,EAAE,WAAW,EAAE,KAAK;QACzB,IAAI,EAAE,WAAW,EAAE,IAAI;QACvB,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,IAAI,iBAAiB,CAAC,OAAO,CAAC;AACrE,QAAA,QAAQ,EAAE,WAAW,EAAE,QAAQ,IAAI,CAAC;QACpC,MAAM;QACN,OAAO;KACV;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAC9C,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CACrC;AACD,IAAA,IAAI,WAAW,KAAK,EAAE,EAAE;AACpB,QAAA,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IACpC;SAAO;QACH,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,KAAK,CAAC;IACtD;AAEA,IAAA,aAAa,CAAC,MAAM,CAAC,KAAK,CACtB,QAAQ,EACR,CAAA,aAAA,EAAgB,KAAK,CAAC,EAAE,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,EAAI,cAAc,CAAA,CAAE;SACnD,OAAO,GAAG,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,CAAG,GAAG,EAAE,CAAC;SAChC,MAAM,GAAG,EAAE,GAAG,aAAa,CAAC,CACpC;AACL;AAEA;;AAEG;SACa,WAAW,CACvB,SAAiB,EACjB,SAA0B,EAC1B,aAMC,EAAA;IAED,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,UAAU,EAAE;AAC5D,QAAA,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC;IACvD;AAEA,IAAA,MAAM,mBAAmB,GAAG,aAAa,CAAC,SAAS,CAAC;IAEpD,SAAS,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,KAAI;AACvC,QAAA,IAAI;YACA,MAAM,QAAQ,GAAG,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC;AACnE,YAAA,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAC3C,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC;YAExD,MAAM,iBAAiB,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,KAAI;AACrD,gBAAA,IAAI,KAAK,CAAC,IAAI,EAAE;oBACZ,OAAO;wBACH,IAAI,EAAE,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,IAAI,CAAC;wBAChD,OAAO,EAAE,KAAK,CAAC,OAAO;qBACzB;gBACL;;;;;;gBAMA,OAAO;oBACH,OAAO,EAAE,KAAK,CAAC,OAAO;iBACzB;AACL,YAAA,CAAC,CAAC;AAEF,YAAA,MAAM,kBAAkB,GAAG;gBACvB,GAAG,aAAa,CAAC,UAAU;AAC3B,gBAAA,GAAG,iBAAiB;aACvB;AAED,YAAA,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO;AACrC,YAAA,MAAM,YAAY,GAAwB;AACtC,gBAAA,GAAG,KAAK;AACR,gBAAA,IAAI,EAAE,QAAQ;AACd,gBAAA,YAAY,EAAE,QAAQ;gBACtB,OAAO;gBACP,UAAU;gBACV,gBAAgB;AAChB,gBAAA,UAAU,EAAE,kBAAkB;gBAC9B,OAAO,EAAE,CACL,GAAkB,EAClB,GAAmB,EACnB,IAAS,KACT;AACA,oBAAA,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE;oBACrC,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC,WAAW,EAAE,mBAAmB,CAAC;oBACzD,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;gBAC1C,CAAC;aACJ;AAED,YAAA,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAC3C;QAAE,OAAO,KAAK,EAAE;AACZ,YAAA,aAAa,CAAC,MAAM,CAAC,KAAK,CACtB,QAAQ,EACR,CAAA,sBAAA,EAAyB,KAAK,CAAC,MAAM,CAAA,CAAA,EAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAA,CAAE,CAClE;AACD,YAAA,MAAM,KAAK;QACf;AACJ,IAAA,CAAC,CAAC;AACN;;;;"}

package/dist/index.d.ts

@@ -1604,6 +1604,15 @@ interface MaliciousUrlScannerConfig {
      * - "log": Allow the request but log a security warning
      */
     mode?: "block" | "log";
+    /**
+     * Paths or regex patterns to exclude from malicious URL scanning
+     * e.g. ["/static/**", "/tmp-storage/**", /^\/api\/presence\//]
+     */
+    excludePaths?: (string | RegExp)[];
+    /**
+     * Pattern types to ignore (e.g. ["encoded_payload", "suspicious_param_name"])
+     */
+    ignorePatterns?: string[];
     /** Custom options passed directly to [StruLink](https://github.com/Nehonix-Team/strulink)'s `scanUrl` method */
     options?: MaliciousPatternOptions;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "xypriss",
-    "version": "9.12.44",
+    "version": "9.12.46",
     "description": "XyPriss is a high-performance, TypeScript-first hyper-system web framework powered by a native Go core (XHSC), featuring robust multi-tenant sandboxing, secure native file streaming, and zero Express dependencies.",
     "author": {
         "DEV.to": "https://dev.to/nehonix",