xypriss 9.12.53 → 9.12.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -4,7 +4,7 @@ var strulink = require('strulink');
4
4
 
5
5
  const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
6
6
  const HASH_REGEX = /^[0-9a-f]{16,64}$/i;
7
- const SAFE_PARAM_REGEX = /^[a-zA-Z0-9_\-.~%]+$/;
7
+ const SAFE_PARAM_REGEX = /^[a-zA-Z0-9_\-.~%@,]+$/;
8
8
  class MaliciousUrlScanner {
9
9
  /**
10
10
  * Middleware for scanning incoming URLs for malicious payloads (XSS, Path Traversal, etc.)
@@ -73,25 +73,36 @@ class MaliciousUrlScanner {
73
73
  const fullUrl = `${protocol}://${host}${req.originalUrl || req.url}`;
74
74
  const result = await strulink.__strl__.scanUrl(fullUrl, options);
75
75
  if (result.isMalicious) {
76
- // Filter heuristic false positives on standard UUIDs, hashes, and benign params
76
+ // Filter heuristic false positives on standard UUIDs, hashes, standard param names and benign values
77
77
  const genuinePatterns = (result.detectedPatterns || []).filter((p) => {
78
78
  if (scannerConfig.ignorePatterns?.includes(p.type)) {
79
79
  return false;
80
80
  }
81
+ // Ignore benign parameter name alerts (e.g. "password", "token", "auth") in standard API routes
82
+ if (p.type === "suspicious_parameter") {
83
+ return false;
84
+ }
81
85
  if (p.type === "encoded_payload" ||
82
86
  p.type === "multi_encoding" ||
83
87
  p.pattern === "high_entropy" ||
84
88
  p.pattern === "multi_layer_encoding") {
85
89
  const val = p.matchedValue || "";
86
- if (UUID_REGEX.test(val) || HASH_REGEX.test(val) || SAFE_PARAM_REGEX.test(val)) {
90
+ if (!val || UUID_REGEX.test(val) || HASH_REGEX.test(val) || SAFE_PARAM_REGEX.test(val)) {
87
91
  return false;
88
92
  }
89
93
  }
90
94
  return true;
91
95
  });
92
96
  if (genuinePatterns.length > 0) {
93
- const reasons = genuinePatterns.map((p) => p.type).join(", ");
94
- const logMessage = `[MaliciousUrlScanner] Detected malicious URL (Score: ${result.score}). Reasons: ${reasons}. URL: ${req.url}`;
97
+ const details = genuinePatterns
98
+ .map((p) => {
99
+ const desc = p.description ? ` (${p.description})` : "";
100
+ const match = p.matchedValue ? ` [match: "${p.matchedValue}"]` : "";
101
+ const loc = p.location ? ` @ ${p.location}` : "";
102
+ return `${p.type}${desc}${match}${loc}`;
103
+ })
104
+ .join(" | ");
105
+ const logMessage = `[XMUrlS (MaliciousUrlScanner)] Detected malicious URL (Score: ${result.score}, Confidence: ${result.confidence || "unknown"}). URL: ${req.url}\n -> StruLink Detections: ${details}${result.recommendation ? `\n -> Recommendation: ${result.recommendation}` : ""}`;
95
106
  if (logger) {
96
107
  logger.warn("security", logMessage);
97
108
  }
@@ -1 +1 @@
1
- {"version":3,"file":"MaliciousUrlScanner.js","sources":["../../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"sourcesContent":[null],"names":["__strl__"],"mappings":";;;;AAMA,MAAM,UAAU,GAAG,iEAAiE;AACpF,MAAM,UAAU,GAAG,oBAAoB;AACvC,MAAM,gBAAgB,GAAG,sBAAsB;MAElC,mBAAmB,CAAA;AAC5B;;;;;;AAMG;AACH,IAAA,OAAO,UAAU,CACb,MAAA,GAA8C,KAAK,EACnD,MAAe,EAAA;;QAGf,IAAI,aAAa,GAA8B,EAAE;AAEjD,QAAA,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE;AAC7B,YAAA,IAAI,CAAC,MAAM;AAAE,gBAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;YAC9F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpD;aAAO;YACH,aAAa,GAAG,MAAM;QAC1B;AAEA,QAAA,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE;AACjC,YAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;QACrF;AAEA,QAAA,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO;AAC1C,QAAA,MAAM,OAAO,GAAG;AACZ,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,WAAW,EAAE,GAAG;YAChB,qBAAqB,EAAE,KAAK;YAC5B,GAAG,aAAa,CAAC,OAAO;AACxB,YAAA,QAAQ,EAAE;AACN,gBAAA,iBAAiB,EAAE,CAAC;AACpB,gBAAA,gBAAgB,EAAE,GAAG;AACrB,gBAAA,GAAI,aAAa,CAAC,OAAe,EAAE,QAAQ;AAC9C,aAAA;SACJ;QAED,OAAO,OAAO,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAI;AAC1E,YAAA,IAAI;AACA,gBAAA,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;;AAGlE,gBAAA,IAAI,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;AACrE,oBAAA,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,YAAY,EAAE;AAC9C,wBAAA,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE;AAC7B,4BAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gCACzB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;AAAO,iCAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;iCAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;gCAC3D,OAAO,IAAI,IAAI;4BACnB;wBACJ;6BAAO,IAAI,OAAO,YAAY,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;4BAC3D,OAAO,IAAI,IAAI;wBACnB;oBACJ;gBACJ;;gBAGA,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;AAC5C,gBAAA,MAAM,OAAO,GAAG,CAAA,EAAG,QAAQ,MAAM,IAAI,CAAA,EAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE;gBAEpE,MAAM,MAAM,GAAG,MAAMA,iBAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAc,CAAC;AAE9D,gBAAA,IAAI,MAAM,CAAC,WAAW,EAAE;;AAEpB,oBAAA,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAM,KAAI;wBACtE,IAAI,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;AAChD,4BAAA,OAAO,KAAK;wBAChB;AACA,wBAAA,IACI,CAAC,CAAC,IAAI,KAAK,iBAAiB;4BAC5B,CAAC,CAAC,IAAI,KAAK,gBAAgB;4BAC3B,CAAC,CAAC,OAAO,KAAK,cAAc;AAC5B,4BAAA,CAAC,CAAC,OAAO,KAAK,sBAAsB,EACtC;AACE,4BAAA,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE;4BAChC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AAC5E,gCAAA,OAAO,KAAK;4BAChB;wBACJ;AACA,wBAAA,OAAO,IAAI;AACf,oBAAA,CAAC,CAAC;AAEF,oBAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAM,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AAClE,wBAAA,MAAM,UAAU,GAAG,CAAA,qDAAA,EAAwD,MAAM,CAAC,KAAK,CAAA,YAAA,EAAe,OAAO,CAAA,OAAA,EAAU,GAAG,CAAC,GAAG,EAAE;wBAEhI,IAAI,MAAM,EAAE;AACR,4BAAA,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;wBACvC;6BAAO;AACH,4BAAA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;wBAC5B;AAEA,wBAAA,IAAI,IAAI,KAAK,OAAO,EAAE;4BAClB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;AACxC,gCAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACjB,oCAAA,KAAK,EAAE,WAAW;AAClB,oCAAA,IAAI,EAAE,eAAe;AACrB,oCAAA,OAAO,EAAE;AACZ,iCAAA,CAAC;4BACN;4BACA;wBACJ;oBACJ;gBACJ;gBAEA,IAAI,IAAI;YACZ;YAAE,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,EAAE;oBACR,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC;gBACvF;gBACA,IAAI,IAAI;YACZ;AACJ,QAAA,CAAC;IACL;AACH;;;;"}
1
+ {"version":3,"file":"MaliciousUrlScanner.js","sources":["../../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"sourcesContent":[null],"names":["__strl__"],"mappings":";;;;AAMA,MAAM,UAAU,GAAG,iEAAiE;AACpF,MAAM,UAAU,GAAG,oBAAoB;AACvC,MAAM,gBAAgB,GAAG,wBAAwB;MAEpC,mBAAmB,CAAA;AAC5B;;;;;;AAMG;AACH,IAAA,OAAO,UAAU,CACb,MAAA,GAA8C,KAAK,EACnD,MAAe,EAAA;;QAGf,IAAI,aAAa,GAA8B,EAAE;AAEjD,QAAA,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE;AAC7B,YAAA,IAAI,CAAC,MAAM;AAAE,gBAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;YAC9F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpD;aAAO;YACH,aAAa,GAAG,MAAM;QAC1B;AAEA,QAAA,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE;AACjC,YAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;QACrF;AAEA,QAAA,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO;AAC1C,QAAA,MAAM,OAAO,GAAG;AACZ,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,WAAW,EAAE,GAAG;YAChB,qBAAqB,EAAE,KAAK;YAC5B,GAAG,aAAa,CAAC,OAAO;AACxB,YAAA,QAAQ,EAAE;AACN,gBAAA,iBAAiB,EAAE,CAAC;AACpB,gBAAA,gBAAgB,EAAE,GAAG;AACrB,gBAAA,GAAI,aAAa,CAAC,OAAe,EAAE,QAAQ;AAC9C,aAAA;SACJ;QAED,OAAO,OAAO,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAI;AAC1E,YAAA,IAAI;AACA,gBAAA,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;;AAGlE,gBAAA,IAAI,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;AACrE,oBAAA,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,YAAY,EAAE;AAC9C,wBAAA,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE;AAC7B,4BAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gCACzB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;AAAO,iCAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;iCAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;gCAC3D,OAAO,IAAI,IAAI;4BACnB;wBACJ;6BAAO,IAAI,OAAO,YAAY,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;4BAC3D,OAAO,IAAI,IAAI;wBACnB;oBACJ;gBACJ;;gBAGA,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;AAC5C,gBAAA,MAAM,OAAO,GAAG,CAAA,EAAG,QAAQ,MAAM,IAAI,CAAA,EAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE;gBAEpE,MAAM,MAAM,GAAG,MAAMA,iBAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAc,CAAC;AAE9D,gBAAA,IAAI,MAAM,CAAC,WAAW,EAAE;;AAEpB,oBAAA,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAM,KAAI;wBACtE,IAAI,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;AAChD,4BAAA,OAAO,KAAK;wBAChB;;AAEA,wBAAA,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,EAAE;AACnC,4BAAA,OAAO,KAAK;wBAChB;AACA,wBAAA,IACI,CAAC,CAAC,IAAI,KAAK,iBAAiB;4BAC5B,CAAC,CAAC,IAAI,KAAK,gBAAgB;4BAC3B,CAAC,CAAC,OAAO,KAAK,cAAc;AAC5B,4BAAA,CAAC,CAAC,OAAO,KAAK,sBAAsB,EACtC;AACE,4BAAA,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE;4BAChC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AACpF,gCAAA,OAAO,KAAK;4BAChB;wBACJ;AACA,wBAAA,OAAO,IAAI;AACf,oBAAA,CAAC,CAAC;AAEF,oBAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC5B,MAAM,OAAO,GAAG;AACX,6BAAA,GAAG,CAAC,CAAC,CAAM,KAAI;AACZ,4BAAA,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,GAAG,CAAA,EAAA,EAAK,CAAC,CAAC,WAAW,CAAA,CAAA,CAAG,GAAG,EAAE;AACvD,4BAAA,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,GAAG,CAAA,UAAA,EAAa,CAAC,CAAC,YAAY,CAAA,EAAA,CAAI,GAAG,EAAE;AACnE,4BAAA,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAA,GAAA,EAAM,CAAC,CAAC,QAAQ,CAAA,CAAE,GAAG,EAAE;4BAChD,OAAO,CAAA,EAAG,CAAC,CAAC,IAAI,CAAA,EAAG,IAAI,CAAA,EAAG,KAAK,CAAA,EAAG,GAAG,CAAA,CAAE;AAC3C,wBAAA,CAAC;6BACA,IAAI,CAAC,KAAK,CAAC;AAEhB,wBAAA,MAAM,UAAU,GAAG,CAAA,8DAAA,EAAiE,MAAM,CAAC,KAAK,CAAA,cAAA,EAAiB,MAAM,CAAC,UAAU,IAAI,SAAS,CAAA,QAAA,EAAW,GAAG,CAAC,GAAG,CAAA,4BAAA,EAA+B,OAAO,CAAA,EAAG,MAAM,CAAC,cAAc,GAAG,CAAA,uBAAA,EAA0B,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE;wBAE1R,IAAI,MAAM,EAAE;AACR,4BAAA,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;wBACvC;6BAAO;AACH,4BAAA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;wBAC5B;AAEA,wBAAA,IAAI,IAAI,KAAK,OAAO,EAAE;4BAClB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;AACxC,gCAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACjB,oCAAA,KAAK,EAAE,WAAW;AAClB,oCAAA,IAAI,EAAE,eAAe;AACrB,oCAAA,OAAO,EAAE;AACZ,iCAAA,CAAC;4BACN;4BACA;wBACJ;oBACJ;gBACJ;gBAEA,IAAI,IAAI;YACZ;YAAE,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,EAAE;oBACR,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC;gBACvF;gBACA,IAAI,IAAI;YACZ;AACJ,QAAA,CAAC;IACL;AACH;;;;"}
@@ -2,7 +2,7 @@ import { __strl__ } from 'strulink';
2
2
 
3
3
  const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
4
4
  const HASH_REGEX = /^[0-9a-f]{16,64}$/i;
5
- const SAFE_PARAM_REGEX = /^[a-zA-Z0-9_\-.~%]+$/;
5
+ const SAFE_PARAM_REGEX = /^[a-zA-Z0-9_\-.~%@,]+$/;
6
6
  class MaliciousUrlScanner {
7
7
  /**
8
8
  * Middleware for scanning incoming URLs for malicious payloads (XSS, Path Traversal, etc.)
@@ -71,25 +71,36 @@ class MaliciousUrlScanner {
71
71
  const fullUrl = `${protocol}://${host}${req.originalUrl || req.url}`;
72
72
  const result = await __strl__.scanUrl(fullUrl, options);
73
73
  if (result.isMalicious) {
74
- // Filter heuristic false positives on standard UUIDs, hashes, and benign params
74
+ // Filter heuristic false positives on standard UUIDs, hashes, standard param names and benign values
75
75
  const genuinePatterns = (result.detectedPatterns || []).filter((p) => {
76
76
  if (scannerConfig.ignorePatterns?.includes(p.type)) {
77
77
  return false;
78
78
  }
79
+ // Ignore benign parameter name alerts (e.g. "password", "token", "auth") in standard API routes
80
+ if (p.type === "suspicious_parameter") {
81
+ return false;
82
+ }
79
83
  if (p.type === "encoded_payload" ||
80
84
  p.type === "multi_encoding" ||
81
85
  p.pattern === "high_entropy" ||
82
86
  p.pattern === "multi_layer_encoding") {
83
87
  const val = p.matchedValue || "";
84
- if (UUID_REGEX.test(val) || HASH_REGEX.test(val) || SAFE_PARAM_REGEX.test(val)) {
88
+ if (!val || UUID_REGEX.test(val) || HASH_REGEX.test(val) || SAFE_PARAM_REGEX.test(val)) {
85
89
  return false;
86
90
  }
87
91
  }
88
92
  return true;
89
93
  });
90
94
  if (genuinePatterns.length > 0) {
91
- const reasons = genuinePatterns.map((p) => p.type).join(", ");
92
- const logMessage = `[MaliciousUrlScanner] Detected malicious URL (Score: ${result.score}). Reasons: ${reasons}. URL: ${req.url}`;
95
+ const details = genuinePatterns
96
+ .map((p) => {
97
+ const desc = p.description ? ` (${p.description})` : "";
98
+ const match = p.matchedValue ? ` [match: "${p.matchedValue}"]` : "";
99
+ const loc = p.location ? ` @ ${p.location}` : "";
100
+ return `${p.type}${desc}${match}${loc}`;
101
+ })
102
+ .join(" | ");
103
+ const logMessage = `[XMUrlS (MaliciousUrlScanner)] Detected malicious URL (Score: ${result.score}, Confidence: ${result.confidence || "unknown"}). URL: ${req.url}\n -> StruLink Detections: ${details}${result.recommendation ? `\n -> Recommendation: ${result.recommendation}` : ""}`;
93
104
  if (logger) {
94
105
  logger.warn("security", logMessage);
95
106
  }
@@ -1 +1 @@
1
- {"version":3,"file":"MaliciousUrlScanner.js","sources":["../../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAMA,MAAM,UAAU,GAAG,iEAAiE;AACpF,MAAM,UAAU,GAAG,oBAAoB;AACvC,MAAM,gBAAgB,GAAG,sBAAsB;MAElC,mBAAmB,CAAA;AAC5B;;;;;;AAMG;AACH,IAAA,OAAO,UAAU,CACb,MAAA,GAA8C,KAAK,EACnD,MAAe,EAAA;;QAGf,IAAI,aAAa,GAA8B,EAAE;AAEjD,QAAA,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE;AAC7B,YAAA,IAAI,CAAC,MAAM;AAAE,gBAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;YAC9F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpD;aAAO;YACH,aAAa,GAAG,MAAM;QAC1B;AAEA,QAAA,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE;AACjC,YAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;QACrF;AAEA,QAAA,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO;AAC1C,QAAA,MAAM,OAAO,GAAG;AACZ,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,WAAW,EAAE,GAAG;YAChB,qBAAqB,EAAE,KAAK;YAC5B,GAAG,aAAa,CAAC,OAAO;AACxB,YAAA,QAAQ,EAAE;AACN,gBAAA,iBAAiB,EAAE,CAAC;AACpB,gBAAA,gBAAgB,EAAE,GAAG;AACrB,gBAAA,GAAI,aAAa,CAAC,OAAe,EAAE,QAAQ;AAC9C,aAAA;SACJ;QAED,OAAO,OAAO,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAI;AAC1E,YAAA,IAAI;AACA,gBAAA,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;;AAGlE,gBAAA,IAAI,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;AACrE,oBAAA,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,YAAY,EAAE;AAC9C,wBAAA,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE;AAC7B,4BAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gCACzB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;AAAO,iCAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;iCAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;gCAC3D,OAAO,IAAI,IAAI;4BACnB;wBACJ;6BAAO,IAAI,OAAO,YAAY,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;4BAC3D,OAAO,IAAI,IAAI;wBACnB;oBACJ;gBACJ;;gBAGA,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;AAC5C,gBAAA,MAAM,OAAO,GAAG,CAAA,EAAG,QAAQ,MAAM,IAAI,CAAA,EAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE;gBAEpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAc,CAAC;AAE9D,gBAAA,IAAI,MAAM,CAAC,WAAW,EAAE;;AAEpB,oBAAA,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAM,KAAI;wBACtE,IAAI,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;AAChD,4BAAA,OAAO,KAAK;wBAChB;AACA,wBAAA,IACI,CAAC,CAAC,IAAI,KAAK,iBAAiB;4BAC5B,CAAC,CAAC,IAAI,KAAK,gBAAgB;4BAC3B,CAAC,CAAC,OAAO,KAAK,cAAc;AAC5B,4BAAA,CAAC,CAAC,OAAO,KAAK,sBAAsB,EACtC;AACE,4BAAA,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE;4BAChC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AAC5E,gCAAA,OAAO,KAAK;4BAChB;wBACJ;AACA,wBAAA,OAAO,IAAI;AACf,oBAAA,CAAC,CAAC;AAEF,oBAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAM,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AAClE,wBAAA,MAAM,UAAU,GAAG,CAAA,qDAAA,EAAwD,MAAM,CAAC,KAAK,CAAA,YAAA,EAAe,OAAO,CAAA,OAAA,EAAU,GAAG,CAAC,GAAG,EAAE;wBAEhI,IAAI,MAAM,EAAE;AACR,4BAAA,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;wBACvC;6BAAO;AACH,4BAAA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;wBAC5B;AAEA,wBAAA,IAAI,IAAI,KAAK,OAAO,EAAE;4BAClB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;AACxC,gCAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACjB,oCAAA,KAAK,EAAE,WAAW;AAClB,oCAAA,IAAI,EAAE,eAAe;AACrB,oCAAA,OAAO,EAAE;AACZ,iCAAA,CAAC;4BACN;4BACA;wBACJ;oBACJ;gBACJ;gBAEA,IAAI,IAAI;YACZ;YAAE,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,EAAE;oBACR,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC;gBACvF;gBACA,IAAI,IAAI;YACZ;AACJ,QAAA,CAAC;IACL;AACH;;;;"}
1
+ {"version":3,"file":"MaliciousUrlScanner.js","sources":["../../../../../../src/middleware/built-in/security/MaliciousUrlScanner.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAMA,MAAM,UAAU,GAAG,iEAAiE;AACpF,MAAM,UAAU,GAAG,oBAAoB;AACvC,MAAM,gBAAgB,GAAG,wBAAwB;MAEpC,mBAAmB,CAAA;AAC5B;;;;;;AAMG;AACH,IAAA,OAAO,UAAU,CACb,MAAA,GAA8C,KAAK,EACnD,MAAe,EAAA;;QAGf,IAAI,aAAa,GAA8B,EAAE;AAEjD,QAAA,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE;AAC7B,YAAA,IAAI,CAAC,MAAM;AAAE,gBAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;YAC9F,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;QACpD;aAAO;YACH,aAAa,GAAG,MAAM;QAC1B;AAEA,QAAA,IAAI,aAAa,CAAC,OAAO,KAAK,KAAK,EAAE;AACjC,YAAA,OAAO,CAAC,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAK,IAAI,IAAI;QACrF;AAEA,QAAA,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO;AAC1C,QAAA,MAAM,OAAO,GAAG;AACZ,YAAA,QAAQ,EAAE,EAAE;AACZ,YAAA,WAAW,EAAE,GAAG;YAChB,qBAAqB,EAAE,KAAK;YAC5B,GAAG,aAAa,CAAC,OAAO;AACxB,YAAA,QAAQ,EAAE;AACN,gBAAA,iBAAiB,EAAE,CAAC;AACpB,gBAAA,gBAAgB,EAAE,GAAG;AACrB,gBAAA,GAAI,aAAa,CAAC,OAAe,EAAE,QAAQ;AAC9C,aAAA;SACJ;QAED,OAAO,OAAO,GAAkB,EAAE,GAAmB,EAAE,IAAmB,KAAI;AAC1E,YAAA,IAAI;AACA,gBAAA,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;;AAGlE,gBAAA,IAAI,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE;AACrE,oBAAA,KAAK,MAAM,OAAO,IAAI,aAAa,CAAC,YAAY,EAAE;AAC9C,wBAAA,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE;AAC7B,4BAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;gCACzB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;AAAO,iCAAA,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;gCAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,gCAAA,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE;oCACxD,OAAO,IAAI,IAAI;gCACnB;4BACJ;iCAAO,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;gCAC3D,OAAO,IAAI,IAAI;4BACnB;wBACJ;6BAAO,IAAI,OAAO,YAAY,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;4BAC3D,OAAO,IAAI,IAAI;wBACnB;oBACJ;gBACJ;;gBAGA,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,MAAM;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW;AAC5C,gBAAA,MAAM,OAAO,GAAG,CAAA,EAAG,QAAQ,MAAM,IAAI,CAAA,EAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,EAAE;gBAEpE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAc,CAAC;AAE9D,gBAAA,IAAI,MAAM,CAAC,WAAW,EAAE;;AAEpB,oBAAA,MAAM,eAAe,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAM,KAAI;wBACtE,IAAI,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;AAChD,4BAAA,OAAO,KAAK;wBAChB;;AAEA,wBAAA,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,EAAE;AACnC,4BAAA,OAAO,KAAK;wBAChB;AACA,wBAAA,IACI,CAAC,CAAC,IAAI,KAAK,iBAAiB;4BAC5B,CAAC,CAAC,IAAI,KAAK,gBAAgB;4BAC3B,CAAC,CAAC,OAAO,KAAK,cAAc;AAC5B,4BAAA,CAAC,CAAC,OAAO,KAAK,sBAAsB,EACtC;AACE,4BAAA,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE;4BAChC,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AACpF,gCAAA,OAAO,KAAK;4BAChB;wBACJ;AACA,wBAAA,OAAO,IAAI;AACf,oBAAA,CAAC,CAAC;AAEF,oBAAA,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE;wBAC5B,MAAM,OAAO,GAAG;AACX,6BAAA,GAAG,CAAC,CAAC,CAAM,KAAI;AACZ,4BAAA,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,GAAG,CAAA,EAAA,EAAK,CAAC,CAAC,WAAW,CAAA,CAAA,CAAG,GAAG,EAAE;AACvD,4BAAA,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,GAAG,CAAA,UAAA,EAAa,CAAC,CAAC,YAAY,CAAA,EAAA,CAAI,GAAG,EAAE;AACnE,4BAAA,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAA,GAAA,EAAM,CAAC,CAAC,QAAQ,CAAA,CAAE,GAAG,EAAE;4BAChD,OAAO,CAAA,EAAG,CAAC,CAAC,IAAI,CAAA,EAAG,IAAI,CAAA,EAAG,KAAK,CAAA,EAAG,GAAG,CAAA,CAAE;AAC3C,wBAAA,CAAC;6BACA,IAAI,CAAC,KAAK,CAAC;AAEhB,wBAAA,MAAM,UAAU,GAAG,CAAA,8DAAA,EAAiE,MAAM,CAAC,KAAK,CAAA,cAAA,EAAiB,MAAM,CAAC,UAAU,IAAI,SAAS,CAAA,QAAA,EAAW,GAAG,CAAC,GAAG,CAAA,4BAAA,EAA+B,OAAO,CAAA,EAAG,MAAM,CAAC,cAAc,GAAG,CAAA,uBAAA,EAA0B,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE;wBAE1R,IAAI,MAAM,EAAE;AACR,4BAAA,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;wBACvC;6BAAO;AACH,4BAAA,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;wBAC5B;AAEA,wBAAA,IAAI,IAAI,KAAK,OAAO,EAAE;4BAClB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;AACxC,gCAAA,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AACjB,oCAAA,KAAK,EAAE,WAAW;AAClB,oCAAA,IAAI,EAAE,eAAe;AACrB,oCAAA,OAAO,EAAE;AACZ,iCAAA,CAAC;4BACN;4BACA;wBACJ;oBACJ;gBACJ;gBAEA,IAAI,IAAI;YACZ;YAAE,OAAO,GAAG,EAAE;gBACV,IAAI,MAAM,EAAE;oBACR,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,2CAA2C,EAAE,GAAY,CAAC;gBACvF;gBACA,IAAI,IAAI;YACZ;AACJ,QAAA,CAAC;IACL;AACH;;;;"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "xypriss",
3
- "version": "9.12.53",
3
+ "version": "9.12.54",
4
4
  "description": "XyPriss is a high-performance, TypeScript-first hyper-system web framework powered by a native Go core (XHSC), featuring robust multi-tenant sandboxing, secure native file streaming, and zero Express dependencies.",
5
5
  "author": {
6
6
  "DEV.to": "https://dev.to/nehonix",