xypriss 9.6.97 → 9.7.0

package/dist/cjs/src/middleware/built-in/security/UriNormalizer.js

@@ -0,0 +1,413 @@
+'use strict';
+
+var vm = require('vm');
+
+function _interopNamespaceDefault(e) {
+    var n = Object.create(null);
+    if (e) {
+        Object.keys(e).forEach(function (k) {
+            if (k !== 'default') {
+                var d = Object.getOwnPropertyDescriptor(e, k);
+                Object.defineProperty(n, k, d.get ? d : {
+                    enumerable: true,
+                    get: function () { return e[k]; }
+                });
+            }
+        });
+    }
+    n.default = e;
+    return Object.freeze(n);
+}
+
+var vm__namespace = /*#__PURE__*/_interopNamespaceDefault(vm);
+
+/**
+ * @module UriNormalizer
+ *
+ * Normalization and security utilities for URIs and paths.
+ *
+ * ### Supported Threats
+ * - Path traversal (including encoded variants: `%2F`, `%2E`, double-encoded `%2520`)
+ * - Injection of null bytes and control characters
+ * - ReDoS attacks via sandbox execution with an adaptive timeout
+ * - Backslash smuggling (`\..\..\`)
+ * - Unicode normalized segments (NFC) to prevent traversal homoglyphs
+ *
+ * ### Non-regression Guarantees (no false positives)
+ * - Legitimate paths with encoded special characters are preserved correctly.
+ * - The trailing slash is preserved if present in the original input.
+ * - Internal empty segments are cleanly removed (`//` collapse).
+ * - The root `/` is always returned for an empty or null input.
+ *
+ * @example
+ * ```ts
+ * UriNormalizer.normalizePath("/foo/%2E%2E/bar");   // => "/bar"
+ * UriNormalizer.normalizePath("/a//b/../c/");        // => "/a/c/"
+ * UriNormalizer.safeRegexCheck(/^[a-z]+$/, "hello"); // => true
+ * ```
+ */
+class UriNormalizer {
+    // ─────────────────────────────────────────────────────────────────────────
+    // Public API
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Normalizes a URI path by resolving `.` and `..` segments, multiple
+     * slashes, backslashes, null bytes, control characters, and all URI
+     * encodings (including double-encodings such as `%2520`).
+     *
+     * Normalization follows this strict order to eliminate bypass vectors:
+     * 1. Iterative decoding until stabilization (anti double-encoding).
+     * 2. Unicode NFC normalization (anti homoglyphs).
+     * 3. Replacement of backslashes with forward slashes.
+     * 4. Removal of null bytes and control characters.
+     * 5. Collapse of multiple slashes.
+     * 6. Resolution of `.` and `..` segments.
+     * 7. Restoration of the trailing slash if the original input had one.
+     *
+     * ### Guaranteed Behaviors
+     * - `""` or `null`/`undefined` → `"/"`
+     * - Paths where all segments resolve above the root are clipped
+     *   to `"/"` (no underflow possible).
+     * - The trailing slash is faithfully preserved or removed based on the input.
+     * - Unicode control characters (U+0000–U+001F, U+007F–U+009F)
+     *   are systematically removed.
+     *
+     * @param {string} pathStr - The raw path to normalize (can be encoded).
+     * @returns {string} The normalized path, always prefixed with `/`.
+     *
+     * @example
+     * ```ts
+     * UriNormalizer.normalizePath("/foo/bar");              // "/foo/bar"
+     * UriNormalizer.normalizePath("/foo/../bar");           // "/bar"
+     * UriNormalizer.normalizePath("/foo/%2E%2E/bar");       // "/bar"
+     * UriNormalizer.normalizePath("/foo/%252E%252E/bar");   // "/bar"  (double-encoded)
+     * UriNormalizer.normalizePath("/a//b/./c/");            // "/a/b/c/"
+     * UriNormalizer.normalizePath("\\foo\\..\\bar");        // "/bar"
+     * UriNormalizer.normalizePath("/foo/\0bar");            // "/foo/bar"
+     * UriNormalizer.normalizePath("");                      // "/"
+     * ```
+     */
+    static normalizePath(pathStr) {
+        if (!pathStr)
+            return "/";
+        // Step 1: Iterative decoding to neutralize double-encodings
+        const decoded = UriNormalizer.iterativeDecode(pathStr);
+        // Step 2: Unicode NFC normalization
+        const nfc = decoded.normalize("NFC");
+        // Step 3: Replace backslashes with forward slashes
+        const forwardSlashed = nfc.replace(/\\/g, "/");
+        // Step 4: Removal of null bytes and control characters
+        const sanitized = UriNormalizer.stripControlCharacters(forwardSlashed);
+        // Step 5: Collapse multiple slashes (e.g., `///` → `/`)
+        const collapsed = sanitized.replace(/\/+/g, "/");
+        // Memorize trailing slash before resolution (it will be lost during split)
+        const hasTrailingSlash = collapsed.endsWith("/") && collapsed.length > 1;
+        // Step 6: Resolve `.` and `..` segments
+        const resolved = UriNormalizer.resolveSegments(collapsed);
+        // Step 7: Restore trailing slash
+        return hasTrailingSlash ? resolved + "/" : resolved;
+    }
+    /**
+     * Executes a regex test with a strict timeout to prevent ReDoS
+     * (Regular Expression Denial of Service) attacks.
+     *
+     * ### Protection Strategy
+     * - Short strings (< {@link REGEX_VM_LENGTH_THRESHOLD} characters) are
+     *   tested directly for performance, but the threshold has been lowered to
+     *   20 to cover catastrophic patterns on short repetitions.
+     * - Beyond the threshold, the regex is executed in an isolated Node.js VM
+     *   context with an adaptive timeout calculated by {@link computeRegexTimeout}.
+     * - In the event of a timeout or VM error, the method returns `false` **and**
+     *   throws a typed error to distinguish a real ReDoS from a false positive.
+     *
+     * ### Error Differentiation
+     * - `UriNormalizerRegexTimeoutError`: timeout reached → probable ReDoS.
+     * - Any other internal exception is propagated as-is to avoid hiding
+     *   caller layer bugs.
+     *
+     * @param {RegExp}  pattern   - The regular expression to evaluate.
+     * @param {string}  str       - The string to test against.
+     * @param {number}  [timeoutMs] - Base timeout in ms (default: {@link REGEX_BASE_TIMEOUT_MS}).
+     *                                Automatically increased based on `str` length.
+     * @returns {boolean} `true` if the regex matches, `false` otherwise or on timeout.
+     * @throws {TypeError}                    If `pattern` is not a RegExp instance.
+     * @throws {UriNormalizerRegexTimeoutError} If the VM timeout is reached (probable ReDoS).
+     *
+     * @example
+     * ```ts
+     * // Basic usage
+     * UriNormalizer.safeRegexCheck(/^[a-z]+$/, "hello");          // true
+     * UriNormalizer.safeRegexCheck(/^[a-z]+$/, "Hello");          // false
+     *
+     * // Potentially catastrophic pattern on long input
+     * try {
+     *   UriNormalizer.safeRegexCheck(/(a+)+$/, "a".repeat(5000) + "!");
+     * } catch (e) {
+     *   if (e instanceof UriNormalizerRegexTimeoutError) {
+     *     console.warn("ReDoS blocked: ", e.message);
+     *   }
+     * }
+     * ```
+     */
+    static safeRegexCheck(pattern, str, timeoutMs = UriNormalizer.REGEX_BASE_TIMEOUT_MS) {
+        // Strict pattern validation for a clear error message
+        if (!(pattern instanceof RegExp)) {
+            throw new TypeError(`UriNormalizer.safeRegexCheck: "pattern" must be an instance of RegExp, received: ${typeof pattern}`);
+        }
+        // Fast path for very short strings (negligible ReDoS risk)
+        if (str.length < UriNormalizer.REGEX_VM_LENGTH_THRESHOLD) {
+            return pattern.test(str);
+        }
+        // Calculate adaptive timeout
+        const effectiveTimeout = UriNormalizer.computeRegexTimeout(str.length, timeoutMs);
+        try {
+            const sandbox = { result: false, pattern, str };
+            const context = vm__namespace.createContext(sandbox);
+            vm__namespace.runInContext("result = pattern.test(str)", context, {
+                timeout: effectiveTimeout,
+            });
+            return sandbox.result;
+        }
+        catch (e) {
+            // Distinguish a VM timeout from an unexpected error
+            if (UriNormalizer.isVmTimeoutError(e)) {
+                throw new UriNormalizerRegexTimeoutError(`Regex exceeded timeout (${effectiveTimeout}ms) on an input of ${str.length} characters. Possible ReDoS.`, effectiveTimeout, str.length);
+            }
+            // Propagate any other VM error (e.g., internal syntax error)
+            throw e;
+        }
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Private Methods — URI Decoding
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Iteratively decodes a URI path until it is stable (idempotent),
+     * neutralizing double-encodings and cascading encodings.
+     *
+     * **Example of bypass without this protection:**
+     * ```
+     * %2520  →  (1st decode)  %20  →  (2nd decode)  " "
+     * %252E%252E  →  %2E%2E  →  ..   ← hidden traversal
+     * ```
+     *
+     * The loop is bounded to {@link MAX_DECODE_ITERATIONS} to prevent any
+     * infinite loop on pathological synthetic inputs. If the limit is reached,
+     * the last stable state is returned without throwing an exception.
+     *
+     * @param {string} raw - The raw string, potentially multi-encoded.
+     * @returns {string} The fully decoded string.
+     *
+     * @private
+     */
+    static iterativeDecode(raw) {
+        let current = raw;
+        for (let i = 0; i < UriNormalizer.MAX_DECODE_ITERATIONS; i++) {
+            let next;
+            try {
+                next = decodeURIComponent(current);
+            }
+            catch {
+                // Malformed URI (e.g., `%GG`): abort and keep previous state
+                break;
+            }
+            if (next === current) {
+                // Idempotence reached: decoding is stable
+                break;
+            }
+            current = next;
+        }
+        return current;
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Private Methods — String Sanitization
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Strips all ASCII and Unicode control characters from a string.
+     *
+     * The removed ranges are:
+     * - U+0000–U+001F: C0 control characters (including null byte, tab, LF, CR...)
+     * - U+007F       : DEL
+     * - U+0080–U+009F: C1 control characters
+     *
+     * These characters can be exploited to bypass filters relying on naive
+     * string comparisons or to cause unexpected behavior in downstream parsers
+     * (e.g., HTTP servers, file systems).
+     *
+     * @param {string} str - The string to sanitize.
+     * @returns {string} The string without control characters.
+     *
+     * @private
+     */
+    static stripControlCharacters(str) {
+        // eslint-disable-next-line no-control-regex
+        return str.replace(/[\u0000-\u001F\u007F-\u009F]/g, "");
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Private Methods — Segment Resolution
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Resolves `.` (current directory) and `..` (parent directory) segments
+     * from a normalized path (without double-slashes or residual encodings).
+     *
+     * The stack can never go below the root: a `..` at the head of the path
+     * is silently ignored, preventing any underflow to `../`.
+     *
+     * @param {string} path - The pre-normalized path (consolidated slashes, decoded).
+     * @returns {string} The path with all `.` and `..` segments resolved,
+     *                   always prefixed by `/`.
+     *
+     * @example
+     * ```ts
+     * // (private method — internal illustration)
+     * resolveSegments("/a/b/../../c")  // "/c"
+     * resolveSegments("/../../../etc") // "/etc"  ← no underflow
+     * resolveSegments("/a/./b")        // "/a/b"
+     * ```
+     *
+     * @private
+     */
+    static resolveSegments(path) {
+        const parts = path.split("/");
+        const stack = [];
+        for (const segment of parts) {
+            if (segment === "..") {
+                // Never exceed root (anti-underflow)
+                if (stack.length > 0) {
+                    stack.pop();
+                }
+            }
+            else if (segment !== "." && segment !== "") {
+                stack.push(segment);
+            }
+        }
+        return "/" + stack.join("/");
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // Private Methods — ReDoS / VM Utilities
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Calculates an adaptive timeout for executing a regex in the VM sandbox,
+     * adding a delta proportional to the length of the string being tested.
+     *
+     * ### Formula
+     * ```
+     * timeout = min(baseMs + floor(length / 1000) * PER_1K, MAX_TIMEOUT)
+     * ```
+     *
+     * This avoids false positives on long legitimate inputs while maintaining
+     * a hard ceiling ({@link REGEX_MAX_TIMEOUT_MS}) to contain severe ReDoS.
+     *
+     * @param {number} length   - Length of the tested string.
+     * @param {number} baseMs   - Base timeout provided by the caller.
+     * @returns {number} The effective timeout in milliseconds.
+     *
+     * @private
+     */
+    static computeRegexTimeout(length, baseMs) {
+        const delta = Math.floor(length / 1000) *
+            UriNormalizer.REGEX_TIMEOUT_PER_1K_CHARS;
+        return Math.min(baseMs + delta, UriNormalizer.REGEX_MAX_TIMEOUT_MS);
+    }
+    /**
+     * Determines whether an error thrown by `vm.runInContext` is a timeout
+     * overrun (i.e. a Node.js script interruption).
+     *
+     * Node.js does not provide a dedicated error class for this type of error.
+     * Detection relies on the `ERR_SCRIPT_EXECUTION_TIMEOUT` error code and/or
+     * the error message (`"Script execution timed out"`), which are stable since Node 10.
+     *
+     * @param {unknown} error - The exception to inspect.
+     * @returns {boolean} `true` if the error is a VM timeout, `false` otherwise.
+     *
+     * @private
+     */
+    static isVmTimeoutError(error) {
+        if (!(error instanceof Error))
+            return false;
+        const nodeError = error;
+        if (nodeError.code === "ERR_SCRIPT_EXECUTION_TIMEOUT")
+            return true;
+        // Fallback to the message for older Node versions
+        return error.message.toLowerCase().includes("timed out");
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Private Constants
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Maximum number of URI decoding iterations to stop infinite loops
+ * on pathological inputs (e.g., synthetic infinite encodings).
+ */
+UriNormalizer.MAX_DECODE_ITERATIONS = 10;
+/**
+ * Minimum length (inclusive) from which regex execution is deferred
+ * to an isolated VM context with a timeout, regardless of the apparent
+ * complexity of the pattern.
+ *
+ * Lowered to 20 chars to cover catastrophic patterns on short
+ * repetitive inputs (e.g., `(a+)+` tested on `"aaaaaaaaaaaaaaaab"`).
+ */
+UriNormalizer.REGEX_VM_LENGTH_THRESHOLD = 20;
+/**
+ * Base VM timeout in milliseconds. It is proportionally increased
+ * according to the string length to avoid false positives on long
+ * legitimate inputs while keeping a hard limit on ReDoS.
+ *
+ * @see {@link UriNormalizer.computeRegexTimeout}
+ */
+UriNormalizer.REGEX_BASE_TIMEOUT_MS = 50;
+/**
+ * Multiplicative factor (ms per 1,000 characters) added to the base
+ * timeout for long strings. This prevents false positives on large
+ * legitimate inputs.
+ */
+UriNormalizer.REGEX_TIMEOUT_PER_1K_CHARS = 5;
+/**
+ * Absolute ceiling for the VM timeout in milliseconds to prevent
+ * a massive input from rendering the timeout useless.
+ */
+UriNormalizer.REGEX_MAX_TIMEOUT_MS = 200;
+// ─────────────────────────────────────────────────────────────────────────────
+// Custom Errors
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Error thrown by {@link UriNormalizer.safeRegexCheck} when regex execution
+ * in the VM context exceeds the allocated timeout.
+ *
+ * This error allows the calling layer to distinguish a true ReDoS block
+ * from a legitimate `false` return (normal non-match), and to apply an
+ * appropriate security policy (log, alert, block the request...).
+ *
+ * @extends {Error}
+ *
+ * @example
+ * ```ts
+ * try {
+ *   UriNormalizer.safeRegexCheck(/(a+)+$/, "a".repeat(10_000) + "!");
+ * } catch (e) {
+ *   if (e instanceof UriNormalizerRegexTimeoutError) {
+ *     console.error(`ReDoS detected (timeout=${e.timeoutMs}ms, len=${e.inputLength})`);
+ *   }
+ * }
+ * ```
+ */
+class UriNormalizerRegexTimeoutError extends Error {
+    /**
+     * @param {string} message     - Descriptive error message.
+     * @param {number} timeoutMs   - Exceeded effective timeout.
+     * @param {number} inputLength - Length of the tested input.
+     */
+    constructor(message, timeoutMs, inputLength) {
+        super(message);
+        /** Class name for reliable instanceof and logging. */
+        this.name = "UriNormalizerRegexTimeoutError";
+        this.timeoutMs = timeoutMs;
+        this.inputLength = inputLength;
+        // Proper prototype chain restoration in TypeScript/Babel
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+
+exports.UriNormalizer = UriNormalizer;
+exports.UriNormalizerRegexTimeoutError = UriNormalizerRegexTimeoutError;
+//# sourceMappingURL=UriNormalizer.js.map

package/dist/cjs/src/middleware/built-in/security/UriNormalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UriNormalizer.js","sources":["../../../../../../src/middleware/built-in/security/UriNormalizer.ts"],"sourcesContent":[null],"names":["vm"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA;;;;;;;;;;;;;;;;;;;;;;;;AAwBG;MACU,aAAa,CAAA;;;;AA+CtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCG;IACI,OAAO,aAAa,CAAC,OAAe,EAAA;AACvC,QAAA,IAAI,CAAC,OAAO;AAAE,YAAA,OAAO,GAAG;;QAGxB,MAAM,OAAO,GAAG,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC;;QAGtD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;;QAGpC,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;;QAG9C,MAAM,SAAS,GAAG,aAAa,CAAC,sBAAsB,CAAC,cAAc,CAAC;;QAGtE,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;;AAGhD,QAAA,MAAM,gBAAgB,GAClB,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;;QAGnD,MAAM,QAAQ,GAAG,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC;;QAGzD,OAAO,gBAAgB,GAAG,QAAQ,GAAG,GAAG,GAAG,QAAQ;IACvD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCG;IACI,OAAO,cAAc,CACxB,OAAe,EACf,GAAW,EACX,SAAA,GAAoB,aAAa,CAAC,qBAAqB,EAAA;;AAGvD,QAAA,IAAI,EAAE,OAAO,YAAY,MAAM,CAAC,EAAE;YAC9B,MAAM,IAAI,SAAS,CACf,CAAA,iFAAA,EAAoF,OAAO,OAAO,CAAA,CAAE,CACvG;QACL;;QAGA,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,CAAC,yBAAyB,EAAE;AACtD,YAAA,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5B;;AAGA,QAAA,MAAM,gBAAgB,GAAG,aAAa,CAAC,mBAAmB,CACtD,GAAG,CAAC,MAAM,EACV,SAAS,CACZ;AAED,QAAA,IAAI;YACA,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE;YAC/C,MAAM,OAAO,GAAGA,aAAE,CAAC,aAAa,CAAC,OAAO,CAAC;AACzC,YAAAA,aAAE,CAAC,YAAY,CAAC,4BAA4B,EAAE,OAAO,EAAE;AACnD,gBAAA,OAAO,EAAE,gBAAgB;AAC5B,aAAA,CAAC;YACF,OAAO,OAAO,CAAC,MAAM;QACzB;QAAE,OAAO,CAAU,EAAE;;AAEjB,YAAA,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;AACnC,gBAAA,MAAM,IAAI,8BAA8B,CACpC,CAAA,wBAAA,EAA2B,gBAAgB,sBAAsB,GAAG,CAAC,MAAM,CAAA,4BAAA,CAA8B,EACzG,gBAAgB,EAChB,GAAG,CAAC,MAAM,CACb;YACL;;AAEA,YAAA,MAAM,CAAC;QACX;IACJ;;;;AAMA;;;;;;;;;;;;;;;;;;AAkBG;IACK,OAAO,eAAe,CAAC,GAAW,EAAA;QACtC,IAAI,OAAO,GAAG,GAAG;AAEjB,QAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,qBAAqB,EAAE,CAAC,EAAE,EAAE;AAC1D,YAAA,IAAI,IAAY;AAChB,YAAA,IAAI;AACA,gBAAA,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC;YACtC;AAAE,YAAA,MAAM;;gBAEJ;YACJ;AAEA,YAAA,IAAI,IAAI,KAAK,OAAO,EAAE;;gBAElB;YACJ;YAEA,OAAO,GAAG,IAAI;QAClB;AAEA,QAAA,OAAO,OAAO;IAClB;;;;AAMA;;;;;;;;;;;;;;;;AAgBG;IACK,OAAO,sBAAsB,CAAC,GAAW,EAAA;;QAE7C,OAAO,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;IAC3D;;;;AAMA;;;;;;;;;;;;;;;;;;;;AAoBG;IACK,OAAO,eAAe,CAAC,IAAY,EAAA;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7B,MAAM,KAAK,GAAa,EAAE;AAE1B,QAAA,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE;AACzB,YAAA,IAAI,OAAO,KAAK,IAAI,EAAE;;AAElB,gBAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;oBAClB,KAAK,CAAC,GAAG,EAAE;gBACf;YACJ;iBAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE,EAAE;AAC1C,gBAAA,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YACvB;QACJ;QAEA,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;IAChC;;;;AAMA;;;;;;;;;;;;;;;;;AAiBG;AACK,IAAA,OAAO,mBAAmB,CAAC,MAAc,EAAE,MAAc,EAAA;QAC7D,MAAM,KAAK,GACP,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YACzB,aAAa,CAAC,0BAA0B;AAC5C,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,aAAa,CAAC,oBAAoB,CAAC;IACvE;AAEA;;;;;;;;;;;;AAYG;IACK,OAAO,gBAAgB,CAAC,KAAc,EAAA;AAC1C,QAAA,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC;AAAE,YAAA,OAAO,KAAK;QAE3C,MAAM,SAAS,GAAG,KAA8B;AAChD,QAAA,IAAI,SAAS,CAAC,IAAI,KAAK,8BAA8B;AAAE,YAAA,OAAO,IAAI;;QAGlE,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC5D;;AA3WA;AACA;AACA;AAEA;;;AAGG;AACqB,aAAA,CAAA,qBAAqB,GAAG,EAAE;AAElD;;;;;;;AAOG;AACqB,aAAA,CAAA,yBAAyB,GAAG,EAAE;AAEtD;;;;;;AAMG;AACqB,aAAA,CAAA,qBAAqB,GAAG,EAAE;AAElD;;;;AAIG;AACqB,aAAA,CAAA,0BAA0B,GAAG,CAAC;AAEtD;;;AAGG;AACqB,aAAA,CAAA,oBAAoB,GAAG,GAAG;AAsUtD;AACA;AACA;AAEA;;;;;;;;;;;;;;;;;;;;AAoBG;AACG,MAAO,8BAA+B,SAAQ,KAAK,CAAA;AAiBrD;;;;AAIG;AACH,IAAA,WAAA,CAAY,OAAe,EAAE,SAAiB,EAAE,WAAmB,EAAA;QAC/D,KAAK,CAAC,OAAO,CAAC;;QArBO,IAAA,CAAA,IAAI,GAAG,gCAAgC;AAsB5D,QAAA,IAAI,CAAC,SAAS,GAAG,SAAS;AAC1B,QAAA,IAAI,CAAC,WAAW,GAAG,WAAW;;QAG9B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;IACrD;AACH;;;;;"}

package/dist/cjs/src/middleware/built-in/security/XyPrissCors.js

@@ -0,0 +1,98 @@
+'use strict';
+
+function xyprissCors(options = {}) {
+    const defaultOptions = {
+        origin: true,
+        methods: "GET,HEAD,PUT,PATCH,POST,DELETE",
+        preflightContinue: false,
+        optionsSuccessStatus: 204,
+    };
+    const config = Object.assign({}, defaultOptions, options);
+    return function corsMiddleware(req, res, next) {
+        const currentOrigin = req.headers ? req.headers.origin : undefined;
+        const appendVary = (headerStr, field) => {
+            if (headerStr === "*")
+                return headerStr;
+            const parts = headerStr.split(",").map((s) => s.trim());
+            if (!parts.includes(field)) {
+                parts.push(field);
+            }
+            return parts.join(", ");
+        };
+        const applyHeaders = (originAllowed) => {
+            if (originAllowed === true || originAllowed === "*") {
+                res.setHeader("Access-Control-Allow-Origin", "*");
+            }
+            else if (typeof originAllowed === "string") {
+                res.setHeader("Access-Control-Allow-Origin", originAllowed);
+                const vary = res.getHeader("Vary") || "";
+                res.setHeader("Vary", appendVary(String(vary), "Origin"));
+            }
+            if (config.credentials) {
+                res.setHeader("Access-Control-Allow-Credentials", "true");
+            }
+            if (config.exposedHeaders) {
+                const eh = Array.isArray(config.exposedHeaders)
+                    ? config.exposedHeaders.join(",")
+                    : config.exposedHeaders;
+                res.setHeader("Access-Control-Expose-Headers", eh);
+            }
+            if (req.method === "OPTIONS") {
+                if (config.methods) {
+                    const m = Array.isArray(config.methods)
+                        ? config.methods.join(",")
+                        : config.methods;
+                    res.setHeader("Access-Control-Allow-Methods", m);
+                }
+                if (config.allowedHeaders) {
+                    const ah = Array.isArray(config.allowedHeaders)
+                        ? config.allowedHeaders.join(",")
+                        : config.allowedHeaders;
+                    res.setHeader("Access-Control-Allow-Headers", ah);
+                }
+                else if (req.headers &&
+                    req.headers["access-control-request-headers"]) {
+                    res.setHeader("Access-Control-Allow-Headers", req.headers["access-control-request-headers"]);
+                    const vary = res.getHeader("Vary") || "";
+                    res.setHeader("Vary", appendVary(String(vary), "Access-Control-Request-Headers"));
+                }
+                if (config.maxAge !== undefined && config.maxAge !== null) {
+                    res.setHeader("Access-Control-Max-Age", String(config.maxAge));
+                }
+                if (!config.preflightContinue) {
+                    res.statusCode = config.optionsSuccessStatus || 204;
+                    // For typical frameworks setting Content-Length to 0 is cleanly handled
+                    res.setHeader("Content-Length", "0");
+                    res.end();
+                    return;
+                }
+            }
+            next();
+        };
+        if (typeof config.origin === "function") {
+            const originFn = config.origin;
+            originFn(currentOrigin, (err, allow) => {
+                if (err)
+                    return next(err);
+                if (allow) {
+                    applyHeaders(allow);
+                }
+                else {
+                    next();
+                }
+            });
+        }
+        else if (config.origin === true || config.origin === "*") {
+            applyHeaders("*");
+        }
+        else if (typeof config.origin === "string") {
+            applyHeaders(config.origin);
+        }
+        else {
+            next();
+        }
+    };
+}
+
+exports.xyprissCors = xyprissCors;
+//# sourceMappingURL=XyPrissCors.js.map

package/dist/cjs/src/middleware/built-in/security/XyPrissCors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"XyPrissCors.js","sources":["../../../../../../src/middleware/built-in/security/XyPrissCors.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAqBM,SAAU,WAAW,CAAC,OAAA,GAA8B,EAAE,EAAA;AACxD,IAAA,MAAM,cAAc,GAAG;AACnB,QAAA,MAAM,EAAE,IAAI;AACZ,QAAA,OAAO,EAAE,gCAAgC;AACzC,QAAA,iBAAiB,EAAE,KAAK;AACxB,QAAA,oBAAoB,EAAE,GAAG;KAC5B;AAED,IAAA,MAAM,MAAM,GAAuB,MAAM,CAAC,MAAM,CAC5C,EAAE,EACF,cAAc,EACd,OAAO,CACV;AAED,IAAA,OAAO,SAAS,cAAc,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAS,EAAA;AACxD,QAAA,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,SAAS;AAElE,QAAA,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,KAAa,KAAI;YACpD,IAAI,SAAS,KAAK,GAAG;AAAE,gBAAA,OAAO,SAAS;YACvC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;AACxB,gBAAA,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACrB;AACA,YAAA,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;AAC3B,QAAA,CAAC;AAED,QAAA,MAAM,YAAY,GAAG,CAAC,aAA+B,KAAI;YACrD,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,GAAG,EAAE;AACjD,gBAAA,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC;YACrD;AAAO,iBAAA,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE;AAC1C,gBAAA,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,aAAa,CAAC;gBAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;AACxC,gBAAA,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC7D;AAEA,YAAA,IAAI,MAAM,CAAC,WAAW,EAAE;AACpB,gBAAA,GAAG,CAAC,SAAS,CAAC,kCAAkC,EAAE,MAAM,CAAC;YAC7D;AACA,YAAA,IAAI,MAAM,CAAC,cAAc,EAAE;gBACvB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;sBACxC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG;AAChC,sBAAE,MAAM,CAAC,cAAc;AAC3B,gBAAA,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,EAAE,CAAC;YACtD;AAEA,YAAA,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE;AAC1B,gBAAA,IAAI,MAAM,CAAC,OAAO,EAAE;oBAChB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;0BAChC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;AACzB,0BAAE,MAAM,CAAC,OAAO;AACpB,oBAAA,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,CAAC,CAAC;gBACpD;AAEA,gBAAA,IAAI,MAAM,CAAC,cAAc,EAAE;oBACvB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;0BACxC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG;AAChC,0BAAE,MAAM,CAAC,cAAc;AAC3B,oBAAA,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,EAAE,CAAC;gBACrD;qBAAO,IACH,GAAG,CAAC,OAAO;AACX,oBAAA,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,EAC/C;AACE,oBAAA,GAAG,CAAC,SAAS,CACT,8BAA8B,EAC9B,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAChD;oBACD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE;AACxC,oBAAA,GAAG,CAAC,SAAS,CACT,MAAM,EACN,UAAU,CACN,MAAM,CAAC,IAAI,CAAC,EACZ,gCAAgC,CACnC,CACJ;gBACL;AAEA,gBAAA,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE;AACvD,oBAAA,GAAG,CAAC,SAAS,CACT,wBAAwB,EACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CACxB;gBACL;AAEA,gBAAA,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE;oBAC3B,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,oBAAoB,IAAI,GAAG;;AAEnD,oBAAA,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC;oBACpC,GAAG,CAAC,GAAG,EAAE;oBACT;gBACJ;YACJ;AACA,YAAA,IAAI,EAAE;AACV,QAAA,CAAC;AAED,QAAA,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE;AACrC,YAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAkB;YAC1C,QAAQ,CACJ,aAAa,EACb,CAAC,GAAiB,EAAE,KAAwB,KAAI;AAC5C,gBAAA,IAAI,GAAG;AAAE,oBAAA,OAAO,IAAI,CAAC,GAAG,CAAC;gBACzB,IAAI,KAAK,EAAE;oBACP,YAAY,CAAC,KAAK,CAAC;gBACvB;qBAAO;AACH,oBAAA,IAAI,EAAE;gBACV;AACJ,YAAA,CAAC,CACJ;QACL;AAAO,aAAA,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE;YACxD,YAAY,CAAC,GAAG,CAAC;QACrB;AAAO,aAAA,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE;AAC1C,YAAA,YAAY,CAAC,MAAM,CAAC,MAAgB,CAAC;QACzC;aAAO;AACH,YAAA,IAAI,EAAE;QACV;AACJ,IAAA,CAAC;AACL;;;;"}

package/dist/cjs/src/middleware/built-in/security/XyPrissHPP.js

@@ -0,0 +1,52 @@
+'use strict';
+
+function xyprissHPP(options = {}) {
+    const checkQuery = options.checkQuery !== false;
+    const checkBody = options.checkBody !== false;
+    const whitelist = Array.isArray(options.whitelist)
+        ? options.whitelist.filter((w) => typeof w === "string")
+        : [];
+    function putAside(req, keyReqPart, keyPolluted) {
+        const reqPart = req[keyReqPart];
+        if (!reqPart || typeof reqPart !== "object")
+            return;
+        let reqPolluted = req[keyPolluted];
+        if (reqPolluted === undefined) {
+            reqPolluted = req[keyPolluted] = {};
+            const parameters = Object.keys(reqPart);
+            for (let i = 0; i < parameters.length; i++) {
+                const paramKey = parameters[i];
+                const paramValue = reqPart[paramKey];
+                if (!Array.isArray(paramValue)) {
+                    continue;
+                }
+                reqPolluted[paramKey] = paramValue;
+                // Prends le dernier élément du tableau pour éviter la pollution de variables multiples
+                reqPart[paramKey] = paramValue[paramValue.length - 1];
+            }
+        }
+        if (whitelist.length > 0) {
+            for (let k = 0; k < whitelist.length; k++) {
+                const whitelistedParam = whitelist[k];
+                if (reqPolluted[whitelistedParam]) {
+                    reqPart[whitelistedParam] = reqPolluted[whitelistedParam];
+                    delete reqPolluted[whitelistedParam];
+                }
+            }
+        }
+    }
+    return function hppMiddleware(req, res, next) {
+        if (checkQuery && req.query) {
+            putAside(req, "query", "queryPolluted");
+        }
+        if (checkBody && req.body) {
+            // Optionnellement, vérifier le header Content-Type pour url-encoded ou autres formats
+            // mais ici on s'aligne globalement sur ce qui a déjà été parsé.
+            putAside(req, "body", "bodyPolluted");
+        }
+        next();
+    };
+}
+
+exports.xyprissHPP = xyprissHPP;
+//# sourceMappingURL=XyPrissHPP.js.map

package/dist/cjs/src/middleware/built-in/security/XyPrissHPP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"XyPrissHPP.js","sources":["../../../../../../src/middleware/built-in/security/XyPrissHPP.ts"],"sourcesContent":[null],"names":[],"mappings":";;AAMM,SAAU,UAAU,CAAC,OAAA,GAA6B,EAAE,EAAA;AACtD,IAAA,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK;AAC/C,IAAA,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;AAC7C,UAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,QAAQ;UACrD,EAAE;AAER,IAAA,SAAS,QAAQ,CAAC,GAAQ,EAAE,UAAkB,EAAE,WAAmB,EAAA;AAC/D,QAAA,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC;AAC/B,QAAA,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE;AAE7C,QAAA,IAAI,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;AAElC,QAAA,IAAI,WAAW,KAAK,SAAS,EAAE;AAC3B,YAAA,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE;YAEnC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;AACvC,YAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACxC,gBAAA,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC;AAC9B,gBAAA,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;gBAEpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;oBAC5B;gBACJ;AAEA,gBAAA,WAAW,CAAC,QAAQ,CAAC,GAAG,UAAU;;AAElC,gBAAA,OAAO,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;YACzD;QACJ;AAEA,QAAA,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE;AACtB,YAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACvC,gBAAA,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,CAAC;AACrC,gBAAA,IAAI,WAAW,CAAC,gBAAgB,CAAC,EAAE;oBAC/B,OAAO,CAAC,gBAAgB,CAAC,GAAG,WAAW,CAAC,gBAAgB,CAAC;AACzD,oBAAA,OAAO,WAAW,CAAC,gBAAgB,CAAC;gBACxC;YACJ;QACJ;IACJ;AAEA,IAAA,OAAO,SAAS,aAAa,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAS,EAAA;AACvD,QAAA,IAAI,UAAU,IAAI,GAAG,CAAC,KAAK,EAAE;AACzB,YAAA,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC;QAC3C;AAEA,QAAA,IAAI,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE;;;AAGvB,YAAA,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC;QACzC;AAEA,QAAA,IAAI,EAAE;AACV,IAAA,CAAC;AACL;;;;"}