grafana e prometeus
This commit is contained in:
JurTI-BR
@@ -1,63 +0,0 @@
|
||||
"use strict";
|
||||
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
||||
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
||||
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
||||
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
||||
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
||||
};
|
||||
exports.__esModule = true;
|
||||
exports.RateLimiterMiddleware = void 0;
|
||||
var common_1 = require("@nestjs/common");
|
||||
var throttler_1 = require("@nestjs/throttler");
|
||||
var RateLimiterMiddleware = /** @class */ (function () {
|
||||
function RateLimiterMiddleware(configService) {
|
||||
this.configService = configService;
|
||||
this.store = new Map();
|
||||
this.ttl = this.configService.get('THROTTLE_TTL', 60);
|
||||
this.limit = this.configService.get('THROTTLE_LIMIT', 10);
|
||||
}
|
||||
RateLimiterMiddleware.prototype.use = function (req, res, next) {
|
||||
// Skip if the request method is OPTIONS (for CORS preflight)
|
||||
if (req.method === 'OPTIONS') {
|
||||
return next();
|
||||
}
|
||||
var key = this.generateKey(req);
|
||||
var now = Date.now();
|
||||
if (!this.store.has(key)) {
|
||||
this.store.set(key, { count: 1, expiration: now + this.ttl * 1000 });
|
||||
this.setRateLimitHeaders(res, 1);
|
||||
return next();
|
||||
}
|
||||
var record = this.store.get(key);
|
||||
if (record.expiration < now) {
|
||||
record.count = 1;
|
||||
record.expiration = now + this.ttl * 1000;
|
||||
this.setRateLimitHeaders(res, 1);
|
||||
return next();
|
||||
}
|
||||
if (record.count >= this.limit) {
|
||||
var timeToWait = Math.ceil((record.expiration - now) / 1000);
|
||||
this.setRateLimitHeaders(res, record.count);
|
||||
res.header('Retry-After', String(timeToWait));
|
||||
throw new throttler_1.ThrottlerException("Too Many Requests. Retry after " + timeToWait + " seconds.");
|
||||
}
|
||||
record.count++;
|
||||
this.setRateLimitHeaders(res, record.count);
|
||||
return next();
|
||||
};
|
||||
RateLimiterMiddleware.prototype.generateKey = function (req) {
|
||||
// Combina IP com rota para rate limiting mais preciso
|
||||
var ip = req.ip || req.headers['x-forwarded-for'] || 'unknown-ip';
|
||||
var path = req.path || req.originalUrl || '';
|
||||
return ip + ":" + path;
|
||||
};
|
||||
RateLimiterMiddleware.prototype.setRateLimitHeaders = function (res, count) {
|
||||
res.header('X-RateLimit-Limit', String(this.limit));
|
||||
res.header('X-RateLimit-Remaining', String(Math.max(0, this.limit - count)));
|
||||
};
|
||||
RateLimiterMiddleware = __decorate([
|
||||
common_1.Injectable()
|
||||
], RateLimiterMiddleware);
|
||||
return RateLimiterMiddleware;
|
||||
}());
|
||||
exports.RateLimiterMiddleware = RateLimiterMiddleware;
|
||||
@@ -1,54 +0,0 @@
|
||||
"use strict";
|
||||
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
||||
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
||||
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
||||
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
||||
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
||||
};
|
||||
exports.__esModule = true;
|
||||
exports.RequestSanitizerMiddleware = void 0;
|
||||
var common_1 = require("@nestjs/common");
|
||||
var RequestSanitizerMiddleware = /** @class */ (function () {
|
||||
function RequestSanitizerMiddleware() {
|
||||
}
|
||||
RequestSanitizerMiddleware.prototype.use = function (req, res, next) {
|
||||
if (req.headers) {
|
||||
this.sanitizeObject(req.headers);
|
||||
}
|
||||
if (req.query) {
|
||||
this.sanitizeObject(req.query);
|
||||
}
|
||||
if (req.body) {
|
||||
this.sanitizeObject(req.body);
|
||||
}
|
||||
next();
|
||||
};
|
||||
RequestSanitizerMiddleware.prototype.sanitizeObject = function (obj) {
|
||||
var _this = this;
|
||||
Object.keys(obj).forEach(function (key) {
|
||||
if (typeof obj[key] === 'string') {
|
||||
obj[key] = _this.sanitizeString(obj[key]);
|
||||
}
|
||||
else if (typeof obj[key] === 'object' && obj[key] !== null) {
|
||||
_this.sanitizeObject(obj[key]);
|
||||
}
|
||||
});
|
||||
};
|
||||
RequestSanitizerMiddleware.prototype.sanitizeString = function (str) {
|
||||
// Remover tags HTML básicas
|
||||
str = str.replace(/<(|\/|[^>\/bi]|\/[^>bi]|[^\/>][^>]+|\/[^>][^>]+)>/g, '');
|
||||
// Remover scripts JavaScript
|
||||
str = str.replace(/javascript:/g, '');
|
||||
str = str.replace(/on\w+=/g, '');
|
||||
// Remover comentários HTML
|
||||
str = str.replace(/<!--[\s\S]*?-->/g, '');
|
||||
// Sanitizar caracteres especiais para evitar SQL injection
|
||||
str = str.replace(/'/g, "''");
|
||||
return str;
|
||||
};
|
||||
RequestSanitizerMiddleware = __decorate([
|
||||
common_1.Injectable()
|
||||
], RequestSanitizerMiddleware);
|
||||
return RequestSanitizerMiddleware;
|
||||
}());
|
||||
exports.RequestSanitizerMiddleware = RequestSanitizerMiddleware;
|
||||
68
src/common/validators/dist/sanitize.validator.js
vendored
68
src/common/validators/dist/sanitize.validator.js
vendored
@@ -1,68 +0,0 @@
|
||||
"use strict";
|
||||
exports.__esModule = true;
|
||||
exports.IsSecureId = exports.IsSanitized = void 0;
|
||||
var class_validator_1 = require("class-validator");
|
||||
// Decorator para sanitizar strings e prevenir SQL/NoSQL injection
|
||||
function IsSanitized(validationOptions) {
|
||||
return function (object, propertyName) {
|
||||
class_validator_1.registerDecorator({
|
||||
name: 'isSanitized',
|
||||
target: object.constructor,
|
||||
propertyName: propertyName,
|
||||
options: validationOptions,
|
||||
validator: {
|
||||
validate: function (value, args) {
|
||||
if (typeof value !== 'string')
|
||||
return true; // Skip non-string values
|
||||
// Check for common SQL injection patterns
|
||||
var sqlInjectionRegex = /('|"|;|--|\/\*|\*\/|@@|@|char|nchar|varchar|nvarchar|alter|begin|cast|create|cursor|declare|delete|drop|end|exec|execute|fetch|insert|kill|open|select|sys|sysobjects|syscolumns|table|update|xp_)/i;
|
||||
if (sqlInjectionRegex.test(value)) {
|
||||
return false;
|
||||
}
|
||||
// Check for NoSQL injection patterns (MongoDB)
|
||||
var noSqlInjectionRegex = /(\$where|\$ne|\$gt|\$lt|\$gte|\$lte|\$in|\$nin|\$or|\$and|\$regex|\$options|\$elemMatch|\{.*\:.*\})/i;
|
||||
if (noSqlInjectionRegex.test(value)) {
|
||||
return false;
|
||||
}
|
||||
// Check for XSS attempts
|
||||
var xssRegex = /(<script|javascript:|on\w+\s*=|<%=|<img|<iframe|alert\(|window\.|document\.)/i;
|
||||
if (xssRegex.test(value)) {
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
},
|
||||
defaultMessage: function (args) {
|
||||
return 'A entrada contém caracteres inválidos ou padrões potencialmente maliciosos';
|
||||
}
|
||||
}
|
||||
});
|
||||
};
|
||||
}
|
||||
exports.IsSanitized = IsSanitized;
|
||||
// Decorator para validar IDs seguros (evita injeção em IDs)
|
||||
function IsSecureId(validationOptions) {
|
||||
return function (object, propertyName) {
|
||||
class_validator_1.registerDecorator({
|
||||
name: 'isSecureId',
|
||||
target: object.constructor,
|
||||
propertyName: propertyName,
|
||||
options: validationOptions,
|
||||
validator: {
|
||||
validate: function (value, args) {
|
||||
if (typeof value !== 'string' && typeof value !== 'number')
|
||||
return false;
|
||||
if (typeof value === 'string') {
|
||||
// Permitir apenas: letras, números, hífens, underscores e GUIDs
|
||||
return /^[a-zA-Z0-9\-_]+$|^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
|
||||
}
|
||||
// Se for número, deve ser positivo
|
||||
return value > 0;
|
||||
},
|
||||
defaultMessage: function (args) {
|
||||
return 'O ID fornecido não é seguro ou está em formato inválido';
|
||||
}
|
||||
}
|
||||
});
|
||||
};
|
||||
}
|
||||
exports.IsSecureId = IsSecureId;
|
||||
@@ -12,7 +12,6 @@ export function IsSanitized(validationOptions?: ValidationOptions) {
|
||||
validate(value: any, args: ValidationArguments) {
|
||||
if (typeof value !== 'string') return true; // Skip non-string values
|
||||
|
||||
// Check for common SQL injection patterns
|
||||
const sqlInjectionRegex = /('|"|;|--|\/\*|\*\/|@@|@|char|nchar|varchar|nvarchar|alter|begin|cast|create|cursor|declare|delete|drop|end|exec|execute|fetch|insert|kill|open|select|sys|sysobjects|syscolumns|table|update|xp_)/i;
|
||||
if (sqlInjectionRegex.test(value)) {
|
||||
return false;
|
||||
|
||||
Reference in New Issue
Block a user