fortify-schema/src/constants/SECURITY_CONSTANTS.ts

A modern TypeScript validation library designed around familiar interface syntax and powerful conditional validation. Experience schema validation that feels natural to TypeScript developers while unlocking advanced runtime validation capabilities.

export const SECURITY_CONSTANTS = {
  MAX_JSON_SIZE: 10 * 1024 * 1024, // 10MB
  MAX_TEXT_LENGTH: 1024 * 1024, // 1MB
  MAX_VALIDATION_TIME: 5000, // 5 seconds
  DANGEROUS_PROPERTIES: new Set([
    "__proto__",
    "constructor",
    "prototype",
    "valueOf",
    "toString",
    "hasOwnProperty",
    "isPrototypeOf",
    "propertyIsEnumerable",
    "__defineGetter__",
    "__defineSetter__",
    "__lookupGetter__",
    "__lookupSetter__",
  ]),
  XSS_PATTERNS: [
    /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
    /javascript:\s*[^;]*/gi,
    /on\w+\s*=\s*["'][^"']*["']/gi,
    /<iframe\b[^>]*>/gi,
    /<object\b[^>]*>/gi,
    /<embed\b[^>]*>/gi,
    /<form\b[^>]*>/gi,
    /data:\s*text\/html/gi,
    /vbscript:/gi,
    /<meta\b[^>]*http-equiv/gi,
  ],
  SQL_PATTERNS: [
    /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|EXECUTE|UNION|TRUNCATE|GRANT|REVOKE)\b)/gi,
    /(union\s+select|or\s+1\s*=\s*1|and\s+1\s*=\s*1)/gi,
    /('|--|\*|;|\|\|)/g,
    /(0x[0-9a-fA-F]+|char\(|ascii\(|substring\()/gi,
    /(sleep\(|benchmark\(|waitfor\s+delay)/gi,
  ],
  LDAP_PATTERNS: [/[()&|!]/g, /\*(?!\w)/g, /[\x00-\x1f\x7f]/g],
  COMMAND_INJECTION_PATTERNS: [
    /[;&|`$(){}[\]\\]/g,
    /(curl|wget|nc|netcat|telnet|ssh|ftp|tftp)/gi,
    /(\.\.|\/etc\/|\/bin\/|\/usr\/|\/var\/)/gi,
  ],
} as const;