survey-mcp-server
Version:
Survey management server handling survey creation, response collection, analysis, and reporting with database access for data management
166 lines • 6.58 kB
JavaScript
export { SecurityValidator, securityValidator } from './validation.js';
export { SecuritySanitizer, securitySanitizer } from './sanitization.js';
import { securityValidator } from './validation.js';
import { securitySanitizer } from './sanitization.js';
import { logger } from '../utils/logger.js';
export class SecurityManager {
constructor() { }
static getInstance() {
if (!SecurityManager.instance) {
SecurityManager.instance = new SecurityManager();
}
return SecurityManager.instance;
}
performSecurityCheck(input, options = {}) {
const issues = [];
let sanitizedInput = input;
try {
// Step 1: Security validation
if (!options.skipValidation) {
const validationResult = securityValidator.validateInput(input, options.validationOptions);
if (!validationResult.isValid) {
issues.push(...validationResult.issues);
return { isSecure: false, issues };
}
}
// Step 2: Security sanitization
if (!options.skipSanitization) {
switch (options.sanitizationContext) {
case 'mongodb':
sanitizedInput = securitySanitizer.sanitizeForMongoDB(input);
break;
case 'typesense':
sanitizedInput = securitySanitizer.sanitizeForTypesense(input);
break;
case 'external_api':
sanitizedInput = securitySanitizer.sanitizeForExternalAPI(input);
break;
default:
// General sanitization
sanitizedInput = this.performGeneralSanitization(input);
break;
}
}
return {
isSecure: true,
sanitizedInput,
issues: []
};
}
catch (error) {
logger.error('Security check failed:', error);
return {
isSecure: false,
issues: [`Security check failed: ${error.message}`]
};
}
}
validateAndSanitizeIMO(imo) {
return securityValidator.validateIMO(imo);
}
validateAndSanitizeEmail(email) {
return securityValidator.validateEmail(email);
}
validateAndSanitizeURL(url) {
return securityValidator.validateURL(url);
}
sanitizeCredentials(credentials) {
return securitySanitizer.sanitizeCredentials(credentials);
}
sanitizeLogData(data) {
return securitySanitizer.sanitizeLogData(data);
}
sanitizeError(error) {
return securitySanitizer.sanitizeError(error);
}
performGeneralSanitization(input) {
// Apply general sanitization rules
if (typeof input === 'string') {
return this.sanitizeString(input);
}
if (Array.isArray(input)) {
return input.map(item => this.performGeneralSanitization(item));
}
if (typeof input === 'object' && input !== null) {
const sanitized = {};
for (const [key, value] of Object.entries(input)) {
if (!this.isDangerousKey(key)) {
sanitized[key] = this.performGeneralSanitization(value);
}
}
return sanitized;
}
return input;
}
sanitizeString(str) {
// Basic string sanitization
let sanitized = str.trim();
// Remove script content
sanitized = sanitized.replace(/<script[\s\S]*?<\/script>/gi, '');
sanitized = sanitized.replace(/javascript\s*:/gi, '');
sanitized = sanitized.replace(/vbscript\s*:/gi, '');
// Remove event handlers
sanitized = sanitized.replace(/on\w+\s*=\s*["'][^"']*["']/gi, '');
// Remove control characters
sanitized = sanitized.replace(/[\x00-\x1F\x7F]/g, '');
return sanitized;
}
isDangerousKey(key) {
const dangerousKeys = [
'__proto__',
'constructor',
'prototype',
'eval',
'function',
'require',
'import',
'process',
'global'
];
return dangerousKeys.includes(key.toLowerCase());
}
createSecurityReport(input) {
const validationResult = securityValidator.validateInput(input);
const issues = validationResult.issues;
let riskLevel = 'low';
const recommendations = [];
// Assess risk level based on issues
const criticalKeywords = ['eval', 'function', '__proto__', 'constructor'];
const highRiskKeywords = ['script', 'javascript', 'vbscript'];
const mediumRiskKeywords = ['$where', '$eval', 'injection'];
for (const issue of issues) {
const issueLower = issue.toLowerCase();
if (criticalKeywords.some(keyword => issueLower.includes(keyword))) {
riskLevel = 'critical';
recommendations.push('Immediately reject input containing dangerous object properties');
}
else if (highRiskKeywords.some(keyword => issueLower.includes(keyword))) {
if (riskLevel !== 'critical')
riskLevel = 'high';
recommendations.push('Remove or escape script content before processing');
}
else if (mediumRiskKeywords.some(keyword => issueLower.includes(keyword))) {
if (riskLevel !== 'critical' && riskLevel !== 'high')
riskLevel = 'medium';
recommendations.push('Apply database-specific sanitization');
}
}
// General recommendations
if (issues.length > 0) {
recommendations.push('Apply input validation and sanitization');
recommendations.push('Use parameterized queries for database operations');
recommendations.push('Implement content security policies');
}
const summary = issues.length === 0
? 'Input appears secure with no obvious security issues detected'
: `Found ${issues.length} security issue(s) requiring attention`;
return {
summary,
riskLevel,
issues,
recommendations
};
}
}
export const securityManager = SecurityManager.getInstance();
//# sourceMappingURL=index.js.map