Skip to content

Security: mcabreradev/filter

Security

SECURITY.md

Security Policy

Supported Versions

We actively support the following versions with security updates:

Version Supported
5.6.x ✅
5.5.x ✅
5.4.x ⚠️ Critical fixes only
< 5.4 ❌ No longer supported

Reporting a Vulnerability

We take the security of @mcabreradev/filter seriously. If you discover a security vulnerability, please follow these steps:

1. Do NOT Create a Public Issue

Please do not report security vulnerabilities through public GitHub issues.

2. Report Privately

Send your vulnerability report to:

Email: security@mcabreradev.com

Subject: [SECURITY] Brief description of the issue

3. Include These Details

  • Description: Clear description of the vulnerability
  • Impact: What an attacker could achieve
  • Steps to Reproduce: Detailed steps to reproduce the issue
  • Proof of Concept: Code example demonstrating the vulnerability
  • Environment: Version of @mcabreradev/filter affected
  • Suggested Fix: If you have ideas for fixing the issue

Example Report

Subject: [SECURITY] SQL-like injection via filter expression

Description:
Unsanitized user input in filter expressions could allow malicious patterns
that cause excessive memory usage or CPU consumption.

Impact:
Denial of Service (DoS) through resource exhaustion

Steps to Reproduce:
1. Create a filter with deeply nested operators
2. Pass extremely large arrays in $in operator
3. Observe memory/CPU spike

Proof of Concept:
[Code example]

Environment:
- @mcabreradev/filter: 5.6.0
- Node.js: 20.0.0

Suggested Fix:
Add limits on expression depth and array sizes

Response Timeline

  • Acknowledgment: Within 48 hours of your report
  • Initial Assessment: Within 7 days
  • Regular Updates: Every 7 days until resolution
  • Disclosure: Coordinated disclosure after fix is released

Security Best Practices

When using @mcabreradev/filter in production:

1. Validate User Input

import { validateExpression, InvalidExpressionError } from '@mcabreradev/filter';

try {
  const expression = validateExpression(userInput);
  const results = filter(data, expression);
} catch (error) {
  if (error instanceof InvalidExpressionError) {
    // Handle invalid expression
  }
}

2. Sanitize Expressions

const ALLOWED_OPERATORS = ['$eq', '$ne', '$gt', '$gte', '$lt', '$lte'];
const ALLOWED_FIELDS = ['name', 'price', 'category'];

function sanitizeExpression(expr: any): any {
  // Only allow whitelisted operators and fields
  if (typeof expr !== 'object') return expr;
  
  const sanitized: any = {};
  for (const [key, value] of Object.entries(expr)) {
    if (key.startsWith('$') && !ALLOWED_OPERATORS.includes(key)) {
      continue; // Skip dangerous operators
    }
    if (!key.startsWith('$') && !ALLOWED_FIELDS.includes(key)) {
      continue; // Skip non-whitelisted fields
    }
    sanitized[key] = sanitizeExpression(value);
  }
  return sanitized;
}

3. Set Resource Limits

import { filter } from '@mcabreradev/filter';

const MAX_ARRAY_SIZE = 10000;
const MAX_EXPRESSION_DEPTH = 5;

if (data.length > MAX_ARRAY_SIZE) {
  throw new Error('Dataset too large');
}

// Limit expression depth
function checkDepth(expr: any, depth = 0): void {
  if (depth > MAX_EXPRESSION_DEPTH) {
    throw new Error('Expression too deep');
  }
  if (typeof expr === 'object') {
    Object.values(expr).forEach(v => checkDepth(v, depth + 1));
  }
}

checkDepth(expression);
const results = filter(data, expression);

4. Rate Limiting

// Express.js example
import rateLimit from 'express-rate-limit';

const filterLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per windowMs
  message: 'Too many filter requests, please try again later'
});

app.get('/api/products', filterLimiter, (req, res) => {
  // Filter logic
});

5. Use TypeScript

TypeScript provides compile-time type safety:

import { filter, Expression } from '@mcabreradev/filter';

interface Product {
  id: number;
  name: string;
  price: number;
}

const safeFilter = (data: Product[], expr: Expression) => {
  return filter<Product>(data, expr);
};

Known Security Considerations

1. Regular Expression Operators

The $regex operator uses JavaScript's RegExp. Be aware of:

  • ReDoS (Regular Expression Denial of Service): Complex patterns can cause exponential backtracking
  • Mitigation: Validate and limit regex patterns from user input
// Don't allow arbitrary regex from users
const SAFE_REGEX_PATTERN = /^[a-zA-Z0-9\s-_]+$/;

if (!SAFE_REGEX_PATTERN.test(userPattern)) {
  throw new Error('Invalid regex pattern');
}

2. Deep Object Nesting

Deeply nested objects can cause stack overflow:

  • Default: maxDepth is set to 3
  • Recommendation: Keep default or lower for untrusted input
filter(data, expression, { maxDepth: 3 }); // Default is safe

3. Large Datasets

Processing very large datasets can cause memory issues:

  • Use lazy evaluation for large datasets
  • Implement pagination in your API
import { filterLazy, take } from '@mcabreradev/filter';

const results = filterLazy(largeDataset, expression);
const firstPage = take(results, 20); // Lazy evaluation

Vulnerability Disclosure Policy

  • We follow coordinated disclosure
  • Security advisories published on GitHub Security Advisories
  • CVE IDs assigned for applicable vulnerabilities
  • Credit given to reporters (unless you prefer anonymity)

Security Updates

Security updates are released as:

  • Patch versions for non-breaking security fixes (e.g., 5.6.1 → 5.6.2)
  • Minor versions if breaking changes are required (e.g., 5.6.x → 5.7.0)

Subscribe to releases to stay informed: https://github.com/mcabreradev/filter/releases

Questions?

For security-related questions that are not vulnerability reports:

Hall of Fame

We thank the following security researchers for responsible disclosure:

Last updated: November 4, 2025

There aren’t any published security advisories