# Create a virtual environment
python -m venv venv
source venv/bin/activate

# Install Pydantic (for strict schema validation) and Requests
pip install pydantic requests

# Initialize project
npm init -y

# Install TypeScript and Zod (Industry standard for schema validation)
npm install zod
npm install --save-dev typescript @types/node ts-node

from pydantic import BaseModel, ValidationError, Field
from typing import Dict, Any
import json

# 1. Define a strict schema for the expected payload
# This prevents 'AutoType' exploitation by restricting allowed keys and types
class SecureUserPayload(BaseModel):
    user_id: int
    username: str = Field(..., min_length=3, max_length=20)
    metadata: Dict[str, str]  # Strict dictionary of strings only

def secure_json_parser(raw_json: str) -> Dict[str, Any]:
    """
    Parses JSON and validates it against the SecureUserPayload schema.
    This acts as a firewall against deserialization attacks.
    """
    try:
        # Parse the raw string into a dictionary
        data = json.loads(raw_json)
        
        # Validate the dictionary against the Pydantic model
        # This will strip any extra/unexpected keys like '@type'
        validated_data = SecureUserPayload(**data)
        
        print("✅ Payload passed security validation.")
        return validated_data.model_dump()
    
    except json.JSONDecodeError:
        print("❌ Error: Invalid JSON format.")
        raise ValueError("Malformed JSON")
    except ValidationError as e:
        # This catches attempts to inject unexpected types or keys
        print(f"❌ Security Violation: Schema mismatch! {e.json()}")
        raise ValueError("Invalid Data Structure")

# --- TEST CASES ---

# Case 1: Valid Payload
valid_input = '{"user_id": 101, "username": "icarax_user", "metadata": {"role": "admin"}}'
print(f"Result 1: {secure_json_parser(valid_input)}")

# Case 2: Exploitation Attempt (Injecting @type to trigger Fastjson RCE)
malicious_input = '{"user_id": 101, "username": "attacker", "metadata": {}, "@type": "com.sun.rowset.JdbcRowSetDataSource"}'
try:
    secure_json_parser(malicious_input)
except ValueError:
    print("🛡️ Defense successfully blocked the malicious payload.")

import { z } from 'zod';

// 1. Define the strict schema
// We use.strict() to ensure no extra properties (like @type) are allowed
const UserSchema = z.object({
  userId: z.number().int(),
  username: z.string().min(3).max(20),
  roles: z.array(z.string()),
}).strict();

/**
 * Sanitizes and validates incoming JSON objects
 * @param rawData The parsed JSON object from the request body
 */
function validateIncomingRequest(rawData: any) {
  try {
    //.parse() will throw an error if the schema doesn't match exactly
    const validatedData = UserSchema.parse(rawData);
    console.log("✅ Data is safe for processing:", validatedData);
    return validatedData;
  } catch (error) {
    if (error instanceof z.ZodError) {
      console.error("❌ SECURITY ALERT: Invalid payload structure detected!");
      console.error(error.errors);
      throw new Error("Invalid Input");
    }
    throw error;
  }
}

// --- TEST CASES ---

// Case 1: Valid Data
const safeData = {
  userId: 1,
  username: "dev_user",
  roles: ["user", "editor"]
};
validateIncomingRequest(safeData);

// Case 2: Malicious Payload (Fastjson Injection attempt)
const attackData = {
  userId: 1,
  username: "hacker",
  roles: ["admin"],
  "@type": "java.util.HashMap" // This is the dangerous payload
};

try {
  validateIncomingRequest(attackData);
} catch (e) {
  console.log("🛡️ Defense: Blocked attempt to inject @type property.");
}

# Security Configuration
STRICT_MODE=true
MAX_PAYLOAD_SIZE=1048576 # 1MB
ALLOWED_DOMAINS=api.icarax.com,auth.icarax.com

import os
from dotenv import load_dotenv

load_dotenv()
STRICT_MODE = os.getenv('STRICT_MODE') == 'true'