WAF Guard & Security Middleware Architecture

Reference for the SveltyCMS Layer 0 WAF guard, its ReDoS-safe threat scanner, the Merkle Tree audit ledger, and the API payload fuzzer.

9/22/2026

2 min read

Edit on GitHub

On this page

SveltyCMS combines a linear, ReDoS-safe WAF payload scanner with cryptographic audit chaining and automated API fuzzing: threats are matched before payload deserialization, and audit integrity is verifiable through Merkle inclusion proofs.

Note: The in-memory Policy-as-Code engine (policy-engine.ts) and runtime baseline clamps (baseline-guard.ts) were removed in the security audit — they were never wired into the dispatcher (the RBAC ENDPOINT_PERMISSIONS mapping + hasPermissionWithRoles is the single enforcement point). Keeping unwired engines around risked a latent authorization bypass if a future rule normalized namespace/method into its resource/action model.

1. Layer 0 WAF Middleware Guard

Requests passing through SvelteKit are inspected at Layer 0 before JSON payload deserialization.

Location: src/hooks/handle-waf-guard.ts (WafGuard.inspectRequest() / inspectEvent())
Matching engine: src/services/security/threat-scan.ts — inspectRequest() is a linear, O(n) ReDoS-safe scanner, shared with AuthGuard payload analysis. The guard class itself only memoizes results per request (locals.__wafCheck plus a WeakMap keyed by the Headers object), so the scan runs at most once per request lifecycle.
Features: Scans path traversal (../), prototype pollution (__proto__), XSS scripts, SQL injection, and HTTP header splitting vectors.
Coverage: tests/unit/security/handle-waf-guard.test.ts, tests/unit/security/threat-scan.test.ts.

2. Cryptographic Merkle Tree Audit Ledger

Audit logs are cryptographically hashed and structured into a Merkle Tree, allowing $O(\log N)$ tamper verification and verifiable inclusion proofs.

Location: src/services/audit-chain.ts
Verification: auditChainService.computeMerkleRoot(entries) and auditChainService.generateMerkleProof(entries, index).

3. Automated Security API Payload Fuzzer

Proactively tests API endpoints against malformed strings, oversized buffers, SQLi patterns, and deep nesting.

Run Command: bun run scripts/security/fuzz-api.ts (standalone script — no npm wrapper)
Script Location: scripts/security/fuzz-api.ts