/**
 * Agentic QE v3 - MCP Security: CVE Prevention Utilities
 * Security utilities for preventing common vulnerabilities (ADR-012)
 *
 * Features:
 * - Path traversal protection (no ../ in paths)
 * - ReDoS prevention with regex escaping
 * - Timing-safe authentication comparison
 * - Input sanitization utilities
 * - Command injection prevention
 */
/**
 * Path validation result
 */
export interface PathValidationResult {
    valid: boolean;
    normalizedPath?: string;
    error?: string;
    riskLevel: 'none' | 'low' | 'medium' | 'high' | 'critical';
}
/**
 * Regex safety result
 */
export interface RegexSafetyResult {
    safe: boolean;
    pattern?: string;
    escapedPattern?: string;
    error?: string;
    riskyPatterns: string[];
}
/**
 * Command validation result
 */
export interface CommandValidationResult {
    valid: boolean;
    sanitizedCommand?: string;
    error?: string;
    blockedPatterns: string[];
}
/**
 * Input sanitization options
 */
export interface SanitizationOptions {
    maxLength?: number;
    allowedChars?: RegExp;
    stripHtml?: boolean;
    stripSql?: boolean;
    escapeShell?: boolean;
    trim?: boolean;
}
/**
 * Path validation options
 */
export interface PathValidationOptions {
    basePath?: string;
    allowAbsolute?: boolean;
    allowedExtensions?: string[];
    deniedExtensions?: string[];
    maxDepth?: number;
    maxLength?: number;
}
/**
 * Validate and sanitize a file path to prevent traversal attacks
 */
export declare function validatePath(path: string, options?: PathValidationOptions): PathValidationResult;
/**
 * Normalize a path by resolving . and .. components
 */
export declare function normalizePath(path: string): string;
/**
 * Safely join path components (strips leading/trailing slashes from all parts)
 */
export declare function joinPaths(...paths: string[]): string;
/**
 * Join paths preserving absolute path from first component
 */
export declare function joinPathsAbsolute(...paths: string[]): string;
/**
 * Get file extension
 */
export declare function getExtension(path: string): string | null;
/**
 * Check if a regex pattern is safe from ReDoS
 */
export declare function isRegexSafe(pattern: string): RegexSafetyResult;
/**
 * Escape special regex characters in a string
 */
export declare function escapeRegex(str: string): string;
/**
 * Create a safe regex with timeout
 */
export declare function createSafeRegex(pattern: string, flags?: string, maxLength?: number): RegExp | null;
/**
 * Perform a timing-safe string comparison
 */
export declare function timingSafeCompare(a: string, b: string): boolean;
/**
 * Timing-safe comparison for hashed values
 */
export declare function timingSafeHashCompare(value: string, expectedHash: string): boolean;
/**
 * Generate a secure random token
 */
export declare function generateSecureToken(length?: number): string;
/**
 * Hash a value securely
 */
export declare function secureHash(value: string, salt?: string): string;
/**
 * Sanitize input string
 */
export declare function sanitizeInput(input: string, options?: SanitizationOptions): string;
/**
 * Escape HTML special characters
 */
export declare function escapeHtml(str: string): string;
/**
 * Strip HTML tags from a string
 */
export declare function stripHtmlTags(str: string): string;
/**
 * Validate and sanitize a command
 */
export declare function validateCommand(command: string, allowedCommands?: string[]): CommandValidationResult;
/**
 * Escape a string for safe shell usage
 */
export declare function escapeShellArg(arg: string): string;
export declare const CVEPrevention: {
    validatePath: typeof validatePath;
    normalizePath: typeof normalizePath;
    joinPaths: typeof joinPaths;
    joinPathsAbsolute: typeof joinPathsAbsolute;
    getExtension: typeof getExtension;
    isRegexSafe: typeof isRegexSafe;
    escapeRegex: typeof escapeRegex;
    createSafeRegex: typeof createSafeRegex;
    timingSafeCompare: typeof timingSafeCompare;
    timingSafeHashCompare: typeof timingSafeHashCompare;
    generateSecureToken: typeof generateSecureToken;
    secureHash: typeof secureHash;
    sanitizeInput: typeof sanitizeInput;
    escapeHtml: typeof escapeHtml;
    stripHtmlTags: typeof stripHtmlTags;
    validateCommand: typeof validateCommand;
    escapeShellArg: typeof escapeShellArg;
};
export default CVEPrevention;
//# sourceMappingURL=cve-prevention.d.ts.map