@contrast/agent 4.2.0

package/lib/constants.js

@@ -0,0 +1,744 @@
+/**
+Copyright: 2021 Contrast Security, Inc
+  Contact: support@contrastsecurity.com
+  License: Commercial
+
+  NOTICE: This Software and the patented inventions embodied within may only be
+  used as part of Contrast Security’s commercial offerings. Even though it is
+  made available through public repositories, use of this Software is subject to
+  the applicable End User Licensing Agreement found at
+  https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+  between Contrast Security and the End User. The Software may not be reverse
+  engineered, modified, repackaged, sold, redistributed or otherwise used in a
+  way not consistent with the End User License Agreement.
+*/
+'use strict';
+
+const { coerce } = require('semver');
+
+/**
+ * Values and data structures share among modules.
+ * @module lib/rules/protect/common
+ */
+
+const ACTIONS = {
+  CREATION: 'CREATION',
+  PROPAGATION: 'PROPAGATION',
+  TRIGGER: 'TRIGGER',
+  TAG: 'TAG',
+  A2A: 'A2A',
+  A2P: 'A2P',
+  A2O: 'A2O',
+  A2R: 'A2R',
+  O2A: 'O2A',
+  O2P: 'O2P',
+  O2O: 'O2O',
+  O2R: 'O2R',
+  P2A: 'P2A',
+  P2P: 'P2P',
+  P2O: 'P2O',
+  P2R: 'P2R'
+};
+
+const ASSESS_STACKTRACES = {
+  UNDEFINED: 'UNDEFINED',
+  ALL: 'ALL',
+  SOME: 'SOME',
+  NONE: 'NONE'
+};
+
+const AUTHENTICATION = {
+  UNAUTHENTICATED: 'UNAUTHENTICATED', // no login detected and no existing authenticated id found
+  AUTHENTICATED: 'AUTHENTICATED', // no login detected but existing authenticated id found
+  LOGIN_FAIL: 'LOGIN_FAIL', // login attempt apparently failed
+  LOGIN_SUCCESS: 'LOGIN_SUCCESS', // login attempt apparently succeeded
+  LOGIN_UNKNOWN: 'LOGIN_UNKNOWN' // login attempt but could not determine success
+};
+
+const SAFE_XSS_CONTENT_TYPES = [
+  '/json',
+  '/x-json',
+  '/javascript',
+  '/x-javascript',
+  '/pdf',
+  '/csv'
+];
+
+const DEBUG_LOG_LEVELS = {
+  TRACE: 'TRACE',
+  DEBUG: 'DEBUG',
+  INFO: 'INFO',
+  WARN: 'WARN',
+  ERROR: 'ERROR'
+};
+
+const HTTP_EVENTS = {
+  SERVER_CREATE: 'http.createServer',
+  SERVER_LISTEN: 'http.Server.listen'
+};
+
+const INSTRUMENTATION_MODE = {
+  UNDEFINED: 'UNDEFINED',
+  AGENT_CONFIG: 'AGENT_CONFIG',
+  DUPLEX: 'DUPLEX',
+  PROFILER: 'PROFILER'
+};
+
+const RULE_TYPES = {
+  DATAFLOW: 'dataflow',
+  NON_DATAFLOW: 'nonDataflow'
+};
+
+const PROTECT_RULE_DEFINITION_TYPES = {
+  KEYWORD: 'KEYWORD',
+  PATTERN: 'PATTERN'
+};
+
+const EVENT_TYPES = {
+  METHOD: 'METHOD',
+  TAG: 'TAG',
+  PROPAGATION: 'PROPAGATION'
+};
+
+const RULES = {
+  BOT_BLOCKER: 'bot-blocker',
+  CMD_INJECTION: 'cmd-injection',
+  CMD_INJECTION_COMMAND_BACKDOORS: 'cmd-injection-command-backdoors',
+  CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS:
+    'cmd-injection-semantic-chained-commands',
+  CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS:
+    'cmd-injection-semantic-dangerous-paths',
+  IP_DENYLIST: 'ip-blacklist',
+  METHOD_TAMPERING: 'method-tampering',
+  NOSQL_INJECTION: 'nosql-injection',
+  PATH_TRAVERSAL: 'path-traversal',
+  REFLECTED_XSS: 'reflected-xss',
+  SQL_INJECTION: 'sql-injection',
+  SSJS_INJECTION: 'ssjs-injection',
+  VIRTUAL_PATCH: 'virtual-patch',
+  UNTRUSTED_DESERIALIZATION: 'untrusted-deserialization',
+  UNSAFE_FILE_UPLOAD: 'unsafe-file-upload',
+  XXE: 'xxe'
+};
+
+const CMD_INJECTION_SEMANTIC_TYPES = {
+  CHAINING: 0,
+  BACKDOOR: 1,
+  PATH_ARGUMENT: 2
+};
+
+/**
+ * Specifies the level of importance of an input evaluation. */
+const IMPORTANCE = {
+  /** Not important
+   *  All of these are true of the assessment:
+   *    1. Did not meet any threshold levels
+   *    2. Matched only LOW or MEDIUM-scoring rules, if any  */
+  NONE: 'NONE',
+
+  /** Worth-watching
+   *  All of these are true of the assessment:
+   *    1. Met or exceeded a lower-set threshold marking significance
+   *    2. Matched only LOW or MEDIUM-scoring rules  */
+  WORTH_WATCHING: 'WORTH_WATCHING',
+
+  /** Definite:
+   *    1. Matched at least a single HIGH or CRITICAL-scoring rule */
+  DEFINITE: 'DEFINITE'
+};
+
+const THRESHOLDS = {
+  WATCH: 'WATCH',
+  DEFINITE: 'DEFINITE'
+};
+
+/**
+ * These are all possible scoring values an attack-detecting rule may have. */
+const SCORES = {
+  NONE: 'NONE',
+  LOW: 'LOW',
+  MEDIUM: 'MEDIUM',
+  HIGH: 'HIGH',
+  CRITICAL: 'CRITICAL'
+};
+
+/**
+ * Each of the SCORES has an associated weight. The values are used to
+ * identify whether an evaluation assessment has reached any numeric
+ * threshold levels. */
+const WEIGHTS = {
+  NONE: 0,
+  LOW: 1,
+  MEDIUM: 2,
+  HIGH: 3,
+  CRITICAL: 4
+};
+
+const IMPACTS = {
+  NONE: 0,
+  LOW: 1,
+  MEDIUM: 2,
+  HIGH: 3,
+  CRITICAL: 4
+};
+
+const EXCLUSION_TYPES = {
+  URL: 'URL',
+  INPUT: 'INPUT',
+  CODE: 'CODE'
+};
+
+const EXCLUSION_MATCH_STRATEGIES = {
+  ALL: 'ALL',
+  ONLY: 'ONLY'
+};
+
+const EXCLUSION_INPUT_TYPES = {
+  UNDEFINED: 'UNDEFINED',
+  BODY: 'BODY',
+  COOKIE: 'COOKIE',
+  HEADER: 'HEADER',
+  PARAMETER: 'PARAMETER',
+  QUERYSTRING: 'QUERYSTRING'
+};
+
+const INPUT_TYPES = {
+  UNDEFINED_TYPE: 'UNDEFINED_TYPE',
+  BODY: 'BODY',
+  COOKIE_NAME: 'COOKIE_NAME',
+  COOKIE_VALUE: 'COOKIE_VALUE',
+  DWR_VALUE: 'DWR_VALUE',
+  GENERIC_XML: 'GENERIC_XML',
+  IP: 'IP',
+  HEADER: 'HEADER',
+  JSON_VALUE: 'JSON_VALUE',
+  JSON_ARRAYED_VALUE: 'JSON_ARRAYED_VALUE',
+  METHOD: 'METHOD',
+  MULTIPART_CONTENT_TYPE: 'MULTIPART_CONTENT_TYPE',
+  MULTIPART_FIELD_NAME: 'MULTIPART_FIELD_NAME',
+  MULTIPART_NAME: 'MULTIPART_NAME',
+  MULTIPART_VALUE: 'MULTIPART_VALUE',
+  PARAMETER_NAME: 'PARAMETER_NAME',
+  PARAMETER_VALUE: 'PARAMETER_VALUE',
+  QUERYSTRING: 'QUERYSTRING',
+  REQUEST: 'REQUEST',
+  SOCKET: 'SOCKET',
+  XML_VALUE: 'XML_VALUE',
+  URI: 'URI',
+  URL: 'URL',
+  URL_PARAMETER: 'URL_PARAMETER',
+  UNKNOWN: 'UNKNOWN'
+};
+
+const INPUT_TYPES_WITH_PARAMS = {
+  BODY: 'BODY',
+  JSON_VALUE: 'JSON_VALUE',
+  JSON_ARRAYED_VALUE: 'JSON_ARRAYED_VALUE',
+  MULTIPART_VALUE: 'MULTIPART_VALUE',
+  PARAMETER_VALUE: 'PARAMETER_VALUE',
+  QUERYSTRING: 'QUERYSTRING',
+  XML_VALUE: 'XML_VALUE',
+  URI: 'URI',
+  URL: 'URL'
+};
+
+const DOCUMENT_TYPES = {
+  NORMAL: 'NORMAL',
+  JSON: 'JSON',
+  XML: 'XML'
+};
+
+const HTTP_VERBS = {
+  GET: 'GET',
+  HEAD: 'HEAD',
+  POST: 'POST',
+  PUT: 'PUT',
+  DELETE: 'DELETE',
+  CONNECT: 'CONNECT',
+  OPTIONS: 'OPTIONS',
+  TRACE: 'TRACE',
+  PATCH: 'PATCH'
+};
+
+const LC_HTTP_VERBS = Object.keys(HTTP_VERBS).map((k) =>
+  HTTP_VERBS[k].toLowerCase()
+);
+
+const PROTOCOLS = {
+  FTP: 'FTP',
+  HTTP: 'HTTP',
+  HTTPS: 'HTTPS',
+  TCP: 'TCP'
+};
+
+const SINK_TYPES = {
+  CODE_ENV: Symbol('CODE_ENV'),
+  CODE_STRING: Symbol('CODE_STRING'),
+  COMMAND: Symbol('COMMAND'),
+  DESERIALIZED_STRING: Symbol('DESERIALIZED_STRING'),
+  FILE_PATH: Symbol('PATH'),
+  NOSQL_QUERY: Symbol('NOSQL_QUERY'),
+  RESPONSE_BODY: Symbol('BODY'),
+  RESPONSE_HEADERS: Symbol('HEADERS'),
+  RESPONSE_STATUS: Symbol('STATUS'),
+  SQL_QUERY: Symbol('QUERY'),
+  XML_STRING: Symbol('XML_STRING')
+};
+
+const CONNECTION_TYPES = {
+  UNENCRYPTED: 'UNENCRYPTED',
+  ENCRYPTED: 'ENCRYPTED'
+};
+
+const PROTECTION_MODES = {
+  NO_ACTION: 'NO_ACTION',
+  MONITOR: 'MONITOR',
+  BLOCK: 'BLOCK',
+  BLOCK_AT_PERIMETER: 'BLOCK_AT_PERIMETER',
+  PERMIT: 'PERMIT'
+};
+
+const PROTECT_RULE_SUPPORTED_MODES = {
+  [RULES.BOT_BLOCKER]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.CMD_INJECTION]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.CMD_INJECTION_COMMAND_BACKDOORS]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK
+  ],
+  [RULES.CMD_INJECTION_SEMANTIC_CHAINED_COMMANDS]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK
+  ],
+  [RULES.CMD_INJECTION_SEMANTIC_DANGEROUS_PATHS]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK
+  ],
+  [RULES.IP_DENYLIST]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.METHOD_TAMPERING]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.NOSQL_INJECTION]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.PATH_TRAVERSAL]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.REFLECTED_XSS]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.SQL_INJECTION]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.SSJS_INJECTION]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.VIRTUAL_PATCH]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.UNSAFE_FILE_UPLOAD]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK_AT_PERIMETER
+  ],
+  [RULES.XXE]: [
+    PROTECTION_MODES.NO_ACTION,
+    PROTECTION_MODES.MONITOR,
+    PROTECTION_MODES.BLOCK
+  ]
+};
+
+const REACTION_OPERATION = {
+  NOOP: 'NOOP',
+  DISABLE: 'DISABLE',
+  INVENTORY: 'INVENTORY'
+};
+
+const SYSLOG_SEVERITIES = {
+  UNDEFINED: 'UNDEFINED',
+  ALERT: 'ALERT',
+  CRITICAL: 'CRITICAL',
+  ERROR: 'ERROR',
+  WARNING: 'WARNING',
+  NOTICE: 'NOTICE',
+  INFO: 'INFO',
+  DEBUG: 'DEBUG'
+};
+
+const ATTACK_STATUS = {
+  BLOCKED: 'blocked',
+  BLOCKED_AT_PERIMETER: 'blockedAtPerimeter',
+  EXPLOITED: 'exploited',
+  INEFFECTIVE: 'ineffective'
+};
+
+const WORD_SHARE = {
+  COMMA: ',',
+  FORWARD_SLASH: '/',
+  SPACE: ' '
+};
+
+/**
+ * Copied from EventTagTypeDTM
+ */
+const TAGS = {
+  'xml-encoded': 'XML_ENCODED',
+  'xml-decoded': 'XML_DECODED',
+  'html-encoded': 'HTML_ENCODED',
+  'html-decoded': 'HTML_DECODED',
+  'url-encoded': 'URL_ENCODED',
+  'url-decoded': 'URL_DECODED',
+  'css-encoded': 'CSS_ENCODED',
+  'css-decoded': 'CSS_DECODED',
+  'base64-encoded': 'BASE64_ENCODED',
+  'base64-decoded': 'BASE64_DECODED',
+  'javascript-encoded': 'JAVASCRIPT_ENCODED',
+  'javascript-decoded': 'JAVASCRIPT_DECODED',
+  'java-encoded': 'JAVA_ENCODED',
+  'java-decoded': 'JAVA_DECODED',
+  'csv-encoded': 'CSV_ENCODED',
+  'csv-decoded': 'CSV_DECODED',
+  'sql-encoded': 'SQL_ENCODED',
+  'sql-decoded': 'SQL_DECODED',
+  'ldap-encoded': 'LDAP_ENCODED',
+  'ldap-decoded': 'LDAP_DECODED',
+  'xpath-encoded': 'XPATH_ENCODED',
+  'xpath-decoded': 'XPATH_DECODED',
+  'os-encoded': 'OS_ENCODED',
+  'os-decoded': 'OS_DECODED',
+  'vbscript-encoded': 'VBSCRIPT_ENCODED',
+  'vbscript-decoded': 'VBSCRIPT_DECODED',
+  'potential-sanitized': 'POTENTIAL_SANITIZED',
+  'potential-validated': 'POTENTIAL_VALIDATED',
+  'no-control-chars': 'NO_CONTROL_CHARS',
+
+  // default catch all
+  'custom-catch-all': 'CUSTOM',
+
+  // custom encoded/validated tags, only for data flow rules
+  'custom-encoded': 'CUSTOM_ENCODED',
+  'custom-encoded-cmd-injection': 'CUSTOM_ENCODED_CMD_INJECTION',
+  'custom-encoded-expression-language-injection':
+    'CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION',
+  'custom-encoded-header-injection': 'CUSTOM_ENCODED_HEADER_INJECTION',
+  'custom-encoded-hql-injection': 'CUSTOM_ENCODED_HQL_INJECTION',
+  'custom-encoded-ldap-injection': 'CUSTOM_ENCODED_LDAP_INJECTION',
+  'custom-encoded-log-injection': 'CUSTOM_ENCODED_LOG_INJECTION',
+  'custom-encoded-nosql-injection': 'CUSTOM_ENCODED_NOSQL_INJECTIOn',
+  'custom-encoded-path-traversal': 'CUSTOM_ENCODED_PATH_TRAVERSAL',
+  'custom-encoded-redos': 'CUSTOM_ENCODED_REDOS',
+  'custom-encoded-reflected-xss': 'CUSTOM_ENCODED_REFLECTED_XSS',
+  'custom-encoded-reflection-injection': 'CUSTOM_ENCODED_REFLECTION_INJECTION',
+  'custom-encoded-smtp-injection': 'CUSTOM_ENCODED_SMTP_INJECTION',
+  'custom-encoded-sql-injection': 'CUSTOM_ENCODED_SQL_INJECTION',
+  'custom-encoded-ssrf': 'CUSTOM_ENCODED_SSRF',
+  'custom-encoded-stored-xss': 'CUSTOM_ENCODED_STORED_XSS',
+  'custom-encoded-trust-boundary-violation':
+    'CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION',
+  'custom-encoded-unsafe-code-execution':
+    'CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION',
+  'custom-encoded-unsafe-readline': 'CUSTOM_ENCODED_UNSAFE_READLINE',
+  'custom-encoded-unsafe-xml-decode': 'CUSTOM_ENCODED_UNSAFE_XML_DECODE',
+  'custom-encoded-untrusted-deserialization':
+    'CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION',
+  'custom-encoded-unvalidated-forward': 'CUSTOM_ENCODED_UNVALIDATED_FORWARD',
+  'custom-encoded-unvalidated-redirect': 'CUSTOM_ENCODED_UNVALIDATED_REDIRECT',
+  'custom-encoded-xpath-injection': 'CUSTOM_ENCODED_XPATH_INJECTION',
+  'custom-encoded-xxe': 'CUSTOM_ENCODED_XXE',
+  'custom-security-control-applied': 'CUSTOM_SECURITY_CONTROL_APPLIED',
+
+  'custom-validated': 'CUSTOM_VALIDATED',
+  'custom-validated-cmd-injection': 'CUSTOM_VALIDATED_CMD_INJECTION',
+  'custom-validated-expression-language-injection':
+    'CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION',
+  'custom-validated-header-injection': 'CUSTOM_VALIDATED_HEADER_INJECTION',
+  'custom-validated-hql-injection': 'CUSTOM_VALIDATED_HQL_INJECTION',
+  'custom-validated-ldap-injection': 'CUSTOM_VALIDATED_LDAP_INJECTION',
+  'custom-validated-log-injection': 'CUSTOM_VALIDATED_LOG_INJECTION',
+  'custom-validated-nosql-injection': 'CUSTOM_VALIDATED_NOSQL_INJECTIOn',
+  'custom-validated-path-traversal': 'CUSTOM_VALIDATED_PATH_TRAVERSAL',
+  'custom-validated-redos': 'CUSTOM_VALIDATED_REDOS',
+  'custom-validated-reflected-xss': 'CUSTOM_VALIDATED_REFLECTED_XSS',
+  'custom-validated-reflection-injection':
+    'CUSTOM_VALIDATED_REFLECTION_INJECTION',
+  'custom-validated-smtp-injection': 'CUSTOM_VALIDATED_SMTP_INJECTION',
+  'custom-validated-sql-injection': 'CUSTOM_VALIDATED_SQL_INJECTION',
+  'custom-validated-ssrf': 'CUSTOM_VALIDATED_SSRF',
+  'custom-validated-stored-xss': 'CUSTOM_VALIDATED_STORED_XSS',
+  'custom-validated-trust-boundary-violation':
+    'CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION',
+  'custom-validated-unsafe-code-execution':
+    'CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION',
+  'custom-validated-unsafe-readline': 'CUSTOM_VALIDATED_UNSAFE_READLINE',
+  'custom-validated-unsafe-xml-decode': 'CUSTOM_VALIDATED_UNSAFE_XML_DECODE',
+  'custom-validated-untrusted-deserialization':
+    'CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION',
+  'custom-validated-unvalidated-forward':
+    'CUSTOM_VALIDATED_UNVALIDATED_FORWARD',
+  'custom-validated-unvalidated-redirect':
+    'CUSTOM_VALIDATED_UNVALIDATED_REDIRECT',
+  'custom-validated-xpath-injection': 'CUSTOM_VALIDATED_XPATH_INJECTION',
+  'custom-validated-xxe': 'CUSTOM_VALIDATED_XXE',
+
+  // tracked-string range tags
+  'no-newlines': 'NO_NEWLINES',
+  untrusted: 'UNTRUSTED',
+  'cross-site': 'CROSS_SITE',
+  'limited-chars': 'LIMITED_CHARS',
+  'alphanum-space-hyphen': 'ALPHANUM_SPACE_HYPHEN',
+  'string-type-checked': 'STRING_TYPE_CHECKED',
+
+  'database-write': 'DATABASE_WRITE'
+};
+
+const contrastPkg = require('../package.json');
+
+const AGENT_INFO = {
+  VERSION: coerce(contrastPkg.version).version,
+  SUPPORTED_VERSIONS: contrastPkg.engines.node,
+  SUPPORTED_NPM_VERSIONS: contrastPkg.engines.npm,
+  NAME: contrastPkg.name,
+  TRACE_VERSION: '4'
+};
+
+const CSP_HEADERS = [
+  'content-security-policy',
+  'x-content-security-policy',
+  'x-webkit-csp'
+];
+
+const VIRTUAL_PATCH_INPUT_TYPES = {
+  UNKNOWN_INPUT: 'UNKNOWN_INPUT',
+  USERAGENT: 'USERAGENT',
+  REFERER: 'REFERER',
+  URL: 'URL',
+  PARAMETER: 'PARAMETER',
+  HEADER: 'HEADER',
+  CODE: 'CODE'
+};
+
+const VIRTUAL_PATCH_EVALUATIONS = {
+  UNKNOWN_EVALUATION: 'UNKNOWN_EVALUATION',
+  MATCHES: 'MATCHES',
+  DOESNT_MATCH: 'DOESNT_MATCH',
+  CONTAINS: 'CONTAINS',
+  DOESNT_CONTAIN: 'DOESNT_CONTAIN',
+  EQUALS: 'EQUALS',
+  DOESNT_EQUAL: 'DOESNT_EQUAL'
+};
+
+const SAFE_HEADER_VALUES = [
+  'KEEP-ALIVE',
+  'keep-alive',
+  '$VERSION=1',
+  'gzip,deflate',
+  'gzip, deflate',
+  'gzip, deflate, sdch',
+  'application/x-wwww-form-urlencoded',
+  '*/*',
+  'max-age=0',
+  'https',
+  'close',
+  '0',
+  '443',
+  'text/json',
+  'text/xml',
+  'application/json',
+  'application/xml'
+];
+
+const TEAMSERVER_API = {
+  CHANNEL_DISABLING_STATUS_CODES: [401, 409, 410],
+  CHANNEL_PAUSING_STATUS_CODES: [401, 403, 408, 412],
+  ERROR_CODE_MESSAGES: {
+    400: 'Malformed body content in request',
+    401: 'Unknown credentials in API request. Please check configuration for proper credentials.',
+    403: 'Unauthorized credentials in API request. Please check configuration for proper credentials.',
+    408: 'Agent request timeout.',
+    409: 'This application is unwanted by TeamServer and no findings will be reported. Make sure the application is unarchived.',
+    410: 'Application not found. Update aborted',
+    412: 'API key no longer valid. Please check configuration for proper credentials.',
+    500: 'Contrast server error. Please see Contrast server logs for more information.'
+  },
+  REACTIONS: {
+    DISABLE: 'DISABLE',
+    NOOP: 'NOOP'
+  }
+};
+
+const INTERVALS = {
+  PREFLIGHT: 5000,
+  HEARTBEAT: 30000
+};
+
+const RESPONSE_TYPES = {
+  NO_ACTION: 'NO_ACTION',
+  BLOCKED: 'BLOCKED',
+  MONITORED: 'MONITORED',
+  PROBED: 'PROBED',
+  BLOCKED_AT_PERIMETER: 'BLOCKED_AT_PERIMETER',
+  AGGREGATED: 'AGGREGATED'
+};
+
+const FRAMEWORKS = ['express', '@hapi/hapi', 'hapi', 'koa', 'fastify'];
+
+const HAPI = {
+  FINISHED: 'Hapi.requestFinished',
+  ORIG_FUNC: Symbol('originalFunction')
+};
+
+// symbol we add to Express layers for storing middleware state
+const MW_PATH = Symbol('middlewarePath');
+// symbol we add to Express requests storing the layers that have
+// been traversed
+const LAYER_STACK = Symbol('layerStack');
+
+// symbol for fetching unproxied object from proxy. used with membranes
+// to proxy when creating SR messages.
+const PROXY_TARGET = Symbol('proxyTarget');
+
+const REQUIRED_SIGNATURE_KEYS = [
+  'id',
+  'definiteThreshold',
+  'watchThreshold',
+  'patternSearchers',
+  'keywordSearchers',
+  'customSearchers'
+];
+
+const HTTP_RESPONSE_HOOKED_METHOD_KEYS = {
+  WRITE_HEAD: Symbol('writeHead'),
+  END: Symbol('end')
+};
+
+const PATCH_TYPES = {
+  // a patch for a function for emitting architecture component events
+  // for flow-map
+  ARCH_COMPONENT: 'arch component',
+  // a patch related to retaining or applying async context
+  ASYNC_CONTEXT: 'async context',
+  // patch for a propagator
+  ASSESS_PROPAGATOR: 'assess propagator',
+  // patch for an assess sink
+  ASSESS_SINK: 'assess sink',
+  // patch for an assess source
+  ASSESS_SOURCE: 'assess source',
+  // deadzone - we patch deadzone functions to ensure they
+  // are run in no instrumentation scope
+  DEADZONE: 'deadzone',
+  // generic catch-all for patches we install to instrument
+  // HTTP frameworks
+  FRAMEWORK: 'framework',
+  // used for hooking injected globals that are added
+  // during rewrite process
+  INJECTION: 'injection',
+  // patch for a protect sink (aka sensor)
+  PROTECT_SINK: 'protect sink',
+  // patch for emitting a protect source event
+  PROTECT_SOURCE: 'protect source',
+  // patch for tracking route coverage (discovery,observation,et)
+  ROUTE_COVERAGE: 'route coverage',
+  // like assess and protect sink but a generic patch that
+  // provides data to both features
+  SINK: 'sink',
+  // like assess and protect source but a generic patch that
+  // provides data to both features
+  SOURCE: 'source',
+  // miscellaneous patching - usage is discouraged
+  // in most cases better to group with a more specific
+  // label (or add one)
+  MISC: 'miscellaneous'
+};
+
+const SCREENER_HEADER_NAME = 'x-contrast-screener-id';
+
+const EXCLUSION_TAG_NAMESPACE = 'exclusion';
+
+module.exports = {
+  ACTIONS,
+  AGENT_INFO,
+  ASSESS_STACKTRACES,
+  ATTACK_STATUS,
+  AUTHENTICATION,
+  CONNECTION_TYPES,
+  CMD_INJECTION_SEMANTIC_TYPES,
+  CSP_HEADERS,
+  DEBUG_LOG_LEVELS,
+  DOCUMENT_TYPES,
+  EXCLUSION_MATCH_STRATEGIES,
+  EXCLUSION_INPUT_TYPES,
+  EXCLUSION_TAG_NAMESPACE,
+  EXCLUSION_TYPES,
+  EVENT_TYPES,
+  FRAMEWORKS,
+  LC_HTTP_VERBS,
+  HAPI,
+  HTTP_VERBS,
+  HTTP_EVENTS,
+  HTTP_RESPONSE_HOOKED_METHOD_KEYS,
+  IMPACTS,
+  IMPORTANCE,
+  INPUT_TYPES,
+  INPUT_TYPES_WITH_PARAMS,
+  INSTRUMENTATION_MODE,
+  INTERVALS,
+  LAYER_STACK,
+  PROXY_TARGET,
+  MW_PATH,
+  PATCH_TYPES,
+  PROTECT_RULE_DEFINITION_TYPES,
+  PROTECT_RULE_SUPPORTED_MODES,
+  PROTECTION_MODES,
+  PROTOCOLS,
+  REACTION_OPERATION,
+  RESPONSE_TYPES,
+  REQUIRED_SIGNATURE_KEYS,
+  RULES,
+  RULE_TYPES,
+  SAFE_XSS_CONTENT_TYPES,
+  SAFE_HEADER_VALUES,
+  SCREENER_HEADER_NAME,
+  SCORES,
+  SINK_TYPES,
+  SYSLOG_SEVERITIES,
+  TAGS,
+  TEAMSERVER_API,
+  THRESHOLDS,
+  VIRTUAL_PATCH_EVALUATIONS,
+  VIRTUAL_PATCH_INPUT_TYPES,
+  WEIGHTS,
+  WORD_SHARE
+};