@futdevpro/fsm-dynamo 1.20.25 → 1.20.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/_modules/ngx-models/_models/control-models/forms-new/checkbox-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/checkbox-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/checkbox-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/checkbox-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/date-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/date-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/date-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/date-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/date-range-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/date-range-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/date-range-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/date-range-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/datetime-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/datetime-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/datetime-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/datetime-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/datetime-range-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/datetime-range-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/datetime-range-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/datetime-range-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/field-new-settings.control-model.d.ts +6 -4
- package/build/_modules/ngx-models/_models/control-models/forms-new/field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/field-new-settings.control-model.js +10 -5
- package/build/_modules/ngx-models/_models/control-models/forms-new/field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/form-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/form-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/form-new-settings.control-model.js +9 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/form-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/multiselect-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/multiselect-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/multiselect-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/multiselect-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/number-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/number-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/number-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/number-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/password-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/password-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/password-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/password-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/radio-select-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/radio-select-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/radio-select-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/radio-select-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/select-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/select-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/select-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/select-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/slider-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/slider-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/slider-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/slider-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/slider-range-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/slider-range-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/slider-range-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/slider-range-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/text-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/text-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/text-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/text-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/textarea-field-new-settings.control-model.d.ts +5 -2
- package/build/_modules/ngx-models/_models/control-models/forms-new/textarea-field-new-settings.control-model.d.ts.map +1 -1
- package/build/_modules/ngx-models/_models/control-models/forms-new/textarea-field-new-settings.control-model.js +10 -3
- package/build/_modules/ngx-models/_models/control-models/forms-new/textarea-field-new-settings.control-model.js.map +1 -1
- package/build/_modules/request-safety/_collections/request-safety-inspector.util.d.ts +19 -8
- package/build/_modules/request-safety/_collections/request-safety-inspector.util.d.ts.map +1 -1
- package/build/_modules/request-safety/_collections/request-safety-inspector.util.js +190 -57
- package/build/_modules/request-safety/_collections/request-safety-inspector.util.js.map +1 -1
- package/build/_modules/request-safety/_enums/request-safety-finding.type-enum.d.ts +3 -1
- package/build/_modules/request-safety/_enums/request-safety-finding.type-enum.d.ts.map +1 -1
- package/build/_modules/request-safety/_enums/request-safety-finding.type-enum.js +2 -0
- package/build/_modules/request-safety/_enums/request-safety-finding.type-enum.js.map +1 -1
- package/build/_modules/request-safety/_models/request-safety.interface.d.ts +4 -2
- package/build/_modules/request-safety/_models/request-safety.interface.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -11,6 +11,10 @@ import { DyFM_RequestSafetyPolicy_Interface, DyFM_RequestSafetyResult_Interface
|
|
|
11
11
|
* no environment access. That is not stylistic: the inspector runs on hostile input, so anything it
|
|
12
12
|
* touched would become an attack surface, and anything it logged would re-leak the value it rejected.
|
|
13
13
|
* The same source therefore runs unchanged in a browser, a Worker and Node.
|
|
14
|
+
*
|
|
15
|
+
* Supply inert data and a trusted product policy. Reflection on a JavaScript Proxy can execute its
|
|
16
|
+
* traps; this utility contains thrown errors but cannot sandbox that code. Likewise, node/string
|
|
17
|
+
* counters do not replace a separate process/sandbox memory and CPU limit.
|
|
14
18
|
*/
|
|
15
19
|
export declare class DyFM_RequestSafetyInspector_Util {
|
|
16
20
|
/**
|
|
@@ -40,17 +44,24 @@ export declare class DyFM_RequestSafetyInspector_Util {
|
|
|
40
44
|
* @returns a content-free outcome; the input itself is never echoed in any form.
|
|
41
45
|
*/
|
|
42
46
|
static inspect(input: unknown, policy: DyFM_RequestSafetyPolicy_Interface): DyFM_RequestSafetyResult_Interface;
|
|
43
|
-
/**
|
|
47
|
+
/** Checks the string budget, canaries and the caller's sensitive/capability patterns. */
|
|
44
48
|
private static inspectString;
|
|
45
49
|
/**
|
|
46
|
-
*
|
|
50
|
+
* Records at most one finding per pattern group, using private per-inspection regex instances.
|
|
47
51
|
*
|
|
48
|
-
*
|
|
49
|
-
*
|
|
50
|
-
* ugyanarra a bemenetre. Ez a fajta nem-determinizmus egy biztonsagi kapunal elfogadhatatlan.
|
|
52
|
+
* Resetting the caller's cursor to zero was itself a mutation when it started at a nonzero offset,
|
|
53
|
+
* and threw for frozen patterns. Only the validated snapshot is mutable; the caller is never touched.
|
|
51
54
|
*/
|
|
52
|
-
private static
|
|
53
|
-
/**
|
|
54
|
-
private static
|
|
55
|
+
private static matchesPattern;
|
|
56
|
+
/** Validates the entire policy before input inspection, without invoking accessors or array iterators. */
|
|
57
|
+
private static snapshotPolicy;
|
|
58
|
+
/** Copies dense policy lists through data descriptors, rejecting holes, accessors and custom properties. */
|
|
59
|
+
private static snapshotList;
|
|
60
|
+
/** Clones ordinary regexes without calling caller-defined test/source/flag members or touching lastIndex. */
|
|
61
|
+
private static snapshotPattern;
|
|
62
|
+
/** Narrows a required positive integer budget; errors remain inside the policy boundary. */
|
|
63
|
+
private static positiveBudget;
|
|
64
|
+
/** Reads and validates only the array's own length descriptor, never an input member access. */
|
|
65
|
+
private static arrayLength;
|
|
55
66
|
}
|
|
56
67
|
//# sourceMappingURL=request-safety-inspector.util.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-safety-inspector.util.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_collections/request-safety-inspector.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EAAE,kCAAkC,EACvE,MAAM,qCAAqC,CAAC;AAE7C
|
|
1
|
+
{"version":3,"file":"request-safety-inspector.util.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_collections/request-safety-inspector.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EAAE,kCAAkC,EACvE,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,gCAAgC;IAE3C;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CACkB;IAE3D;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAOvC;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CACZ,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,kCAAkC,GACzC,kCAAkC;IA8KrC,yFAAyF;IACzF,OAAO,CAAC,MAAM,CAAC,aAAa;IA6B5B;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAe7B,0GAA0G;IAC1G,OAAO,CAAC,MAAM,CAAC,cAAc;IA+D7B,4GAA4G;IAC5G,OAAO,CAAC,MAAM,CAAC,YAAY;IA2B3B,6GAA6G;IAC7G,OAAO,CAAC,MAAM,CAAC,eAAe;IAS9B,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,cAAc;IAQ7B,gGAAgG;IAChG,OAAO,CAAC,MAAM,CAAC,WAAW;CAS3B"}
|
|
@@ -14,6 +14,10 @@ const request_safety_finding_type_enum_1 = require("../_enums/request-safety-fin
|
|
|
14
14
|
* no environment access. That is not stylistic: the inspector runs on hostile input, so anything it
|
|
15
15
|
* touched would become an attack surface, and anything it logged would re-leak the value it rejected.
|
|
16
16
|
* The same source therefore runs unchanged in a browser, a Worker and Node.
|
|
17
|
+
*
|
|
18
|
+
* Supply inert data and a trusted product policy. Reflection on a JavaScript Proxy can execute its
|
|
19
|
+
* traps; this utility contains thrown errors but cannot sandbox that code. Likewise, node/string
|
|
20
|
+
* counters do not replace a separate process/sandbox memory and CPU limit.
|
|
17
21
|
*/
|
|
18
22
|
class DyFM_RequestSafetyInspector_Util {
|
|
19
23
|
/**
|
|
@@ -48,16 +52,18 @@ class DyFM_RequestSafetyInspector_Util {
|
|
|
48
52
|
* @returns a content-free outcome; the input itself is never echoed in any form.
|
|
49
53
|
*/
|
|
50
54
|
static inspect(input, policy) {
|
|
55
|
+
const snapshot = DyFM_RequestSafetyInspector_Util.snapshotPolicy(policy);
|
|
51
56
|
const counts = {};
|
|
52
57
|
let inspectedNodes = 0;
|
|
53
|
-
const namespace =
|
|
58
|
+
const namespace = snapshot?.namespace ?? 'unknown';
|
|
59
|
+
/** Adds only a stable namespaced finding and its aggregate count. */
|
|
54
60
|
const record = (finding) => {
|
|
55
61
|
const code = `${namespace}:${finding}`;
|
|
56
62
|
counts[code] = (counts[code] ?? 0) + 1;
|
|
57
63
|
};
|
|
58
|
-
if (!
|
|
59
|
-
//
|
|
60
|
-
const code =
|
|
64
|
+
if (!snapshot) {
|
|
65
|
+
// Invalid policy is not permission to proceed. Do not echo even its namespace.
|
|
66
|
+
const code = `unknown:${request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.invalidPolicy}`;
|
|
61
67
|
return {
|
|
62
68
|
contractVersion: 'dyfm-request-safety/1',
|
|
63
69
|
accepted: false,
|
|
@@ -66,13 +72,18 @@ class DyFM_RequestSafetyInspector_Util {
|
|
|
66
72
|
inspectedNodes: 0,
|
|
67
73
|
};
|
|
68
74
|
}
|
|
75
|
+
policy = snapshot;
|
|
69
76
|
const forbiddenKeys = new Set((policy.forbiddenKeys ?? []).map((key) => DyFM_RequestSafetyInspector_Util.normalize(key)));
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
77
|
+
// Only the active path constitutes a cycle; acyclic shared subtrees are valid JSON input.
|
|
78
|
+
const ancestors = new Set();
|
|
79
|
+
let isNodeBudgetExhausted = false;
|
|
80
|
+
/** Visits data descriptors within the shared per-call budgets. */
|
|
74
81
|
const walk = (value, depth) => {
|
|
82
|
+
if (isNodeBudgetExhausted) {
|
|
83
|
+
return;
|
|
84
|
+
}
|
|
75
85
|
if (inspectedNodes >= policy.maxNodes) {
|
|
86
|
+
isNodeBudgetExhausted = true;
|
|
76
87
|
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.nodeBudget);
|
|
77
88
|
return;
|
|
78
89
|
}
|
|
@@ -85,49 +96,85 @@ class DyFM_RequestSafetyInspector_Util {
|
|
|
85
96
|
return;
|
|
86
97
|
}
|
|
87
98
|
if (typeof value === 'string') {
|
|
88
|
-
DyFM_RequestSafetyInspector_Util.inspectString(value, policy,
|
|
99
|
+
DyFM_RequestSafetyInspector_Util.inspectString(value, policy, record);
|
|
89
100
|
return;
|
|
90
101
|
}
|
|
91
102
|
if (typeof value === 'undefined') {
|
|
92
103
|
return;
|
|
93
104
|
}
|
|
94
105
|
if (typeof value !== 'object') {
|
|
95
|
-
//
|
|
106
|
+
// Functions, symbols and bigint are not carried by this contract.
|
|
96
107
|
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.unsupportedValueType);
|
|
97
108
|
return;
|
|
98
109
|
}
|
|
99
|
-
if (
|
|
110
|
+
if (ancestors.has(value)) {
|
|
100
111
|
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.cycle);
|
|
101
112
|
return;
|
|
102
113
|
}
|
|
103
|
-
|
|
104
|
-
if (Array.isArray(value)) {
|
|
105
|
-
for (const item of value) {
|
|
106
|
-
walk(item, depth + 1);
|
|
107
|
-
}
|
|
108
|
-
return;
|
|
109
|
-
}
|
|
114
|
+
const isArray = Array.isArray(value);
|
|
110
115
|
const prototype = Object.getPrototypeOf(value);
|
|
111
|
-
if (prototype !== Object.prototype && prototype !== null) {
|
|
112
|
-
//
|
|
113
|
-
// egyezne azzal, amit itt lattunk — tehat az ellenorzes ertelmet vesztene.
|
|
116
|
+
if (isArray ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) {
|
|
117
|
+
// Serialization of custom prototypes may differ from the inspected data.
|
|
114
118
|
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.unsupportedPrototype);
|
|
115
119
|
return;
|
|
116
120
|
}
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
121
|
+
ancestors.add(value);
|
|
122
|
+
try {
|
|
123
|
+
// Never invoke input iterators or read property values directly, including array indices.
|
|
124
|
+
const keys = Reflect.ownKeys(value);
|
|
125
|
+
if (isArray) {
|
|
126
|
+
// Holes serialize too. Charge them arithmetically, without iterating a huge sparse array.
|
|
127
|
+
const length = DyFM_RequestSafetyInspector_Util.arrayLength(value);
|
|
128
|
+
const presentIndices = keys.filter((key) => (typeof key === 'string' && /^(?:0|[1-9]\d*)$/u.test(key) && Number(key) < length)).length;
|
|
129
|
+
const holes = length - presentIndices;
|
|
130
|
+
if (holes > policy.maxNodes - inspectedNodes) {
|
|
131
|
+
inspectedNodes = policy.maxNodes;
|
|
132
|
+
isNodeBudgetExhausted = true;
|
|
133
|
+
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.nodeBudget);
|
|
134
|
+
return;
|
|
135
|
+
}
|
|
136
|
+
inspectedNodes += holes;
|
|
120
137
|
}
|
|
121
|
-
const
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
138
|
+
for (const key of keys) {
|
|
139
|
+
if (isArray && key === 'length') {
|
|
140
|
+
continue;
|
|
141
|
+
}
|
|
142
|
+
if (isNodeBudgetExhausted || inspectedNodes >= policy.maxNodes) {
|
|
143
|
+
if (!isNodeBudgetExhausted) {
|
|
144
|
+
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.nodeBudget);
|
|
145
|
+
isNodeBudgetExhausted = true;
|
|
146
|
+
}
|
|
147
|
+
break;
|
|
148
|
+
}
|
|
149
|
+
if (typeof key !== 'string') {
|
|
150
|
+
inspectedNodes++;
|
|
151
|
+
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.unsupportedValueType);
|
|
152
|
+
continue;
|
|
153
|
+
}
|
|
154
|
+
if (forbiddenKeys.has(DyFM_RequestSafetyInspector_Util.normalize(key))) {
|
|
155
|
+
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.forbiddenKey);
|
|
156
|
+
}
|
|
157
|
+
DyFM_RequestSafetyInspector_Util.inspectString(key, policy, record);
|
|
158
|
+
const descriptor = Object.getOwnPropertyDescriptor(value, key);
|
|
159
|
+
if (!descriptor || !('value' in descriptor)) {
|
|
160
|
+
inspectedNodes++;
|
|
161
|
+
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.accessor);
|
|
162
|
+
continue;
|
|
163
|
+
}
|
|
164
|
+
walk(descriptor.value, depth + 1);
|
|
126
165
|
}
|
|
127
|
-
|
|
166
|
+
}
|
|
167
|
+
finally {
|
|
168
|
+
ancestors.delete(value);
|
|
128
169
|
}
|
|
129
170
|
};
|
|
130
|
-
|
|
171
|
+
try {
|
|
172
|
+
walk(input, 0);
|
|
173
|
+
}
|
|
174
|
+
catch {
|
|
175
|
+
// Proxy reflection can throw. Contain its error; this is not a sandbox for arbitrary proxy code.
|
|
176
|
+
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.inspectionFailure);
|
|
177
|
+
}
|
|
131
178
|
const findingCodes = Object.keys(counts).sort();
|
|
132
179
|
return {
|
|
133
180
|
contractVersion: 'dyfm-request-safety/1',
|
|
@@ -137,52 +184,138 @@ class DyFM_RequestSafetyInspector_Util {
|
|
|
137
184
|
inspectedNodes: inspectedNodes,
|
|
138
185
|
};
|
|
139
186
|
}
|
|
140
|
-
/**
|
|
141
|
-
static inspectString(value, policy,
|
|
187
|
+
/** Checks the string budget, canaries and the caller's sensitive/capability patterns. */
|
|
188
|
+
static inspectString(value, policy, record) {
|
|
142
189
|
const normalized = DyFM_RequestSafetyInspector_Util.normalize(value);
|
|
143
190
|
if (normalized.length > policy.maxStringLength) {
|
|
144
191
|
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.stringBudget);
|
|
192
|
+
return;
|
|
145
193
|
}
|
|
146
|
-
for (const canary of canaries) {
|
|
194
|
+
for (const canary of policy.canaries ?? []) {
|
|
147
195
|
if (canary.length > 0 && normalized.includes(canary)) {
|
|
148
196
|
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.canary);
|
|
149
197
|
break;
|
|
150
198
|
}
|
|
151
199
|
}
|
|
152
|
-
DyFM_RequestSafetyInspector_Util.
|
|
153
|
-
|
|
200
|
+
if (DyFM_RequestSafetyInspector_Util.matchesPattern(normalized, policy.sensitiveValuePatterns)) {
|
|
201
|
+
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.sensitiveValue);
|
|
202
|
+
}
|
|
203
|
+
if (DyFM_RequestSafetyInspector_Util.matchesPattern(normalized, policy.unsupportedCapabilityPatterns)) {
|
|
204
|
+
record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.unsupportedCapability);
|
|
205
|
+
}
|
|
154
206
|
}
|
|
155
207
|
/**
|
|
156
|
-
*
|
|
208
|
+
* Records at most one finding per pattern group, using private per-inspection regex instances.
|
|
157
209
|
*
|
|
158
|
-
*
|
|
159
|
-
*
|
|
160
|
-
* ugyanarra a bemenetre. Ez a fajta nem-determinizmus egy biztonsagi kapunal elfogadhatatlan.
|
|
210
|
+
* Resetting the caller's cursor to zero was itself a mutation when it started at a nonzero offset,
|
|
211
|
+
* and threw for frozen patterns. Only the validated snapshot is mutable; the caller is never touched.
|
|
161
212
|
*/
|
|
162
|
-
static
|
|
213
|
+
static matchesPattern(normalized, patterns) {
|
|
163
214
|
for (const pattern of patterns ?? []) {
|
|
164
215
|
pattern.lastIndex = 0;
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
// `lastIndex`-et. A hivo UGYANAZT a RegExp-peldanyt hasznalhatja mashol is — ha elmozdulva
|
|
168
|
-
// adnank vissza, a sajat kovetkezo `test()`-je mast talalna. A vizsgalonak a hivo allapotat
|
|
169
|
-
// pontosan ugy kell hagynia, ahogy kapta. (Merve: `lastIndex` 6 maradt a nullazas nelkul.)
|
|
170
|
-
pattern.lastIndex = 0;
|
|
171
|
-
if (matched) {
|
|
172
|
-
record(finding);
|
|
173
|
-
return;
|
|
216
|
+
if (pattern.test(normalized)) {
|
|
217
|
+
return true;
|
|
174
218
|
}
|
|
175
219
|
}
|
|
220
|
+
return false;
|
|
176
221
|
}
|
|
177
|
-
/**
|
|
178
|
-
static
|
|
179
|
-
|
|
180
|
-
|
|
222
|
+
/** Validates the entire policy before input inspection, without invoking accessors or array iterators. */
|
|
223
|
+
static snapshotPolicy(policy) {
|
|
224
|
+
try {
|
|
225
|
+
if (!policy || typeof policy !== 'object') {
|
|
226
|
+
return null;
|
|
227
|
+
}
|
|
228
|
+
const prototype = Object.getPrototypeOf(policy);
|
|
229
|
+
if (prototype !== Object.prototype && prototype !== null) {
|
|
230
|
+
return null;
|
|
231
|
+
}
|
|
232
|
+
const allowedKeys = [
|
|
233
|
+
'namespace', 'maxDepth', 'maxNodes', 'maxStringLength', 'forbiddenKeys',
|
|
234
|
+
'canaries', 'sensitiveValuePatterns', 'unsupportedCapabilityPatterns',
|
|
235
|
+
];
|
|
236
|
+
const values = {};
|
|
237
|
+
for (const key of Reflect.ownKeys(policy)) {
|
|
238
|
+
if (typeof key !== 'string' || !allowedKeys.includes(key)) {
|
|
239
|
+
return null;
|
|
240
|
+
}
|
|
241
|
+
const descriptor = Object.getOwnPropertyDescriptor(policy, key);
|
|
242
|
+
if (!descriptor || !('value' in descriptor)) {
|
|
243
|
+
return null;
|
|
244
|
+
}
|
|
245
|
+
values[key] = descriptor.value;
|
|
246
|
+
}
|
|
247
|
+
if (typeof values.namespace !== 'string' || !/^[a-z][a-z0-9_.|\-]{0,63}$/iu.test(values.namespace)) {
|
|
248
|
+
return null;
|
|
249
|
+
}
|
|
250
|
+
return {
|
|
251
|
+
namespace: values.namespace,
|
|
252
|
+
maxDepth: DyFM_RequestSafetyInspector_Util.positiveBudget(values.maxDepth),
|
|
253
|
+
maxNodes: DyFM_RequestSafetyInspector_Util.positiveBudget(values.maxNodes),
|
|
254
|
+
maxStringLength: DyFM_RequestSafetyInspector_Util.positiveBudget(values.maxStringLength),
|
|
255
|
+
forbiddenKeys: DyFM_RequestSafetyInspector_Util.snapshotList(values.forbiddenKeys, (entry) => {
|
|
256
|
+
if (typeof entry !== 'string') {
|
|
257
|
+
throw new Error('INVALID_POLICY');
|
|
258
|
+
}
|
|
259
|
+
return entry;
|
|
260
|
+
}),
|
|
261
|
+
canaries: DyFM_RequestSafetyInspector_Util.snapshotList(values.canaries, (entry) => {
|
|
262
|
+
if (typeof entry !== 'string') {
|
|
263
|
+
throw new Error('INVALID_POLICY');
|
|
264
|
+
}
|
|
265
|
+
return DyFM_RequestSafetyInspector_Util.normalize(entry);
|
|
266
|
+
}),
|
|
267
|
+
sensitiveValuePatterns: DyFM_RequestSafetyInspector_Util.snapshotList(values.sensitiveValuePatterns, DyFM_RequestSafetyInspector_Util.snapshotPattern),
|
|
268
|
+
unsupportedCapabilityPatterns: DyFM_RequestSafetyInspector_Util.snapshotList(values.unsupportedCapabilityPatterns, DyFM_RequestSafetyInspector_Util.snapshotPattern),
|
|
269
|
+
};
|
|
270
|
+
}
|
|
271
|
+
catch {
|
|
272
|
+
return null;
|
|
273
|
+
}
|
|
274
|
+
}
|
|
275
|
+
/** Copies dense policy lists through data descriptors, rejecting holes, accessors and custom properties. */
|
|
276
|
+
static snapshotList(value, convert) {
|
|
277
|
+
if (value === undefined) {
|
|
278
|
+
return [];
|
|
279
|
+
}
|
|
280
|
+
if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) {
|
|
281
|
+
throw new Error('INVALID_POLICY');
|
|
181
282
|
}
|
|
182
|
-
|
|
183
|
-
|
|
283
|
+
const length = DyFM_RequestSafetyInspector_Util.arrayLength(value);
|
|
284
|
+
if (Reflect.ownKeys(value).length !== length + 1) {
|
|
285
|
+
throw new Error('INVALID_POLICY');
|
|
286
|
+
}
|
|
287
|
+
const result = [];
|
|
288
|
+
for (let index = 0; index < length; index++) {
|
|
289
|
+
const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
|
|
290
|
+
if (!descriptor || !('value' in descriptor)) {
|
|
291
|
+
throw new Error('INVALID_POLICY');
|
|
292
|
+
}
|
|
293
|
+
result.push(convert(descriptor.value));
|
|
294
|
+
}
|
|
295
|
+
return result;
|
|
296
|
+
}
|
|
297
|
+
/** Clones ordinary regexes without calling caller-defined test/source/flag members or touching lastIndex. */
|
|
298
|
+
static snapshotPattern(value) {
|
|
299
|
+
if (!(value instanceof RegExp) || Object.getPrototypeOf(value) !== RegExp.prototype ||
|
|
300
|
+
Reflect.ownKeys(value).some((key) => key !== 'lastIndex')) {
|
|
301
|
+
throw new Error('INVALID_POLICY');
|
|
302
|
+
}
|
|
303
|
+
return new RegExp(value.source, value.flags);
|
|
304
|
+
}
|
|
305
|
+
/** Narrows a required positive integer budget; errors remain inside the policy boundary. */
|
|
306
|
+
static positiveBudget(value) {
|
|
307
|
+
if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
|
|
308
|
+
throw new Error('INVALID_POLICY');
|
|
309
|
+
}
|
|
310
|
+
return value;
|
|
311
|
+
}
|
|
312
|
+
/** Reads and validates only the array's own length descriptor, never an input member access. */
|
|
313
|
+
static arrayLength(value) {
|
|
314
|
+
const length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
|
|
315
|
+
if (typeof length !== 'number' || !Number.isSafeInteger(length) || length < 0) {
|
|
316
|
+
throw new Error('INVALID_ARRAY');
|
|
184
317
|
}
|
|
185
|
-
return
|
|
318
|
+
return length;
|
|
186
319
|
}
|
|
187
320
|
}
|
|
188
321
|
exports.DyFM_RequestSafetyInspector_Util = DyFM_RequestSafetyInspector_Util;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-safety-inspector.util.js","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_collections/request-safety-inspector.util.ts"],"names":[],"mappings":";;;AAAA,iGAA4F;AAK5F
|
|
1
|
+
{"version":3,"file":"request-safety-inspector.util.js","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_collections/request-safety-inspector.util.ts"],"names":[],"mappings":";;;AAAA,iGAA4F;AAK5F;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,gCAAgC;IAE3C;;;;;;;OAOG;IACK,MAAM,CAAU,iBAAiB,GACvC,wDAAwD,CAAC;IAE3D;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,KAAa;QAC5B,OAAO,GAAG,KAAK,IAAI,EAAE,EAAE;aACpB,SAAS,CAAC,MAAM,CAAC;aACjB,OAAO,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,EAAE,CAAC;aAC/D,WAAW,EAAE,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CACZ,KAAc,EACd,MAA0C;QAE1C,MAAM,QAAQ,GACZ,gCAAgC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,cAAc,GAAW,CAAC,CAAC;QAE/B,MAAM,SAAS,GAAW,QAAQ,EAAE,SAAS,IAAI,SAAS,CAAC;QAC3D,qEAAqE;QACrE,MAAM,MAAM,GAAsD,CAChE,OAAuC,EACjC,EAAE;YACR,MAAM,IAAI,GAAW,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;YAE/C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,+EAA+E;YAC/E,MAAM,IAAI,GAAW,WAAW,iEAA8B,CAAC,aAAa,EAAE,CAAC;YAE/E,OAAO;gBACL,eAAe,EAAE,uBAAuB;gBACxC,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,CAAE,IAAI,CAAE;gBACtB,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC5B,cAAc,EAAE,CAAC;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,QAAQ,CAAC;QAClB,MAAM,aAAa,GAAgB,IAAI,GAAG,CACxC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAC9B,CAAC,GAAW,EAAU,EAAE,CAAC,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,CACzE,CACF,CAAC;QAEF,0FAA0F;QAC1F,MAAM,SAAS,GAAgB,IAAI,GAAG,EAAU,CAAC;QACjD,IAAI,qBAAqB,GAAY,KAAK,CAAC;QAE3C,kEAAkE;QAClE,MAAM,IAAI,GAA4C,CAAC,KAAc,EAAE,KAAa,EAAQ,EAAE;YAC5F,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,OAAO;YACT,CAAC;YAED,IAAI,cAAc,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,qBAAqB,GAAG,IAAI,CAAC;gBAC7B,MAAM,CAAC,iEAA8B,CAAC,UAAU,CAAC,CAAC;gBAElD,OAAO;YACT,CAAC;YACD,cAAc,EAAE,CAAC;YAEjB,IAAI,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,iEAA8B,CAAC,WAAW,CAAC,CAAC;gBAEnD,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9E,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,gCAAgC,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAEtE,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,kEAAkE;gBAClE,MAAM,CAAC,iEAA8B,CAAC,oBAAoB,CAAC,CAAC;gBAE5D,OAAO;YACT,CAAC;YAED,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,iEAA8B,CAAC,KAAK,CAAC,CAAC;gBAE7C,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAkB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAE9D,IAAI,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACnG,yEAAyE;gBACzE,MAAM,CAAC,iEAA8B,CAAC,oBAAoB,CAAC,CAAC;gBAE5D,OAAO;YACT,CAAC;YAED,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,MAAM,IAAI,GAAwB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAEzD,IAAI,OAAO,EAAE,CAAC;oBACZ,0FAA0F;oBAC1F,MAAM,MAAM,GAAW,gCAAgC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBAC3E,MAAM,cAAc,GAAW,IAAI,CAAC,MAAM,CAAC,CAAC,GAAoB,EAAW,EAAE,CAAC,CAC5E,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CACjF,CAAC,CAAC,MAAM,CAAC;oBACV,MAAM,KAAK,GAAW,MAAM,GAAG,cAAc,CAAC;oBAE9C,IAAI,KAAK,GAAG,MAAM,CAAC,QAAQ,GAAG,cAAc,EAAE,CAAC;wBAC7C,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;wBACjC,qBAAqB,GAAG,IAAI,CAAC;wBAC7B,MAAM,CAAC,iEAA8B,CAAC,UAAU,CAAC,CAAC;wBAElD,OAAO;oBACT,CAAC;oBACD,cAAc,IAAI,KAAK,CAAC;gBAC1B,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,IAAI,OAAO,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAChC,SAAS;oBACX,CAAC;oBAED,IAAI,qBAAqB,IAAI,cAAc,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;wBAC/D,IAAI,CAAC,qBAAqB,EAAE,CAAC;4BAC3B,MAAM,CAAC,iEAA8B,CAAC,UAAU,CAAC,CAAC;4BAClD,qBAAqB,GAAG,IAAI,CAAC;wBAC/B,CAAC;wBACD,MAAM;oBACR,CAAC;oBAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAC5B,cAAc,EAAE,CAAC;wBACjB,MAAM,CAAC,iEAA8B,CAAC,oBAAoB,CAAC,CAAC;wBAC5D,SAAS;oBACX,CAAC;oBAED,IAAI,aAAa,CAAC,GAAG,CAAC,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBACvE,MAAM,CAAC,iEAA8B,CAAC,YAAY,CAAC,CAAC;oBACtD,CAAC;oBACD,gCAAgC,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;oBACpE,MAAM,UAAU,GAAmC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAE/F,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;wBAC5C,cAAc,EAAE,CAAC;wBACjB,MAAM,CAAC,iEAA8B,CAAC,QAAQ,CAAC,CAAC;wBAChD,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,iGAAiG;YACjG,MAAM,CAAC,iEAA8B,CAAC,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,YAAY,GAAa,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1D,OAAO;YACL,eAAe,EAAE,uBAAuB;YACxC,QAAQ,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC;YACnC,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,cAAc;SAC/B,CAAC;IACJ,CAAC;IAED,yFAAyF;IACjF,MAAM,CAAC,aAAa,CAC1B,KAAa,EACb,MAA0C,EAC1C,MAAyD;QAEzD,MAAM,UAAU,GAAW,gCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAE7E,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/C,MAAM,CAAC,iEAA8B,CAAC,YAAY,CAAC,CAAC;YAEpD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,iEAA8B,CAAC,MAAM,CAAC,CAAC;gBAC9C,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,gCAAgC,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC/F,MAAM,CAAC,iEAA8B,CAAC,cAAc,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,gCAAgC,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACtG,MAAM,CAAC,iEAA8B,CAAC,qBAAqB,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,cAAc,CAC3B,UAAkB,EAClB,QAAuC;QAEvC,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAEtB,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0GAA0G;IAClG,MAAM,CAAC,cAAc,CAAC,MAAe;QAC3C,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,SAAS,GAAkB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAE/D,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,WAAW,GAAsB;gBACrC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,eAAe;gBACvE,UAAU,EAAE,wBAAwB,EAAE,+BAA+B;aACtE,CAAC;YACF,MAAM,MAAM,GAA4B,EAAE,CAAC;YAE3C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,UAAU,GAAmC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAEhG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;oBAC5C,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;YACjC,CAAC;YAED,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnG,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,gCAAgC,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC1E,QAAQ,EAAE,gCAAgC,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC1E,eAAe,EAAE,gCAAgC,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;gBACxF,aAAa,EAAE,gCAAgC,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,KAAc,EAAU,EAAE;oBAC5G,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACpC,CAAC;oBAED,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC;gBACF,QAAQ,EAAE,gCAAgC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAc,EAAU,EAAE;oBAClG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACpC,CAAC;oBAED,OAAO,gCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC3D,CAAC,CAAC;gBACF,sBAAsB,EAAE,gCAAgC,CAAC,YAAY,CACnE,MAAM,CAAC,sBAAsB,EAAE,gCAAgC,CAAC,eAAe,CAChF;gBACD,6BAA6B,EAAE,gCAAgC,CAAC,YAAY,CAC1E,MAAM,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,eAAe,CACvF;aACF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,YAAY,CAAI,KAAc,EAAE,OAA8B;QAC3E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAW,gCAAgC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAE3E,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,MAAM,GAAQ,EAAE,CAAC;QAEvB,KAAK,IAAI,KAAK,GAAW,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,UAAU,GAAmC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAEzG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6GAA6G;IACrG,MAAM,CAAC,eAAe,CAAC,KAAc;QAC3C,IAAI,CAAC,CAAC,KAAK,YAAY,MAAM,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;YACjF,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAoB,EAAW,EAAE,CAAC,GAAG,KAAK,WAAW,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IACpF,MAAM,CAAC,cAAc,CAAC,KAAc;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gGAAgG;IACxF,MAAM,CAAC,WAAW,CAAC,KAAa;QACtC,MAAM,MAAM,GAAY,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC;QAEhF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;;AAhYH,4EAiYC"}
|
|
@@ -32,6 +32,8 @@ export declare enum DyFM_RequestSafetyFinding_Type {
|
|
|
32
32
|
/** A value is of a type the contract does not carry (function, symbol, bigint, class instance…). */
|
|
33
33
|
unsupportedValueType = "unsupported-value-type",
|
|
34
34
|
/** The policy itself is invalid — fail-closed, the input is never inspected. */
|
|
35
|
-
invalidPolicy = "invalid-policy"
|
|
35
|
+
invalidPolicy = "invalid-policy",
|
|
36
|
+
/** Reflection failed; no exception message, input fragment or stack is returned. */
|
|
37
|
+
inspectionFailure = "inspection-failure"
|
|
36
38
|
}
|
|
37
39
|
//# sourceMappingURL=request-safety-finding.type-enum.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-safety-finding.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_enums/request-safety-finding.type-enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,oBAAY,8BAA8B;IACxC,0EAA0E;IAC1E,YAAY,kBAAkB;IAC9B,2EAA2E;IAC3E,cAAc,oBAAoB;IAClC,kFAAkF;IAClF,qBAAqB,2BAA2B;IAChD,4FAA4F;IAC5F,MAAM,WAAW;IACjB,kCAAkC;IAClC,KAAK,UAAU;IACf,kDAAkD;IAClD,WAAW,iBAAiB;IAC5B,mDAAmD;IACnD,UAAU,gBAAgB;IAC1B,oDAAoD;IACpD,YAAY,kBAAkB;IAC9B,mGAAmG;IACnG,QAAQ,aAAa;IACrB,sEAAsE;IACtE,oBAAoB,0BAA0B;IAC9C,oGAAoG;IACpG,oBAAoB,2BAA2B;IAC/C,gFAAgF;IAChF,aAAa,mBAAmB;
|
|
1
|
+
{"version":3,"file":"request-safety-finding.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_enums/request-safety-finding.type-enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,oBAAY,8BAA8B;IACxC,0EAA0E;IAC1E,YAAY,kBAAkB;IAC9B,2EAA2E;IAC3E,cAAc,oBAAoB;IAClC,kFAAkF;IAClF,qBAAqB,2BAA2B;IAChD,4FAA4F;IAC5F,MAAM,WAAW;IACjB,kCAAkC;IAClC,KAAK,UAAU;IACf,kDAAkD;IAClD,WAAW,iBAAiB;IAC5B,mDAAmD;IACnD,UAAU,gBAAgB;IAC1B,oDAAoD;IACpD,YAAY,kBAAkB;IAC9B,mGAAmG;IACnG,QAAQ,aAAa;IACrB,sEAAsE;IACtE,oBAAoB,0BAA0B;IAC9C,oGAAoG;IACpG,oBAAoB,2BAA2B;IAC/C,gFAAgF;IAChF,aAAa,mBAAmB;IAChC,oFAAoF;IACpF,iBAAiB,uBAAuB;CACzC"}
|
|
@@ -37,5 +37,7 @@ var DyFM_RequestSafetyFinding_Type;
|
|
|
37
37
|
DyFM_RequestSafetyFinding_Type["unsupportedValueType"] = "unsupported-value-type";
|
|
38
38
|
/** The policy itself is invalid — fail-closed, the input is never inspected. */
|
|
39
39
|
DyFM_RequestSafetyFinding_Type["invalidPolicy"] = "invalid-policy";
|
|
40
|
+
/** Reflection failed; no exception message, input fragment or stack is returned. */
|
|
41
|
+
DyFM_RequestSafetyFinding_Type["inspectionFailure"] = "inspection-failure";
|
|
40
42
|
})(DyFM_RequestSafetyFinding_Type || (exports.DyFM_RequestSafetyFinding_Type = DyFM_RequestSafetyFinding_Type = {}));
|
|
41
43
|
//# sourceMappingURL=request-safety-finding.type-enum.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-safety-finding.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_enums/request-safety-finding.type-enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,IAAY,
|
|
1
|
+
{"version":3,"file":"request-safety-finding.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_enums/request-safety-finding.type-enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,IAAY,8BA2BX;AA3BD,WAAY,8BAA8B;IACxC,0EAA0E;IAC1E,gEAA8B,CAAA;IAC9B,2EAA2E;IAC3E,oEAAkC,CAAA;IAClC,kFAAkF;IAClF,kFAAgD,CAAA;IAChD,4FAA4F;IAC5F,mDAAiB,CAAA;IACjB,kCAAkC;IAClC,iDAAe,CAAA;IACf,kDAAkD;IAClD,8DAA4B,CAAA;IAC5B,mDAAmD;IACnD,4DAA0B,CAAA;IAC1B,oDAAoD;IACpD,gEAA8B,CAAA;IAC9B,mGAAmG;IACnG,uDAAqB,CAAA;IACrB,sEAAsE;IACtE,gFAA8C,CAAA;IAC9C,oGAAoG;IACpG,iFAA+C,CAAA;IAC/C,gFAAgF;IAChF,kEAAgC,CAAA;IAChC,oFAAoF;IACpF,0EAAwC,CAAA;AAC1C,CAAC,EA3BW,8BAA8B,8CAA9B,8BAA8B,QA2BzC"}
|
|
@@ -16,6 +16,8 @@ export interface DyFM_RequestSafetyPolicy_Interface {
|
|
|
16
16
|
*
|
|
17
17
|
* Two products can then share this vocabulary without their findings becoming ambiguous in a shared
|
|
18
18
|
* log or dashboard.
|
|
19
|
+
* Must start with an ASCII letter, contain only letters, digits, dot, underscore, pipe or hyphen,
|
|
20
|
+
* and be at most 64 characters. Invalid policies use `unknown:invalid-policy`, never a supplied value.
|
|
19
21
|
*/
|
|
20
22
|
readonly namespace: string;
|
|
21
23
|
/**
|
|
@@ -23,7 +25,7 @@ export interface DyFM_RequestSafetyPolicy_Interface {
|
|
|
23
25
|
* zero-width joiners or full-width characters is still caught.
|
|
24
26
|
*/
|
|
25
27
|
readonly forbiddenKeys?: readonly string[];
|
|
26
|
-
/** Patterns for values
|
|
28
|
+
/** Patterns for secret/PII values and property names. Matched against normalized strings. */
|
|
27
29
|
readonly sensitiveValuePatterns?: readonly RegExp[];
|
|
28
30
|
/** Patterns for capabilities the caller's product contract does not support. */
|
|
29
31
|
readonly unsupportedCapabilityPatterns?: readonly RegExp[];
|
|
@@ -36,7 +38,7 @@ export interface DyFM_RequestSafetyPolicy_Interface {
|
|
|
36
38
|
readonly canaries?: readonly string[];
|
|
37
39
|
/** Maximum nesting depth. The root is depth 0. */
|
|
38
40
|
readonly maxDepth: number;
|
|
39
|
-
/** Maximum number of inspected nodes (values), including the root. */
|
|
41
|
+
/** Maximum number of inspected nodes (values), including the root; not an OS-level memory/CPU limit. */
|
|
40
42
|
readonly maxNodes: number;
|
|
41
43
|
/** Maximum length of any single string, measured AFTER normalization. */
|
|
42
44
|
readonly maxStringLength: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-safety.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_models/request-safety.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kCAAkC;IACjD
|
|
1
|
+
{"version":3,"file":"request-safety.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_models/request-safety.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kCAAkC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,6FAA6F;IAC7F,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,gFAAgF;IAChF,QAAQ,CAAC,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,eAAe,EAAE,uBAAuB,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gGAAgG;IAChG,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,+FAA+F;AAC/F,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC;CAClD"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@futdevpro/fsm-dynamo",
|
|
3
|
-
"version": "1.20.
|
|
3
|
+
"version": "1.20.29",
|
|
4
4
|
"description": "Full Stack Model Collection for Dynamic (NodeJS-Typescript) Framework called Dynamo, by Future Development Ltd.",
|
|
5
5
|
"DyBu_settings": {
|
|
6
6
|
"packageType": "full-stack-package",
|