@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/wafv2/statement/sim-waf-request-fields.d.ts

@@ -0,0 +1,42 @@
+import type { SimWafPatternSelection } from "./sim-waf-match-pattern.js";
+/**
+ * One header, cookie or query argument, as WAF sees it.
+ */
+export interface SimWafNameValue {
+    readonly name: string;
+    readonly value: string;
+}
+/**
+ * Whether a rule reads the names, the values, or both.
+ */
+export type SimWafMatchScope = "ALL" | "KEY" | "VALUE";
+/**
+ * Split a query string into its arguments without decoding them.
+ *
+ * Decoding is what the URL_DECODE text transformation is for, so a rule that
+ * did not ask for it sees the argument as it arrived. Names are lower cased,
+ * as WAF lower cases both sides before comparing a `SingleQueryArgument`.
+ */
+export declare function simWafQueryArguments(queryString: string): readonly SimWafNameValue[];
+/**
+ * Read the cookies one request sent.
+ */
+export declare function simWafCookies(headers: Headers): readonly SimWafNameValue[];
+/**
+ * Read the headers one request sent, lower cased as HTTP treats them.
+ */
+export declare function simWafHeaderEntries(headers: Headers): readonly SimWafNameValue[];
+/**
+ * Narrow a set of headers or cookies to the ones a rule inspects, and read the
+ * part of each that it matches against.
+ */
+export declare function simWafPatternCandidates(properties: {
+    readonly entries: readonly SimWafNameValue[];
+    readonly selection: SimWafPatternSelection;
+    readonly matchScope: SimWafMatchScope;
+}): readonly string[];
+/**
+ * Read the match scope a rule named, refusing anything else.
+ */
+export declare function requiredSimWafMatchScope(matchScope: string | undefined, ruleName: string): SimWafMatchScope;
+//# sourceMappingURL=sim-waf-request-fields.d.ts.map

package/dist/service/wafv2/statement/sim-waf-request-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-request-fields.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-request-fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGzE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAEvD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAClB,SAAS,eAAe,EAAE,CAc5B;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,eAAe,EAAE,CAe1E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,GACf,SAAS,eAAe,EAAE,CAE5B;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC,GAAG,SAAS,MAAM,EAAE,CAWpB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,MAAM,GACf,gBAAgB,CASlB"}

package/dist/service/wafv2/statement/sim-waf-request-fields.js

@@ -0,0 +1,74 @@
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+/**
+ * Split a query string into its arguments without decoding them.
+ *
+ * Decoding is what the URL_DECODE text transformation is for, so a rule that
+ * did not ask for it sees the argument as it arrived. Names are lower cased,
+ * as WAF lower cases both sides before comparing a `SingleQueryArgument`.
+ */
+export function simWafQueryArguments(queryString) {
+    return queryString
+        .split("&")
+        .filter((pair) => pair !== "")
+        .map((pair) => {
+        const separator = pair.indexOf("=");
+        return separator === -1
+            ? { name: pair.toLowerCase(), value: "" }
+            : {
+                name: pair.slice(0, separator).toLowerCase(),
+                value: pair.slice(separator + 1),
+            };
+    });
+}
+/**
+ * Read the cookies one request sent.
+ */
+export function simWafCookies(headers) {
+    return (headers.get("cookie") ?? "")
+        .split(";")
+        .map((cookie) => cookie.trim())
+        .filter((cookie) => cookie !== "")
+        .map((cookie) => {
+        const separator = cookie.indexOf("=");
+        return separator === -1
+            ? { name: cookie, value: "" }
+            : {
+                name: cookie.slice(0, separator),
+                value: cookie.slice(separator + 1),
+            };
+    });
+}
+/**
+ * Read the headers one request sent, lower cased as HTTP treats them.
+ */
+export function simWafHeaderEntries(headers) {
+    return [...headers].map(([name, value]) => ({ name, value }));
+}
+/**
+ * Narrow a set of headers or cookies to the ones a rule inspects, and read the
+ * part of each that it matches against.
+ */
+export function simWafPatternCandidates(properties) {
+    const { entries, matchScope } = properties;
+    const { included, excluded } = properties.selection;
+    return entries
+        .filter((entry) => (included === undefined || included.has(entry.name.toLowerCase())) &&
+        (excluded === undefined || !excluded.has(entry.name.toLowerCase())))
+        .flatMap((entry) => scoped(entry, matchScope));
+}
+/**
+ * Read the match scope a rule named, refusing anything else.
+ */
+export function requiredSimWafMatchScope(matchScope, ruleName) {
+    if (matchScope !== "ALL" && matchScope !== "KEY" && matchScope !== "VALUE") {
+        invalidSimWafRule(ruleName, `The match scope ${String(matchScope)} is not valid`);
+    }
+    return matchScope;
+}
+function scoped(entry, matchScope) {
+    if (matchScope === "KEY") {
+        return [entry.name];
+    }
+    return matchScope === "VALUE" ? [entry.value] : [entry.name, entry.value];
+}
+//# sourceMappingURL=sim-waf-request-fields.js.map

package/dist/service/wafv2/statement/sim-waf-request-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-request-fields.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-request-fields.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAe/D;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB;IAEnB,OAAO,WAAW;SACf,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEpC,OAAO,SAAS,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YACzC,CAAC,CAAC;gBACE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE;gBAC5C,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;aACjC,CAAC;IACR,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;SACjC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEtC,OAAO,SAAS,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;YAC7B,CAAC,CAAC;gBACE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;aACnC,CAAC;IACR,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB;IAEhB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAIvC;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;IAC3C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC;IAEpD,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CACtE;SACA,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA8B,EAC9B,QAAgB;IAEhB,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3E,iBAAiB,CACf,QAAQ,EACR,mBAAmB,MAAM,CAAC,UAAU,CAAC,eAAe,CACrD,CAAC;IACJ,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CACb,KAAsB,EACtB,UAA4B;IAE5B,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC"}

package/dist/service/wafv2/statement/sim-waf-rule-refusals.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Refuse something in a rule that real WAFv2 takes and this simulation does
+ * not.
+ *
+ * Every refusal names the rule and what in it was refused, because a web ACL
+ * is a list of rules that all look alike from the outside and the name is the
+ * only thing that says which one to go and look at.
+ */
+export declare function refuseSimWafRuleInput(ruleName: string, refused: string, reason: string): never;
+/**
+ * Refuse a rule real WAFv2 would refuse too.
+ */
+export declare function invalidSimWafRule(ruleName: string, reason: string): never;
+//# sourceMappingURL=sim-waf-rule-refusals.d.ts.map

package/dist/service/wafv2/statement/sim-waf-rule-refusals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule-refusals.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rule-refusals.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,KAAK,CAMP;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAIzE"}

package/dist/service/wafv2/statement/sim-waf-rule-refusals.js

@@ -0,0 +1,21 @@
+import { SimWafInvalidParameterException, SimWafUnsimulatedInputException, } from "../error/sim-wafv2.error.js";
+/**
+ * Refuse something in a rule that real WAFv2 takes and this simulation does
+ * not.
+ *
+ * Every refusal names the rule and what in it was refused, because a web ACL
+ * is a list of rules that all look alike from the outside and the name is the
+ * only thing that says which one to go and look at.
+ */
+export function refuseSimWafRuleInput(ruleName, refused, reason) {
+    throw new SimWafUnsimulatedInputException(`Rule ${ruleName} uses ${refused}, which Yulin does not simulate: ` +
+        `${reason}. A web ACL that accepted a rule it cannot evaluate would ` +
+        `allow a request AWS blocks.`);
+}
+/**
+ * Refuse a rule real WAFv2 would refuse too.
+ */
+export function invalidSimWafRule(ruleName, reason) {
+    throw new SimWafInvalidParameterException(`Error reason: ${reason}, field: RULE, parameter: ${ruleName}`);
+}
+//# sourceMappingURL=sim-waf-rule-refusals.js.map

package/dist/service/wafv2/statement/sim-waf-rule-refusals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-rule-refusals.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-rule-refusals.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,6BAA6B,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,OAAe,EACf,MAAc;IAEd,MAAM,IAAI,+BAA+B,CACvC,QAAQ,QAAQ,SAAS,OAAO,mCAAmC;QACjE,GAAG,MAAM,4DAA4D;QACrE,6BAA6B,CAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAc;IAChE,MAAM,IAAI,+BAA+B,CACvC,iBAAiB,MAAM,6BAA6B,QAAQ,EAAE,CAC/D,CAAC;AACJ,CAAC"}

package/dist/service/wafv2/statement/sim-waf-set-field.d.ts

@@ -0,0 +1,12 @@
+import type { SimWafFieldToMatchInput } from "./sim-waf-field-to-match.type.js";
+import type { SimWafFieldReader } from "./sim-waf-field-to-match.js";
+/**
+ * Build the reader for the fields whose content WAF stops reading once it
+ * reaches its inspection limit.
+ *
+ * These three are the ones that carry an `OversizeHandling`, because they are
+ * the ones a request can make too big to read: a body, a header set, a cookie
+ * set.
+ */
+export declare function compileSimWafSetField(field: SimWafFieldToMatchInput, ruleName: string): SimWafFieldReader;
+//# sourceMappingURL=sim-waf-set-field.d.ts.map

package/dist/service/wafv2/statement/sim-waf-set-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-set-field.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-set-field.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,uBAAuB,EAExB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAarE;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,EAAE,MAAM,GACf,iBAAiB,CA2BnB"}

package/dist/service/wafv2/statement/sim-waf-set-field.js

@@ -0,0 +1,37 @@
+import { requiredSimWafOversizeHandling, simWafFieldContent, } from "./sim-waf-field-content.js";
+import { requiredSimWafPatternSelection } from "./sim-waf-match-pattern.js";
+import { requiredSimWafMatchScope, simWafCookies, simWafHeaderEntries, simWafPatternCandidates, } from "./sim-waf-request-fields.js";
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+const decoder = new TextDecoder();
+/**
+ * Build the reader for the fields whose content WAF stops reading once it
+ * reaches its inspection limit.
+ *
+ * These three are the ones that carry an `OversizeHandling`, because they are
+ * the ones a request can make too big to read: a body, a header set, a cookie
+ * set.
+ */
+export function compileSimWafSetField(field, ruleName) {
+    if (field.Headers !== undefined) {
+        return entriesReader(field.Headers, ruleName, (request) => simWafHeaderEntries(request.headers));
+    }
+    if (field.Cookies !== undefined) {
+        return entriesReader(field.Cookies, ruleName, (request) => simWafCookies(request.headers));
+    }
+    if (field.Body === undefined) {
+        invalidSimWafRule(ruleName, "FieldToMatch names no field to match on");
+    }
+    const oversize = requiredSimWafOversizeHandling(field.Body.OversizeHandling, ruleName);
+    return (request) => simWafFieldContent(request.body === undefined ? [] : [decoder.decode(request.body)], oversize);
+}
+function entriesReader(input, ruleName, entries) {
+    const matchScope = requiredSimWafMatchScope(input.MatchScope, ruleName);
+    const oversize = requiredSimWafOversizeHandling(input.OversizeHandling, ruleName);
+    const selection = requiredSimWafPatternSelection(input.MatchPattern, ruleName);
+    return (request) => simWafFieldContent(simWafPatternCandidates({
+        entries: entries(request),
+        selection,
+        matchScope,
+    }), oversize);
+}
+//# sourceMappingURL=sim-waf-set-field.js.map

package/dist/service/wafv2/statement/sim-waf-set-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-set-field.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-set-field.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAEL,wBAAwB,EACxB,aAAa,EACb,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA8B,EAC9B,QAAgB;IAEhB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CACxD,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CACrC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CACxD,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,iBAAiB,CAAC,QAAQ,EAAE,yCAAyC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,8BAA8B,CAC7C,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAC3B,QAAQ,CACT,CAAC;IAEF,OAAO,CAAC,OAAO,EAAsB,EAAE,CACrC,kBAAkB,CAChB,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAChE,QAAQ,CACT,CAAC;AACN,CAAC;AAED,SAAS,aAAa,CACpB,KAA8B,EAC9B,QAAgB,EAChB,OAAwE;IAExE,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,8BAA8B,CAC7C,KAAK,CAAC,gBAAgB,EACtB,QAAQ,CACT,CAAC;IACF,MAAM,SAAS,GAAG,8BAA8B,CAC9C,KAAK,CAAC,YAAY,EAClB,QAAQ,CACT,CAAC;IAEF,OAAO,CAAC,OAAO,EAAsB,EAAE,CACrC,kBAAkB,CAChB,uBAAuB,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;QACzB,SAAS;QACT,UAAU;KACX,CAAC,EACF,QAAQ,CACT,CAAC;AACN,CAAC"}

package/dist/service/wafv2/statement/sim-waf-size-constraint.d.ts

@@ -0,0 +1,17 @@
+import type { SimWafValueTest } from "./sim-waf-field-match.js";
+/**
+ * Minimal structural WAFv2 SizeConstraintStatement.
+ */
+export interface SimWafSizeConstraintStatementInput {
+    readonly ComparisonOperator?: string | undefined;
+    readonly Size?: number | undefined;
+}
+/**
+ * Build the test a SizeConstraintStatement puts each string through.
+ *
+ * The size is in bytes rather than characters, and it is the size after the
+ * rule's text transformations have run: a rule that decodes before it measures
+ * is measuring the decoded value.
+ */
+export declare function simWafSizeTest(statement: SimWafSizeConstraintStatementInput, ruleName: string): SimWafValueTest;
+//# sourceMappingURL=sim-waf-size-constraint.d.ts.map

package/dist/service/wafv2/statement/sim-waf-size-constraint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-size-constraint.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-size-constraint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAGhE;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAeD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,kCAAkC,EAC7C,QAAQ,EAAE,MAAM,GACf,eAAe,CAiBjB"}

package/dist/service/wafv2/statement/sim-waf-size-constraint.js

@@ -0,0 +1,30 @@
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+const encoder = new TextEncoder();
+const comparisons = new Map([
+    ["EQ", (size, against) => size === against],
+    ["NE", (size, against) => size !== against],
+    ["LE", (size, against) => size <= against],
+    ["LT", (size, against) => size < against],
+    ["GE", (size, against) => size >= against],
+    ["GT", (size, against) => size > against],
+]);
+/**
+ * Build the test a SizeConstraintStatement puts each string through.
+ *
+ * The size is in bytes rather than characters, and it is the size after the
+ * rule's text transformations have run: a rule that decodes before it measures
+ * is measuring the decoded value.
+ */
+export function simWafSizeTest(statement, ruleName) {
+    const compare = comparisons.get(statement.ComparisonOperator ?? "");
+    const against = statement.Size;
+    if (compare === undefined) {
+        invalidSimWafRule(ruleName, `The comparison operator ${String(statement.ComparisonOperator)} is ` +
+            `not valid`);
+    }
+    if (against === undefined) {
+        invalidSimWafRule(ruleName, "SizeConstraintStatement needs a Size");
+    }
+    return (value) => compare(encoder.encode(value).length, against);
+}
+//# sourceMappingURL=sim-waf-size-constraint.js.map

package/dist/service/wafv2/statement/sim-waf-size-constraint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-size-constraint.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-size-constraint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAU/D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB;IACE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAW,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC;IACpD,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAW,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC;IACpD,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAW,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC;IACnD,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAW,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC;IAClD,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAW,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC;IACnD,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAW,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC;CACnD,CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAA6C,EAC7C,QAAgB;IAEhB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC;IAE/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,iBAAiB,CACf,QAAQ,EACR,2BAA2B,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM;YACnE,WAAW,CACd,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,iBAAiB,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC"}

package/dist/service/wafv2/statement/sim-waf-statement.d.ts

@@ -0,0 +1,21 @@
+import type { SimWafRegexPatternSet } from "../regex-pattern-set/sim-waf-regex-pattern-set.js";
+import type { SimWafResourceStore } from "../resource/sim-waf-resource-store.js";
+import { type SimWafMatcher } from "./sim-waf-field-match.js";
+import type { SimWafStatementInput } from "./sim-waf-statement.type.js";
+/**
+ * What a statement needs from the rest of the simulation to be compiled.
+ */
+export interface SimWafStatementScope {
+    readonly regexPatternSets: SimWafResourceStore<SimWafRegexPatternSet>;
+    readonly ruleName: string;
+}
+/**
+ * Turn one statement into the matcher a rule evaluates a request with.
+ *
+ * Compiling happens when the web ACL is written rather than when a request
+ * arrives, which is what lets `CreateWebACL` refuse a statement kind it cannot
+ * evaluate. It also means a rule does no parsing per request: what a request
+ * meets is a closure over what the rule already worked out.
+ */
+export declare function compileSimWafStatement(statement: SimWafStatementInput | undefined, scope: SimWafStatementScope): SimWafMatcher;
+//# sourceMappingURL=sim-waf-statement.d.ts.map

package/dist/service/wafv2/statement/sim-waf-statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-statement.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAEjF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAC;AASlC,OAAO,KAAK,EAEV,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AAGrC;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,oBAAoB,GAAG,SAAS,EAC3C,KAAK,EAAE,oBAAoB,GAC1B,aAAa,CA4Bf"}

package/dist/service/wafv2/statement/sim-waf-statement.js

@@ -0,0 +1,64 @@
+import { simWafByteMatchTest } from "./sim-waf-byte-match.js";
+import { compileSimWafFieldMatcher, } from "./sim-waf-field-match.js";
+import { simWafRegexPatternSetTest, simWafRegexTest, } from "./sim-waf-regex-match.js";
+import { compileSimWafLabelMatch } from "./sim-waf-label-match.js";
+import { compileSimWafLogicalStatement } from "./sim-waf-logical-statement.js";
+import { invalidSimWafRule } from "./sim-waf-rule-refusals.js";
+import { simWafSizeTest } from "./sim-waf-size-constraint.js";
+import { refuseUnsimulatedSimWafStatement } from "./sim-waf-unsimulated-statement.js";
+/**
+ * Turn one statement into the matcher a rule evaluates a request with.
+ *
+ * Compiling happens when the web ACL is written rather than when a request
+ * arrives, which is what lets `CreateWebACL` refuse a statement kind it cannot
+ * evaluate. It also means a rule does no parsing per request: what a request
+ * meets is a closure over what the rule already worked out.
+ */
+export function compileSimWafStatement(statement, scope) {
+    const { ruleName } = scope;
+    if (statement === undefined) {
+        invalidSimWafRule(ruleName, "A rule needs a Statement");
+    }
+    refuseUnsimulatedSimWafStatement(statement, ruleName);
+    if (statement.ManagedRuleGroupStatement !== undefined) {
+        // A rule group statement is the whole of a rule's statement on real WAFv2
+        // as well, so one nested inside another statement is refused rather than
+        // evaluated somewhere it could not carry its own actions.
+        invalidSimWafRule(ruleName, "A ManagedRuleGroupStatement is the whole of a rule's statement, and " +
+            "cannot be joined to or nested inside another one");
+    }
+    if (statement.LabelMatchStatement !== undefined) {
+        return compileSimWafLabelMatch(statement.LabelMatchStatement, ruleName);
+    }
+    return (compileFieldStatement(statement, scope) ??
+        compileSimWafLogicalStatement(statement, scope));
+}
+function compileFieldStatement(statement, scope) {
+    const { ruleName } = scope;
+    if (statement.ByteMatchStatement !== undefined) {
+        const byteMatch = statement.ByteMatchStatement;
+        return fieldMatcher(byteMatch, ruleName, simWafByteMatchTest(byteMatch, ruleName));
+    }
+    if (statement.RegexMatchStatement !== undefined) {
+        const regexMatch = statement.RegexMatchStatement;
+        return fieldMatcher(regexMatch, ruleName, simWafRegexTest(regexMatch, ruleName));
+    }
+    if (statement.RegexPatternSetReferenceStatement !== undefined) {
+        const reference = statement.RegexPatternSetReferenceStatement;
+        return fieldMatcher(reference, ruleName, simWafRegexPatternSetTest(reference, ruleName, scope.regexPatternSets));
+    }
+    if (statement.SizeConstraintStatement !== undefined) {
+        const size = statement.SizeConstraintStatement;
+        return fieldMatcher(size, ruleName, simWafSizeTest(size, ruleName));
+    }
+    return undefined;
+}
+function fieldMatcher(statement, ruleName, test) {
+    return compileSimWafFieldMatcher({
+        field: statement.FieldToMatch,
+        transformations: statement.TextTransformations,
+        ruleName,
+        test,
+    });
+}
+//# sourceMappingURL=sim-waf-statement.js.map

package/dist/service/wafv2/statement/sim-waf-statement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-statement.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,yBAAyB,GAE1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAK9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAUtF;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAA2C,EAC3C,KAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,iBAAiB,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC1D,CAAC;IAED,gCAAgC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEtD,IAAI,SAAS,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;QACtD,0EAA0E;QAC1E,yEAAyE;QACzE,0DAA0D;QAC1D,iBAAiB,CACf,QAAQ,EACR,sEAAsE;YACpE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,uBAAuB,CAAC,SAAS,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,CACL,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC;QACvC,6BAA6B,CAAC,SAAS,EAAE,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,SAA+B,EAC/B,KAA2B;IAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAE3B,IAAI,SAAS,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,SAAS,CAAC,kBAAkB,CAAC;QAE/C,OAAO,YAAY,CACjB,SAAS,EACT,QAAQ,EACR,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,SAAS,CAAC,mBAAmB,CAAC;QAEjD,OAAO,YAAY,CACjB,UAAU,EACV,QAAQ,EACR,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CACtC,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,iCAAiC,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,iCAAiC,CAAC;QAE9D,OAAO,YAAY,CACjB,SAAS,EACT,QAAQ,EACR,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,SAAS,CAAC,uBAAuB,CAAC;QAE/C,OAAO,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,SAAoC,EACpC,QAAgB,EAChB,IAAgC;IAEhC,OAAO,yBAAyB,CAAC;QAC/B,KAAK,EAAE,SAAS,CAAC,YAAY;QAC7B,eAAe,EAAE,SAAS,CAAC,mBAAmB;QAC9C,QAAQ;QACR,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/service/wafv2/statement/sim-waf-statement.type.d.ts

@@ -0,0 +1,48 @@
+import type { SimWafManagedRuleGroupStatementInput } from "../managed/sim-waf-managed-group.type.js";
+import type { SimWafByteMatchStatementInput } from "./sim-waf-byte-match.js";
+import type { SimWafLabelMatchStatementInput } from "./sim-waf-label-match.js";
+import type { SimWafFieldToMatchInput } from "./sim-waf-field-to-match.type.js";
+import type { SimWafRegexMatchStatementInput, SimWafRegexPatternSetReferenceInput } from "./sim-waf-regex-match.js";
+import type { SimWafSizeConstraintStatementInput } from "./sim-waf-size-constraint.js";
+import type { SimWafTextTransformationInput } from "./sim-waf-text-transformation.js";
+/**
+ * What every statement that reads a request field carries.
+ */
+export interface SimWafFieldStatementInput {
+    readonly FieldToMatch?: SimWafFieldToMatchInput | undefined;
+    readonly TextTransformations?: readonly SimWafTextTransformationInput[] | undefined;
+}
+/**
+ * Minimal structural WAFv2 Statement.
+ *
+ * The kinds Yulin refuses are declared alongside the ones it evaluates, so a
+ * rule that uses one is refused by name rather than read as a rule with no
+ * statement in it.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/wafv2/Interface/Statement/
+ */
+export interface SimWafStatementInput {
+    readonly ByteMatchStatement?: (SimWafByteMatchStatementInput & SimWafFieldStatementInput) | undefined;
+    readonly RegexMatchStatement?: (SimWafRegexMatchStatementInput & SimWafFieldStatementInput) | undefined;
+    readonly RegexPatternSetReferenceStatement?: (SimWafRegexPatternSetReferenceInput & SimWafFieldStatementInput) | undefined;
+    readonly SizeConstraintStatement?: (SimWafSizeConstraintStatementInput & SimWafFieldStatementInput) | undefined;
+    readonly AndStatement?: {
+        readonly Statements?: readonly SimWafStatementInput[] | undefined;
+    } | undefined;
+    readonly OrStatement?: {
+        readonly Statements?: readonly SimWafStatementInput[] | undefined;
+    } | undefined;
+    readonly NotStatement?: {
+        readonly Statement?: SimWafStatementInput | undefined;
+    } | undefined;
+    readonly IPSetReferenceStatement?: unknown;
+    readonly GeoMatchStatement?: unknown;
+    readonly AsnMatchStatement?: unknown;
+    readonly RateBasedStatement?: unknown;
+    readonly SqliMatchStatement?: unknown;
+    readonly XssMatchStatement?: unknown;
+    readonly LabelMatchStatement?: SimWafLabelMatchStatementInput | undefined;
+    readonly ManagedRuleGroupStatement?: SimWafManagedRuleGroupStatementInput | undefined;
+    readonly RuleGroupReferenceStatement?: unknown;
+}
+//# sourceMappingURL=sim-waf-statement.type.d.ts.map

package/dist/service/wafv2/statement/sim-waf-statement.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-statement.type.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EACV,8BAA8B,EAC9B,mCAAmC,EACpC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAEtF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,mBAAmB,CAAC,EACzB,SAAS,6BAA6B,EAAE,GACxC,SAAS,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EACxB,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,GAC3D,SAAS,CAAC;IACd,QAAQ,CAAC,mBAAmB,CAAC,EACzB,CAAC,8BAA8B,GAAG,yBAAyB,CAAC,GAC5D,SAAS,CAAC;IACd,QAAQ,CAAC,iCAAiC,CAAC,EACvC,CAAC,mCAAmC,GAAG,yBAAyB,CAAC,GACjE,SAAS,CAAC;IACd,QAAQ,CAAC,uBAAuB,CAAC,EAC7B,CAAC,kCAAkC,GAAG,yBAAyB,CAAC,GAChE,SAAS,CAAC;IACd,QAAQ,CAAC,YAAY,CAAC,EAClB;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAA;KAAE,GACrE,SAAS,CAAC;IACd,QAAQ,CAAC,WAAW,CAAC,EACjB;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAA;KAAE,GACrE,SAAS,CAAC;IACd,QAAQ,CAAC,YAAY,CAAC,EAClB;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAA;KAAE,GACzD,SAAS,CAAC;IACd,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,yBAAyB,CAAC,EAC/B,oCAAoC,GACpC,SAAS,CAAC;IACd,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD"}

package/dist/service/wafv2/statement/sim-waf-statement.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-waf-statement.type.js.map

package/dist/service/wafv2/statement/sim-waf-statement.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-statement.type.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-statement.type.ts"],"names":[],"mappings":""}

package/dist/service/wafv2/statement/sim-waf-text-transformation.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal structural WAFv2 text transformation.
+ */
+export interface SimWafTextTransformationInput {
+    readonly Priority?: number | undefined;
+    readonly Type?: string | undefined;
+}
+/**
+ * What a rule does to a field before it matches against it.
+ */
+export type SimWafTextTransform = (value: string) => string;
+/**
+ * Build the transformation a rule applies to every field it reads.
+ *
+ * WAF applies them in ascending `Priority` rather than in the order they were
+ * written, so lowercasing after decoding is a different rule from decoding
+ * after lowercasing however the list is arranged.
+ */
+export declare function compileSimWafTextTransformations(transformations: readonly SimWafTextTransformationInput[] | undefined, ruleName: string): SimWafTextTransform;
+//# sourceMappingURL=sim-waf-text-transformation.d.ts.map

package/dist/service/wafv2/statement/sim-waf-text-transformation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-text-transformation.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-text-transformation.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;AAkB5D;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,eAAe,EAAE,SAAS,6BAA6B,EAAE,GAAG,SAAS,EACrE,QAAQ,EAAE,MAAM,GACf,mBAAmB,CAcrB"}

package/dist/service/wafv2/statement/sim-waf-text-transformation.js

@@ -0,0 +1,76 @@
+import { refuseSimWafRuleInput } from "./sim-waf-rule-refusals.js";
+import { simWafUrlDecode } from "./sim-waf-url-decode.js";
+const namedEntities = new Map([
+    ["quot", '"'],
+    ["nbsp", " "],
+    ["amp", "&"],
+    ["lt", "<"],
+    ["gt", ">"],
+]);
+const transforms = new Map([
+    ["NONE", (value) => value],
+    ["LOWERCASE", (value) => value.toLowerCase()],
+    ["URL_DECODE", simWafUrlDecode],
+    ["COMPRESS_WHITE_SPACE", compressWhitespace],
+    ["HTML_ENTITY_DECODE", htmlEntityDecode],
+]);
+/**
+ * Build the transformation a rule applies to every field it reads.
+ *
+ * WAF applies them in ascending `Priority` rather than in the order they were
+ * written, so lowercasing after decoding is a different rule from decoding
+ * after lowercasing however the list is arranged.
+ */
+export function compileSimWafTextTransformations(transformations, ruleName) {
+    const ordered = (transformations ?? [])
+        .toSorted((left, right) => (left.Priority ?? 0) - (right.Priority ?? 0))
+        .map((transformation) => compileOne(transformation, ruleName));
+    return (value) => {
+        let transformed = value;
+        for (const transform of ordered) {
+            transformed = transform(transformed);
+        }
+        return transformed;
+    };
+}
+function compileOne(transformation, ruleName) {
+    const transform = transforms.get(transformation.Type ?? "");
+    if (transform === undefined) {
+        refuseSimWafRuleInput(ruleName, `the text transformation ${String(transformation.Type)}`, "only NONE, LOWERCASE, URL_DECODE, COMPRESS_WHITE_SPACE and " +
+            "HTML_ENTITY_DECODE are simulated");
+    }
+    return transform;
+}
+/**
+ * Replace every whitespace character with a space and collapse runs of them.
+ *
+ * The set is WAF's own, which includes the non-breaking space that a plain
+ * `\s` leaves alone.
+ */
+function compressWhitespace(value) {
+    return value.replaceAll(/[\f\n\r\t\v\u{20}\u{A0}]+/gu, " ");
+}
+/**
+ * Decode the HTML entities WAF's HTML_ENTITY_DECODE decodes, named and
+ * numbered alike.
+ */
+function htmlEntityDecode(value) {
+    return value.replaceAll(/&(#x[\da-f]+|#\d+|[a-z]+);?/giu, (entity, body) => decodeEntity(body.toLowerCase()) ?? entity);
+}
+function decodeEntity(body) {
+    if (body.startsWith("#x")) {
+        return fromCodePoint(Number.parseInt(body.slice(2), 16));
+    }
+    if (body.startsWith("#")) {
+        return fromCodePoint(Number(body.slice(1)));
+    }
+    return namedEntities.get(body);
+}
+function fromCodePoint(codePoint) {
+    return Number.isSafeInteger(codePoint) &&
+        codePoint >= 0 &&
+        codePoint <= 0x10_ff_ff
+        ? String.fromCodePoint(codePoint)
+        : undefined;
+}
+//# sourceMappingURL=sim-waf-text-transformation.js.map

package/dist/service/wafv2/statement/sim-waf-text-transformation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-text-transformation.js","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-text-transformation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAe1D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAiB;IAC5C,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,MAAM,EAAE,GAAG,CAAC;IACb,CAAC,KAAK,EAAE,GAAG,CAAC;IACZ,CAAC,IAAI,EAAE,GAAG,CAAC;IACX,CAAC,IAAI,EAAE,GAAG,CAAC;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAA8B;IACtD,CAAC,MAAM,EAAE,CAAC,KAAK,EAAU,EAAE,CAAC,KAAK,CAAC;IAClC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAU,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IACrD,CAAC,YAAY,EAAE,eAAe,CAAC;IAC/B,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;IAC5C,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;CACzC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,eAAqE,EACrE,QAAgB;IAEhB,MAAM,OAAO,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;SACpC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEjE,OAAO,CAAC,KAAK,EAAU,EAAE;QACvB,IAAI,WAAW,GAAG,KAAK,CAAC;QAExB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,cAA6C,EAC7C,QAAgB;IAEhB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE5D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,qBAAqB,CACnB,QAAQ,EACR,2BAA2B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EACxD,6DAA6D;YAC3D,kCAAkC,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,UAAU,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,UAAU,CACrB,gCAAgC,EAChC,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE,CAC/B,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;QACpC,SAAS,IAAI,CAAC;QACd,SAAS,IAAI,UAAU;QACvB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;QACjC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/service/wafv2/statement/sim-waf-unsimulated-field.d.ts

@@ -0,0 +1,11 @@
+import type { SimWafFieldToMatchInput } from "./sim-waf-field-to-match.type.js";
+/**
+ * Refuse the field-to-match kinds real WAFv2 offers and this simulation does
+ * not read.
+ *
+ * Each is named where the rule was written, because a field that was accepted
+ * and then never read would leave the rule matching nothing at all: the web
+ * ACL would look like it covered the request and would let it through.
+ */
+export declare function refuseUnsimulatedSimWafField(field: SimWafFieldToMatchInput, ruleName: string): void;
+//# sourceMappingURL=sim-waf-unsimulated-field.d.ts.map

package/dist/service/wafv2/statement/sim-waf-unsimulated-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-unsimulated-field.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/statement/sim-waf-unsimulated-field.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAMhF;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,EAAE,MAAM,GACf,IAAI,CA8BN"}

package/dist/service/wafv2/statement/sim-waf-unsimulated-field.js

@@ -0,0 +1,50 @@
+import { invalidSimWafRule, refuseSimWafRuleInput, } from "./sim-waf-rule-refusals.js";
+/**
+ * Refuse the field-to-match kinds real WAFv2 offers and this simulation does
+ * not read.
+ *
+ * Each is named where the rule was written, because a field that was accepted
+ * and then never read would leave the rule matching nothing at all: the web
+ * ACL would look like it covered the request and would let it through.
+ */
+export function refuseUnsimulatedSimWafField(field, ruleName) {
+    refuseTwoFields(field, ruleName);
+    if (field.JsonBody !== undefined) {
+        refuseSimWafRuleInput(ruleName, "the field to match JsonBody", "matching inside a parsed JSON body has a path syntax of its own, and " +
+            "its own answer for a body that will not parse");
+    }
+    if (field.HeaderOrder !== undefined) {
+        refuseSimWafRuleInput(ruleName, "the field to match HeaderOrder", "the order headers arrived in is not something a simulated request " +
+            "carries");
+    }
+    if (field.UriFragment !== undefined) {
+        refuseSimWafRuleInput(ruleName, "the field to match UriFragment", "a fragment is never sent to a server, so no request here has one");
+    }
+    refuseFingerprintFields(field, ruleName);
+}
+/**
+ * Refuse a field to match naming more than one part of the request.
+ *
+ * Real WAFv2 takes one request component per `FieldToMatch`, and a rule that
+ * wants two is written as two rules. Reading the first component found would
+ * make which of them the rule inspected a matter of the order they are checked
+ * in.
+ */
+function refuseTwoFields(field, ruleName) {
+    const named = Object.entries(field)
+        .filter(([, value]) => value !== undefined)
+        .map(([component]) => component);
+    if (named.length > 1) {
+        invalidSimWafRule(ruleName, `The field to match names ${named.join(" and ")}, and a statement ` +
+            `inspects one request component`);
+    }
+}
+function refuseFingerprintFields(field, ruleName) {
+    const fingerprint = field.JA3Fingerprint === undefined ? undefined : "JA3Fingerprint";
+    const named = field.JA4Fingerprint === undefined ? fingerprint : "JA4Fingerprint";
+    if (named !== undefined) {
+        refuseSimWafRuleInput(ruleName, `the field to match ${named}`, "a TLS fingerprint comes from the handshake, and a request that " +
+            "reached a simulated service made none");
+    }
+}
+//# sourceMappingURL=sim-waf-unsimulated-field.js.map