@kensio/yulin 1.17.2 → 1.18.0

package/dist/service/wafv2/managed/detect/sim-waf-managed-components.d.ts

@@ -0,0 +1,40 @@
+import type { SimWafManagedDetector } from "../sim-waf-managed-rule.type.js";
+/**
+ * Whether one string carries what a managed rule is looking for.
+ */
+export type SimWafManagedPattern = (value: string) => boolean;
+/**
+ * Read a rule's pattern against the URI path.
+ *
+ * These six point one pattern at the component a rule reads.
+ *
+ * The managed rules come in families that run the same detection over a
+ * different component each, which is what the `_BODY` and `_URIPATH` on the
+ * end of a rule name says. Pairing a pattern with a component here is what
+ * lets each rule be one line of the group it belongs to.
+ *
+ * A component that holds several strings matches when any of them does, as a
+ * rule reading a set of query arguments or headers does on AWS.
+ */
+export declare function simWafInUriPath(pattern: SimWafManagedPattern): SimWafManagedDetector;
+/**
+ * Read a rule's pattern against the query string.
+ */
+export declare function simWafInQueryString(pattern: SimWafManagedPattern): SimWafManagedDetector;
+/**
+ * Read a rule's pattern against every query argument.
+ */
+export declare function simWafInQueryArguments(pattern: SimWafManagedPattern): SimWafManagedDetector;
+/**
+ * Read a rule's pattern against as much of the body as WAF inspects.
+ */
+export declare function simWafInBody(pattern: SimWafManagedPattern): SimWafManagedDetector;
+/**
+ * Read a rule's pattern against the whole cookie header.
+ */
+export declare function simWafInCookies(pattern: SimWafManagedPattern): SimWafManagedDetector;
+/**
+ * Read a rule's pattern against every header the request sent.
+ */
+export declare function simWafInHeaders(pattern: SimWafManagedPattern): SimWafManagedDetector;
+//# sourceMappingURL=sim-waf-managed-components.d.ts.map

package/dist/service/wafv2/managed/detect/sim-waf-managed-components.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-components.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/detect/sim-waf-managed-components.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAE7E;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAE9D;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,GAC5B,qBAAqB,CAEvB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,qBAAqB,CAEvB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,oBAAoB,GAC5B,qBAAqB,CAEvB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,oBAAoB,GAC5B,qBAAqB,CAEvB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,GAC5B,qBAAqB,CAEvB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,oBAAoB,GAC5B,qBAAqB,CAEvB"}

package/dist/service/wafv2/managed/detect/sim-waf-managed-components.js

@@ -0,0 +1,47 @@
+/**
+ * Read a rule's pattern against the URI path.
+ *
+ * These six point one pattern at the component a rule reads.
+ *
+ * The managed rules come in families that run the same detection over a
+ * different component each, which is what the `_BODY` and `_URIPATH` on the
+ * end of a rule name says. Pairing a pattern with a component here is what
+ * lets each rule be one line of the group it belongs to.
+ *
+ * A component that holds several strings matches when any of them does, as a
+ * rule reading a set of query arguments or headers does on AWS.
+ */
+export function simWafInUriPath(pattern) {
+    return (parts) => pattern(parts.uriPath);
+}
+/**
+ * Read a rule's pattern against the query string.
+ */
+export function simWafInQueryString(pattern) {
+    return (parts) => pattern(parts.queryString);
+}
+/**
+ * Read a rule's pattern against every query argument.
+ */
+export function simWafInQueryArguments(pattern) {
+    return (parts) => parts.queryArguments.some(pattern);
+}
+/**
+ * Read a rule's pattern against as much of the body as WAF inspects.
+ */
+export function simWafInBody(pattern) {
+    return (parts) => pattern(parts.body);
+}
+/**
+ * Read a rule's pattern against the whole cookie header.
+ */
+export function simWafInCookies(pattern) {
+    return (parts) => pattern(parts.cookieHeader);
+}
+/**
+ * Read a rule's pattern against every header the request sent.
+ */
+export function simWafInHeaders(pattern) {
+    return (parts) => parts.headerValues.some(pattern);
+}
+//# sourceMappingURL=sim-waf-managed-components.js.map

package/dist/service/wafv2/managed/detect/sim-waf-managed-components.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-components.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/detect/sim-waf-managed-components.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA6B;IAE7B,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA6B;IAE7B,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA6B;IAE7B,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA6B;IAE7B,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA6B;IAE7B,OAAO,CAAC,KAAK,EAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC"}

package/dist/service/wafv2/managed/detect/sim-waf-managed-patterns.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Whether a component asks the EC2 instance metadata service for anything.
+ *
+ * Both halves are patterns in the request rather than facts about its sender,
+ * so neither of them needs the caller's address that keeps
+ * `IPSetReferenceStatement` out of this simulation.
+ */
+export declare function simWafDetectsEc2MetadataSsrf(value: string): boolean;
+/**
+ * Whether a component carries a JNDI lookup, which is how Log4Shell arrives.
+ *
+ * The nested forms that hide the letters of `jndi` behind further lookups are
+ * not matched. AWS matches them and does not say how.
+ */
+export declare function simWafDetectsLog4JRce(value: string): boolean;
+/**
+ * Whether a component carries a local file inclusion, which is a traversal out
+ * of the directory a path was meant to stay in.
+ */
+export declare function simWafDetectsGenericLfi(value: string): boolean;
+/**
+ * Whether a component carries a remote file inclusion, which AWS describes as
+ * a URL scheme followed by an IPv4 host.
+ */
+export declare function simWafDetectsGenericRfi(value: string): boolean;
+/**
+ * Whether a component names a file with a restricted extension.
+ *
+ * The extension has to end there, so `report.log` is a match and `logo.png` is
+ * not.
+ */
+export declare function simWafDetectsRestrictedExtension(value: string): boolean;
+/**
+ * Whether a path asks for a web application directory that is not meant to be
+ * served, which AWS gives `web-inf` as the example of.
+ */
+export declare function simWafDetectsExploitablePath(value: string): boolean;
+/**
+ * Whether a path asks for an exposed administrative page, which AWS gives
+ * `sqlmanager` as the example of.
+ *
+ * The administrative paths an application of its own uses are not matched.
+ * `/admin` is nowhere in what AWS published, and matching it here would block
+ * a request AWS lets through.
+ */
+export declare function simWafDetectsAdminPath(value: string): boolean;
+/**
+ * Whether a component carries a serialized Java object, which is the payload
+ * an unsafe deserialization is delivered in.
+ *
+ * `rO0` is the base64 of the two bytes a Java stream starts with, and it is
+ * the published example. The raw bytes are not matched: they are not valid
+ * UTF-8, and every component here is read as text.
+ */
+export declare function simWafDetectsJavaDeserializationRce(value: string): boolean;
+/**
+ * Whether a User-Agent names one of the scanners AWS gives as examples of a
+ * bad bot.
+ */
+export declare function simWafDetectsBadBot(value: string): boolean;
+//# sourceMappingURL=sim-waf-managed-patterns.d.ts.map

package/dist/service/wafv2/managed/detect/sim-waf-managed-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-patterns.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/detect/sim-waf-managed-patterns.ts"],"names":[],"mappings":"AA8CA;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOnE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI1D"}

package/dist/service/wafv2/managed/detect/sim-waf-managed-patterns.js

@@ -0,0 +1,121 @@
+import { simWafUrlDecode } from "../../statement/sim-waf-url-decode.js";
+/**
+ * The patterns AWS published for its managed rules, and nothing beyond them.
+ *
+ * AWS documents an example pattern or two for each of these rules and holds
+ * the rest back, which is what stops a simulation of them from agreeing with
+ * real WAF. Each function here matches what was published, so every one of
+ * them detects less than the rule it stands for and none of them detects more.
+ *
+ * That direction is the whole point. A test with the core rule set on is
+ * usually asking whether an application's own traffic still gets through, and
+ * a rule that blocked more than AWS blocks would fail that test for a request
+ * AWS allows. A rule that blocks less is invisible to it, and right on AWS
+ * too.
+ *
+ * Every one of these reads the component after a URL decode, because the
+ * managed rules apply one and a payload arrives percent encoded more often
+ * than not.
+ */
+/** The EC2 instance metadata address and the path exfiltration asks it for. */
+const metadataAddress = "169.254.169.254";
+const metadataPath = "/latest/meta-data";
+/** `${jndi:` is the published shape of a Log4Shell lookup. */
+const jndiLookup = /\$\{jndi:/iu;
+/** A path traversal, in either slash, either way round. */
+const pathTraversal = /\.\.[/\\]|[/\\]\.\./u;
+/**
+ * A URL scheme followed by an IPv4 host, which is the published RFI shape.
+ *
+ * Every quantifier here is bounded and each is followed by a character it
+ * cannot itself match, so a value that fails to match fails at a fixed
+ * position. The unsafe-expression check reads the repeated groups and cannot
+ * see that.
+ */
+const remoteInclusion = 
+// oxlint-disable-next-line security/detect-unsafe-regex
+/[a-z][a-z\d+.-]{0,30}:\/\/\d{1,3}(?:\.\d{1,3}){3}/iu;
+/** The two file extensions AWS gives as examples of a restricted one. */
+const restrictedExtension = /\.(?:log|ini)\b/iu;
+/**
+ * Whether a component asks the EC2 instance metadata service for anything.
+ *
+ * Both halves are patterns in the request rather than facts about its sender,
+ * so neither of them needs the caller's address that keeps
+ * `IPSetReferenceStatement` out of this simulation.
+ */
+export function simWafDetectsEc2MetadataSsrf(value) {
+    const decoded = simWafUrlDecode(value);
+    return (decoded.includes(metadataAddress) ||
+        decoded.toLowerCase().includes(metadataPath));
+}
+/**
+ * Whether a component carries a JNDI lookup, which is how Log4Shell arrives.
+ *
+ * The nested forms that hide the letters of `jndi` behind further lookups are
+ * not matched. AWS matches them and does not say how.
+ */
+export function simWafDetectsLog4JRce(value) {
+    return jndiLookup.test(simWafUrlDecode(value));
+}
+/**
+ * Whether a component carries a local file inclusion, which is a traversal out
+ * of the directory a path was meant to stay in.
+ */
+export function simWafDetectsGenericLfi(value) {
+    return pathTraversal.test(simWafUrlDecode(value));
+}
+/**
+ * Whether a component carries a remote file inclusion, which AWS describes as
+ * a URL scheme followed by an IPv4 host.
+ */
+export function simWafDetectsGenericRfi(value) {
+    return remoteInclusion.test(simWafUrlDecode(value));
+}
+/**
+ * Whether a component names a file with a restricted extension.
+ *
+ * The extension has to end there, so `report.log` is a match and `logo.png` is
+ * not.
+ */
+export function simWafDetectsRestrictedExtension(value) {
+    return restrictedExtension.test(simWafUrlDecode(value));
+}
+/**
+ * Whether a path asks for a web application directory that is not meant to be
+ * served, which AWS gives `web-inf` as the example of.
+ */
+export function simWafDetectsExploitablePath(value) {
+    return simWafUrlDecode(value).toLowerCase().includes("web-inf");
+}
+/**
+ * Whether a path asks for an exposed administrative page, which AWS gives
+ * `sqlmanager` as the example of.
+ *
+ * The administrative paths an application of its own uses are not matched.
+ * `/admin` is nowhere in what AWS published, and matching it here would block
+ * a request AWS lets through.
+ */
+export function simWafDetectsAdminPath(value) {
+    return simWafUrlDecode(value).toLowerCase().includes("sqlmanager");
+}
+/**
+ * Whether a component carries a serialized Java object, which is the payload
+ * an unsafe deserialization is delivered in.
+ *
+ * `rO0` is the base64 of the two bytes a Java stream starts with, and it is
+ * the published example. The raw bytes are not matched: they are not valid
+ * UTF-8, and every component here is read as text.
+ */
+export function simWafDetectsJavaDeserializationRce(value) {
+    return simWafUrlDecode(value).includes("rO0");
+}
+/**
+ * Whether a User-Agent names one of the scanners AWS gives as examples of a
+ * bad bot.
+ */
+export function simWafDetectsBadBot(value) {
+    const decoded = simWafUrlDecode(value).toLowerCase();
+    return decoded.includes("nessus") || decoded.includes("nmap");
+}
+//# sourceMappingURL=sim-waf-managed-patterns.js.map

package/dist/service/wafv2/managed/detect/sim-waf-managed-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-patterns.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/detect/sim-waf-managed-patterns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAExE;;;;;;;;;;;;;;;;;GAiBG;AAEH,+EAA+E;AAC/E,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAC1C,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC,8DAA8D;AAC9D,MAAM,UAAU,GAAG,aAAa,CAAC;AAEjC,2DAA2D;AAC3D,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,eAAe;AACnB,wDAAwD;AACxD,qDAAqD,CAAC;AAExD,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEvC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,OAAO,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAa;IAC5D,OAAO,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACxD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mCAAmC,CAAC,KAAa;IAC/D,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAErD,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC"}

package/dist/service/wafv2/managed/detect/sim-waf-managed-sizes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The sizes the four `SizeRestrictions_*` rules allow a component to reach.
+ *
+ * AWS documents every one of these figures, so these rules match exactly where
+ * the rules they stand for match. A component of exactly the limit is allowed
+ * and one byte more is not, which is the boundary a test about a large upload
+ * or a long query string is really asking about.
+ */
+export declare const simWafManagedSizeLimits: {
+    readonly queryString: 2048;
+    readonly cookieHeader: 10240;
+    readonly body: 8192;
+    readonly uriPath: 1024;
+};
+//# sourceMappingURL=sim-waf-managed-sizes.d.ts.map

package/dist/service/wafv2/managed/detect/sim-waf-managed-sizes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-sizes.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/detect/sim-waf-managed-sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;aAClC,WAAW,EAAE,IAAI;aACjB,YAAY,EAAE,KAAM;aACpB,IAAI,EAAE,IAAI;aACV,OAAO,EAAE,IAAI;CACL,CAAC"}

package/dist/service/wafv2/managed/detect/sim-waf-managed-sizes.js

@@ -0,0 +1,15 @@
+/**
+ * The sizes the four `SizeRestrictions_*` rules allow a component to reach.
+ *
+ * AWS documents every one of these figures, so these rules match exactly where
+ * the rules they stand for match. A component of exactly the limit is allowed
+ * and one byte more is not, which is the boundary a test about a large upload
+ * or a long query string is really asking about.
+ */
+export const simWafManagedSizeLimits = {
+    queryString: 2048,
+    cookieHeader: 10_240,
+    body: 8192,
+    uriPath: 1024,
+};
+//# sourceMappingURL=sim-waf-managed-sizes.js.map

package/dist/service/wafv2/managed/detect/sim-waf-managed-sizes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-managed-sizes.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/detect/sim-waf-managed-sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,MAAM;IACpB,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,IAAI;CACL,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-admin-protection.d.ts

@@ -0,0 +1,10 @@
+import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The AWS admin protection rule set, which is one rule that blocks by default.
+ *
+ * It keeps external callers off the administrative pages third-party software
+ * exposes. What it matches is a published example and no more, so an
+ * application's own administrative paths reach it here as they do on AWS.
+ */
+export declare const simWafAdminProtectionRuleSet: SimWafManagedRuleGroupDefinition;
+//# sourceMappingURL=sim-waf-admin-protection.d.ts.map

package/dist/service/wafv2/managed/group/sim-waf-admin-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-admin-protection.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-admin-protection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,gCAY1C,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-admin-protection.js

@@ -0,0 +1,23 @@
+import { simWafInUriPath } from "../detect/sim-waf-managed-components.js";
+import { simWafDetectsAdminPath } from "../detect/sim-waf-managed-patterns.js";
+/**
+ * The AWS admin protection rule set, which is one rule that blocks by default.
+ *
+ * It keeps external callers off the administrative pages third-party software
+ * exposes. What it matches is a published example and no more, so an
+ * application's own administrative paths reach it here as they do on AWS.
+ */
+export const simWafAdminProtectionRuleSet = {
+    name: "AWSManagedRulesAdminProtectionRuleSet",
+    labelNamespace: "awswaf:managed:aws:admin-protection",
+    capacity: 100,
+    rules: [
+        {
+            name: "AdminProtection_URIPATH",
+            label: "AdminProtection_URIPath",
+            tier: "documented",
+            detects: simWafInUriPath(simWafDetectsAdminPath),
+        },
+    ],
+};
+//# sourceMappingURL=sim-waf-admin-protection.js.map

package/dist/service/wafv2/managed/group/sim-waf-admin-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-admin-protection.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-admin-protection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAG/E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAqC;IAC5E,IAAI,EAAE,uCAAuC;IAC7C,cAAc,EAAE,qCAAqC;IACrD,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE;QACL;YACE,IAAI,EAAE,yBAAyB;YAC/B,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,eAAe,CAAC,sBAAsB,CAAC;SACjD;KACF;CACF,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-common-rule-set.d.ts

@@ -0,0 +1,16 @@
+import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The AWS core rule set, in the order AWS evaluates its rules.
+ *
+ * This is the group a team turning WAF on nearly always turns on, which is why
+ * it is here. Every rule blocks by default.
+ *
+ * The order matters as much as the rules do. Two rules can claim one request,
+ * and the first of them to claim it is the one that blocks it and the one
+ * whose label the request carries, so a rule moved up or down would change
+ * which of them a test sees. The rules are held in two lists, and the join
+ * between them is where AWS's own order goes from reading the request to
+ * looking inside it.
+ */
+export declare const simWafCommonRuleSet: SimWafManagedRuleGroupDefinition;
+//# sourceMappingURL=sim-waf-common-rule-set.d.ts.map

package/dist/service/wafv2/managed/group/sim-waf-common-rule-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-common-rule-set.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-common-rule-set.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAIxF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,EAAE,gCAKjC,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-common-rule-set.js

@@ -0,0 +1,22 @@
+import { simWafCorePayloadRules } from "./sim-waf-core-payload-rules.js";
+import { simWafCoreRequestRules } from "./sim-waf-core-request-rules.js";
+/**
+ * The AWS core rule set, in the order AWS evaluates its rules.
+ *
+ * This is the group a team turning WAF on nearly always turns on, which is why
+ * it is here. Every rule blocks by default.
+ *
+ * The order matters as much as the rules do. Two rules can claim one request,
+ * and the first of them to claim it is the one that blocks it and the one
+ * whose label the request carries, so a rule moved up or down would change
+ * which of them a test sees. The rules are held in two lists, and the join
+ * between them is where AWS's own order goes from reading the request to
+ * looking inside it.
+ */
+export const simWafCommonRuleSet = {
+    name: "AWSManagedRulesCommonRuleSet",
+    labelNamespace: "awswaf:managed:aws:core-rule-set",
+    capacity: 700,
+    rules: [...simWafCoreRequestRules, ...simWafCorePayloadRules],
+};
+//# sourceMappingURL=sim-waf-common-rule-set.js.map

package/dist/service/wafv2/managed/group/sim-waf-common-rule-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-common-rule-set.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-common-rule-set.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,IAAI,EAAE,8BAA8B;IACpC,cAAc,EAAE,kCAAkC;IAClD,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,CAAC,GAAG,sBAAsB,EAAE,GAAG,sBAAsB,CAAC;CAC9D,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-core-payload-rules.d.ts

@@ -0,0 +1,11 @@
+import type { SimWafManagedRuleDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The core rule set rules that look inside a request, in AWS's order.
+ *
+ * These are the last sixteen rules of the group. Each of them reads one
+ * component for one payload, which is what the end of a rule name says, and
+ * the four `CrossSiteScripting_*` rules that close the group detect nothing:
+ * AWS documents none of the detection they run.
+ */
+export declare const simWafCorePayloadRules: readonly SimWafManagedRuleDefinition[];
+//# sourceMappingURL=sim-waf-core-payload-rules.d.ts.map

package/dist/service/wafv2/managed/group/sim-waf-core-payload-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-core-payload-rules.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-core-payload-rules.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAEnF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,2BAA2B,EA6FxE,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-core-payload-rules.js

@@ -0,0 +1,105 @@
+import { simWafInBody, simWafInCookies, simWafInQueryArguments, simWafInUriPath, } from "../detect/sim-waf-managed-components.js";
+import { simWafDetectsEc2MetadataSsrf, simWafDetectsGenericLfi, simWafDetectsGenericRfi, simWafDetectsRestrictedExtension, } from "../detect/sim-waf-managed-patterns.js";
+/**
+ * The core rule set rules that look inside a request, in AWS's order.
+ *
+ * These are the last sixteen rules of the group. Each of them reads one
+ * component for one payload, which is what the end of a rule name says, and
+ * the four `CrossSiteScripting_*` rules that close the group detect nothing:
+ * AWS documents none of the detection they run.
+ */
+export const simWafCorePayloadRules = [
+    {
+        name: "EC2MetaDataSSRF_BODY",
+        label: "EC2MetaDataSSRF_Body",
+        tier: "documented",
+        detects: simWafInBody(simWafDetectsEc2MetadataSsrf),
+    },
+    {
+        name: "EC2MetaDataSSRF_COOKIE",
+        label: "EC2MetaDataSSRF_Cookie",
+        tier: "documented",
+        detects: simWafInCookies(simWafDetectsEc2MetadataSsrf),
+    },
+    {
+        name: "EC2MetaDataSSRF_URIPATH",
+        label: "EC2MetaDataSSRF_URIPath",
+        tier: "documented",
+        detects: simWafInUriPath(simWafDetectsEc2MetadataSsrf),
+    },
+    {
+        name: "EC2MetaDataSSRF_QUERYARGUMENTS",
+        label: "EC2MetaDataSSRF_QueryArguments",
+        tier: "documented",
+        detects: simWafInQueryArguments(simWafDetectsEc2MetadataSsrf),
+    },
+    {
+        name: "GenericLFI_QUERYARGUMENTS",
+        label: "GenericLFI_QueryArguments",
+        tier: "documented",
+        detects: simWafInQueryArguments(simWafDetectsGenericLfi),
+    },
+    {
+        name: "RestrictedExtensions_URIPATH",
+        label: "RestrictedExtensions_URIPath",
+        tier: "documented",
+        detects: simWafInUriPath(simWafDetectsRestrictedExtension),
+    },
+    {
+        name: "RestrictedExtensions_QUERYARGUMENTS",
+        label: "RestrictedExtensions_QueryArguments",
+        tier: "documented",
+        detects: simWafInQueryArguments(simWafDetectsRestrictedExtension),
+    },
+    {
+        name: "GenericLFI_URIPATH",
+        label: "GenericLFI_URIPath",
+        tier: "documented",
+        detects: simWafInUriPath(simWafDetectsGenericLfi),
+    },
+    {
+        name: "GenericLFI_BODY",
+        label: "GenericLFI_Body",
+        tier: "documented",
+        detects: simWafInBody(simWafDetectsGenericLfi),
+    },
+    {
+        name: "GenericRFI_QUERYARGUMENTS",
+        label: "GenericRFI_QueryArguments",
+        tier: "documented",
+        detects: simWafInQueryArguments(simWafDetectsGenericRfi),
+    },
+    {
+        name: "GenericRFI_BODY",
+        label: "GenericRFI_Body",
+        tier: "documented",
+        detects: simWafInBody(simWafDetectsGenericRfi),
+    },
+    {
+        name: "GenericRFI_URIPATH",
+        label: "GenericRFI_URIPath",
+        tier: "documented",
+        detects: simWafInUriPath(simWafDetectsGenericRfi),
+    },
+    {
+        name: "CrossSiteScripting_COOKIE",
+        label: "CrossSiteScripting_Cookie",
+        tier: "declared",
+    },
+    {
+        name: "CrossSiteScripting_QUERYARGUMENTS",
+        label: "CrossSiteScripting_QueryArguments",
+        tier: "declared",
+    },
+    {
+        name: "CrossSiteScripting_BODY",
+        label: "CrossSiteScripting_Body",
+        tier: "declared",
+    },
+    {
+        name: "CrossSiteScripting_URIPATH",
+        label: "CrossSiteScripting_URIPath",
+        tier: "declared",
+    },
+];
+//# sourceMappingURL=sim-waf-core-payload-rules.js.map

package/dist/service/wafv2/managed/group/sim-waf-core-payload-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-core-payload-rules.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-core-payload-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,eAAe,GAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,uBAAuB,EACvB,gCAAgC,GACjC,MAAM,uCAAuC,CAAC;AAG/C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA2C;IAC5E;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,YAAY,CAAC,4BAA4B,CAAC;KACpD;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,wBAAwB;QAC/B,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,eAAe,CAAC,4BAA4B,CAAC;KACvD;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,eAAe,CAAC,4BAA4B,CAAC;KACvD;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,KAAK,EAAE,gCAAgC;QACvC,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sBAAsB,CAAC,4BAA4B,CAAC;KAC9D;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,2BAA2B;QAClC,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;KACzD;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,8BAA8B;QACrC,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,eAAe,CAAC,gCAAgC,CAAC;KAC3D;IACD;QACE,IAAI,EAAE,qCAAqC;QAC3C,KAAK,EAAE,qCAAqC;QAC5C,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sBAAsB,CAAC,gCAAgC,CAAC;KAClE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,eAAe,CAAC,uBAAuB,CAAC;KAClD;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,YAAY,CAAC,uBAAuB,CAAC;KAC/C;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,2BAA2B;QAClC,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;KACzD;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,YAAY,CAAC,uBAAuB,CAAC;KAC/C;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,eAAe,CAAC,uBAAuB,CAAC;KAClD;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,2BAA2B;QAClC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,KAAK,EAAE,mCAAmC;QAC1C,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,yBAAyB;QAChC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,UAAU;KACjB;CACF,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-core-request-rules.d.ts

@@ -0,0 +1,11 @@
+import type { SimWafManagedRuleDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The core rule set rules that read the request itself, in AWS's order.
+ *
+ * These are the first six rules of the group, and the four size restrictions
+ * among them are the ones AWS documents a figure for. They are the rules most
+ * likely to claim an application's own traffic, and the ones a team therefore
+ * meets first.
+ */
+export declare const simWafCoreRequestRules: readonly SimWafManagedRuleDefinition[];
+//# sourceMappingURL=sim-waf-core-request-rules.d.ts.map

package/dist/service/wafv2/managed/group/sim-waf-core-request-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-core-request-rules.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-core-request-rules.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAEnF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,2BAA2B,EA0CxE,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-core-request-rules.js

@@ -0,0 +1,49 @@
+import { simWafDetectsBadBot } from "../detect/sim-waf-managed-patterns.js";
+import { simWafManagedSizeLimits } from "../detect/sim-waf-managed-sizes.js";
+/**
+ * The core rule set rules that read the request itself, in AWS's order.
+ *
+ * These are the first six rules of the group, and the four size restrictions
+ * among them are the ones AWS documents a figure for. They are the rules most
+ * likely to claim an application's own traffic, and the ones a team therefore
+ * meets first.
+ */
+export const simWafCoreRequestRules = [
+    {
+        name: "NoUserAgent_HEADER",
+        label: "NoUserAgent_Header",
+        tier: "exact",
+        detects: (parts) => parts.userAgent === undefined || parts.userAgent === "",
+    },
+    {
+        name: "UserAgent_BadBots_HEADER",
+        label: "UserAgent_BadBots_Header",
+        tier: "documented",
+        detects: (parts) => parts.userAgent !== undefined && simWafDetectsBadBot(parts.userAgent),
+    },
+    {
+        name: "SizeRestrictions_QUERYSTRING",
+        label: "SizeRestrictions_QueryString",
+        tier: "exact",
+        detects: (parts) => parts.queryStringBytes > simWafManagedSizeLimits.queryString,
+    },
+    {
+        name: "SizeRestrictions_Cookie_HEADER",
+        label: "SizeRestrictions_Cookie_Header",
+        tier: "exact",
+        detects: (parts) => parts.cookieHeaderBytes > simWafManagedSizeLimits.cookieHeader,
+    },
+    {
+        name: "SizeRestrictions_BODY",
+        label: "SizeRestrictions_Body",
+        tier: "exact",
+        detects: (parts) => parts.bodyBytes > simWafManagedSizeLimits.body,
+    },
+    {
+        name: "SizeRestrictions_URIPATH",
+        label: "SizeRestrictions_URIPath",
+        tier: "exact",
+        detects: (parts) => parts.uriPathBytes > simWafManagedSizeLimits.uriPath,
+    },
+];
+//# sourceMappingURL=sim-waf-core-request-rules.js.map

package/dist/service/wafv2/managed/group/sim-waf-core-request-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-core-request-rules.js","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-core-request-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAG7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA2C;IAC5E;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,KAAK,EAAW,EAAE,CAC1B,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE;KAC1D;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,CAAC,KAAK,EAAW,EAAE,CAC1B,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC;KACxE;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,8BAA8B;QACrC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,KAAK,EAAW,EAAE,CAC1B,KAAK,CAAC,gBAAgB,GAAG,uBAAuB,CAAC,WAAW;KAC/D;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,KAAK,EAAE,gCAAgC;QACvC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,KAAK,EAAW,EAAE,CAC1B,KAAK,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,YAAY;KACjE;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,KAAK,EAAW,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,uBAAuB,CAAC,IAAI;KAC5E;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,0BAA0B;QACjC,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,KAAK,EAAW,EAAE,CAC1B,KAAK,CAAC,YAAY,GAAG,uBAAuB,CAAC,OAAO;KACvD;CACF,CAAC"}

package/dist/service/wafv2/managed/group/sim-waf-known-bad-inputs.d.ts

@@ -0,0 +1,14 @@
+import type { SimWafManagedRuleGroupDefinition } from "../sim-waf-managed-rule.type.js";
+/**
+ * The AWS known bad inputs rule set, in the order AWS evaluates its rules.
+ *
+ * This is the group that goes on beside the core rule set. Every rule blocks
+ * by default.
+ *
+ * `Host_localhost_HEADER` reads the AWS-facing hostname rather than the Host
+ * header as it arrived. A simulated endpoint is served under
+ * `*.sim-aws.localhost`, so a rule reading the header itself would block every
+ * request to every simulated endpoint and nothing else would ever be tested.
+ */
+export declare const simWafKnownBadInputsRuleSet: SimWafManagedRuleGroupDefinition;
+//# sourceMappingURL=sim-waf-known-bad-inputs.d.ts.map

package/dist/service/wafv2/managed/group/sim-waf-known-bad-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-known-bad-inputs.d.ts","sourceRoot":"","sources":["../../../../../src/service/wafv2/managed/group/sim-waf-known-bad-inputs.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAExF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,EAAE,gCAyEzC,CAAC"}