@patchstack/connect 0.3.30 → 0.3.31

package/dist/protect.edge.js

@@ -990,6 +990,30 @@ function expandIPv6(host) {
   }
   return out;
 }
+var JWT_CANDIDATE = /(?<![A-Za-z0-9_-])(?<![A-Za-z0-9_-]\.)eyJ[A-Za-z0-9_-]{2,2048}\.[A-Za-z0-9_-]{2,8192}\.[A-Za-z0-9_-]{0,2048}(?![A-Za-z0-9_-])(?!\.[A-Za-z0-9_-])/g;
+function base64UrlToBase64(segment) {
+  const padded = segment.length % 4 === 0 ? segment : segment + "=".repeat(4 - segment.length % 4);
+  return padded.replace(/-/g, "+").replace(/_/g, "/");
+}
+function jwtClaimSpans(text, claim, value) {
+  const found = /* @__PURE__ */ new Set();
+  if (typeof text !== "string" || typeof claim !== "string" || claim === "") return [];
+  const wanted = String(value);
+  for (const [token] of text.matchAll(JWT_CANDIDATE)) {
+    const parts = token.split(".");
+    let payload;
+    try {
+      payload = JSON.parse(base64DecodeUtf8(base64UrlToBase64(parts[1])));
+    } catch {
+      continue;
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) continue;
+    if (!Object.prototype.hasOwnProperty.call(payload, claim)) continue;
+    const actual = payload[claim];
+    if (typeof actual === "string" && actual === wanted) found.add(token);
+  }
+  return [...found];
+}
 var warnedScopes = /* @__PURE__ */ new Set();
 function warnUnrecognisedScope(when) {
   const key = Object.keys(when).sort().join(",");
@@ -1018,16 +1042,30 @@ function ruleAppliesTo(when, resolver) {
     return true;
   }
 }
+function foldPathForScope(value) {
+  const out = String(value).toLowerCase();
+  return out.endsWith("/") ? out.slice(0, -1) : out;
+}
+var REGEX_SYNTAX = /[\\^$*+?()[\]{}|]/;
+var REGEX_FORM = /^\/(.+?)\/([gimsuy]*)$/s;
+function isRegexForm(pattern) {
+  const parts = REGEX_FORM.exec(pattern);
+  return parts !== null && REGEX_SYNTAX.test(parts[1]);
+}
 function pathMatches(pattern, path) {
-  if (pattern.length > 2 && pattern.startsWith("/") && pattern.endsWith("/")) {
+  if (isRegexForm(pattern)) {
     const re = safeRegExp(pattern);
     return re ? re.test(path) : false;
   }
-  if (pattern.includes("*")) {
-    const re = safeRegExp("/^" + pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^?]*") + "$/");
-    return re ? re.test(path) : false;
+  const target = foldPathForScope(path);
+  const folded = foldPathForScope(pattern);
+  if (folded.includes("*")) {
+    const trailing = folded.endsWith("/*");
+    const body = (trailing ? folded.slice(0, -2) : folded).replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^?]*");
+    const re = safeRegExp("/^" + body + (trailing ? "(?:/[^?]*)?" : "") + "$/");
+    return re ? re.test(target) : false;
   }
-  return path === pattern;
+  return target === folded;
 }
 function normalizeDefaultPort(host) {
   return String(host).toLowerCase().replace(/:(?:80|443)$/, "");
@@ -1180,6 +1218,8 @@ function matchValue(type, value, matchVal, matchObj) {
       const stripped = strValue.replace(/[ _\-,]/g, "");
       return ctypeResult(strValue, /^[\w$€-￿]*$/.test(stripped), matchVal);
     }
+    case "jwt_claim_equals":
+      return jwtClaimSpans(strValue, matchObj?.claim, matchVal).length > 0;
     case "array_key_value":
       return arrayKeyValue(value, matchObj);
     // file_contains (uploaded-file content scanning) is NOT WordPress-specific, but is
@@ -2008,13 +2048,43 @@ var DEFAULT_RESPONSE_RULES = [
     rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:sk_live_[0-9A-Za-z]{16,}|rk_live_[0-9A-Za-z]{16,}|gh[opsu]_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z_]{60,}|glpat-[0-9A-Za-z_-]{20,}|xox[baprs]-[0-9A-Za-z-]{10,}|sk-ant-[0-9A-Za-z_-]{20,}|ya29\\.[0-9A-Za-z_-]{20,}|npm_[0-9A-Za-z]{36})(?![0-9A-Za-z])/" } }]
   },
   {
-    id: "resp-jwt",
-    title: "JWT in response body",
+    id: "resp-supabase-secret-key",
+    title: "Supabase secret key in response body",
     phase: "response",
     category: "secret-exposure",
     action: "redact",
+    // Supabase's opaque key format, which is not a JWT and so is not covered by the JWT rule below.
+    // `sb_secret_` is the elevated one — documented as full access, bypassing Row Level Security,
+    // backend-only — while `sb_publishable_` is meant for public clients and must pass untouched.
+    // Both key systems are live at once: new keys sit alongside the legacy `anon` / `service_role`
+    // JWTs rather than replacing them, so this rule and the JWT rule cover different halves.
+    //
+    // The documented grammar is the prefix, 22 base64url characters, `_`, then an 8-character
+    // base64url checksum. Matching it exactly is what keeps the mask on the key and off the response
+    // around it: a variable-length suffix would either run past the key into adjacent syntax or stop
+    // short and leave the tail of a real key visible. The trailing guard rejects a longer run of key
+    // characters, which is not this format.
+    prefilter: ["sb_secret_"],
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\bsb_secret_[A-Za-z0-9_-]{22}_[A-Za-z0-9_-]{8}(?![A-Za-z0-9_-])/" } }]
+  },
+  {
+    id: "resp-supabase-service-role-key",
+    title: "Supabase service_role key in response body",
+    phase: "response",
+    category: "secret-exposure",
+    action: "redact",
+    // Scoped to the one role that must never leave: `service_role` bypasses Row Level Security
+    // entirely. A JWT in a response body is not inherently a leak — the Supabase `anon` key is public
+    // by design and a login response carries the user's own access token — so this decides on the
+    // decoded payload rather than on the shape of the token.
+    //
+    // `jwt_claim_equals` also yields the matching token spans, which is what lets `redact` mask those
+    // tokens and serve the rest of the response.
+    //
+    // A broad any-JWT rule is a reasonable thing to want; it belongs in the managed hardening bundle as
+    // an opt-in, observe-only rule rather than an on-by-default mask.
     prefilter: ["eyJ"],
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\beyJ[A-Za-z0-9_-]{8,}\\.eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\b/" } }]
+    rule_v2: [{ parameter: "response.body", match: { type: "jwt_claim_equals", claim: "role", value: "service_role" } }]
   },
   {
     id: "resp-db-connection-string",
@@ -2297,6 +2367,7 @@ var MATCH_TYPES = Object.freeze([
   "internal_host",
   "is_numeric",
   "isset",
+  "jwt_claim_equals",
   "less_than",
   "more_than",
   "not_contains",
@@ -2322,6 +2393,8 @@ var OPERANDLESS_MATCH_TYPES = Object.freeze([
   "cors_reflected"
 ]);
 var OPERAND_SHAPES = Object.freeze([
+  "positive-number",
+  "boolean",
   "non-empty-string",
   "regex-literal",
   "string-or-string-list",
@@ -2346,6 +2419,14 @@ var MATCH_OPERANDS = Object.freeze({
     required: Object.freeze(["key", "match"]),
     shapes: Object.freeze({ key: "string-or-string-list", match: "object" })
   }),
+  // Decides on a JWT's DECODED payload rather than its shape, and yields the matching token spans so
+  // `redact` masks only those tokens. `claim` names an own, top-level claim; `value` is compared with
+  // exact string equality. Anything not positively identified — undecodable, not JSON, not an object,
+  // oversized, claim missing, claim not a string, or a different value — is a no-match.
+  jwt_claim_equals: Object.freeze({
+    required: Object.freeze(["claim", "value"]),
+    shapes: Object.freeze({ claim: "non-empty-string", value: "non-empty-string" })
+  }),
   regex: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "regex-literal" }) }),
   contains: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-string" }) }),
   stripos: Object.freeze({ required: Object.freeze(["value"]), shapes: Object.freeze({ value: "non-empty-string" }) }),
@@ -2371,6 +2452,10 @@ function operandShapeProblem(shape, value) {
   const isScalar = (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean";
   const isHeaderName = (v) => typeof v === "string" && HEADER_NAME.test(v);
   switch (shape) {
+    case "positive-number":
+      return typeof value === "number" && Number.isFinite(value) && value > 0 ? null : "must be a finite positive number";
+    case "boolean":
+      return typeof value === "boolean" ? null : "must be true or false";
     case "non-empty-string":
       return isFilledString(value) ? null : "must be a non-empty string";
     case "regex-literal":
@@ -2453,6 +2538,13 @@ var ACTIONS = Object.freeze([
   "remove-header",
   "harden-cookie"
 ]);
+var RULE_PROPERTY_SHAPES = Object.freeze({
+  max_bytes: "positive-number",
+  bypass_limit: "boolean",
+  ensure: "boolean",
+  prefilter: "non-empty-string-list"
+});
+var ENFORCEMENT_VALUES = Object.freeze(["dry-run"]);
 var WHEN_KEYS = Object.freeze(["path", "method"]);
 var RULE_PROPERTIES = Object.freeze([
   "id",
@@ -2628,6 +2720,24 @@ function whenProblem(when) {
 function isNonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "";
 }
+function nullPropertyProblem(rule) {
+  if (!rule || typeof rule !== "object") return null;
+  for (const property of RULE_PROPERTIES) {
+    if (property in rule && rule[property] === null) {
+      return `"${property}" is present but null; omit it to mean the default, since a null is a value that was meant to be something and is not`;
+    }
+  }
+  return null;
+}
+function rulePropertyProblem(rule) {
+  if (!rule || typeof rule !== "object") return null;
+  for (const [property, shape] of Object.entries(RULE_PROPERTY_SHAPES)) {
+    if (rule[property] === void 0 || rule[property] === null) continue;
+    const problem = operandShapeProblem(shape, rule[property]);
+    if (problem) return `"${property}" ${problem}`;
+  }
+  return null;
+}
 function actionProblem(action, rule) {
   if (action === void 0 || action === null) return null;
   if (!ACTIONS.includes(action)) return `unknown action "${action}"`;
@@ -2692,13 +2802,15 @@ function idOf(rule) {
 }
 function ruleProblem(rule) {
   if (!rule || typeof rule !== "object") return "not an object";
+  const nullReason = nullPropertyProblem(rule);
+  if (nullReason) return nullReason;
   if (rule.phase !== void 0 && !PHASES2.has(rule.phase)) return `unknown phase "${rule.phase}"`;
   const actionReason = actionProblem(rule.action, rule);
   if (actionReason) return actionReason;
   const scopeReason = whenProblem(rule.when);
   if (scopeReason) return scopeReason;
-  const capOverride = rule.max_bytes;
-  if (capOverride !== void 0 && !(Number(capOverride) > 0)) return "max_bytes must be a positive number";
+  const propertyReason = rulePropertyProblem(rule);
+  if (propertyReason) return propertyReason;
   return conditionsProblem(rule.rule_v2);
 }
 function conditionsProblem(conditions, depth = 0) {
@@ -3989,6 +4101,8 @@ function extractRedactors(rule) {
         }
       } else if ((m.type === "contains" || m.type === "stripos") && m.value != null) {
         out.push({ literal: String(m.value) });
+      } else if (m.type === "jwt_claim_equals" && typeof m.claim === "string") {
+        out.push({ jwtClaim: { claim: m.claim, value: String(m.value ?? "") } });
       } else if (m.type === "array_key_value" && m.match && isBodyParam(c.parameter)) {
         const keys = Array.isArray(m.key) ? m.key : [m.key];
         for (const key of keys) {
@@ -4007,7 +4121,11 @@ function applyRedactors(body, redactors, mask, transform) {
   let out = body;
   for (const r of redactors) {
     if (r.re) out = out.replace(r.re, transform ? (m) => transform(m) : mask);
-    else if (r.literal) {
+    else if (r.jwtClaim) {
+      for (const token of jwtClaimSpans(out, r.jwtClaim.claim, r.jwtClaim.value)) {
+        out = out.split(token).join(transform ? transform(token) : mask);
+      }
+    } else if (r.literal) {
       const re = new RegExp(r.literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi");
       out = out.replace(re, (m) => transform ? transform(m) : mask);
     }