@patchstack/connect 0.3.33 → 0.4.0

package/dist/protect.cjs

@@ -3788,18 +3788,10 @@ function conditionsProblem(conditions, depth = 0) {
   return null;
 }
 
-// src/protect/capture-plan.js
-var NEVER_CAPTURABLE = /* @__PURE__ */ new Set(["response"]);
-var CAPTURE_LIMITS = Object.freeze({
-  /** Named and prefix values in one event, together. Raw has its own allowance. */
-  capturedValues: 10,
-  /** Characters of any single captured value. */
-  valueChars: 512,
-  /** Resolved values one prefix permission may contribute. */
-  prefixValues: 5
-});
-function parametersOf(rule) {
+// src/protect/rule-parameters.js
+function readRuleParameters(rule) {
   const out = /* @__PURE__ */ new Set();
+  let complete = true;
   const add = (parameter) => {
     if (typeof parameter === "string" && parameter !== "rules") out.add(parameter);
   };
@@ -3811,7 +3803,11 @@ function parametersOf(rule) {
     add(parameter);
   };
   const walk2 = (conditions, depth) => {
-    if (!Array.isArray(conditions) || depth > 20) return;
+    if (!Array.isArray(conditions)) return;
+    if (depth > LIMITS.maxNestingDepth) {
+      complete = false;
+      return;
+    }
     for (const condition of conditions) {
       if (!condition || typeof condition !== "object") continue;
       collect(condition.parameter);
@@ -3819,8 +3815,22 @@ function parametersOf(rule) {
     }
   };
   walk2(rule?.rule_v2, 0);
-  return [...out];
+  return { parameters: [...out], complete };
 }
+function ruleParameters(rule) {
+  return readRuleParameters(rule).parameters;
+}
+
+// src/protect/capture-plan.js
+var NEVER_CAPTURABLE = /* @__PURE__ */ new Set(["response"]);
+var CAPTURE_LIMITS = Object.freeze({
+  /** Named and prefix values in one event, together. Raw has its own allowance. */
+  capturedValues: 10,
+  /** Characters of any single captured value. */
+  valueChars: 512,
+  /** Resolved values one prefix permission may contribute. */
+  prefixValues: 5
+});
 function rawOptIn(rule) {
   if (!rule || typeof rule !== "object" || !Object.hasOwn(rule, "capture")) return null;
   const capture = rule.capture;
@@ -3838,7 +3848,7 @@ function derivePlan(rule) {
   const named = /* @__PURE__ */ new Set();
   const prefixes = /* @__PURE__ */ new Set();
   if (enforceableRuleProblem(rule) !== null) return NOTHING;
-  const parameters = parametersOf(rule).filter((parameter) => parameterProblem(parameter) === null);
+  const parameters = ruleParameters(rule).filter((parameter) => parameterProblem(parameter) === null);
   for (const parameter of parameters) {
     const dot = parameter.indexOf(".");
     if (dot === -1) continue;
@@ -4550,9 +4560,23 @@ var DEFAULT_RESPONSE_RULES = [
     title: "Private key in response body",
     phase: "response",
     category: "secret-exposure",
-    action: "redact",
+    // Withheld: the key material sits after the marker and this pattern does not delimit it.
+    action: "block",
     prefilter: ["PRIVATE KEY"],
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/" } }]
+    // Matches a PEM BEGIN line whose label contains `PRIVATE KEY`, with up to 32 further label
+    // characters — uppercase letters, digits, spaces and hyphens — on either side of it. That covers
+    // the enumerated types (`RSA`, `EC`, `OPENSSH`, `DSA`, `ENCRYPTED`), a label carrying words after
+    // `PRIVATE KEY` (`PGP PRIVATE KEY BLOCK`), a hyphenated or otherwise unlisted type, and a bare
+    // `-----BEGIN PRIVATE KEY-----`. `PUBLIC KEY` and `CERTIFICATE` do not match, and neither does
+    // prose that mentions a private key without a BEGIN line.
+    //
+    // No footer required: a truncated response or an absent END marker does not make the material
+    // above it less of a key. Two bounded character classes rather than a repeated group — a
+    // quantifier inside a quantified group is the shape the engine refuses as a backtracking risk, and
+    // a refused pattern is a rule that never fires.
+    //
+    // A lowercase label, or one longer than 32 characters on either side, is not matched.
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/-----BEGIN [A-Z0-9 -]{0,32}PRIVATE KEY[A-Z0-9 -]{0,32}-----/" } }]
   },
   {
     id: "resp-aws-access-key",
@@ -4629,26 +4653,65 @@ var DEFAULT_RESPONSE_RULES = [
     title: "Database connection string with credentials in response body",
     phase: "response",
     category: "secret-exposure",
-    action: "redact",
+    // Withheld. The credentials are only the first half of the disclosure — the host, port, database
+    // name and query name the system they open — and a URI's own grammar admits commas, parentheses
+    // and semicolons, so no end-of-URI character class delimits it in free text without either
+    // stopping inside a real URI or consuming the punctuation around it. The pattern therefore
+    // identifies the URI and the response is withheld rather than partly rewritten.
+    action: "block",
     prefilter: ["mongodb", "postgres", "mysql", "redis", "amqp"],
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:mongodb(?:\\+srv)?|postgres(?:ql)?|mysql|redis|amqps?):\\/\\/[^\\s:@\\/]+:[^\\s:@\\/]+@/i" } }]
+    // A scheme this application connects with, a user, a password and an `@`. Credentials are
+    // required, so a URL without them is not matched.
+    //
+    // The username is the userinfo grammar without `:`; the password is the same grammar with it. Every
+    // other character either class admits may appear raw in a real credential, so a narrower one turns
+    // a live credential into a rule that says nothing — `postgres://user:p;ss@host` is an ordinary DSN.
+    //
+    // The first raw colon separates username from password. Excluding it from the username makes the
+    // separator unambiguous and keeps matching linear; the password continues to admit raw colons. A
+    // username that contains a colon carries it as `%3A`.
+    //
+    // Both classes admitting `:` would leave every colon available as the separator, so a candidate
+    // run with no `@` is re-split at every position. The screening cap does not bound that: a rule may
+    // raise it with `max_bytes` or remove it with `bypass_limit`.
+    //
+    // What terminates a candidate is everything the grammar excludes: whitespace, `/`, `?`, `#`, `@`,
+    // quotes, backslashes, angle and square brackets and braces. That is what keeps the run inside one
+    // value. Expressed as "anything but `:`, `@`, `/` and whitespace" it crosses structure instead: in
+    // `{"docs":"postgres://db.internal","contact":"user@example.com"}` it consumes the closing quote,
+    // the comma and the next key, reaching the `:` and `@` of an unrelated property and withholding a
+    // response that discloses nothing.
+    //
+    // The consequence is deliberate: a run of punctuation-joined text that parses as a credential URI
+    // is treated as one. `postgres://db.internal;contact:admin@example.com` has username
+    // `db.internal;contact`, password `admin` and host `example.com` — indistinguishable from a leak,
+    // so it is withheld. Ordinary prose separates with whitespace, which terminates the candidate.
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\b(?:mongodb(?:\\+srv)?|postgres(?:ql)?|mysql|redis|amqps?):\\/\\/[A-Za-z0-9._~%!$&'()*+,;=-]+:[A-Za-z0-9._~%!$&'()*+,;=:-]+@/i" } }]
   },
   {
     id: "resp-stack-trace",
     title: "Node stack trace leaking in response body",
     phase: "response",
     category: "info-exposure",
-    action: "redact",
+    // Withheld. A frame is recognised by its shape and the trace has no end the pattern can rely on,
+    // so masking the frames it happens to match leaves the message, the remaining frames and every
+    // path and line number in them.
+    action: "block",
     // No prefilter: a Node stack frame has no single distinctive literal (` at ` is too common to
     // gate on). The pattern is linearly bounded per line, so it runs on every screened body.
-    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/\\n\\s+at\\s+.+\\(.+:\\d+:\\d+\\)/" } }]
+    //
+    // Accepts a real newline and a JSON-escaped one. Most traces reach a client inside a JSON error
+    // body, where the newline is the two characters `\` and `n`.
+    rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/(?:\\n|\\\\n)\\s*at\\s+.+\\(.+:\\d+:\\d+\\)/" } }]
   },
   {
     id: "resp-sql-error",
     title: "SQL / ORM error disclosure in response body",
     phase: "response",
     category: "info-exposure",
-    action: "redact",
+    // Withheld. The signature is the start of the disclosure: masking `SQLSTATE[23000]` and serving
+    // the constraint name, the column and the offending value discloses the schema anyway.
+    action: "block",
     prefilter: ["SQLSTATE", "Sequelize", "ER_", "ORA-", "PG::", "SQLITE_ERROR", "SQL syntax"],
     rule_v2: [{ parameter: "response.body", match: { type: "regex", value: "/(SQLSTATE\\[[0-9A-Z]+\\]|SequelizeDatabaseError|ER_[A-Z_]+|ORA-\\d{5}|PG::[A-Za-z]+Error|SQLITE_ERROR|You have an error in your SQL syntax)/i" } }]
   },
@@ -4657,7 +4720,9 @@ var DEFAULT_RESPONSE_RULES = [
     title: "Backend exception / stack trace disclosure in response body",
     phase: "response",
     category: "info-exposure",
-    action: "redact",
+    // Withheld, for the same reason as the trace above: the marker opens the dump and the file names,
+    // line numbers and frames after it are the disclosure.
+    action: "block",
     // Multi-language exception/traceback signatures a normal API response never carries:
     // Python traceback, Java "Exception in thread", .NET System.*Exception, JVM stack frames,
     // Go goroutine dumps. (Node `at fn (file:line:col)` frames are handled by resp-stack-trace.)
@@ -5186,21 +5251,6 @@ function unattended(timer) {
   if (timer && typeof timer.unref === "function") timer.unref();
   return timer;
 }
-function ruleParameters(rule) {
-  const out = /* @__PURE__ */ new Set();
-  const walk2 = (conditions) => {
-    if (!Array.isArray(conditions)) return;
-    for (const condition of conditions) {
-      if (!condition || typeof condition !== "object") continue;
-      if (typeof condition.parameter === "string" && condition.parameter !== "rules") {
-        out.add(condition.parameter);
-      }
-      if (Array.isArray(condition.rules)) walk2(condition.rules);
-    }
-  };
-  walk2(rule?.rule_v2);
-  return [...out];
-}
 function revisionOf(rule) {
   const revision = rule?.source_revision;
   if (typeof revision === "string" && revision !== "") return revision;
@@ -5501,7 +5551,7 @@ function createDetectionReporter(opts) {
       const capture = boundCapture(detection.capture);
       const rawRoute = routeOf(detection.path);
       const route = typeof rawRoute === "string" ? capText(rawRoute, MAX_ROUTE_CHARS) : { value: rawRoute, truncated: false };
-      const allParameters = ruleParameters(detection.rule);
+      const { parameters: allParameters, complete: sawEveryParameter } = readRuleParameters(detection.rule);
       const parameters = allParameters.slice(0, MAX_PARAMETERS).map((name) => capText(name, MAX_PARAMETER_CHARS));
       const truncated = [];
       if (route.truncated) truncated.push("route");
@@ -5510,7 +5560,7 @@ function createDetectionReporter(opts) {
       if (query.total > queryKeys.length || queryKeys.some((entry) => entry.truncated)) {
         truncated.push("query_keys");
       }
-      if (allParameters.length > MAX_PARAMETERS || parameters.some((entry) => entry.truncated)) {
+      if (!sawEveryParameter || allParameters.length > MAX_PARAMETERS || parameters.some((entry) => entry.truncated)) {
         truncated.push("parameters");
       }
       const id = capText(String(ruleId), MAX_IDENTIFIER_CHARS);
@@ -5531,7 +5581,10 @@ function createDetectionReporter(opts) {
         ...truncated.length > 0 ? { truncated } : {},
         // Only when parameters were actually left out. Reporting a total because some OTHER field was
         // shortened states that parameters were omitted when none were.
-        ...truncated.includes("parameters") ? { parameters_total: allParameters.length } : {},
+        // Only when the walk saw the whole rule. Shortened by the cap, this is the true total; cut short
+        // by the nesting bound, it is the count of what was seen, and sending that as the total states a
+        // size nobody established. The mark travels either way, so a short list is always marked as one.
+        ...truncated.includes("parameters") && sawEveryParameter ? { parameters_total: allParameters.length } : {},
         method: method === null ? null : method.value,
         // The rest of the URL, as names only. `route` is the path; together they say what was requested
         // without saying what was in it.
@@ -5711,6 +5764,19 @@ function reportingState(input) {
   return { state: "on", reports: true };
 }
 
+// src/protect/response-hardening.js
+var BODY_INDEPENDENT = Object.freeze(["response.status", "response.headers"]);
+var BODY_INDEPENDENT_PREFIX = "response.header.";
+var HEADER_ACTIONS = Object.freeze(["set-header", "remove-header", "harden-cookie"]);
+function hardensWithoutBody(rule) {
+  if (!rule || !HEADER_ACTIONS.includes(rule.action)) return false;
+  const { parameters, complete } = readRuleParameters(rule);
+  if (!complete) return false;
+  return parameters.every(
+    (parameter) => BODY_INDEPENDENT.includes(parameter) || parameter.startsWith(BODY_INDEPENDENT_PREFIX)
+  );
+}
+
 // src/protect/firewall-log.js
 var DEFAULT_API_BASE = "https://api.patchstack.com";
 var STOP_BUDGET_MS2 = 5e3;
@@ -6094,7 +6160,7 @@ async function createProtection(options = {}) {
   let screenCap;
   let engine;
   let responseRuleSet;
-  let egressEngine;
+  let egressRuleSet;
   const applyBundle = (delivered) => {
     const incoming = delivered.firewall ?? [];
     requestRules = byPhase(incoming, "request");
@@ -6121,7 +6187,10 @@ async function createProtection(options = {}) {
       // the common case — cutting CPU/latency and shrinking the regex/ReDoS surface. Case-insensitive.
       prefilter: Array.isArray(rule.prefilter) && rule.prefilter.length ? rule.prefilter.map((s) => String(s).toLowerCase()) : null
     }));
-    egressEngine = new RuleEngine({ firewall: egressRules, onError });
+    egressRuleSet = egressRules.map((rule) => ({
+      rule,
+      engine: new RuleEngine({ firewall: [rule], onError })
+    }));
   };
   applyBundle(bundle);
   const skipCounts = /* @__PURE__ */ Object.create(null);
@@ -6169,12 +6238,13 @@ async function createProtection(options = {}) {
     });
     return effectiveMode === "block" ? block() : allow2();
   };
-  const screenText = (text, meta, reqCtx) => {
+  const screenText = (text, meta, reqCtx, only) => {
     let blockRule = null;
     const redactions = [];
     const headerMutations = [];
     let lowerText = null;
     for (const { rule, engine: re, redactors, prefilter, mutatedSpan } of responseRuleSet) {
+      if (only && !only(rule)) continue;
       if (prefilter) {
         if (lowerText === null) lowerText = text.toLowerCase();
         if (!prefilter.some((p) => lowerText.includes(p))) continue;
@@ -6322,7 +6392,8 @@ async function createProtection(options = {}) {
     const read = await readTextResponse(response, screenCap);
     if (read.skip) {
       if (read.skip !== "not-a-response") recordSkip("response", read.skip, { status: response?.status });
-      return response;
+      if (read.skip === "not-a-response") return response;
+      return hardenHeadersOnly(response, reqCtx);
     }
     const text = read.text;
     const r = screenText(text, { status: response.status, headers: headerObject(response.headers) }, reqCtx);
@@ -6330,6 +6401,74 @@ async function createProtection(options = {}) {
     if (r.verdict === "redact") return rebuildResponse(response, r.body, r.headers);
     return response;
   };
+  const headerValueChanged = (was, value) => {
+    const had = was !== void 0 && was !== null;
+    if (value === null || value === void 0) return had;
+    if (!had) return true;
+    if (Array.isArray(value) || Array.isArray(was)) {
+      const a = Array.isArray(was) ? was : [was];
+      const b = Array.isArray(value) ? value : [value];
+      return a.length !== b.length || b.some((item, i) => String(item) !== String(a[i]));
+    }
+    return String(value) !== String(was);
+  };
+  const headersChanged = (before, after) => Object.entries(after).some(([name, value]) => headerValueChanged(before[name], value));
+  const writeHeadHeaderIndex = (args) => {
+    const at = typeof args[1] === "string" ? 2 : 1;
+    const value = args[at];
+    return value !== null && typeof value === "object" ? at : -1;
+  };
+  const writeHeadEntries = (headers) => {
+    if (!Array.isArray(headers)) return Object.entries(headers);
+    if (headers.length && headers.every((entry) => Array.isArray(entry) && entry.length === 2)) {
+      return headers.map(([name, value]) => [String(name), value]);
+    }
+    const entries = [];
+    for (let i = 0; i + 1 < headers.length; i += 2) entries.push([String(headers[i]), headers[i + 1]]);
+    return entries;
+  };
+  const writeHeadHeaderObject = (headers) => {
+    const out = {};
+    for (const [name, value] of writeHeadEntries(headers)) {
+      const key = name.toLowerCase();
+      out[key] = Object.hasOwn(out, key) ? [].concat(out[key], value) : value;
+    }
+    return out;
+  };
+  const rewriteWriteHeadHeaders = (headers, changed) => {
+    const replaced = /* @__PURE__ */ new Set();
+    const entries = [];
+    for (const [name, value] of writeHeadEntries(headers)) {
+      const key = name.toLowerCase();
+      if (!changed.has(key)) {
+        entries.push([name, value]);
+        continue;
+      }
+      if (replaced.has(key)) continue;
+      replaced.add(key);
+      const replacement = changed.get(key);
+      if (replacement === null || replacement === void 0) continue;
+      entries.push([name, replacement]);
+    }
+    if (!Array.isArray(headers)) return Object.fromEntries(entries);
+    const paired = headers.length > 0 && headers.every((entry) => Array.isArray(entry) && entry.length === 2);
+    const expanded = entries.flatMap(
+      ([name, value]) => Array.isArray(value) ? value.map((item) => [name, item]) : [[name, value]]
+    );
+    return paired ? expanded : expanded.flat();
+  };
+  const hardenHeadersOnly = (response, reqCtx) => {
+    try {
+      const meta = { status: response.status, headers: headerObject(response.headers) };
+      const r = screenText("", meta, reqCtx, hardensWithoutBody);
+      if (r.verdict !== "redact" || !r.headers) return response;
+      if (!headersChanged(meta.headers, r.headers)) return response;
+      return rebuildResponse(response, response.body, r.headers);
+    } catch (err) {
+      notify(onError, err, "onError");
+      return response;
+    }
+  };
   const wrapNodeResponse = (res, reqCtx) => {
     const origWrite = res.write.bind(res);
     const origEnd = res.end.bind(res);
@@ -6337,6 +6476,51 @@ async function createProtection(options = {}) {
     let size = 0;
     let overflow = false;
     const MAX = screenCap;
+    let hardened = false;
+    let answeredWithoutBody = false;
+    const hardenBeforeFlush = (effective) => {
+      if (hardened) return null;
+      hardened = true;
+      try {
+        if (res.headersSent || typeof res.setHeader !== "function") return null;
+        const set = typeof res.getHeaders === "function" ? res.getHeaders() : {};
+        const headers = effective && effective.headers ? { ...set, ...effective.headers } : set;
+        const status = effective && effective.status !== void 0 ? effective.status : res.statusCode;
+        const r = screenText("", { status, headers }, reqCtx, hardensWithoutBody);
+        answeredWithoutBody = true;
+        if (r.verdict !== "redact" || !r.headers) return null;
+        const changed = /* @__PURE__ */ new Map();
+        for (const [name, value] of Object.entries(r.headers)) {
+          if (!headerValueChanged(headers[name], value)) continue;
+          changed.set(name.toLowerCase(), value);
+          try {
+            if (value === null || value === void 0) res.removeHeader?.(name);
+            else res.setHeader(name, value);
+          } catch {
+          }
+        }
+        return changed.size ? changed : null;
+      } catch (err) {
+        notify(onError, err, "onError");
+        return null;
+      }
+    };
+    const stillToAnswer = (rule) => !hardensWithoutBody(rule);
+    if (typeof res.writeHead === "function") {
+      const origWriteHead = res.writeHead.bind(res);
+      res.writeHead = function(...args) {
+        const at = writeHeadHeaderIndex(args);
+        const given = at === -1 ? null : args[at];
+        const changed = hardenBeforeFlush({
+          status: typeof args[0] === "number" ? args[0] : void 0,
+          headers: given ? writeHeadHeaderObject(given) : null
+        });
+        if (!changed || !given) return origWriteHead(...args);
+        const rewritten = [...args];
+        rewritten[at] = rewriteWriteHeadHeaders(given, changed);
+        return origWriteHead(...rewritten);
+      };
+    }
     const collect = (chunk, enc) => {
       if (chunk == null) return;
       const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, typeof enc === "string" ? enc : "utf8");
@@ -6352,6 +6536,7 @@ async function createProtection(options = {}) {
       chunks.push(buf);
     };
     res.write = function(chunk, enc, cb) {
+      hardenBeforeFlush();
       if (overflow) return origWrite(chunk, enc, cb);
       collect(chunk, enc);
       if (typeof enc === "function") enc();
@@ -6359,6 +6544,7 @@ async function createProtection(options = {}) {
       return true;
     };
     res.end = function(chunk, enc, cb) {
+      hardenBeforeFlush();
       if (typeof chunk === "function") {
         cb = chunk;
         chunk = void 0;
@@ -6385,7 +6571,12 @@ async function createProtection(options = {}) {
       const text = buffer.toString("utf8");
       let r;
       try {
-        r = screenText(text, { status: res.statusCode, headers: res.getHeaders ? res.getHeaders() : {} }, reqCtx);
+        r = screenText(
+          text,
+          { status: res.statusCode, headers: res.getHeaders ? res.getHeaders() : {} },
+          reqCtx,
+          answeredWithoutBody ? stillToAnswer : void 0
+        );
       } catch (err) {
         notify(onError, err, "onError");
         for (const c of chunks) origWrite(c);
@@ -6435,15 +6626,6 @@ async function createProtection(options = {}) {
   const allow = new Set((options.allowHosts ?? []).map((h) => String(h).toLowerCase()));
   const egressShouldBlock = (url, host, method) => {
     if (host && allow.has(host.toLowerCase())) return false;
-    let result;
-    try {
-      result = egressEngine.evaluate({ _egress: { url, host, method } });
-    } catch (err) {
-      notify(onError, err, "onError");
-      return false;
-    }
-    if (!result.blocked) return false;
-    const egressMode = ruleMode(result.rule);
     let egressPath = null;
     try {
       const u = new URL(url);
@@ -6451,17 +6633,30 @@ async function createProtection(options = {}) {
     } catch {
       egressPath = typeof url === "string" ? url : null;
     }
-    onDetect({
-      phase: "egress",
-      mode: egressMode,
-      category: result.rule?.category,
-      rule: result.rule,
-      message: result.message,
-      method: typeof method === "string" ? method : null,
-      path: egressPath,
-      capture: evidenceFrom(result)
-    });
-    return egressMode === "block";
+    let block = false;
+    for (const { rule, engine: re } of egressRuleSet) {
+      let result;
+      try {
+        result = re.evaluate({ _egress: { url, host, method } });
+      } catch (err) {
+        notify(onError, err, "onError");
+        continue;
+      }
+      if (!result.blocked) continue;
+      const egressMode = ruleMode(rule);
+      onDetect({
+        phase: "egress",
+        mode: egressMode,
+        category: rule?.category,
+        rule,
+        message: result.message,
+        method: typeof method === "string" ? method : null,
+        path: egressPath,
+        capture: evidenceFrom(result)
+      });
+      if (egressMode === "block") block = true;
+    }
+    return block;
   };
   const protection = {
     get mode() {