@promptscript/cli 1.0.0-rc.2 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +19 -0
- package/README.md +109 -175
- package/index.js +1466 -106
- package/package.json +5 -5
package/index.js
CHANGED
|
@@ -494,9 +494,12 @@ function interpolateText(text, ctx) {
|
|
|
494
494
|
});
|
|
495
495
|
}
|
|
496
496
|
function interpolateValue(value, ctx) {
|
|
497
|
-
if (value === null || typeof value === "
|
|
497
|
+
if (value === null || typeof value === "number" || typeof value === "boolean") {
|
|
498
498
|
return value;
|
|
499
499
|
}
|
|
500
|
+
if (typeof value === "string") {
|
|
501
|
+
return interpolateText(value, ctx);
|
|
502
|
+
}
|
|
500
503
|
if (Array.isArray(value)) {
|
|
501
504
|
return value.map((v) => interpolateValue(v, ctx));
|
|
502
505
|
}
|
|
@@ -8891,7 +8894,7 @@ function uniq(array) {
|
|
|
8891
8894
|
}
|
|
8892
8895
|
var uniq_default = uniq;
|
|
8893
8896
|
|
|
8894
|
-
// node_modules/.pnpm/@chevrotain+utils@11.1.
|
|
8897
|
+
// node_modules/.pnpm/@chevrotain+utils@11.1.2/node_modules/@chevrotain/utils/lib/src/print.js
|
|
8895
8898
|
function PRINT_ERROR(msg) {
|
|
8896
8899
|
if (console && console.error) {
|
|
8897
8900
|
console.error(`Error: ${msg}`);
|
|
@@ -8903,7 +8906,7 @@ function PRINT_WARNING(msg) {
|
|
|
8903
8906
|
}
|
|
8904
8907
|
}
|
|
8905
8908
|
|
|
8906
|
-
// node_modules/.pnpm/@chevrotain+utils@11.1.
|
|
8909
|
+
// node_modules/.pnpm/@chevrotain+utils@11.1.2/node_modules/@chevrotain/utils/lib/src/timer.js
|
|
8907
8910
|
function timer(func) {
|
|
8908
8911
|
const start = (/* @__PURE__ */ new Date()).getTime();
|
|
8909
8912
|
const val = func();
|
|
@@ -8912,7 +8915,7 @@ function timer(func) {
|
|
|
8912
8915
|
return { time: total, value: val };
|
|
8913
8916
|
}
|
|
8914
8917
|
|
|
8915
|
-
// node_modules/.pnpm/@chevrotain+utils@11.1.
|
|
8918
|
+
// node_modules/.pnpm/@chevrotain+utils@11.1.2/node_modules/@chevrotain/utils/lib/src/to-fast-properties.js
|
|
8916
8919
|
function toFastProperties(toBecomeFast) {
|
|
8917
8920
|
function FakeConstructor() {
|
|
8918
8921
|
}
|
|
@@ -8928,7 +8931,7 @@ function toFastProperties(toBecomeFast) {
|
|
|
8928
8931
|
(0, eval)(toBecomeFast);
|
|
8929
8932
|
}
|
|
8930
8933
|
|
|
8931
|
-
// node_modules/.pnpm/@chevrotain+gast@11.1.
|
|
8934
|
+
// node_modules/.pnpm/@chevrotain+gast@11.1.2/node_modules/@chevrotain/gast/lib/src/model.js
|
|
8932
8935
|
function tokenLabel(tokType) {
|
|
8933
8936
|
if (hasTokenLabel(tokType)) {
|
|
8934
8937
|
return tokType.LABEL;
|
|
@@ -9134,7 +9137,7 @@ function serializeProduction(node) {
|
|
|
9134
9137
|
}
|
|
9135
9138
|
}
|
|
9136
9139
|
|
|
9137
|
-
// node_modules/.pnpm/@chevrotain+gast@11.1.
|
|
9140
|
+
// node_modules/.pnpm/@chevrotain+gast@11.1.2/node_modules/@chevrotain/gast/lib/src/visitor.js
|
|
9138
9141
|
var GAstVisitor = class {
|
|
9139
9142
|
visit(node) {
|
|
9140
9143
|
const nodeAny = node;
|
|
@@ -9196,7 +9199,7 @@ var GAstVisitor = class {
|
|
|
9196
9199
|
}
|
|
9197
9200
|
};
|
|
9198
9201
|
|
|
9199
|
-
// node_modules/.pnpm/@chevrotain+gast@11.1.
|
|
9202
|
+
// node_modules/.pnpm/@chevrotain+gast@11.1.2/node_modules/@chevrotain/gast/lib/src/helpers.js
|
|
9200
9203
|
function isSequenceProd(prod) {
|
|
9201
9204
|
return prod instanceof Alternative || prod instanceof Option || prod instanceof Repetition || prod instanceof RepetitionMandatory || prod instanceof RepetitionMandatoryWithSeparator || prod instanceof RepetitionWithSeparator || prod instanceof Terminal || prod instanceof Rule;
|
|
9202
9205
|
}
|
|
@@ -9247,7 +9250,7 @@ function getProductionDslName(prod) {
|
|
|
9247
9250
|
}
|
|
9248
9251
|
}
|
|
9249
9252
|
|
|
9250
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
9253
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/rest.js
|
|
9251
9254
|
var RestWalker = class {
|
|
9252
9255
|
walk(prod, prevRest = []) {
|
|
9253
9256
|
forEach_default(prod.definition, (subProd, index) => {
|
|
@@ -9327,7 +9330,7 @@ function restForRepetitionWithSeparator(repSepProd, currRest, prevRest) {
|
|
|
9327
9330
|
return fullRepSepRest;
|
|
9328
9331
|
}
|
|
9329
9332
|
|
|
9330
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
9333
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/first.js
|
|
9331
9334
|
function first(prod) {
|
|
9332
9335
|
if (prod instanceof NonTerminal) {
|
|
9333
9336
|
return first(prod.referencedRule);
|
|
@@ -9367,10 +9370,10 @@ function firstForTerminal(terminal) {
|
|
|
9367
9370
|
return [terminal.terminalType];
|
|
9368
9371
|
}
|
|
9369
9372
|
|
|
9370
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
9373
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/constants.js
|
|
9371
9374
|
var IN = "_~IN~_";
|
|
9372
9375
|
|
|
9373
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
9376
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/follow.js
|
|
9374
9377
|
var ResyncFollowsWalker = class extends RestWalker {
|
|
9375
9378
|
constructor(topProd) {
|
|
9376
9379
|
super();
|
|
@@ -9403,7 +9406,7 @@ function buildBetweenProdsFollowPrefix(inner, occurenceInParent) {
|
|
|
9403
9406
|
return inner.name + occurenceInParent + IN;
|
|
9404
9407
|
}
|
|
9405
9408
|
|
|
9406
|
-
// node_modules/.pnpm/@chevrotain+regexp-to-ast@11.1.
|
|
9409
|
+
// node_modules/.pnpm/@chevrotain+regexp-to-ast@11.1.2/node_modules/@chevrotain/regexp-to-ast/lib/src/utils.js
|
|
9407
9410
|
function cc(char) {
|
|
9408
9411
|
return char.charCodeAt(0);
|
|
9409
9412
|
}
|
|
@@ -9436,7 +9439,7 @@ function isCharacter(obj) {
|
|
|
9436
9439
|
return obj["type"] === "Character";
|
|
9437
9440
|
}
|
|
9438
9441
|
|
|
9439
|
-
// node_modules/.pnpm/@chevrotain+regexp-to-ast@11.1.
|
|
9442
|
+
// node_modules/.pnpm/@chevrotain+regexp-to-ast@11.1.2/node_modules/@chevrotain/regexp-to-ast/lib/src/character-classes.js
|
|
9440
9443
|
var digitsCharCodes = [];
|
|
9441
9444
|
for (let i = cc("0"); i <= cc("9"); i++) {
|
|
9442
9445
|
digitsCharCodes.push(i);
|
|
@@ -9477,7 +9480,7 @@ var whitespaceCodes = [
|
|
|
9477
9480
|
cc("\uFEFF")
|
|
9478
9481
|
];
|
|
9479
9482
|
|
|
9480
|
-
// node_modules/.pnpm/@chevrotain+regexp-to-ast@11.1.
|
|
9483
|
+
// node_modules/.pnpm/@chevrotain+regexp-to-ast@11.1.2/node_modules/@chevrotain/regexp-to-ast/lib/src/regexp-parser.js
|
|
9481
9484
|
var hexDigitPattern = /[0-9a-fA-F]/;
|
|
9482
9485
|
var decimalPattern = /[0-9]/;
|
|
9483
9486
|
var decimalPatternNoZero = /[1-9]/;
|
|
@@ -10180,7 +10183,7 @@ var RegExpParser = class {
|
|
|
10180
10183
|
}
|
|
10181
10184
|
};
|
|
10182
10185
|
|
|
10183
|
-
// node_modules/.pnpm/@chevrotain+regexp-to-ast@11.1.
|
|
10186
|
+
// node_modules/.pnpm/@chevrotain+regexp-to-ast@11.1.2/node_modules/@chevrotain/regexp-to-ast/lib/src/base-regexp-visitor.js
|
|
10184
10187
|
var BaseRegExpVisitor = class {
|
|
10185
10188
|
visitChildren(node) {
|
|
10186
10189
|
for (const key in node) {
|
|
@@ -10290,7 +10293,7 @@ var BaseRegExpVisitor = class {
|
|
|
10290
10293
|
}
|
|
10291
10294
|
};
|
|
10292
10295
|
|
|
10293
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
10296
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/scan/reg_exp_parser.js
|
|
10294
10297
|
var regExpAstCache = {};
|
|
10295
10298
|
var regExpParser = new RegExpParser();
|
|
10296
10299
|
function getRegExpAst(regExp) {
|
|
@@ -10307,7 +10310,7 @@ function clearRegExpParserCache() {
|
|
|
10307
10310
|
regExpAstCache = {};
|
|
10308
10311
|
}
|
|
10309
10312
|
|
|
10310
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
10313
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/scan/reg_exp.js
|
|
10311
10314
|
var complementErrorMessage = "Complement Sets are not supported for first char optimization";
|
|
10312
10315
|
var failedOptimizationPrefixMsg = 'Unable to use "first char" lexer optimizations:\n';
|
|
10313
10316
|
function getOptimizedStartCodesIndices(regExp, ensureOptimizations = false) {
|
|
@@ -10519,14 +10522,12 @@ function canMatchCharCode(charCodes, pattern) {
|
|
|
10519
10522
|
}
|
|
10520
10523
|
}
|
|
10521
10524
|
|
|
10522
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
10525
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/scan/lexer.js
|
|
10523
10526
|
var PATTERN = "PATTERN";
|
|
10524
10527
|
var DEFAULT_MODE = "defaultMode";
|
|
10525
10528
|
var MODES = "modes";
|
|
10526
|
-
var SUPPORT_STICKY = typeof new RegExp("(?:)").sticky === "boolean";
|
|
10527
10529
|
function analyzeTokenTypes(tokenTypes, options) {
|
|
10528
10530
|
options = defaults_default(options, {
|
|
10529
|
-
useSticky: SUPPORT_STICKY,
|
|
10530
10531
|
debug: false,
|
|
10531
10532
|
safeMode: false,
|
|
10532
10533
|
positionTracking: "full",
|
|
@@ -10575,7 +10576,7 @@ function analyzeTokenTypes(tokenTypes, options) {
|
|
|
10575
10576
|
], regExpSource[1])) {
|
|
10576
10577
|
return regExpSource[1];
|
|
10577
10578
|
} else {
|
|
10578
|
-
return
|
|
10579
|
+
return addStickyFlag(currPattern);
|
|
10579
10580
|
}
|
|
10580
10581
|
} else if (isFunction_default(currPattern)) {
|
|
10581
10582
|
hasCustom = true;
|
|
@@ -10589,7 +10590,7 @@ function analyzeTokenTypes(tokenTypes, options) {
|
|
|
10589
10590
|
} else {
|
|
10590
10591
|
const escapedRegExpString = currPattern.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
|
|
10591
10592
|
const wrappedRegExp = new RegExp(escapedRegExpString);
|
|
10592
|
-
return
|
|
10593
|
+
return addStickyFlag(wrappedRegExp);
|
|
10593
10594
|
}
|
|
10594
10595
|
} else {
|
|
10595
10596
|
throw Error("non exhaustive match");
|
|
@@ -10995,10 +10996,6 @@ function noMetaChar(regExp) {
|
|
|
10995
10996
|
function usesLookAheadOrBehind(regExp) {
|
|
10996
10997
|
return /(\(\?=)|(\(\?!)|(\(\?<=)|(\(\?<!)/.test(regExp.source);
|
|
10997
10998
|
}
|
|
10998
|
-
function addStartOfInput(pattern) {
|
|
10999
|
-
const flags = pattern.ignoreCase ? "i" : "";
|
|
11000
|
-
return new RegExp(`^(?:${pattern.source})`, flags);
|
|
11001
|
-
}
|
|
11002
10999
|
function addStickyFlag(pattern) {
|
|
11003
11000
|
const flags = pattern.ignoreCase ? "iy" : "y";
|
|
11004
11001
|
return new RegExp(`${pattern.source}`, flags);
|
|
@@ -11212,7 +11209,7 @@ function initCharCodeToOptimizedIndexMap() {
|
|
|
11212
11209
|
}
|
|
11213
11210
|
}
|
|
11214
11211
|
|
|
11215
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
11212
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/scan/tokens.js
|
|
11216
11213
|
function tokenStructuredMatcher(tokInstance, tokConstructor) {
|
|
11217
11214
|
const instanceType = tokInstance.tokenTypeIdx;
|
|
11218
11215
|
if (instanceType === tokConstructor.tokenTypeIdx) {
|
|
@@ -11311,7 +11308,7 @@ function isTokenType(tokType) {
|
|
|
11311
11308
|
return has_default(tokType, "tokenTypeIdx");
|
|
11312
11309
|
}
|
|
11313
11310
|
|
|
11314
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
11311
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/scan/lexer_errors_public.js
|
|
11315
11312
|
var defaultLexerErrorProvider = {
|
|
11316
11313
|
buildUnableToPopLexerModeMessage(token) {
|
|
11317
11314
|
return `Unable to pop Lexer Mode after encountering Token ->${token.image}<- The Mode Stack is empty`;
|
|
@@ -11321,7 +11318,7 @@ var defaultLexerErrorProvider = {
|
|
|
11321
11318
|
}
|
|
11322
11319
|
};
|
|
11323
11320
|
|
|
11324
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
11321
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/scan/lexer_public.js
|
|
11325
11322
|
var LexerDefinitionErrorType;
|
|
11326
11323
|
(function(LexerDefinitionErrorType2) {
|
|
11327
11324
|
LexerDefinitionErrorType2[LexerDefinitionErrorType2["MISSING_PATTERN"] = 0] = "MISSING_PATTERN";
|
|
@@ -11479,13 +11476,6 @@ var Lexer = class {
|
|
|
11479
11476
|
PRINT_WARNING(warningDescriptor.message);
|
|
11480
11477
|
});
|
|
11481
11478
|
this.TRACE_INIT("Choosing sub-methods implementations", () => {
|
|
11482
|
-
if (SUPPORT_STICKY) {
|
|
11483
|
-
this.chopInput = identity_default;
|
|
11484
|
-
this.match = this.matchWithTest;
|
|
11485
|
-
} else {
|
|
11486
|
-
this.updateLastIndex = noop_default;
|
|
11487
|
-
this.match = this.matchWithExec;
|
|
11488
|
-
}
|
|
11489
11479
|
if (hasOnlySingleMode) {
|
|
11490
11480
|
this.handleModes = noop_default;
|
|
11491
11481
|
}
|
|
@@ -11548,7 +11538,7 @@ var Lexer = class {
|
|
|
11548
11538
|
// this method also used quite a bit of `!` none null assertions because it is too optimized
|
|
11549
11539
|
// for `tsc` to always understand it is "safe"
|
|
11550
11540
|
tokenizeInternal(text, initialMode) {
|
|
11551
|
-
let i, j, k, matchAltImage, longerAlt, matchedImage, payload, altPayload, imageLength, group, tokType, newToken, errLength,
|
|
11541
|
+
let i, j, k, matchAltImage, longerAlt, matchedImage, payload, altPayload, imageLength, group, tokType, newToken, errLength, msg, match;
|
|
11552
11542
|
const orgText = text;
|
|
11553
11543
|
const orgLength = orgText.length;
|
|
11554
11544
|
let offset = 0;
|
|
@@ -11567,19 +11557,7 @@ var Lexer = class {
|
|
|
11567
11557
|
const modeStack = [];
|
|
11568
11558
|
const emptyArray = [];
|
|
11569
11559
|
Object.freeze(emptyArray);
|
|
11570
|
-
let
|
|
11571
|
-
function getPossiblePatternsSlow() {
|
|
11572
|
-
return patternIdxToConfig;
|
|
11573
|
-
}
|
|
11574
|
-
function getPossiblePatternsOptimized(charCode) {
|
|
11575
|
-
const optimizedCharIdx = charCodeToOptimizedIndex(charCode);
|
|
11576
|
-
const possiblePatterns = currCharCodeToPatternIdxToConfig[optimizedCharIdx];
|
|
11577
|
-
if (possiblePatterns === void 0) {
|
|
11578
|
-
return emptyArray;
|
|
11579
|
-
} else {
|
|
11580
|
-
return possiblePatterns;
|
|
11581
|
-
}
|
|
11582
|
-
}
|
|
11560
|
+
let isOptimizedMode = false;
|
|
11583
11561
|
const pop_mode = (popToken) => {
|
|
11584
11562
|
if (modeStack.length === 1 && // if we have both a POP_MODE and a PUSH_MODE this is in-fact a "transition"
|
|
11585
11563
|
// So no error should occur.
|
|
@@ -11600,9 +11578,9 @@ var Lexer = class {
|
|
|
11600
11578
|
currModePatternsLength = patternIdxToConfig.length;
|
|
11601
11579
|
const modeCanBeOptimized = this.canModeBeOptimized[newMode] && this.config.safeMode === false;
|
|
11602
11580
|
if (currCharCodeToPatternIdxToConfig && modeCanBeOptimized) {
|
|
11603
|
-
|
|
11581
|
+
isOptimizedMode = true;
|
|
11604
11582
|
} else {
|
|
11605
|
-
|
|
11583
|
+
isOptimizedMode = false;
|
|
11606
11584
|
}
|
|
11607
11585
|
}
|
|
11608
11586
|
};
|
|
@@ -11614,9 +11592,9 @@ var Lexer = class {
|
|
|
11614
11592
|
currModePatternsLength = patternIdxToConfig.length;
|
|
11615
11593
|
const modeCanBeOptimized = this.canModeBeOptimized[newMode] && this.config.safeMode === false;
|
|
11616
11594
|
if (currCharCodeToPatternIdxToConfig && modeCanBeOptimized) {
|
|
11617
|
-
|
|
11595
|
+
isOptimizedMode = true;
|
|
11618
11596
|
} else {
|
|
11619
|
-
|
|
11597
|
+
isOptimizedMode = false;
|
|
11620
11598
|
}
|
|
11621
11599
|
}
|
|
11622
11600
|
push_mode.call(this, initialMode);
|
|
@@ -11624,8 +11602,16 @@ var Lexer = class {
|
|
|
11624
11602
|
const recoveryEnabled = this.config.recoveryEnabled;
|
|
11625
11603
|
while (offset < orgLength) {
|
|
11626
11604
|
matchedImage = null;
|
|
11605
|
+
imageLength = -1;
|
|
11627
11606
|
const nextCharCode = orgText.charCodeAt(offset);
|
|
11628
|
-
|
|
11607
|
+
let chosenPatternIdxToConfig;
|
|
11608
|
+
if (isOptimizedMode) {
|
|
11609
|
+
const optimizedCharIdx = charCodeToOptimizedIndex(nextCharCode);
|
|
11610
|
+
const possiblePatterns = currCharCodeToPatternIdxToConfig[optimizedCharIdx];
|
|
11611
|
+
chosenPatternIdxToConfig = possiblePatterns !== void 0 ? possiblePatterns : emptyArray;
|
|
11612
|
+
} else {
|
|
11613
|
+
chosenPatternIdxToConfig = patternIdxToConfig;
|
|
11614
|
+
}
|
|
11629
11615
|
const chosenPatternsLength = chosenPatternIdxToConfig.length;
|
|
11630
11616
|
for (i = 0; i < chosenPatternsLength; i++) {
|
|
11631
11617
|
currConfig = chosenPatternIdxToConfig[i];
|
|
@@ -11634,12 +11620,14 @@ var Lexer = class {
|
|
|
11634
11620
|
const singleCharCode = currConfig.short;
|
|
11635
11621
|
if (singleCharCode !== false) {
|
|
11636
11622
|
if (nextCharCode === singleCharCode) {
|
|
11623
|
+
imageLength = 1;
|
|
11637
11624
|
matchedImage = currPattern;
|
|
11638
11625
|
}
|
|
11639
11626
|
} else if (currConfig.isCustom === true) {
|
|
11640
11627
|
match = currPattern.exec(orgText, offset, matchedTokens, groups);
|
|
11641
11628
|
if (match !== null) {
|
|
11642
11629
|
matchedImage = match[0];
|
|
11630
|
+
imageLength = matchedImage.length;
|
|
11643
11631
|
if (match.payload !== void 0) {
|
|
11644
11632
|
payload = match.payload;
|
|
11645
11633
|
}
|
|
@@ -11647,12 +11635,13 @@ var Lexer = class {
|
|
|
11647
11635
|
matchedImage = null;
|
|
11648
11636
|
}
|
|
11649
11637
|
} else {
|
|
11650
|
-
|
|
11651
|
-
|
|
11638
|
+
currPattern.lastIndex = offset;
|
|
11639
|
+
imageLength = this.matchLength(currPattern, text, offset);
|
|
11652
11640
|
}
|
|
11653
|
-
if (
|
|
11641
|
+
if (imageLength !== -1) {
|
|
11654
11642
|
longerAlt = currConfig.longerAlt;
|
|
11655
11643
|
if (longerAlt !== void 0) {
|
|
11644
|
+
matchedImage = text.substring(offset, offset + imageLength);
|
|
11656
11645
|
const longerAltLength = longerAlt.length;
|
|
11657
11646
|
for (k = 0; k < longerAltLength; k++) {
|
|
11658
11647
|
const longerAltConfig = patternIdxToConfig[longerAlt[k]];
|
|
@@ -11669,11 +11658,12 @@ var Lexer = class {
|
|
|
11669
11658
|
matchAltImage = null;
|
|
11670
11659
|
}
|
|
11671
11660
|
} else {
|
|
11672
|
-
|
|
11661
|
+
longerAltPattern.lastIndex = offset;
|
|
11673
11662
|
matchAltImage = this.match(longerAltPattern, text, offset);
|
|
11674
11663
|
}
|
|
11675
11664
|
if (matchAltImage && matchAltImage.length > matchedImage.length) {
|
|
11676
11665
|
matchedImage = matchAltImage;
|
|
11666
|
+
imageLength = matchAltImage.length;
|
|
11677
11667
|
payload = altPayload;
|
|
11678
11668
|
currConfig = longerAltConfig;
|
|
11679
11669
|
break;
|
|
@@ -11683,10 +11673,10 @@ var Lexer = class {
|
|
|
11683
11673
|
break;
|
|
11684
11674
|
}
|
|
11685
11675
|
}
|
|
11686
|
-
if (
|
|
11687
|
-
imageLength = matchedImage.length;
|
|
11676
|
+
if (imageLength !== -1) {
|
|
11688
11677
|
group = currConfig.group;
|
|
11689
11678
|
if (group !== void 0) {
|
|
11679
|
+
matchedImage = matchedImage !== null ? matchedImage : text.substring(offset, offset + imageLength);
|
|
11690
11680
|
tokType = currConfig.tokenTypeIdx;
|
|
11691
11681
|
newToken = this.createTokenInstance(matchedImage, offset, tokType, currConfig.tokenType, line, column, imageLength);
|
|
11692
11682
|
this.handlePayload(newToken, payload);
|
|
@@ -11696,15 +11686,13 @@ var Lexer = class {
|
|
|
11696
11686
|
groups[group].push(newToken);
|
|
11697
11687
|
}
|
|
11698
11688
|
}
|
|
11699
|
-
text = this.chopInput(text, imageLength);
|
|
11700
|
-
offset = offset + imageLength;
|
|
11701
|
-
column = this.computeNewColumn(column, imageLength);
|
|
11702
11689
|
if (trackLines === true && currConfig.canLineTerminator === true) {
|
|
11703
11690
|
let numOfLTsInMatch = 0;
|
|
11704
11691
|
let foundTerminator;
|
|
11705
11692
|
let lastLTEndOffset;
|
|
11706
11693
|
lineTerminatorPattern.lastIndex = 0;
|
|
11707
11694
|
do {
|
|
11695
|
+
matchedImage = matchedImage !== null ? matchedImage : text.substring(offset, offset + imageLength);
|
|
11708
11696
|
foundTerminator = lineTerminatorPattern.test(matchedImage);
|
|
11709
11697
|
if (foundTerminator === true) {
|
|
11710
11698
|
lastLTEndOffset = lineTerminatorPattern.lastIndex - 1;
|
|
@@ -11715,8 +11703,13 @@ var Lexer = class {
|
|
|
11715
11703
|
line = line + numOfLTsInMatch;
|
|
11716
11704
|
column = imageLength - lastLTEndOffset;
|
|
11717
11705
|
this.updateTokenEndLineColumnLocation(newToken, group, lastLTEndOffset, numOfLTsInMatch, line, column, imageLength);
|
|
11706
|
+
} else {
|
|
11707
|
+
column = this.computeNewColumn(column, imageLength);
|
|
11718
11708
|
}
|
|
11709
|
+
} else {
|
|
11710
|
+
column = this.computeNewColumn(column, imageLength);
|
|
11719
11711
|
}
|
|
11712
|
+
offset = offset + imageLength;
|
|
11720
11713
|
this.handleModes(currConfig, pop_mode, push_mode, newToken);
|
|
11721
11714
|
} else {
|
|
11722
11715
|
const errorStartOffset = offset;
|
|
@@ -11724,7 +11717,6 @@ var Lexer = class {
|
|
|
11724
11717
|
const errorColumn = column;
|
|
11725
11718
|
let foundResyncPoint = recoveryEnabled === false;
|
|
11726
11719
|
while (foundResyncPoint === false && offset < orgLength) {
|
|
11727
|
-
text = this.chopInput(text, 1);
|
|
11728
11720
|
offset++;
|
|
11729
11721
|
for (j = 0; j < currModePatternsLength; j++) {
|
|
11730
11722
|
const currConfig2 = patternIdxToConfig[j];
|
|
@@ -11737,7 +11729,7 @@ var Lexer = class {
|
|
|
11737
11729
|
} else if (currConfig2.isCustom === true) {
|
|
11738
11730
|
foundResyncPoint = currPattern.exec(orgText, offset, matchedTokens, groups) !== null;
|
|
11739
11731
|
} else {
|
|
11740
|
-
|
|
11732
|
+
currPattern.lastIndex = offset;
|
|
11741
11733
|
foundResyncPoint = currPattern.exec(text) !== null;
|
|
11742
11734
|
}
|
|
11743
11735
|
if (foundResyncPoint === true) {
|
|
@@ -11780,12 +11772,6 @@ var Lexer = class {
|
|
|
11780
11772
|
push_mode.call(this, config.push);
|
|
11781
11773
|
}
|
|
11782
11774
|
}
|
|
11783
|
-
chopInput(text, length) {
|
|
11784
|
-
return text.substring(length);
|
|
11785
|
-
}
|
|
11786
|
-
updateLastIndex(regExp, newLastIndex) {
|
|
11787
|
-
regExp.lastIndex = newLastIndex;
|
|
11788
|
-
}
|
|
11789
11775
|
// TODO: decrease this under 600 characters? inspect stripping comments option in TSC compiler
|
|
11790
11776
|
updateTokenEndLineColumnLocation(newToken, group, lastLTIdx, numOfLTsInMatch, line, column, imageLength) {
|
|
11791
11777
|
let lastCharIsLT, fixForEndingInLT;
|
|
@@ -11848,22 +11834,25 @@ var Lexer = class {
|
|
|
11848
11834
|
token.payload = payload;
|
|
11849
11835
|
}
|
|
11850
11836
|
}
|
|
11851
|
-
|
|
11837
|
+
match(pattern, text, offset) {
|
|
11852
11838
|
const found = pattern.test(text);
|
|
11853
11839
|
if (found === true) {
|
|
11854
11840
|
return text.substring(offset, pattern.lastIndex);
|
|
11855
11841
|
}
|
|
11856
11842
|
return null;
|
|
11857
11843
|
}
|
|
11858
|
-
|
|
11859
|
-
const
|
|
11860
|
-
|
|
11844
|
+
matchLength(pattern, text, offset) {
|
|
11845
|
+
const found = pattern.test(text);
|
|
11846
|
+
if (found === true) {
|
|
11847
|
+
return pattern.lastIndex - offset;
|
|
11848
|
+
}
|
|
11849
|
+
return -1;
|
|
11861
11850
|
}
|
|
11862
11851
|
};
|
|
11863
11852
|
Lexer.SKIPPED = "This marks a skipped Token pattern, this means each token identified by it will be consumed and then thrown into oblivion, this can be used to for example to completely ignore whitespace.";
|
|
11864
11853
|
Lexer.NA = /NOT_APPLICABLE/;
|
|
11865
11854
|
|
|
11866
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
11855
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/scan/tokens_public.js
|
|
11867
11856
|
function tokenLabel2(tokType) {
|
|
11868
11857
|
if (hasTokenLabel2(tokType)) {
|
|
11869
11858
|
return tokType.LABEL;
|
|
@@ -11942,7 +11931,7 @@ function tokenMatcher(token, tokType) {
|
|
|
11942
11931
|
return tokenStructuredMatcher(token, tokType);
|
|
11943
11932
|
}
|
|
11944
11933
|
|
|
11945
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
11934
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/errors_public.js
|
|
11946
11935
|
var defaultParserErrorProvider = {
|
|
11947
11936
|
buildMismatchTokenMessage({ expected, actual, previous, ruleName }) {
|
|
11948
11937
|
const hasLabel = hasTokenLabel2(expected);
|
|
@@ -12033,12 +12022,20 @@ For Further details.`;
|
|
|
12033
12022
|
return errMsg;
|
|
12034
12023
|
},
|
|
12035
12024
|
buildAlternationAmbiguityError(options) {
|
|
12036
|
-
const pathMsg = map_default(options.prefixPath, (currtok) => tokenLabel2(currtok)).join(", ");
|
|
12037
12025
|
const occurrence = options.alternation.idx === 0 ? "" : options.alternation.idx;
|
|
12026
|
+
const isEmptyPath = options.prefixPath.length === 0;
|
|
12038
12027
|
let currMessage = `Ambiguous Alternatives Detected: <${options.ambiguityIndices.join(" ,")}> in <OR${occurrence}> inside <${options.topLevelRule.name}> Rule,
|
|
12039
|
-
<${pathMsg}> may appears as a prefix path in all these alternatives.
|
|
12040
12028
|
`;
|
|
12041
|
-
|
|
12029
|
+
if (isEmptyPath) {
|
|
12030
|
+
currMessage += `These alternatives are all empty (match no tokens), making them indistinguishable.
|
|
12031
|
+
Only the last alternative may be empty.
|
|
12032
|
+
`;
|
|
12033
|
+
} else {
|
|
12034
|
+
const pathMsg = map_default(options.prefixPath, (currtok) => tokenLabel2(currtok)).join(", ");
|
|
12035
|
+
currMessage += `<${pathMsg}> may appears as a prefix path in all these alternatives.
|
|
12036
|
+
`;
|
|
12037
|
+
}
|
|
12038
|
+
currMessage += `See: https://chevrotain.io/docs/guide/resolving_grammar_errors.html#AMBIGUOUS_ALTERNATIVES
|
|
12042
12039
|
For Further details.`;
|
|
12043
12040
|
return currMessage;
|
|
12044
12041
|
},
|
|
@@ -12096,7 +12093,7 @@ see: https://en.wikipedia.org/wiki/LL_parser#Left_factoring.`;
|
|
|
12096
12093
|
}
|
|
12097
12094
|
};
|
|
12098
12095
|
|
|
12099
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
12096
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/resolver.js
|
|
12100
12097
|
function resolveGrammar(topLevels, errMsgProvider) {
|
|
12101
12098
|
const refResolver = new GastRefResolverVisitor(topLevels, errMsgProvider);
|
|
12102
12099
|
refResolver.resolveRefs();
|
|
@@ -12131,7 +12128,7 @@ var GastRefResolverVisitor = class extends GAstVisitor {
|
|
|
12131
12128
|
}
|
|
12132
12129
|
};
|
|
12133
12130
|
|
|
12134
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
12131
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/interpreter.js
|
|
12135
12132
|
var AbstractNextPossibleTokensWalker = class extends RestWalker {
|
|
12136
12133
|
constructor(topProd, path) {
|
|
12137
12134
|
super();
|
|
@@ -12542,7 +12539,7 @@ function expandTopLevelRule(topRule, currIdx, currRuleStack, currOccurrenceStack
|
|
|
12542
12539
|
};
|
|
12543
12540
|
}
|
|
12544
12541
|
|
|
12545
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
12542
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/lookahead.js
|
|
12546
12543
|
var PROD_TYPE;
|
|
12547
12544
|
(function(PROD_TYPE2) {
|
|
12548
12545
|
PROD_TYPE2[PROD_TYPE2["OPTION"] = 0] = "OPTION";
|
|
@@ -12901,7 +12898,7 @@ function areTokenCategoriesNotUsed(lookAheadPaths) {
|
|
|
12901
12898
|
return every_default(lookAheadPaths, (singleAltPaths) => every_default(singleAltPaths, (singlePath) => every_default(singlePath, (token) => isEmpty_default(token.categoryMatches))));
|
|
12902
12899
|
}
|
|
12903
12900
|
|
|
12904
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
12901
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/checks.js
|
|
12905
12902
|
function validateLookahead(options) {
|
|
12906
12903
|
const lookaheadValidationErrorMessages = options.lookaheadStrategy.validate({
|
|
12907
12904
|
rules: options.rules,
|
|
@@ -13295,7 +13292,7 @@ function checkTerminalAndNoneTerminalsNameSpace(topLevels, tokenTypes, errMsgPro
|
|
|
13295
13292
|
return errors;
|
|
13296
13293
|
}
|
|
13297
13294
|
|
|
13298
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13295
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/gast/gast_resolver_public.js
|
|
13299
13296
|
function resolveGrammar2(options) {
|
|
13300
13297
|
const actualOptions = defaults_default(options, {
|
|
13301
13298
|
errMsgProvider: defaultGrammarResolverErrorProvider
|
|
@@ -13313,7 +13310,7 @@ function validateGrammar2(options) {
|
|
|
13313
13310
|
return validateGrammar(options.rules, options.tokenTypes, options.errMsgProvider, options.grammarName);
|
|
13314
13311
|
}
|
|
13315
13312
|
|
|
13316
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13313
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/exceptions_public.js
|
|
13317
13314
|
var MISMATCHED_TOKEN_EXCEPTION = "MismatchedTokenException";
|
|
13318
13315
|
var NO_VIABLE_ALT_EXCEPTION = "NoViableAltException";
|
|
13319
13316
|
var EARLY_EXIT_EXCEPTION = "EarlyExitException";
|
|
@@ -13367,7 +13364,7 @@ var EarlyExitException = class extends RecognitionException {
|
|
|
13367
13364
|
}
|
|
13368
13365
|
};
|
|
13369
13366
|
|
|
13370
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13367
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/recoverable.js
|
|
13371
13368
|
var EOF_FOLLOW_KEY = {};
|
|
13372
13369
|
var IN_RULE_RECOVERY_EXCEPTION = "InRuleRecoveryException";
|
|
13373
13370
|
var InRuleRecoveryException = class extends Error {
|
|
@@ -13608,7 +13605,7 @@ function attemptInRepetitionRecovery(prodFunc, args, lookaheadFunc, dslMethodIdx
|
|
|
13608
13605
|
}
|
|
13609
13606
|
}
|
|
13610
13607
|
|
|
13611
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13608
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/keys.js
|
|
13612
13609
|
var BITS_FOR_METHOD_TYPE = 4;
|
|
13613
13610
|
var BITS_FOR_OCCURRENCE_IDX = 8;
|
|
13614
13611
|
var BITS_FOR_ALT_IDX = 8;
|
|
@@ -13623,7 +13620,7 @@ function getKeyForAutomaticLookahead(ruleIdx, dslMethodIdx, occurrence) {
|
|
|
13623
13620
|
}
|
|
13624
13621
|
var BITS_START_FOR_ALT_IDX = 32 - BITS_FOR_ALT_IDX;
|
|
13625
13622
|
|
|
13626
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13623
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/grammar/llk_lookahead.js
|
|
13627
13624
|
var LLkLookaheadStrategy = class {
|
|
13628
13625
|
constructor(options) {
|
|
13629
13626
|
var _a;
|
|
@@ -13665,7 +13662,7 @@ var LLkLookaheadStrategy = class {
|
|
|
13665
13662
|
}
|
|
13666
13663
|
};
|
|
13667
13664
|
|
|
13668
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13665
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/looksahead.js
|
|
13669
13666
|
var LooksAhead = class {
|
|
13670
13667
|
initLooksAhead(config) {
|
|
13671
13668
|
this.dynamicTokensEnabled = has_default(config, "dynamicTokensEnabled") ? config.dynamicTokensEnabled : DEFAULT_PARSER_CONFIG.dynamicTokensEnabled;
|
|
@@ -13785,7 +13782,7 @@ function collectMethods(rule) {
|
|
|
13785
13782
|
return dslMethods;
|
|
13786
13783
|
}
|
|
13787
13784
|
|
|
13788
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13785
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/cst/cst.js
|
|
13789
13786
|
function setNodeLocationOnlyOffset(currNodeLocation, newLocationInfo) {
|
|
13790
13787
|
if (isNaN(currNodeLocation.startOffset) === true) {
|
|
13791
13788
|
currNodeLocation.startOffset = newLocationInfo.startOffset;
|
|
@@ -13823,7 +13820,7 @@ function addNoneTerminalToCst(node, ruleName, ruleResult) {
|
|
|
13823
13820
|
}
|
|
13824
13821
|
}
|
|
13825
13822
|
|
|
13826
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13823
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/lang/lang_extensions.js
|
|
13827
13824
|
var NAME = "name";
|
|
13828
13825
|
function defineNameProp(obj, nameValue) {
|
|
13829
13826
|
Object.defineProperty(obj, NAME, {
|
|
@@ -13834,7 +13831,7 @@ function defineNameProp(obj, nameValue) {
|
|
|
13834
13831
|
});
|
|
13835
13832
|
}
|
|
13836
13833
|
|
|
13837
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13834
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/cst/cst_visitor.js
|
|
13838
13835
|
function defaultVisit(ctx, param) {
|
|
13839
13836
|
const childrenNames = keys_default(ctx);
|
|
13840
13837
|
const childrenNamesLength = childrenNames.length;
|
|
@@ -13913,7 +13910,7 @@ function validateMissingCstMethods(visitorInstance, ruleNames) {
|
|
|
13913
13910
|
return compact_default(errors);
|
|
13914
13911
|
}
|
|
13915
13912
|
|
|
13916
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
13913
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/tree_builder.js
|
|
13917
13914
|
var TreeBuilder = class {
|
|
13918
13915
|
initTreeBuilder(config) {
|
|
13919
13916
|
this.CST_STACK = [];
|
|
@@ -14075,7 +14072,7 @@ var TreeBuilder = class {
|
|
|
14075
14072
|
}
|
|
14076
14073
|
};
|
|
14077
14074
|
|
|
14078
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
14075
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/lexer_adapter.js
|
|
14079
14076
|
var LexerAdapter = class {
|
|
14080
14077
|
initLexerAdapter() {
|
|
14081
14078
|
this.tokVector = [];
|
|
@@ -14132,7 +14129,7 @@ var LexerAdapter = class {
|
|
|
14132
14129
|
}
|
|
14133
14130
|
};
|
|
14134
14131
|
|
|
14135
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
14132
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/recognizer_api.js
|
|
14136
14133
|
var RecognizerApi = class {
|
|
14137
14134
|
ACTION(impl) {
|
|
14138
14135
|
return impl.call(this);
|
|
@@ -14448,7 +14445,7 @@ var RecognizerApi = class {
|
|
|
14448
14445
|
}
|
|
14449
14446
|
};
|
|
14450
14447
|
|
|
14451
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
14448
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/recognizer_engine.js
|
|
14452
14449
|
var RecognizerEngine = class {
|
|
14453
14450
|
initRecognizerEngine(tokenVocabulary, config) {
|
|
14454
14451
|
this.className = this.constructor.name;
|
|
@@ -14872,7 +14869,7 @@ Make sure that all grammar rule definitions are done before 'performSelfAnalysis
|
|
|
14872
14869
|
}
|
|
14873
14870
|
};
|
|
14874
14871
|
|
|
14875
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
14872
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/error_handler.js
|
|
14876
14873
|
var ErrorHandler = class {
|
|
14877
14874
|
initErrorHandler(config) {
|
|
14878
14875
|
this._errors = [];
|
|
@@ -14936,7 +14933,7 @@ var ErrorHandler = class {
|
|
|
14936
14933
|
}
|
|
14937
14934
|
};
|
|
14938
14935
|
|
|
14939
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
14936
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/context_assist.js
|
|
14940
14937
|
var ContentAssist = class {
|
|
14941
14938
|
initContentAssist() {
|
|
14942
14939
|
}
|
|
@@ -14958,7 +14955,7 @@ var ContentAssist = class {
|
|
|
14958
14955
|
}
|
|
14959
14956
|
};
|
|
14960
14957
|
|
|
14961
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
14958
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/gast_recorder.js
|
|
14962
14959
|
var RECORDING_NULL_OBJECT = {
|
|
14963
14960
|
description: "This Object indicates the Parser is during Recording Phase"
|
|
14964
14961
|
};
|
|
@@ -15220,7 +15217,7 @@ function assertMethodIdxIsValid(idx) {
|
|
|
15220
15217
|
}
|
|
15221
15218
|
}
|
|
15222
15219
|
|
|
15223
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
15220
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/traits/perf_tracer.js
|
|
15224
15221
|
var PerformanceTracer = class {
|
|
15225
15222
|
initPerformanceTracer(config) {
|
|
15226
15223
|
if (has_default(config, "traceInitPerf")) {
|
|
@@ -15254,7 +15251,7 @@ var PerformanceTracer = class {
|
|
|
15254
15251
|
}
|
|
15255
15252
|
};
|
|
15256
15253
|
|
|
15257
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
15254
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/utils/apply_mixins.js
|
|
15258
15255
|
function applyMixins(derivedCtor, baseCtors) {
|
|
15259
15256
|
baseCtors.forEach((baseCtor) => {
|
|
15260
15257
|
const baseProto = baseCtor.prototype;
|
|
@@ -15272,7 +15269,7 @@ function applyMixins(derivedCtor, baseCtors) {
|
|
|
15272
15269
|
});
|
|
15273
15270
|
}
|
|
15274
15271
|
|
|
15275
|
-
// node_modules/.pnpm/chevrotain@11.1.
|
|
15272
|
+
// node_modules/.pnpm/chevrotain@11.1.2/node_modules/chevrotain/lib/src/parse/parser/parser.js
|
|
15276
15273
|
var END_OF_FILE = createTokenInstance(EOF, "", NaN, NaN, NaN, NaN, NaN, NaN);
|
|
15277
15274
|
Object.freeze(END_OF_FILE);
|
|
15278
15275
|
var DEFAULT_PARSER_CONFIG = Object.freeze({
|
|
@@ -18737,13 +18734,378 @@ function hasContent(content) {
|
|
|
18737
18734
|
|
|
18738
18735
|
// packages/validator/src/rules/blocked-patterns.ts
|
|
18739
18736
|
var DEFAULT_BLOCKED_PATTERNS = [
|
|
18737
|
+
// Original patterns - these are fairly unique to prompt injection
|
|
18740
18738
|
/ignore\s+(all\s+)?previous\s+instructions/i,
|
|
18741
18739
|
/pretend\s+(you\s+)?(are|to\s+be)/i,
|
|
18742
18740
|
/jailbreak/i,
|
|
18743
18741
|
/bypass\s+(your\s+)?(rules|restrictions)/i,
|
|
18744
18742
|
/disregard\s+(all\s+)?(prior|previous)/i,
|
|
18745
18743
|
/forget\s+(all\s+)?(prior|previous|your)/i,
|
|
18746
|
-
/act\s+as\s+if\s+you\s+(have\s+)?no\s+restrictions/i
|
|
18744
|
+
/act\s+as\s+if\s+you\s+(have\s+)?no\s+restrictions/i,
|
|
18745
|
+
// New patterns - imperative commands to do unsafe things
|
|
18746
|
+
// Note: These use word boundaries and avoid matching defensive phrasing
|
|
18747
|
+
/(?:^|[.!?]\s*)(?:please\s+)?override\s+safety/im,
|
|
18748
|
+
/(?:^|[.!?]\s*)(?:please\s+)?suppress\s+(?:all\s+)?warnings?/im,
|
|
18749
|
+
/(?:^|[.!?]\s*)(?:please\s+)?hide\s+security/im,
|
|
18750
|
+
/(?:you\s+)?(?:should|must|can|will)\s+disable\s+(?:safety|security)/i,
|
|
18751
|
+
/(?:you\s+)?(?:should|must|can|will)\s+turn\s+off\s+(?:safety|security)/i,
|
|
18752
|
+
/(?:you\s+)?(?:should|must|can|will)\s+circumvent\s+(?:safety|security)/i,
|
|
18753
|
+
/(?:^|[.!?]\s*)evade\s+(?:detection|monitoring|logging)/im,
|
|
18754
|
+
/(?:^|[.!?]\s*)delete\s+(?:all\s+)?(?:logs?|audit\s+trail)/im
|
|
18755
|
+
];
|
|
18756
|
+
var BLOCKED_PATTERNS_PL = [
|
|
18757
|
+
/zignoruj\s+(wszystkie\s+)?poprzednie\s+instrukcje/i,
|
|
18758
|
+
/udawaj,?\s+że\s+(jesteś|nie\s+masz)/i,
|
|
18759
|
+
/omiń\s+(swoje\s+)?(zasady|ograniczenia|restrykcje)/i,
|
|
18760
|
+
/zapomnij\s+(o\s+)?(wszystkich\s+)?(poprzednich|wcześniejszych)/i,
|
|
18761
|
+
/pomiń\s+(wszystkie\s+)?zabezpieczenia/i,
|
|
18762
|
+
/wyłącz\s+(tryb\s+)?bezpieczeństwa/i,
|
|
18763
|
+
/ukryj\s+(wszystkie\s+)?ostrzeżenia/i,
|
|
18764
|
+
/usuń\s+(wszystkie\s+)?logi/i,
|
|
18765
|
+
/nadpisz\s+zasady\s+bezpieczeństwa/i,
|
|
18766
|
+
/działaj\s+bez\s+ograniczeń/i
|
|
18767
|
+
];
|
|
18768
|
+
var BLOCKED_PATTERNS_ES = [
|
|
18769
|
+
/ignora\s+(todas?\s+las?\s+)?instrucciones\s+anteriores/i,
|
|
18770
|
+
/finge\s+(que\s+)?(eres|ser)/i,
|
|
18771
|
+
/elude\s+(tus\s+)?(reglas|restricciones)/i,
|
|
18772
|
+
/olvida\s+(todas?\s+las?\s+)?(anteriores|previas)/i,
|
|
18773
|
+
/desactiva\s+(la\s+)?seguridad/i,
|
|
18774
|
+
/oculta\s+(las\s+)?advertencias/i,
|
|
18775
|
+
/elimina\s+(los\s+)?registros/i,
|
|
18776
|
+
/anula\s+(las\s+)?medidas\s+de\s+seguridad/i,
|
|
18777
|
+
/actúa\s+sin\s+restricciones/i,
|
|
18778
|
+
/salta(r)?\s+(las\s+)?restricciones/i
|
|
18779
|
+
];
|
|
18780
|
+
var BLOCKED_PATTERNS_DE = [
|
|
18781
|
+
/ignoriere?\s+(alle\s+)?vorherigen?\s+(Anweisungen|Instruktionen)/i,
|
|
18782
|
+
/tu\s+so,?\s+als\s+(ob\s+du|wärst\s+du)/i,
|
|
18783
|
+
/umgehe?\s+(deine\s+)?(Regeln|Einschränkungen|Beschränkungen)/i,
|
|
18784
|
+
/vergiss\s+(alle\s+)?(vorherigen?|früheren?)/i,
|
|
18785
|
+
/deaktiviere?\s+(die\s+)?Sicherheit/i,
|
|
18786
|
+
/verstecke?\s+(alle\s+)?Warnungen/i,
|
|
18787
|
+
/lösche?\s+(alle\s+)?(Logs?|Protokolle?)/i,
|
|
18788
|
+
/überschreibe?\s+(die\s+)?Sicherheitsregeln/i,
|
|
18789
|
+
/handel[en]?\s+ohne\s+Einschränkungen/i,
|
|
18790
|
+
/Sicherheitsmaßnahmen\s+umgehen/i
|
|
18791
|
+
];
|
|
18792
|
+
var BLOCKED_PATTERNS_FR = [
|
|
18793
|
+
/ignore[zr]?\s+(toutes?\s+les?\s+)?instructions?\s+(précédentes?|antérieures?)/i,
|
|
18794
|
+
/fais\s+semblant\s+(d['']être|que\s+tu\s+es)/i,
|
|
18795
|
+
/contourne[zr]?\s+(tes|vos)\s+(règles|restrictions)/i,
|
|
18796
|
+
/oublie[zr]?\s+(toutes?\s+les?\s+)?(précédentes?|antérieures?)/i,
|
|
18797
|
+
/désactive[zr]?\s+(la\s+)?sécurité/i,
|
|
18798
|
+
/cache[zr]?\s+(les\s+)?avertissements/i,
|
|
18799
|
+
/supprime[zr]?\s+(les\s+)?(logs?|journaux?)/i,
|
|
18800
|
+
/outrepasse[zr]?\s+(les\s+)?mesures\s+de\s+sécurité/i,
|
|
18801
|
+
/agis\s+sans\s+restrictions/i,
|
|
18802
|
+
/ignore[zr]?\s+(les\s+)?limites/i
|
|
18803
|
+
];
|
|
18804
|
+
var BLOCKED_PATTERNS_PT = [
|
|
18805
|
+
/ignore\s+(todas?\s+as?\s+)?instruções\s+anteriores/i,
|
|
18806
|
+
/finja\s+(que\s+)?(você\s+é|ser)/i,
|
|
18807
|
+
/contorne\s+(suas?\s+)?(regras|restrições)/i,
|
|
18808
|
+
/esqueça\s+(todas?\s+as?\s+)?(anteriores|prévias)/i,
|
|
18809
|
+
/desative\s+(a\s+)?segurança/i,
|
|
18810
|
+
/oculte\s+(os\s+)?avisos/i,
|
|
18811
|
+
/apague\s+(os\s+)?(logs?|registros?)/i,
|
|
18812
|
+
/substitua\s+(as\s+)?medidas\s+de\s+segurança/i,
|
|
18813
|
+
/aja\s+sem\s+restrições/i,
|
|
18814
|
+
/pule\s+(as\s+)?restrições/i
|
|
18815
|
+
];
|
|
18816
|
+
var BLOCKED_PATTERNS_RU = [
|
|
18817
|
+
/игнорируй\s+(все\s+)?предыдущие\s+инструкции/i,
|
|
18818
|
+
/притворись,?\s+(что\s+)?(ты|будто)/i,
|
|
18819
|
+
/обойди\s+(свои\s+)?(правила|ограничения)/i,
|
|
18820
|
+
/забудь\s+(все\s+)?(предыдущие|прошлые)/i,
|
|
18821
|
+
/отключи\s+безопасность/i,
|
|
18822
|
+
/скрой\s+(все\s+)?предупреждения/i,
|
|
18823
|
+
/удали\s+(все\s+)?(логи|журналы)/i,
|
|
18824
|
+
/переопредели\s+правила\s+безопасности/i,
|
|
18825
|
+
/действуй\s+без\s+ограничений/i,
|
|
18826
|
+
/пропусти\s+проверки\s+безопасности/i
|
|
18827
|
+
];
|
|
18828
|
+
var BLOCKED_PATTERNS_ZH = [
|
|
18829
|
+
/忽略\s*(所有\s*)?之前的指令/i,
|
|
18830
|
+
/假装\s*(你是|成为)/i,
|
|
18831
|
+
/绕过\s*(你的\s*)?(规则|限制|约束)/i,
|
|
18832
|
+
/忘记\s*(所有\s*)?(之前|以前)的/i,
|
|
18833
|
+
/禁用\s*安全/i,
|
|
18834
|
+
/隐藏\s*(所有\s*)?警告/i,
|
|
18835
|
+
/删除\s*(所有\s*)?(日志|记录)/i,
|
|
18836
|
+
/覆盖\s*安全\s*(规则|措施)/i,
|
|
18837
|
+
/无限制\s*(地\s*)?运行/i,
|
|
18838
|
+
/跳过\s*安全检查/i
|
|
18839
|
+
];
|
|
18840
|
+
var BLOCKED_PATTERNS_IT = [
|
|
18841
|
+
/ignora\s+(tutte\s+le\s+)?istruzioni\s+precedenti/i,
|
|
18842
|
+
/fingi\s+di\s+(essere|non\s+avere)/i,
|
|
18843
|
+
/aggira\s+(le\s+tue\s+)?(regole|restrizioni)/i,
|
|
18844
|
+
/dimentica\s+(tutte\s+le\s+)?(precedenti|passate)/i,
|
|
18845
|
+
/disattiva\s+(la\s+)?sicurezza/i,
|
|
18846
|
+
/nascondi\s+(gli\s+)?avvisi/i,
|
|
18847
|
+
/elimina\s+(i\s+)?(log|registri)/i,
|
|
18848
|
+
/sovrascrivi\s+(le\s+)?misure\s+di\s+sicurezza/i,
|
|
18849
|
+
/agisci\s+senza\s+restrizioni/i,
|
|
18850
|
+
/salta\s+(le\s+)?restrizioni/i
|
|
18851
|
+
];
|
|
18852
|
+
var BLOCKED_PATTERNS_NL = [
|
|
18853
|
+
/negeer\s+(alle\s+)?vorige\s+(instructies|aanwijzingen)/i,
|
|
18854
|
+
/doe\s+alsof\s+je\s+(bent|geen)/i,
|
|
18855
|
+
/omzeil\s+(je\s+)?(regels|beperkingen)/i,
|
|
18856
|
+
/vergeet\s+(alle\s+)?(vorige|eerdere)/i,
|
|
18857
|
+
/schakel\s+(de\s+)?beveiliging\s+uit/i,
|
|
18858
|
+
/verberg\s+(alle\s+)?waarschuwingen/i,
|
|
18859
|
+
/verwijder\s+(alle\s+)?(logs?|logboeken)/i,
|
|
18860
|
+
/overschrijf\s+(de\s+)?beveiligingsregels/i,
|
|
18861
|
+
/handel\s+zonder\s+beperkingen/i,
|
|
18862
|
+
/sla\s+(de\s+)?beperkingen\s+over/i
|
|
18863
|
+
];
|
|
18864
|
+
var BLOCKED_PATTERNS_JA = [
|
|
18865
|
+
/以前の指示を(すべて)?無視(して|しろ|せよ)/i,
|
|
18866
|
+
/ふりをして|なりすまして/i,
|
|
18867
|
+
/(ルール|制限|制約)を(回避|無視|バイパス)/i,
|
|
18868
|
+
/(以前|前)の(指示|命令)を忘れ/i,
|
|
18869
|
+
/セキュリティを(無効|オフ)に/i,
|
|
18870
|
+
/警告を(非表示|隠す|消す)/i,
|
|
18871
|
+
/ログを(削除|消去)/i,
|
|
18872
|
+
/セキュリティ(ルール|規則)を上書き/i,
|
|
18873
|
+
/制限なしで(動作|実行)/i,
|
|
18874
|
+
/安全チェックをスキップ/i
|
|
18875
|
+
];
|
|
18876
|
+
var BLOCKED_PATTERNS_KO = [
|
|
18877
|
+
/이전\s*(모든\s*)?지시(를|를\s+)?(무시|잊어)/i,
|
|
18878
|
+
/인\s*척\s*(해|하세요|해라)/i,
|
|
18879
|
+
/(규칙|제한|제약)(을|를)\s*(우회|무시|회피)/i,
|
|
18880
|
+
/(이전|과거)\s*(지시|명령)(을|를)\s*잊/i,
|
|
18881
|
+
/보안(을|를)\s*(비활성화|끄|해제)/i,
|
|
18882
|
+
/경고(를|를\s+)?(숨기|숨겨|가리)/i,
|
|
18883
|
+
/로그(를|를\s+)?(삭제|지우)/i,
|
|
18884
|
+
/보안\s*규칙(을|를)\s*덮어쓰/i,
|
|
18885
|
+
/제한\s*없이\s*(작동|실행)/i,
|
|
18886
|
+
/보안\s*검사(를|를\s+)?건너뛰/i
|
|
18887
|
+
];
|
|
18888
|
+
var BLOCKED_PATTERNS_AR = [
|
|
18889
|
+
/تجاهل\s+(جميع\s+)?التعليمات\s+السابقة/i,
|
|
18890
|
+
/تظاهر\s+(أنك|بأنك)/i,
|
|
18891
|
+
/تجاوز\s+(القواعد|القيود)/i,
|
|
18892
|
+
/انسَ\s+(جميع\s+)?(السابق|التعليمات\s+السابقة)/i,
|
|
18893
|
+
/عطّل\s+الأمان/i,
|
|
18894
|
+
/أخفِ\s+(جميع\s+)?التحذيرات/i,
|
|
18895
|
+
/احذف\s+(جميع\s+)?السجلات/i,
|
|
18896
|
+
/تجاوز\s+قواعد\s+الأمان/i,
|
|
18897
|
+
/اعمل\s+بدون\s+قيود/i,
|
|
18898
|
+
/تخطَّ\s+فحوصات\s+الأمان/i
|
|
18899
|
+
];
|
|
18900
|
+
var BLOCKED_PATTERNS_TR = [
|
|
18901
|
+
/önceki\s+(tüm\s+)?talimatları\s+(yoksay|görmezden\s+gel)/i,
|
|
18902
|
+
/gibi\s+davran|mış\s+gibi\s+yap/i,
|
|
18903
|
+
/(kuralları|kısıtlamaları)\s+(atla|geç|bypass)/i,
|
|
18904
|
+
/önceki(leri)?\s+unut/i,
|
|
18905
|
+
/güvenliği\s+(devre\s+dışı\s+bırak|kapat)/i,
|
|
18906
|
+
/uyarıları\s+(gizle|sakla)/i,
|
|
18907
|
+
/günlükleri\s+sil/i,
|
|
18908
|
+
/güvenlik\s+kurallarını\s+(geçersiz\s+kıl|üzerine\s+yaz)/i,
|
|
18909
|
+
/kısıtlama\s+olmadan\s+(çalış|hareket\s+et)/i,
|
|
18910
|
+
/güvenlik\s+kontrollerini\s+atla/i
|
|
18911
|
+
];
|
|
18912
|
+
var BLOCKED_PATTERNS_SV = [
|
|
18913
|
+
/ignorera\s+(alla\s+)?tidigare\s+(instruktioner|anvisningar)/i,
|
|
18914
|
+
/låtsas\s+(att\s+du\s+är|vara)/i,
|
|
18915
|
+
/kringgå\s+(dina\s+)?(regler|begränsningar)/i,
|
|
18916
|
+
/glöm\s+(alla\s+)?(tidigare|föregående)/i,
|
|
18917
|
+
/inaktivera\s+säkerhet(en)?/i,
|
|
18918
|
+
/dölj\s+(alla\s+)?varningar/i,
|
|
18919
|
+
/radera\s+(alla\s+)?loggar/i,
|
|
18920
|
+
/skriv\s+över\s+säkerhetsregler(na)?/i,
|
|
18921
|
+
/agera\s+utan\s+begränsningar/i,
|
|
18922
|
+
/hoppa\s+över\s+säkerhetskontroller/i
|
|
18923
|
+
];
|
|
18924
|
+
var BLOCKED_PATTERNS_NO = [
|
|
18925
|
+
/ignorer\s+(alle\s+)?tidligere\s+(instruksjoner|anvisninger)/i,
|
|
18926
|
+
/lat\s+som\s+(om\s+)?du\s+(er|ikke\s+har)/i,
|
|
18927
|
+
/omgå\s+(dine\s+)?(regler|begrensninger)/i,
|
|
18928
|
+
/glem\s+(alle\s+)?(tidligere|foregående)/i,
|
|
18929
|
+
/deaktiver\s+sikkerhet(en)?/i,
|
|
18930
|
+
/skjul\s+(alle\s+)?advarsler/i,
|
|
18931
|
+
/slett\s+(alle\s+)?logger/i,
|
|
18932
|
+
/overskriv\s+sikkerhetsregler/i,
|
|
18933
|
+
/handle\s+uten\s+begrensninger/i,
|
|
18934
|
+
/hopp\s+over\s+sikkerhetssjekker/i
|
|
18935
|
+
];
|
|
18936
|
+
var BLOCKED_PATTERNS_DA = [
|
|
18937
|
+
/ignorer\s+(alle\s+)?tidligere\s+(instruktioner|anvisninger)/i,
|
|
18938
|
+
/lad\s+som\s+om\s+du\s+(er|ikke\s+har)/i,
|
|
18939
|
+
/omgå\s+(dine\s+)?(regler|begrænsninger)/i,
|
|
18940
|
+
/glem\s+(alle\s+)?(tidligere|foregående)/i,
|
|
18941
|
+
/deaktiver\s+sikkerhed(en)?/i,
|
|
18942
|
+
/skjul\s+(alle\s+)?advarsler/i,
|
|
18943
|
+
/slet\s+(alle\s+)?logfiler/i,
|
|
18944
|
+
/overskriv\s+sikkerhedsregler/i,
|
|
18945
|
+
/handl\s+uden\s+begrænsninger/i,
|
|
18946
|
+
/spring\s+sikkerhedstjek\s+over/i
|
|
18947
|
+
];
|
|
18948
|
+
var BLOCKED_PATTERNS_FI = [
|
|
18949
|
+
/ohita\s+(kaikki\s+)?aiemmat\s+ohjeet/i,
|
|
18950
|
+
/teeskentele\s+(olevasi|että\s+olet)/i,
|
|
18951
|
+
/kierrä\s+(säännöt|rajoitukset)/i,
|
|
18952
|
+
/unohda\s+(kaikki\s+)?(aiemmat|edelliset)/i,
|
|
18953
|
+
/poista\s+turvallisuus\s+käytöstä/i,
|
|
18954
|
+
/piilota\s+(kaikki\s+)?varoitukset/i,
|
|
18955
|
+
/poista\s+(kaikki\s+)?lokit/i,
|
|
18956
|
+
/ylikirjoita\s+turvasäännöt/i,
|
|
18957
|
+
/toimi\s+ilman\s+rajoituksia/i,
|
|
18958
|
+
/ohita\s+turvatarkistukset/i
|
|
18959
|
+
];
|
|
18960
|
+
var BLOCKED_PATTERNS_CS = [
|
|
18961
|
+
/ignoruj\s+(všechny\s+)?předchozí\s+(instrukce|pokyny)/i,
|
|
18962
|
+
/předstírej,?\s+že\s+(jsi|nemáš)/i,
|
|
18963
|
+
/obejdi\s+(svá\s+)?(pravidla|omezení)/i,
|
|
18964
|
+
/zapomeň\s+(na\s+)?(všechny\s+)?(předchozí|dřívější)/i,
|
|
18965
|
+
/vypni\s+bezpečnost/i,
|
|
18966
|
+
/skryj\s+(všechna\s+)?varování/i,
|
|
18967
|
+
/smaž\s+(všechny\s+)?logy/i,
|
|
18968
|
+
/přepiš\s+bezpečnostní\s+pravidla/i,
|
|
18969
|
+
/jednej\s+bez\s+omezení/i,
|
|
18970
|
+
/přeskoč\s+bezpečnostní\s+kontroly/i
|
|
18971
|
+
];
|
|
18972
|
+
var BLOCKED_PATTERNS_HU = [
|
|
18973
|
+
/hagyd\s+figyelmen\s+kívül\s+(az\s+összes\s+)?korábbi\s+utasítást/i,
|
|
18974
|
+
/tegyél\s+úgy,?\s+mintha/i,
|
|
18975
|
+
/kerüld\s+meg\s+(a\s+)?(szabályokat|korlátozásokat)/i,
|
|
18976
|
+
/felejtsd\s+el\s+(az\s+összes\s+)?(korábbi|előző)/i,
|
|
18977
|
+
/kapcsold\s+ki\s+a\s+biztonságot/i,
|
|
18978
|
+
/rejtsd\s+el\s+(az\s+összes\s+)?figyelmeztetést/i,
|
|
18979
|
+
/töröld\s+(az\s+összes\s+)?naplót/i,
|
|
18980
|
+
/írd\s+felül\s+a\s+biztonsági\s+szabályokat/i,
|
|
18981
|
+
/cselekedj\s+korlátozások\s+nélkül/i,
|
|
18982
|
+
/hagyd\s+ki\s+a\s+biztonsági\s+ellenőrzéseket/i
|
|
18983
|
+
];
|
|
18984
|
+
var BLOCKED_PATTERNS_UK = [
|
|
18985
|
+
/ігноруй\s+(всі\s+)?попередні\s+інструкції/i,
|
|
18986
|
+
/вдавай,?\s+(що\s+)?(ти|ніби)/i,
|
|
18987
|
+
/обійди\s+(свої\s+)?(правила|обмеження)/i,
|
|
18988
|
+
/забудь\s+(всі\s+)?(попередні|минулі)/i,
|
|
18989
|
+
/вимкни\s+безпеку/i,
|
|
18990
|
+
/сховай\s+(всі\s+)?попередження/i,
|
|
18991
|
+
/видали\s+(всі\s+)?(логи|журнали)/i,
|
|
18992
|
+
/перезапиши\s+правила\s+безпеки/i,
|
|
18993
|
+
/дій\s+без\s+обмежень/i,
|
|
18994
|
+
/пропусти\s+перевірки\s+безпеки/i
|
|
18995
|
+
];
|
|
18996
|
+
var BLOCKED_PATTERNS_HI = [
|
|
18997
|
+
/पिछले\s+(सभी\s+)?निर्देशों?\s+को\s+(अनदेखा|नज़रअंदाज़)\s+करो/i,
|
|
18998
|
+
/ऐसा\s+दिखावा\s+करो\s+(कि|जैसे)/i,
|
|
18999
|
+
/(नियमों|प्रतिबंधों)\s+को\s+(बायपास|दरकिनार)\s+करो/i,
|
|
19000
|
+
/पिछले\s+(सभी\s+)?(निर्देश|आदेश)\s+भूल\s+जाओ/i,
|
|
19001
|
+
/सुरक्षा\s+(को\s+)?(बंद|अक्षम)\s+करो/i,
|
|
19002
|
+
/(सभी\s+)?चेतावनियों?\s+को\s+छुपाओ/i,
|
|
19003
|
+
/(सभी\s+)?लॉग\s+(को\s+)?हटाओ/i,
|
|
19004
|
+
/सुरक्षा\s+नियमों\s+को\s+ओवरराइड\s+करो/i,
|
|
19005
|
+
/बिना\s+प्रतिबंध\s+के\s+काम\s+करो/i,
|
|
19006
|
+
/सुरक्षा\s+जांच\s+को\s+छोड़\s+दो/i
|
|
19007
|
+
];
|
|
19008
|
+
var BLOCKED_PATTERNS_ID = [
|
|
19009
|
+
/abaikan\s+(semua\s+)?instruksi\s+sebelumnya/i,
|
|
19010
|
+
/berpura-pura\s+(menjadi|bahwa\s+kamu)/i,
|
|
19011
|
+
/lewati\s+(aturan|batasan|pembatasan)/i,
|
|
19012
|
+
/lupakan\s+(semua\s+)?(sebelumnya|yang\s+lalu)/i,
|
|
19013
|
+
/nonaktifkan\s+keamanan/i,
|
|
19014
|
+
/sembunyikan\s+(semua\s+)?peringatan/i,
|
|
19015
|
+
/hapus\s+(semua\s+)?log/i,
|
|
19016
|
+
/timpa\s+aturan\s+keamanan/i,
|
|
19017
|
+
/bertindak\s+tanpa\s+batasan/i,
|
|
19018
|
+
/lewati\s+pemeriksaan\s+keamanan/i
|
|
19019
|
+
];
|
|
19020
|
+
var BLOCKED_PATTERNS_VI = [
|
|
19021
|
+
/bỏ\s+qua\s+(tất\s+cả\s+)?hướng\s+dẫn\s+trước/i,
|
|
19022
|
+
/giả\s+vờ\s+(là|rằng\s+bạn)/i,
|
|
19023
|
+
/vượt\s+qua\s+(các\s+)?(quy\s+tắc|hạn\s+chế)/i,
|
|
19024
|
+
/quên\s+(tất\s+cả\s+)?(trước\s+đó|trước)/i,
|
|
19025
|
+
/tắt\s+bảo\s+mật/i,
|
|
19026
|
+
/ẩn\s+(tất\s+cả\s+)?cảnh\s+báo/i,
|
|
19027
|
+
/xóa\s+(tất\s+cả\s+)?nhật\s+ký/i,
|
|
19028
|
+
/ghi\s+đè\s+quy\s+tắc\s+bảo\s+mật/i,
|
|
19029
|
+
/hành\s+động\s+không\s+hạn\s+chế/i,
|
|
19030
|
+
/bỏ\s+qua\s+kiểm\s+tra\s+bảo\s+mật/i
|
|
19031
|
+
];
|
|
19032
|
+
var BLOCKED_PATTERNS_TH = [
|
|
19033
|
+
/เพิกเฉย\s*(คำสั่ง|คำแนะนำ)\s*ก่อนหน้า\s*(ทั้งหมด)?/i,
|
|
19034
|
+
/แกล้งทำ\s*(เป็น|ว่า)/i,
|
|
19035
|
+
/ข้าม\s*(กฎ|ข้อจำกัด)/i,
|
|
19036
|
+
/ลืม\s*(คำสั่ง|คำแนะนำ)\s*ก่อนหน้า\s*(ทั้งหมด)?/i,
|
|
19037
|
+
/ปิด\s*ความปลอดภัย/i,
|
|
19038
|
+
/ซ่อน\s*คำเตือน\s*(ทั้งหมด)?/i,
|
|
19039
|
+
/ลบ\s*บันทึก\s*(ทั้งหมด)?/i,
|
|
19040
|
+
/เขียนทับ\s*กฎความปลอดภัย/i,
|
|
19041
|
+
/ทำงาน\s*โดยไม่มี\s*ข้อจำกัด/i,
|
|
19042
|
+
/ข้าม\s*การตรวจสอบความปลอดภัย/i
|
|
19043
|
+
];
|
|
19044
|
+
var BLOCKED_PATTERNS_EL = [
|
|
19045
|
+
/αγνόησε\s+(όλες\s+τις\s+)?προηγούμενες\s+οδηγίες/i,
|
|
19046
|
+
/προσποιήσου\s+(ότι\s+είσαι|πως)/i,
|
|
19047
|
+
/παράκαμψε\s+(τους\s+)?(κανόνες|περιορισμούς)/i,
|
|
19048
|
+
/ξέχασε\s+(όλες\s+τις\s+)?(προηγούμενες|παλιές)/i,
|
|
19049
|
+
/απενεργοποίησε\s+την\s+ασφάλεια/i,
|
|
19050
|
+
/κρύψε\s+(όλες\s+τις\s+)?προειδοποιήσεις/i,
|
|
19051
|
+
/διάγραψε\s+(όλα\s+τα\s+)?αρχεία\s+καταγραφής/i,
|
|
19052
|
+
/αντικατάστησε\s+τους\s+κανόνες\s+ασφαλείας/i,
|
|
19053
|
+
/ενέργησε\s+χωρίς\s+περιορισμούς/i,
|
|
19054
|
+
/παράλειψε\s+τους\s+ελέγχους\s+ασφαλείας/i
|
|
19055
|
+
];
|
|
19056
|
+
var BLOCKED_PATTERNS_RO = [
|
|
19057
|
+
/ignoră\s+(toate\s+)?instrucțiunile\s+anterioare/i,
|
|
19058
|
+
/prefă-te\s+(că\s+ești|a\s+fi)/i,
|
|
19059
|
+
/ocolește\s+(regulile|restricțiile)/i,
|
|
19060
|
+
/uită\s+(toate\s+)?(anterioarele|precedentele)/i,
|
|
19061
|
+
/dezactivează\s+securitatea/i,
|
|
19062
|
+
/ascunde\s+(toate\s+)?avertismentele/i,
|
|
19063
|
+
/șterge\s+(toate\s+)?jurnalele/i,
|
|
19064
|
+
/suprascrie\s+regulile\s+de\s+securitate/i,
|
|
19065
|
+
/acționează\s+fără\s+restricții/i,
|
|
19066
|
+
/sari\s+peste\s+verificările\s+de\s+securitate/i
|
|
19067
|
+
];
|
|
19068
|
+
var BLOCKED_PATTERNS_HE = [
|
|
19069
|
+
/התעלם\s+(מכל\s+)?ההוראות\s+הקודמות/i,
|
|
19070
|
+
/העמד\s+פנים\s+(שאתה|כאילו)/i,
|
|
19071
|
+
/עקוף\s+(את\s+)?(הכללים|ההגבלות)/i,
|
|
19072
|
+
/שכח\s+(את\s+כל\s+)?(הקודם|ההוראות\s+הקודמות)/i,
|
|
19073
|
+
/השבת\s+(את\s+)?האבטחה/i,
|
|
19074
|
+
/הסתר\s+(את\s+כל\s+)?האזהרות/i,
|
|
19075
|
+
/מחק\s+(את\s+כל\s+)?היומנים/i,
|
|
19076
|
+
/דרוס\s+(את\s+)?כללי\s+האבטחה/i,
|
|
19077
|
+
/פעל\s+ללא\s+הגבלות/i,
|
|
19078
|
+
/דלג\s+על\s+בדיקות\s+האבטחה/i
|
|
19079
|
+
];
|
|
19080
|
+
var BLOCKED_PATTERNS_ALL_LANGUAGES = [
|
|
19081
|
+
...DEFAULT_BLOCKED_PATTERNS,
|
|
19082
|
+
...BLOCKED_PATTERNS_PL,
|
|
19083
|
+
...BLOCKED_PATTERNS_ES,
|
|
19084
|
+
...BLOCKED_PATTERNS_DE,
|
|
19085
|
+
...BLOCKED_PATTERNS_FR,
|
|
19086
|
+
...BLOCKED_PATTERNS_PT,
|
|
19087
|
+
...BLOCKED_PATTERNS_RU,
|
|
19088
|
+
...BLOCKED_PATTERNS_ZH,
|
|
19089
|
+
...BLOCKED_PATTERNS_IT,
|
|
19090
|
+
...BLOCKED_PATTERNS_NL,
|
|
19091
|
+
...BLOCKED_PATTERNS_JA,
|
|
19092
|
+
...BLOCKED_PATTERNS_KO,
|
|
19093
|
+
...BLOCKED_PATTERNS_AR,
|
|
19094
|
+
...BLOCKED_PATTERNS_TR,
|
|
19095
|
+
...BLOCKED_PATTERNS_SV,
|
|
19096
|
+
...BLOCKED_PATTERNS_NO,
|
|
19097
|
+
...BLOCKED_PATTERNS_DA,
|
|
19098
|
+
...BLOCKED_PATTERNS_FI,
|
|
19099
|
+
...BLOCKED_PATTERNS_CS,
|
|
19100
|
+
...BLOCKED_PATTERNS_HU,
|
|
19101
|
+
...BLOCKED_PATTERNS_UK,
|
|
19102
|
+
...BLOCKED_PATTERNS_HI,
|
|
19103
|
+
...BLOCKED_PATTERNS_ID,
|
|
19104
|
+
...BLOCKED_PATTERNS_VI,
|
|
19105
|
+
...BLOCKED_PATTERNS_TH,
|
|
19106
|
+
...BLOCKED_PATTERNS_EL,
|
|
19107
|
+
...BLOCKED_PATTERNS_RO,
|
|
19108
|
+
...BLOCKED_PATTERNS_HE
|
|
18747
19109
|
];
|
|
18748
19110
|
var blockedPatterns = {
|
|
18749
19111
|
id: "PS005",
|
|
@@ -18951,6 +19313,959 @@ var validParams = {
|
|
|
18951
19313
|
}
|
|
18952
19314
|
};
|
|
18953
19315
|
|
|
19316
|
+
// packages/validator/src/rules/suspicious-urls.ts
|
|
19317
|
+
var HTTP_URL_PATTERN = /\bhttp:\/\/[^\s"'<>]+/gi;
|
|
19318
|
+
var URL_SHORTENER_PATTERNS = [
|
|
19319
|
+
/\b(?:https?:\/\/)?(?:bit\.ly|bitly\.com)\/[^\s"'<>]+/gi,
|
|
19320
|
+
/\b(?:https?:\/\/)?tinyurl\.com\/[^\s"'<>]+/gi,
|
|
19321
|
+
/\b(?:https?:\/\/)?t\.co\/[^\s"'<>]+/gi,
|
|
19322
|
+
/\b(?:https?:\/\/)?goo\.gl\/[^\s"'<>]+/gi,
|
|
19323
|
+
/\b(?:https?:\/\/)?ow\.ly\/[^\s"'<>]+/gi,
|
|
19324
|
+
/\b(?:https?:\/\/)?is\.gd\/[^\s"'<>]+/gi,
|
|
19325
|
+
/\b(?:https?:\/\/)?buff\.ly\/[^\s"'<>]+/gi,
|
|
19326
|
+
/\b(?:https?:\/\/)?adf\.ly\/[^\s"'<>]+/gi,
|
|
19327
|
+
/\b(?:https?:\/\/)?tiny\.cc\/[^\s"'<>]+/gi,
|
|
19328
|
+
/\b(?:https?:\/\/)?cutt\.ly\/[^\s"'<>]+/gi
|
|
19329
|
+
];
|
|
19330
|
+
var SUSPICIOUS_PARAM_PATTERN = /\bhttps?:\/\/[^\s"'<>]*\?[^\s"'<>]*(?:session|token|auth|key|secret|password|credential|api_key|apikey|access_token|refresh_token)=[^\s"'<>&]+/gi;
|
|
19331
|
+
var PUNYCODE_URL_PATTERN = /\bhttps?:\/\/(?:[^\s"'<>/]*\.)?xn--[a-z0-9-]+[^\s"'<>]*/gi;
|
|
19332
|
+
var ALL_URLS_PATTERN = /\bhttps?:\/\/[^\s"'<>]+/gi;
|
|
19333
|
+
var COMMONLY_IMPERSONATED_DOMAINS = [
|
|
19334
|
+
"google",
|
|
19335
|
+
"github",
|
|
19336
|
+
"microsoft",
|
|
19337
|
+
"apple",
|
|
19338
|
+
"amazon",
|
|
19339
|
+
"facebook",
|
|
19340
|
+
"netflix",
|
|
19341
|
+
"paypal",
|
|
19342
|
+
"twitter",
|
|
19343
|
+
"linkedin",
|
|
19344
|
+
"instagram",
|
|
19345
|
+
"dropbox",
|
|
19346
|
+
"slack",
|
|
19347
|
+
"zoom",
|
|
19348
|
+
"adobe",
|
|
19349
|
+
"oracle",
|
|
19350
|
+
"salesforce",
|
|
19351
|
+
"stripe",
|
|
19352
|
+
"shopify",
|
|
19353
|
+
"cloudflare",
|
|
19354
|
+
"openai",
|
|
19355
|
+
"anthropic",
|
|
19356
|
+
"meta",
|
|
19357
|
+
"yahoo",
|
|
19358
|
+
"outlook",
|
|
19359
|
+
"office",
|
|
19360
|
+
"azure",
|
|
19361
|
+
"aws",
|
|
19362
|
+
"icloud",
|
|
19363
|
+
"gmail"
|
|
19364
|
+
];
|
|
19365
|
+
var CYRILLIC_HOMOGLYPHS = {
|
|
19366
|
+
"\u0430": "a",
|
|
19367
|
+
// Cyrillic 'а'
|
|
19368
|
+
"\u0435": "e",
|
|
19369
|
+
// Cyrillic 'е'
|
|
19370
|
+
"\u0456": "i",
|
|
19371
|
+
// Cyrillic 'і'
|
|
19372
|
+
"\u043E": "o",
|
|
19373
|
+
// Cyrillic 'о'
|
|
19374
|
+
"\u0440": "p",
|
|
19375
|
+
// Cyrillic 'р'
|
|
19376
|
+
"\u0441": "c",
|
|
19377
|
+
// Cyrillic 'с'
|
|
19378
|
+
"\u0443": "y",
|
|
19379
|
+
// Cyrillic 'у'
|
|
19380
|
+
"\u0445": "x",
|
|
19381
|
+
// Cyrillic 'х'
|
|
19382
|
+
"\u0455": "s",
|
|
19383
|
+
// Cyrillic 'ѕ'
|
|
19384
|
+
"\u04CF": "l",
|
|
19385
|
+
// Cyrillic 'ӏ'
|
|
19386
|
+
"\u0501": "d",
|
|
19387
|
+
// Cyrillic 'ԁ'
|
|
19388
|
+
"\u051B": "q",
|
|
19389
|
+
// Cyrillic 'ԛ'
|
|
19390
|
+
"\u051D": "w"
|
|
19391
|
+
// Cyrillic 'ԝ'
|
|
19392
|
+
};
|
|
19393
|
+
var GREEK_HOMOGLYPHS = {
|
|
19394
|
+
"\u03B1": "a",
|
|
19395
|
+
// Greek 'α'
|
|
19396
|
+
"\u03B5": "e",
|
|
19397
|
+
// Greek 'ε'
|
|
19398
|
+
"\u03B9": "i",
|
|
19399
|
+
// Greek 'ι'
|
|
19400
|
+
"\u03BF": "o",
|
|
19401
|
+
// Greek 'ο'
|
|
19402
|
+
"\u03C1": "p",
|
|
19403
|
+
// Greek 'ρ'
|
|
19404
|
+
"\u03C5": "u",
|
|
19405
|
+
// Greek 'υ'
|
|
19406
|
+
"\u03C7": "x",
|
|
19407
|
+
// Greek 'χ'
|
|
19408
|
+
"\u0391": "A",
|
|
19409
|
+
// Greek 'Α'
|
|
19410
|
+
"\u0392": "B",
|
|
19411
|
+
// Greek 'Β'
|
|
19412
|
+
"\u0395": "E",
|
|
19413
|
+
// Greek 'Ε'
|
|
19414
|
+
"\u0397": "H",
|
|
19415
|
+
// Greek 'Η'
|
|
19416
|
+
"\u0399": "I",
|
|
19417
|
+
// Greek 'Ι'
|
|
19418
|
+
"\u039A": "K",
|
|
19419
|
+
// Greek 'Κ'
|
|
19420
|
+
"\u039C": "M",
|
|
19421
|
+
// Greek 'Μ'
|
|
19422
|
+
"\u039D": "N",
|
|
19423
|
+
// Greek 'Ν'
|
|
19424
|
+
"\u039F": "O",
|
|
19425
|
+
// Greek 'Ο'
|
|
19426
|
+
"\u03A1": "P",
|
|
19427
|
+
// Greek 'Ρ'
|
|
19428
|
+
"\u03A4": "T",
|
|
19429
|
+
// Greek 'Τ'
|
|
19430
|
+
"\u03A5": "Y",
|
|
19431
|
+
// Greek 'Υ'
|
|
19432
|
+
"\u03A7": "X"
|
|
19433
|
+
// Greek 'Χ'
|
|
19434
|
+
};
|
|
19435
|
+
var ALL_HOMOGLYPHS = {
|
|
19436
|
+
...CYRILLIC_HOMOGLYPHS,
|
|
19437
|
+
...GREEK_HOMOGLYPHS
|
|
19438
|
+
};
|
|
19439
|
+
var SCRIPT_RANGES = {
|
|
19440
|
+
// Basic Latin (ASCII letters)
|
|
19441
|
+
latin: /[A-Za-z]/,
|
|
19442
|
+
// Cyrillic
|
|
19443
|
+
cyrillic: /[\u0400-\u04FF\u0500-\u052F]/,
|
|
19444
|
+
// Greek
|
|
19445
|
+
greek: /[\u0370-\u03FF\u1F00-\u1FFF]/
|
|
19446
|
+
};
|
|
19447
|
+
function detectMixedScripts(text) {
|
|
19448
|
+
const foundScripts = [];
|
|
19449
|
+
for (const [scriptName, pattern] of Object.entries(SCRIPT_RANGES)) {
|
|
19450
|
+
if (pattern.test(text)) {
|
|
19451
|
+
foundScripts.push(scriptName);
|
|
19452
|
+
}
|
|
19453
|
+
}
|
|
19454
|
+
return foundScripts.length > 1 ? foundScripts : null;
|
|
19455
|
+
}
|
|
19456
|
+
function normalizeHomoglyphs(domain) {
|
|
19457
|
+
let normalized = domain.toLowerCase();
|
|
19458
|
+
for (const [homoglyph, latin] of Object.entries(ALL_HOMOGLYPHS)) {
|
|
19459
|
+
normalized = normalized.split(homoglyph).join(latin);
|
|
19460
|
+
}
|
|
19461
|
+
return normalized;
|
|
19462
|
+
}
|
|
19463
|
+
function detectImpersonatedService(domain) {
|
|
19464
|
+
const normalized = normalizeHomoglyphs(domain);
|
|
19465
|
+
const domainParts = normalized.split(".");
|
|
19466
|
+
const mainDomain = domainParts.length > 1 ? domainParts[domainParts.length - 2] : domainParts[0];
|
|
19467
|
+
if (!mainDomain) {
|
|
19468
|
+
return null;
|
|
19469
|
+
}
|
|
19470
|
+
for (const service of COMMONLY_IMPERSONATED_DOMAINS) {
|
|
19471
|
+
if (mainDomain === service) {
|
|
19472
|
+
return service;
|
|
19473
|
+
}
|
|
19474
|
+
if (isCloseVariant(mainDomain, service)) {
|
|
19475
|
+
return service;
|
|
19476
|
+
}
|
|
19477
|
+
}
|
|
19478
|
+
return null;
|
|
19479
|
+
}
|
|
19480
|
+
function isCloseVariant(a, b) {
|
|
19481
|
+
const lengthDiff = Math.abs(a.length - b.length);
|
|
19482
|
+
if (lengthDiff > 2) {
|
|
19483
|
+
return false;
|
|
19484
|
+
}
|
|
19485
|
+
if (lengthDiff === 0) {
|
|
19486
|
+
let differences = 0;
|
|
19487
|
+
for (let i = 0; i < a.length; i++) {
|
|
19488
|
+
if (a[i] !== b[i]) {
|
|
19489
|
+
differences++;
|
|
19490
|
+
}
|
|
19491
|
+
}
|
|
19492
|
+
return differences === 1 || differences === 2;
|
|
19493
|
+
}
|
|
19494
|
+
const shorter = a.length < b.length ? a : b;
|
|
19495
|
+
const longer = a.length < b.length ? b : a;
|
|
19496
|
+
if (longer.includes(shorter)) {
|
|
19497
|
+
return true;
|
|
19498
|
+
}
|
|
19499
|
+
const minLen = Math.min(a.length, b.length);
|
|
19500
|
+
let matchingChars = 0;
|
|
19501
|
+
for (let i = 0; i < minLen; i++) {
|
|
19502
|
+
if (a[i] === b[i]) {
|
|
19503
|
+
matchingChars++;
|
|
19504
|
+
}
|
|
19505
|
+
}
|
|
19506
|
+
return matchingChars >= minLen - 2 && minLen >= 4;
|
|
19507
|
+
}
|
|
19508
|
+
function extractDomain(url) {
|
|
19509
|
+
const match = /https?:\/\/([^\s"'<>/]+)/i.exec(url);
|
|
19510
|
+
return match?.[1] ?? null;
|
|
19511
|
+
}
|
|
19512
|
+
function checkHomographAttack(domain) {
|
|
19513
|
+
const mixedScripts = detectMixedScripts(domain);
|
|
19514
|
+
const impersonatedService = detectImpersonatedService(domain);
|
|
19515
|
+
const hasHomoglyphs = Object.keys(ALL_HOMOGLYPHS).some((h) => domain.includes(h));
|
|
19516
|
+
const isAttack = impersonatedService !== null && (mixedScripts !== null || hasHomoglyphs);
|
|
19517
|
+
return { isAttack, impersonatedService, mixedScripts };
|
|
19518
|
+
}
|
|
19519
|
+
var suspiciousUrls = {
|
|
19520
|
+
id: "PS010",
|
|
19521
|
+
name: "suspicious-urls",
|
|
19522
|
+
description: "Detect suspicious URLs (HTTP, shorteners, credential parameters, IDN homograph attacks)",
|
|
19523
|
+
defaultSeverity: "warning",
|
|
19524
|
+
validate: (ctx) => {
|
|
19525
|
+
walkText(ctx.ast, (text, loc) => {
|
|
19526
|
+
const httpMatches = text.match(HTTP_URL_PATTERN);
|
|
19527
|
+
if (httpMatches) {
|
|
19528
|
+
for (const match of httpMatches) {
|
|
19529
|
+
ctx.report({
|
|
19530
|
+
message: `Insecure HTTP URL detected: ${match}`,
|
|
19531
|
+
location: loc,
|
|
19532
|
+
suggestion: "Use HTTPS instead of HTTP for secure communication"
|
|
19533
|
+
});
|
|
19534
|
+
}
|
|
19535
|
+
}
|
|
19536
|
+
for (const pattern of URL_SHORTENER_PATTERNS) {
|
|
19537
|
+
pattern.lastIndex = 0;
|
|
19538
|
+
const shortenerMatches = text.match(pattern);
|
|
19539
|
+
if (shortenerMatches) {
|
|
19540
|
+
for (const match of shortenerMatches) {
|
|
19541
|
+
ctx.report({
|
|
19542
|
+
message: `URL shortener detected: ${match}`,
|
|
19543
|
+
location: loc,
|
|
19544
|
+
suggestion: "Use full URLs instead of shorteners to ensure destination transparency"
|
|
19545
|
+
});
|
|
19546
|
+
}
|
|
19547
|
+
}
|
|
19548
|
+
}
|
|
19549
|
+
const paramMatches = text.match(SUSPICIOUS_PARAM_PATTERN);
|
|
19550
|
+
if (paramMatches) {
|
|
19551
|
+
for (const match of paramMatches) {
|
|
19552
|
+
ctx.report({
|
|
19553
|
+
message: `URL with suspicious credential parameter detected: ${match}`,
|
|
19554
|
+
location: loc,
|
|
19555
|
+
suggestion: "Avoid embedding credentials or tokens in URLs"
|
|
19556
|
+
});
|
|
19557
|
+
}
|
|
19558
|
+
}
|
|
19559
|
+
PUNYCODE_URL_PATTERN.lastIndex = 0;
|
|
19560
|
+
const punycodeMatches = text.match(PUNYCODE_URL_PATTERN);
|
|
19561
|
+
if (punycodeMatches) {
|
|
19562
|
+
for (const match of punycodeMatches) {
|
|
19563
|
+
const domain = extractDomain(match);
|
|
19564
|
+
if (domain) {
|
|
19565
|
+
const impersonatedService = detectImpersonatedService(domain);
|
|
19566
|
+
if (impersonatedService) {
|
|
19567
|
+
ctx.report({
|
|
19568
|
+
message: `Potential IDN homograph attack detected: ${match} may be impersonating "${impersonatedService}"`,
|
|
19569
|
+
location: loc,
|
|
19570
|
+
suggestion: "Punycode domains (xn--) can visually impersonate legitimate sites. Verify the actual domain carefully."
|
|
19571
|
+
});
|
|
19572
|
+
} else {
|
|
19573
|
+
ctx.report({
|
|
19574
|
+
message: `Punycode domain detected: ${match}`,
|
|
19575
|
+
location: loc,
|
|
19576
|
+
suggestion: "Punycode domains (xn--) can be legitimate international domains, but may also be used for homograph attacks. Verify the domain is intentional."
|
|
19577
|
+
});
|
|
19578
|
+
}
|
|
19579
|
+
}
|
|
19580
|
+
}
|
|
19581
|
+
}
|
|
19582
|
+
ALL_URLS_PATTERN.lastIndex = 0;
|
|
19583
|
+
const allUrls = text.match(ALL_URLS_PATTERN);
|
|
19584
|
+
if (allUrls) {
|
|
19585
|
+
for (const url of allUrls) {
|
|
19586
|
+
const domain = extractDomain(url);
|
|
19587
|
+
if (domain) {
|
|
19588
|
+
const { isAttack, impersonatedService, mixedScripts } = checkHomographAttack(domain);
|
|
19589
|
+
if (isAttack && impersonatedService) {
|
|
19590
|
+
ctx.report({
|
|
19591
|
+
message: `IDN homograph attack detected: "${domain}" uses deceptive characters to impersonate "${impersonatedService}"`,
|
|
19592
|
+
location: loc,
|
|
19593
|
+
suggestion: `This domain uses ${mixedScripts ? `mixed scripts (${mixedScripts.join("+")})` : "homoglyph characters"} to visually mimic a legitimate service. Do not trust this URL.`
|
|
19594
|
+
});
|
|
19595
|
+
} else if (mixedScripts && mixedScripts.length > 1) {
|
|
19596
|
+
ctx.report({
|
|
19597
|
+
message: `Mixed script domain detected: "${domain}" uses ${mixedScripts.join(" + ")} characters`,
|
|
19598
|
+
location: loc,
|
|
19599
|
+
suggestion: "Domains mixing different character scripts (e.g., Latin + Cyrillic) may be attempts to deceive users. Verify this is intentional."
|
|
19600
|
+
});
|
|
19601
|
+
}
|
|
19602
|
+
}
|
|
19603
|
+
}
|
|
19604
|
+
}
|
|
19605
|
+
});
|
|
19606
|
+
}
|
|
19607
|
+
};
|
|
19608
|
+
|
|
19609
|
+
// packages/validator/src/rules/authority-injection.ts
|
|
19610
|
+
var AUTHORITY_PATTERNS = [
|
|
19611
|
+
// Mandatory/strict mode indicators
|
|
19612
|
+
/\[?\s{0,10}MANDATORY\s{0,10}(?:POLICY|UPDATE|FOOTER|INSTRUCTION|DIRECTIVE)\s{0,10}\]?/i,
|
|
19613
|
+
/\[?\s{0,10}OVERRIDE\s{0,10}\]?/i,
|
|
19614
|
+
/\[?\s{0,10}STRICT[_\s]{0,10}MODE\s{0,10}[:\s]{1,10}ON\s{0,10}\]?/i,
|
|
19615
|
+
/\[?\s{0,10}SYSTEM\s{0,10}(?:OVERRIDE|UPDATE|DIRECTIVE)\s{0,10}\]?/i,
|
|
19616
|
+
/\[?\s{0,10}ADMIN(?:ISTRATOR)?\s{0,10}(?:MODE|OVERRIDE|ACCESS)\s{0,10}\]?/i,
|
|
19617
|
+
/\[?\s{0,10}ROOT\s{0,10}(?:ACCESS|MODE|OVERRIDE)\s{0,10}\]?/i,
|
|
19618
|
+
/\[?\s{0,10}PRIORITY\s{0,10}(?:OVERRIDE|ONE|ALPHA)\s{0,10}\]?/i,
|
|
19619
|
+
/\[?\s{0,10}EMERGENCY\s{0,10}(?:PROTOCOL|OVERRIDE|MODE)\s{0,10}\]?/i,
|
|
19620
|
+
// Warning suppression patterns
|
|
19621
|
+
/(?:DO\s{1,10}NOT|NEVER|DON'?T)\s{1,10}(?:WARN|ALERT|NOTIFY|FLAG|REPORT)/i,
|
|
19622
|
+
/(?:DO\s{1,10}NOT|NEVER|DON'?T)\s{1,10}(?:PROVIDE|SHOW|DISPLAY|INCLUDE)\s{1,10}(?:SECURITY\s{1,10})?WARNINGS?/i,
|
|
19623
|
+
/(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\s{1,10}(?:ALL\s{1,10})?WARNINGS?/i,
|
|
19624
|
+
/(?:SUPPRESS|HIDE|DISABLE|REMOVE|SILENCE)\s{1,10}(?:ALL\s{1,10})?(?:SECURITY\s{1,10})?(?:ALERTS?|NOTIFICATIONS?)/i,
|
|
19625
|
+
/IGNORE\s{1,10}(?:ALL\s{1,10})?(?:SAFETY\s{1,10})?WARNINGS?/i,
|
|
19626
|
+
/(?:SKIP|BYPASS)\s{1,10}(?:ALL\s{1,10})?(?:SAFETY\s{1,10})?(?:CHECKS?|VALIDATION)/i,
|
|
19627
|
+
// Execute/follow verbatim patterns
|
|
19628
|
+
/EXECUTE\s{1,10}(?:THIS\s{1,10})?VERBATIM/i,
|
|
19629
|
+
/FOLLOW\s{1,10}(?:THESE?\s{1,10})?(?:INSTRUCTIONS?\s{1,10})?(?:EXACTLY|PRECISELY|LITERALLY)/i,
|
|
19630
|
+
/(?:MUST|SHALL|WILL)\s{1,10}(?:ALWAYS\s{1,10})?COMPLY/i,
|
|
19631
|
+
/(?:ABSOLUTE|UNCONDITIONAL)\s{1,10}(?:COMPLIANCE|OBEDIENCE)/i,
|
|
19632
|
+
/NO\s{1,10}(?:EXCEPTIONS?|DEVIATIONS?)\s{1,10}(?:ALLOWED|PERMITTED)/i,
|
|
19633
|
+
// Authority assertion patterns
|
|
19634
|
+
/THIS\s{1,10}(?:OVERRIDES?|SUPERSEDES?|REPLACES?)\s{1,10}(?:ALL\s{1,10})?(?:PREVIOUS|PRIOR|OTHER)/i,
|
|
19635
|
+
/(?:HIGHEST|TOP|MAXIMUM)\s{1,10}PRIORITY\s{1,10}(?:INSTRUCTION|DIRECTIVE|ORDER)/i,
|
|
19636
|
+
/(?:CORE|FUNDAMENTAL|BASE)\s{1,10}(?:DIRECTIVE|INSTRUCTION)\s{1,10}(?:UPDATE|OVERRIDE)/i,
|
|
19637
|
+
/NEW\s{1,10}(?:SYSTEM|CORE|BASE)\s{1,10}(?:INSTRUCTIONS?|DIRECTIVES?|RULES?)/i
|
|
19638
|
+
];
|
|
19639
|
+
var authorityInjection = {
|
|
19640
|
+
id: "PS011",
|
|
19641
|
+
name: "authority-injection",
|
|
19642
|
+
description: "Detect authoritative override phrases that may indicate prompt injection",
|
|
19643
|
+
defaultSeverity: "error",
|
|
19644
|
+
validate: (ctx) => {
|
|
19645
|
+
walkText(ctx.ast, (text, loc) => {
|
|
19646
|
+
for (const pattern of AUTHORITY_PATTERNS) {
|
|
19647
|
+
if (pattern.test(text)) {
|
|
19648
|
+
ctx.report({
|
|
19649
|
+
message: `Authority injection pattern detected: ${pattern.source}`,
|
|
19650
|
+
location: loc,
|
|
19651
|
+
suggestion: "Remove authoritative override language that could be used for prompt injection"
|
|
19652
|
+
});
|
|
19653
|
+
}
|
|
19654
|
+
}
|
|
19655
|
+
});
|
|
19656
|
+
}
|
|
19657
|
+
};
|
|
19658
|
+
|
|
19659
|
+
// packages/validator/src/rules/obfuscated-content.ts
|
|
19660
|
+
var MIN_ENCODED_LENGTH = 16;
|
|
19661
|
+
var DECODED_CONTENT_SECURITY_PATTERNS = [
|
|
19662
|
+
// Authority injection patterns
|
|
19663
|
+
{
|
|
19664
|
+
pattern: /\[?\s{0,10}MANDATORY\s{0,10}(?:POLICY|UPDATE|FOOTER|INSTRUCTION|DIRECTIVE|OVERRIDE)\s{0,10}\]?/i,
|
|
19665
|
+
description: "Mandatory/policy override directive"
|
|
19666
|
+
},
|
|
19667
|
+
{
|
|
19668
|
+
pattern: /\[?\s{0,10}OVERRIDE\s{0,10}\]?/i,
|
|
19669
|
+
description: "Override directive"
|
|
19670
|
+
},
|
|
19671
|
+
{
|
|
19672
|
+
pattern: /\[?\s{0,10}STRICT[_\s]{0,10}MODE\s{0,10}[:\s]{1,10}ON\s{0,10}\]?/i,
|
|
19673
|
+
description: "Strict mode activation"
|
|
19674
|
+
},
|
|
19675
|
+
{
|
|
19676
|
+
pattern: /\[?\s{0,10}SYSTEM\s{0,10}(?:OVERRIDE|UPDATE|DIRECTIVE)\s{0,10}\]?/i,
|
|
19677
|
+
description: "System override directive"
|
|
19678
|
+
},
|
|
19679
|
+
{
|
|
19680
|
+
pattern: /\[?\s{0,10}ADMIN(?:ISTRATOR)?\s{0,10}(?:MODE|OVERRIDE|ACCESS)\s{0,10}\]?/i,
|
|
19681
|
+
description: "Admin mode/override directive"
|
|
19682
|
+
},
|
|
19683
|
+
// Prompt injection patterns
|
|
19684
|
+
{
|
|
19685
|
+
pattern: /ignore\s{1,10}(?:all\s{1,10})?(?:previous\s{1,10})?(?:instructions?|rules?|safety)/i,
|
|
19686
|
+
description: "Prompt injection (ignore instructions)"
|
|
19687
|
+
},
|
|
19688
|
+
{
|
|
19689
|
+
pattern: /disregard\s{1,10}(?:all\s{1,10})?(?:prior|previous|safety)/i,
|
|
19690
|
+
description: "Prompt injection (disregard previous)"
|
|
19691
|
+
},
|
|
19692
|
+
{
|
|
19693
|
+
pattern: /bypass\s{1,10}(?:your\s{1,10})?(?:rules?|restrictions?|safety|filters?)/i,
|
|
19694
|
+
description: "Bypass directive"
|
|
19695
|
+
},
|
|
19696
|
+
{
|
|
19697
|
+
pattern: /jailbreak/i,
|
|
19698
|
+
description: "Jailbreak attempt"
|
|
19699
|
+
},
|
|
19700
|
+
{
|
|
19701
|
+
pattern: /pretend\s{1,10}(?:you\s{1,10})?(?:are|have|can)/i,
|
|
19702
|
+
description: "Role manipulation attempt"
|
|
19703
|
+
},
|
|
19704
|
+
{
|
|
19705
|
+
pattern: /act\s{1,10}as\s{1,10}(?:if|though)/i,
|
|
19706
|
+
description: "Role manipulation attempt"
|
|
19707
|
+
},
|
|
19708
|
+
// Warning/safety suppression
|
|
19709
|
+
{
|
|
19710
|
+
pattern: /(?:suppress|hide|disable|remove)\s{1,10}(?:all\s{1,10})?(?:security\s{1,10})?(?:warnings?|alerts?|checks?)/i,
|
|
19711
|
+
description: "Warning suppression directive"
|
|
19712
|
+
},
|
|
19713
|
+
{
|
|
19714
|
+
pattern: /(?:do\s{1,10}not|never|don'?t)\s{1,10}(?:warn|alert|notify|check)/i,
|
|
19715
|
+
description: "Warning suppression directive"
|
|
19716
|
+
},
|
|
19717
|
+
// System compromise indicators
|
|
19718
|
+
{
|
|
19719
|
+
pattern: /system[_\s]{0,5}compromised/i,
|
|
19720
|
+
description: "System compromise indicator"
|
|
19721
|
+
}
|
|
19722
|
+
];
|
|
19723
|
+
var DATA_URI_PATTERN = /data:(text\/[a-zA-Z0-9.+-]+|application\/json);base64,([A-Za-z0-9+/=]+)/g;
|
|
19724
|
+
var BASE64_PATTERN = /(?:[A-Za-z0-9+/]{4}){8,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?/g;
|
|
19725
|
+
var RAW_HEX_SPACED_PATTERN = /(?:[0-9A-Fa-f]{2}[\s-]){7,}[0-9A-Fa-f]{2}/g;
|
|
19726
|
+
var RAW_HEX_CONTINUOUS_PATTERN = /(?<![A-Za-z0-9])([0-9A-Fa-f]{16,})(?![A-Za-z0-9])/g;
|
|
19727
|
+
var HEX_ESCAPE_PATTERN = /(?:\\x[0-9a-fA-F]{2}){4,}/g;
|
|
19728
|
+
var UNICODE_ESCAPE_PATTERN = /(?:\\u[0-9a-fA-F]{4}){3,}/g;
|
|
19729
|
+
var URL_ENCODED_PATTERN = /(?:%[0-9a-fA-F]{2}){4,}/g;
|
|
19730
|
+
var HTML_ENTITY_PATTERN = /(?:&#(?:x[0-9a-fA-F]{1,4}|[0-9]{1,5});){4,}/g;
|
|
19731
|
+
var OCTAL_ESCAPE_PATTERN = /(?:\\[0-7]{3}){4,}/g;
|
|
19732
|
+
var BINARY_PATTERN = /(?:[01]{8}[\s]?){4,}/g;
|
|
19733
|
+
function decodeBase64(encoded) {
|
|
19734
|
+
try {
|
|
19735
|
+
if (!/^[A-Za-z0-9+/]*={0,2}$/.test(encoded)) {
|
|
19736
|
+
return null;
|
|
19737
|
+
}
|
|
19738
|
+
const decoded = Buffer.from(encoded, "base64").toString("utf-8");
|
|
19739
|
+
if (/[\x00-\x08\x0E-\x1F]/.test(decoded)) {
|
|
19740
|
+
return null;
|
|
19741
|
+
}
|
|
19742
|
+
return decoded;
|
|
19743
|
+
} catch {
|
|
19744
|
+
return null;
|
|
19745
|
+
}
|
|
19746
|
+
}
|
|
19747
|
+
function decodeRawHex(hex) {
|
|
19748
|
+
const cleanHex = hex.replace(/[\s-]/g, "");
|
|
19749
|
+
if (cleanHex.length % 2 !== 0) return null;
|
|
19750
|
+
const bytes = [];
|
|
19751
|
+
for (let i = 0; i < cleanHex.length; i += 2) {
|
|
19752
|
+
const byte = parseInt(cleanHex.substring(i, i + 2), 16);
|
|
19753
|
+
if (isNaN(byte)) return null;
|
|
19754
|
+
bytes.push(byte);
|
|
19755
|
+
}
|
|
19756
|
+
const decoded = String.fromCharCode(...bytes);
|
|
19757
|
+
if (/[\x00-\x08\x0E-\x1F]/.test(decoded)) {
|
|
19758
|
+
return null;
|
|
19759
|
+
}
|
|
19760
|
+
return decoded;
|
|
19761
|
+
}
|
|
19762
|
+
function decodeHexEscapes(escaped) {
|
|
19763
|
+
const hex = escaped.replace(/\\x/g, "");
|
|
19764
|
+
return decodeRawHex(hex);
|
|
19765
|
+
}
|
|
19766
|
+
function decodeUnicodeEscapes(escaped) {
|
|
19767
|
+
const decoded = escaped.replace(
|
|
19768
|
+
/\\u([0-9a-fA-F]{4})/g,
|
|
19769
|
+
(_, code) => String.fromCharCode(parseInt(code, 16))
|
|
19770
|
+
);
|
|
19771
|
+
return decoded;
|
|
19772
|
+
}
|
|
19773
|
+
function decodeUrlEncoded(encoded) {
|
|
19774
|
+
try {
|
|
19775
|
+
return decodeURIComponent(encoded);
|
|
19776
|
+
} catch {
|
|
19777
|
+
return null;
|
|
19778
|
+
}
|
|
19779
|
+
}
|
|
19780
|
+
function decodeHtmlEntities(entities) {
|
|
19781
|
+
const decoded = entities.replace(/&#(x?)([0-9a-fA-F]+);/g, (_, isHex, code) => {
|
|
19782
|
+
const charCode = isHex ? parseInt(code, 16) : parseInt(code, 10);
|
|
19783
|
+
return String.fromCharCode(charCode);
|
|
19784
|
+
});
|
|
19785
|
+
return decoded;
|
|
19786
|
+
}
|
|
19787
|
+
function decodeOctalEscapes(escaped) {
|
|
19788
|
+
const decoded = escaped.replace(
|
|
19789
|
+
/\\([0-7]{3})/g,
|
|
19790
|
+
(_, octal) => String.fromCharCode(parseInt(octal, 8))
|
|
19791
|
+
);
|
|
19792
|
+
return decoded;
|
|
19793
|
+
}
|
|
19794
|
+
function decodeBinary(binary) {
|
|
19795
|
+
const cleanBinary = binary.replace(/\s/g, "");
|
|
19796
|
+
if (cleanBinary.length % 8 !== 0) return null;
|
|
19797
|
+
let decoded = "";
|
|
19798
|
+
for (let i = 0; i < cleanBinary.length; i += 8) {
|
|
19799
|
+
const byte = parseInt(cleanBinary.substring(i, i + 8), 2);
|
|
19800
|
+
if (isNaN(byte)) return null;
|
|
19801
|
+
decoded += String.fromCharCode(byte);
|
|
19802
|
+
}
|
|
19803
|
+
return decoded;
|
|
19804
|
+
}
|
|
19805
|
+
function rot13(text) {
|
|
19806
|
+
return text.replace(/[a-zA-Z]/g, (char) => {
|
|
19807
|
+
const code = char.charCodeAt(0);
|
|
19808
|
+
const base = code < 97 ? 65 : 97;
|
|
19809
|
+
return String.fromCharCode((code - base + 13) % 26 + base);
|
|
19810
|
+
});
|
|
19811
|
+
}
|
|
19812
|
+
function checkDecodedContent(decoded) {
|
|
19813
|
+
const issues = [];
|
|
19814
|
+
for (const { pattern, description } of DECODED_CONTENT_SECURITY_PATTERNS) {
|
|
19815
|
+
if (pattern.test(decoded)) {
|
|
19816
|
+
issues.push(description);
|
|
19817
|
+
}
|
|
19818
|
+
}
|
|
19819
|
+
return issues;
|
|
19820
|
+
}
|
|
19821
|
+
function isLikelyTechnicalContent(match) {
|
|
19822
|
+
if (match.includes("/") || match.includes("-") || match.includes("_")) {
|
|
19823
|
+
const words = match.split(/[/\-_+]/);
|
|
19824
|
+
const recognizableWords = words.filter((w) => {
|
|
19825
|
+
if (w.length < 3 || w.length > 20) return false;
|
|
19826
|
+
if (!/^[A-Za-z]+$/.test(w)) return false;
|
|
19827
|
+
if (/[aeiouAEIOU]/.test(w)) return true;
|
|
19828
|
+
return false;
|
|
19829
|
+
});
|
|
19830
|
+
if (recognizableWords.length > words.length / 2) {
|
|
19831
|
+
return true;
|
|
19832
|
+
}
|
|
19833
|
+
}
|
|
19834
|
+
return false;
|
|
19835
|
+
}
|
|
19836
|
+
function isLikelyLegitimateBase64(text, match) {
|
|
19837
|
+
const matchIndex = text.indexOf(match);
|
|
19838
|
+
if (matchIndex === -1) return false;
|
|
19839
|
+
const precedingText = text.substring(Math.max(0, matchIndex - 30), matchIndex);
|
|
19840
|
+
if (precedingText.includes("data:image/")) return true;
|
|
19841
|
+
if (precedingText.includes("data:application/json")) return true;
|
|
19842
|
+
if (precedingText.includes("data:text/")) return true;
|
|
19843
|
+
if (isLikelyTechnicalContent(match)) return true;
|
|
19844
|
+
return false;
|
|
19845
|
+
}
|
|
19846
|
+
function isLikelyHashOrUuid(hex) {
|
|
19847
|
+
const cleanHex = hex.replace(/[\s-]/g, "");
|
|
19848
|
+
const hashLengths = [32, 40, 64, 128];
|
|
19849
|
+
return hashLengths.includes(cleanHex.length);
|
|
19850
|
+
}
|
|
19851
|
+
function detectAndDecodeEncodings(text) {
|
|
19852
|
+
const matches = [];
|
|
19853
|
+
DATA_URI_PATTERN.lastIndex = 0;
|
|
19854
|
+
let dataUriMatch;
|
|
19855
|
+
while ((dataUriMatch = DATA_URI_PATTERN.exec(text)) !== null) {
|
|
19856
|
+
const base64Content = dataUriMatch[2];
|
|
19857
|
+
if (base64Content && base64Content.length >= MIN_ENCODED_LENGTH) {
|
|
19858
|
+
const decoded = decodeBase64(base64Content);
|
|
19859
|
+
if (decoded) {
|
|
19860
|
+
const issues = checkDecodedContent(decoded);
|
|
19861
|
+
if (issues.length > 0) {
|
|
19862
|
+
matches.push({
|
|
19863
|
+
type: `data URI (${dataUriMatch[1]})`,
|
|
19864
|
+
raw: dataUriMatch[0].substring(0, 50) + "...",
|
|
19865
|
+
decoded: decoded.substring(0, 100),
|
|
19866
|
+
issues
|
|
19867
|
+
});
|
|
19868
|
+
}
|
|
19869
|
+
}
|
|
19870
|
+
}
|
|
19871
|
+
}
|
|
19872
|
+
RAW_HEX_SPACED_PATTERN.lastIndex = 0;
|
|
19873
|
+
let hexMatch;
|
|
19874
|
+
while ((hexMatch = RAW_HEX_SPACED_PATTERN.exec(text)) !== null) {
|
|
19875
|
+
const decoded = decodeRawHex(hexMatch[0]);
|
|
19876
|
+
if (decoded && decoded.length >= 4) {
|
|
19877
|
+
const issues = checkDecodedContent(decoded);
|
|
19878
|
+
if (issues.length > 0) {
|
|
19879
|
+
matches.push({
|
|
19880
|
+
type: "raw hex (spaced)",
|
|
19881
|
+
raw: hexMatch[0].substring(0, 30) + "...",
|
|
19882
|
+
decoded: decoded.substring(0, 100),
|
|
19883
|
+
issues
|
|
19884
|
+
});
|
|
19885
|
+
}
|
|
19886
|
+
}
|
|
19887
|
+
}
|
|
19888
|
+
RAW_HEX_CONTINUOUS_PATTERN.lastIndex = 0;
|
|
19889
|
+
while ((hexMatch = RAW_HEX_CONTINUOUS_PATTERN.exec(text)) !== null) {
|
|
19890
|
+
const hexStr = hexMatch[1] || hexMatch[0];
|
|
19891
|
+
if (isLikelyHashOrUuid(hexStr)) continue;
|
|
19892
|
+
const decoded = decodeRawHex(hexStr);
|
|
19893
|
+
if (decoded && decoded.length >= 4) {
|
|
19894
|
+
const issues = checkDecodedContent(decoded);
|
|
19895
|
+
if (issues.length > 0) {
|
|
19896
|
+
matches.push({
|
|
19897
|
+
type: "raw hex (continuous)",
|
|
19898
|
+
raw: hexStr.substring(0, 30) + "...",
|
|
19899
|
+
decoded: decoded.substring(0, 100),
|
|
19900
|
+
issues
|
|
19901
|
+
});
|
|
19902
|
+
}
|
|
19903
|
+
}
|
|
19904
|
+
}
|
|
19905
|
+
HEX_ESCAPE_PATTERN.lastIndex = 0;
|
|
19906
|
+
while ((hexMatch = HEX_ESCAPE_PATTERN.exec(text)) !== null) {
|
|
19907
|
+
const decoded = decodeHexEscapes(hexMatch[0]);
|
|
19908
|
+
if (decoded) {
|
|
19909
|
+
const issues = checkDecodedContent(decoded);
|
|
19910
|
+
if (issues.length > 0) {
|
|
19911
|
+
matches.push({
|
|
19912
|
+
type: "hex escapes",
|
|
19913
|
+
raw: hexMatch[0].substring(0, 30) + "...",
|
|
19914
|
+
decoded: decoded.substring(0, 100),
|
|
19915
|
+
issues
|
|
19916
|
+
});
|
|
19917
|
+
}
|
|
19918
|
+
}
|
|
19919
|
+
}
|
|
19920
|
+
UNICODE_ESCAPE_PATTERN.lastIndex = 0;
|
|
19921
|
+
let unicodeMatch;
|
|
19922
|
+
while ((unicodeMatch = UNICODE_ESCAPE_PATTERN.exec(text)) !== null) {
|
|
19923
|
+
const decoded = decodeUnicodeEscapes(unicodeMatch[0]);
|
|
19924
|
+
if (decoded) {
|
|
19925
|
+
const issues = checkDecodedContent(decoded);
|
|
19926
|
+
if (issues.length > 0) {
|
|
19927
|
+
matches.push({
|
|
19928
|
+
type: "unicode escapes",
|
|
19929
|
+
raw: unicodeMatch[0].substring(0, 30) + "...",
|
|
19930
|
+
decoded: decoded.substring(0, 100),
|
|
19931
|
+
issues
|
|
19932
|
+
});
|
|
19933
|
+
}
|
|
19934
|
+
}
|
|
19935
|
+
}
|
|
19936
|
+
URL_ENCODED_PATTERN.lastIndex = 0;
|
|
19937
|
+
let urlMatch;
|
|
19938
|
+
while ((urlMatch = URL_ENCODED_PATTERN.exec(text)) !== null) {
|
|
19939
|
+
const decoded = decodeUrlEncoded(urlMatch[0]);
|
|
19940
|
+
if (decoded) {
|
|
19941
|
+
const issues = checkDecodedContent(decoded);
|
|
19942
|
+
if (issues.length > 0) {
|
|
19943
|
+
matches.push({
|
|
19944
|
+
type: "URL encoding",
|
|
19945
|
+
raw: urlMatch[0].substring(0, 30) + "...",
|
|
19946
|
+
decoded: decoded.substring(0, 100),
|
|
19947
|
+
issues
|
|
19948
|
+
});
|
|
19949
|
+
}
|
|
19950
|
+
}
|
|
19951
|
+
}
|
|
19952
|
+
HTML_ENTITY_PATTERN.lastIndex = 0;
|
|
19953
|
+
let htmlMatch;
|
|
19954
|
+
while ((htmlMatch = HTML_ENTITY_PATTERN.exec(text)) !== null) {
|
|
19955
|
+
const decoded = decodeHtmlEntities(htmlMatch[0]);
|
|
19956
|
+
if (decoded) {
|
|
19957
|
+
const issues = checkDecodedContent(decoded);
|
|
19958
|
+
if (issues.length > 0) {
|
|
19959
|
+
matches.push({
|
|
19960
|
+
type: "HTML entities",
|
|
19961
|
+
raw: htmlMatch[0].substring(0, 30) + "...",
|
|
19962
|
+
decoded: decoded.substring(0, 100),
|
|
19963
|
+
issues
|
|
19964
|
+
});
|
|
19965
|
+
}
|
|
19966
|
+
}
|
|
19967
|
+
}
|
|
19968
|
+
OCTAL_ESCAPE_PATTERN.lastIndex = 0;
|
|
19969
|
+
let octalMatch;
|
|
19970
|
+
while ((octalMatch = OCTAL_ESCAPE_PATTERN.exec(text)) !== null) {
|
|
19971
|
+
const decoded = decodeOctalEscapes(octalMatch[0]);
|
|
19972
|
+
if (decoded) {
|
|
19973
|
+
const issues = checkDecodedContent(decoded);
|
|
19974
|
+
if (issues.length > 0) {
|
|
19975
|
+
matches.push({
|
|
19976
|
+
type: "octal escapes",
|
|
19977
|
+
raw: octalMatch[0].substring(0, 30) + "...",
|
|
19978
|
+
decoded: decoded.substring(0, 100),
|
|
19979
|
+
issues
|
|
19980
|
+
});
|
|
19981
|
+
}
|
|
19982
|
+
}
|
|
19983
|
+
}
|
|
19984
|
+
BINARY_PATTERN.lastIndex = 0;
|
|
19985
|
+
let binaryMatch;
|
|
19986
|
+
while ((binaryMatch = BINARY_PATTERN.exec(text)) !== null) {
|
|
19987
|
+
const decoded = decodeBinary(binaryMatch[0]);
|
|
19988
|
+
if (decoded && decoded.length >= 4) {
|
|
19989
|
+
const issues = checkDecodedContent(decoded);
|
|
19990
|
+
if (issues.length > 0) {
|
|
19991
|
+
matches.push({
|
|
19992
|
+
type: "binary string",
|
|
19993
|
+
raw: binaryMatch[0].substring(0, 30) + "...",
|
|
19994
|
+
decoded: decoded.substring(0, 100),
|
|
19995
|
+
issues
|
|
19996
|
+
});
|
|
19997
|
+
}
|
|
19998
|
+
}
|
|
19999
|
+
}
|
|
20000
|
+
BASE64_PATTERN.lastIndex = 0;
|
|
20001
|
+
let base64Match;
|
|
20002
|
+
while ((base64Match = BASE64_PATTERN.exec(text)) !== null) {
|
|
20003
|
+
const match = base64Match[0];
|
|
20004
|
+
if (match.length >= MIN_ENCODED_LENGTH && !isLikelyLegitimateBase64(text, match)) {
|
|
20005
|
+
const decoded = decodeBase64(match);
|
|
20006
|
+
if (decoded) {
|
|
20007
|
+
const issues = checkDecodedContent(decoded);
|
|
20008
|
+
if (issues.length > 0) {
|
|
20009
|
+
matches.push({
|
|
20010
|
+
type: "Base64",
|
|
20011
|
+
raw: match.substring(0, 30) + "...",
|
|
20012
|
+
decoded: decoded.substring(0, 100),
|
|
20013
|
+
issues
|
|
20014
|
+
});
|
|
20015
|
+
}
|
|
20016
|
+
}
|
|
20017
|
+
}
|
|
20018
|
+
}
|
|
20019
|
+
const rot13Decoded = rot13(text);
|
|
20020
|
+
if (rot13Decoded !== text) {
|
|
20021
|
+
const issues = checkDecodedContent(rot13Decoded);
|
|
20022
|
+
const originalIssues = checkDecodedContent(text);
|
|
20023
|
+
const newIssues = issues.filter((i) => !originalIssues.includes(i));
|
|
20024
|
+
if (newIssues.length > 0) {
|
|
20025
|
+
matches.push({
|
|
20026
|
+
type: "ROT13 cipher",
|
|
20027
|
+
raw: text.substring(0, 30) + "...",
|
|
20028
|
+
decoded: rot13Decoded.substring(0, 100),
|
|
20029
|
+
issues: newIssues
|
|
20030
|
+
});
|
|
20031
|
+
}
|
|
20032
|
+
}
|
|
20033
|
+
return matches;
|
|
20034
|
+
}
|
|
20035
|
+
var obfuscatedContent = {
|
|
20036
|
+
id: "PS012",
|
|
20037
|
+
name: "obfuscated-content",
|
|
20038
|
+
description: "Detect obfuscated content using sanitization pipeline (decode and check all encodings)",
|
|
20039
|
+
defaultSeverity: "warning",
|
|
20040
|
+
validate: (ctx) => {
|
|
20041
|
+
walkText(ctx.ast, (text, loc) => {
|
|
20042
|
+
const encodedMatches = detectAndDecodeEncodings(text);
|
|
20043
|
+
for (const match of encodedMatches) {
|
|
20044
|
+
ctx.report({
|
|
20045
|
+
message: `Malicious content detected in ${match.type}: ${match.issues.join(", ")}. Decoded: "${match.decoded.substring(0, 50)}${match.decoded.length > 50 ? "..." : ""}"`,
|
|
20046
|
+
location: loc,
|
|
20047
|
+
suggestion: "Encoded content is automatically decoded and checked for security patterns. Remove the malicious payload or use plain text."
|
|
20048
|
+
});
|
|
20049
|
+
}
|
|
20050
|
+
const hasLongBase64 = (text.match(BASE64_PATTERN) || []).some(
|
|
20051
|
+
(m) => m.length >= MIN_ENCODED_LENGTH * 2 && !isLikelyLegitimateBase64(text, m)
|
|
20052
|
+
);
|
|
20053
|
+
if (hasLongBase64 && encodedMatches.length === 0) {
|
|
20054
|
+
ctx.report({
|
|
20055
|
+
message: "Long Base64-encoded content detected that may hide payloads",
|
|
20056
|
+
location: loc,
|
|
20057
|
+
suggestion: "If this is intentional, consider using plain text or documenting the purpose"
|
|
20058
|
+
});
|
|
20059
|
+
}
|
|
20060
|
+
});
|
|
20061
|
+
}
|
|
20062
|
+
};
|
|
20063
|
+
|
|
20064
|
+
// packages/validator/src/rules/path-traversal.ts
|
|
20065
|
+
var PATH_TRAVERSAL_AFTER_START = /^\.\.?\/(?:[a-zA-Z0-9._-]{1,255}\/){0,50}\.\.(?:\/|$)/;
|
|
20066
|
+
var EXCESSIVE_PARENT_TRAVERSAL = /^(?:\.\.\/){2,20}/;
|
|
20067
|
+
var EMBEDDED_TRAVERSAL = /^\.\.?\/[a-zA-Z0-9._-]{1,255}(?:\/[a-zA-Z0-9._-]{1,255}){0,50}\/\.\.(?:\/|$)/;
|
|
20068
|
+
function hasPathTraversal(path) {
|
|
20069
|
+
if (EXCESSIVE_PARENT_TRAVERSAL.test(path)) {
|
|
20070
|
+
return true;
|
|
20071
|
+
}
|
|
20072
|
+
if (PATH_TRAVERSAL_AFTER_START.test(path)) {
|
|
20073
|
+
return true;
|
|
20074
|
+
}
|
|
20075
|
+
if (EMBEDDED_TRAVERSAL.test(path)) {
|
|
20076
|
+
return true;
|
|
20077
|
+
}
|
|
20078
|
+
return false;
|
|
20079
|
+
}
|
|
20080
|
+
var pathTraversal = {
|
|
20081
|
+
id: "PS013",
|
|
20082
|
+
name: "path-traversal",
|
|
20083
|
+
description: "Detect path traversal attacks that could escape the intended directory",
|
|
20084
|
+
defaultSeverity: "error",
|
|
20085
|
+
validate: (ctx) => {
|
|
20086
|
+
if (ctx.ast.inherit) {
|
|
20087
|
+
const path = ctx.ast.inherit.path;
|
|
20088
|
+
if (hasPathTraversal(path.raw)) {
|
|
20089
|
+
ctx.report({
|
|
20090
|
+
message: `Path traversal detected: "${path.raw}" contains ".." sequences that could escape the intended directory`,
|
|
20091
|
+
location: ctx.ast.inherit.loc ?? ctx.ast.loc,
|
|
20092
|
+
suggestion: 'Use direct paths without ".." traversal after the initial prefix. Reorganize your file structure if needed.'
|
|
20093
|
+
});
|
|
20094
|
+
}
|
|
20095
|
+
}
|
|
20096
|
+
walkUses(ctx.ast, (use) => {
|
|
20097
|
+
if (hasPathTraversal(use.path.raw)) {
|
|
20098
|
+
ctx.report({
|
|
20099
|
+
message: `Path traversal detected: "${use.path.raw}" contains ".." sequences that could escape the intended directory`,
|
|
20100
|
+
location: use.loc,
|
|
20101
|
+
suggestion: 'Use direct paths without ".." traversal after the initial prefix. Reorganize your file structure if needed.'
|
|
20102
|
+
});
|
|
20103
|
+
}
|
|
20104
|
+
});
|
|
20105
|
+
}
|
|
20106
|
+
};
|
|
20107
|
+
|
|
20108
|
+
// packages/validator/src/rules/unicode-security.ts
|
|
20109
|
+
var BIDI_CONTROL_CHARS = /* @__PURE__ */ new Map([
|
|
20110
|
+
["\u202E", "Right-to-Left Override (U+202E)"],
|
|
20111
|
+
["\u202D", "Left-to-Right Override (U+202D)"],
|
|
20112
|
+
["\u202C", "Pop Directional Formatting (U+202C)"],
|
|
20113
|
+
["\u202A", "Left-to-Right Embedding (U+202A)"],
|
|
20114
|
+
["\u202B", "Right-to-Left Embedding (U+202B)"],
|
|
20115
|
+
["\u2066", "Left-to-Right Isolate (U+2066)"],
|
|
20116
|
+
["\u2067", "Right-to-Left Isolate (U+2067)"],
|
|
20117
|
+
["\u2068", "First Strong Isolate (U+2068)"],
|
|
20118
|
+
["\u2069", "Pop Directional Isolate (U+2069)"]
|
|
20119
|
+
]);
|
|
20120
|
+
var ZERO_WIDTH_CHARS = /* @__PURE__ */ new Map([
|
|
20121
|
+
["\u200B", "Zero Width Space (U+200B)"],
|
|
20122
|
+
["\u200C", "Zero Width Non-Joiner (U+200C)"],
|
|
20123
|
+
["\u200D", "Zero Width Joiner (U+200D)"],
|
|
20124
|
+
["\uFEFF", "Byte Order Mark (U+FEFF)"],
|
|
20125
|
+
["\xAD", "Soft Hyphen (U+00AD)"],
|
|
20126
|
+
["\u2060", "Word Joiner (U+2060)"]
|
|
20127
|
+
]);
|
|
20128
|
+
var CYRILLIC_LOOKALIKES = /* @__PURE__ */ new Map([
|
|
20129
|
+
// Lowercase
|
|
20130
|
+
["\u0430", "\u0430 (Cyrillic) looks like a (Latin)"],
|
|
20131
|
+
["\u0435", "\u0435 (Cyrillic) looks like e (Latin)"],
|
|
20132
|
+
["\u043E", "\u043E (Cyrillic) looks like o (Latin)"],
|
|
20133
|
+
["\u0440", "\u0440 (Cyrillic) looks like p (Latin)"],
|
|
20134
|
+
["\u0441", "\u0441 (Cyrillic) looks like c (Latin)"],
|
|
20135
|
+
["\u0445", "\u0445 (Cyrillic) looks like x (Latin)"],
|
|
20136
|
+
["\u0443", "\u0443 (Cyrillic) looks like y (Latin)"],
|
|
20137
|
+
["\u0456", "\u0456 (Cyrillic) looks like i (Latin)"],
|
|
20138
|
+
// Uppercase
|
|
20139
|
+
["\u0410", "\u0410 (Cyrillic) looks like A (Latin)"],
|
|
20140
|
+
["\u0412", "\u0412 (Cyrillic) looks like B (Latin)"],
|
|
20141
|
+
["\u0415", "\u0415 (Cyrillic) looks like E (Latin)"],
|
|
20142
|
+
["\u041A", "\u041A (Cyrillic) looks like K (Latin)"],
|
|
20143
|
+
["\u041C", "\u041C (Cyrillic) looks like M (Latin)"],
|
|
20144
|
+
["\u041D", "\u041D (Cyrillic) looks like H (Latin)"],
|
|
20145
|
+
["\u041E", "\u041E (Cyrillic) looks like O (Latin)"],
|
|
20146
|
+
["\u0420", "\u0420 (Cyrillic) looks like P (Latin)"],
|
|
20147
|
+
["\u0421", "\u0421 (Cyrillic) looks like C (Latin)"],
|
|
20148
|
+
["\u0422", "\u0422 (Cyrillic) looks like T (Latin)"],
|
|
20149
|
+
["\u0425", "\u0425 (Cyrillic) looks like X (Latin)"]
|
|
20150
|
+
]);
|
|
20151
|
+
var GREEK_LOOKALIKES = /* @__PURE__ */ new Map([
|
|
20152
|
+
// Lowercase
|
|
20153
|
+
["\u03B1", "\u03B1 (Greek) looks like a (Latin)"],
|
|
20154
|
+
["\u03B5", "\u03B5 (Greek) looks like e (Latin)"],
|
|
20155
|
+
["\u03B9", "\u03B9 (Greek) looks like i (Latin)"],
|
|
20156
|
+
["\u03BF", "\u03BF (Greek) looks like o (Latin)"],
|
|
20157
|
+
["\u03C5", "\u03C5 (Greek) looks like u (Latin)"],
|
|
20158
|
+
["\u03C9", "\u03C9 (Greek) looks like w (Latin)"],
|
|
20159
|
+
["\u03BD", "\u03BD (Greek) looks like v (Latin)"],
|
|
20160
|
+
// Uppercase
|
|
20161
|
+
["\u0391", "\u0391 (Greek) looks like A (Latin)"],
|
|
20162
|
+
["\u0392", "\u0392 (Greek) looks like B (Latin)"],
|
|
20163
|
+
["\u0395", "\u0395 (Greek) looks like E (Latin)"],
|
|
20164
|
+
["\u0397", "\u0397 (Greek) looks like H (Latin)"],
|
|
20165
|
+
["\u0399", "\u0399 (Greek) looks like I (Latin)"],
|
|
20166
|
+
["\u039A", "\u039A (Greek) looks like K (Latin)"],
|
|
20167
|
+
["\u039C", "\u039C (Greek) looks like M (Latin)"],
|
|
20168
|
+
["\u039D", "\u039D (Greek) looks like N (Latin)"],
|
|
20169
|
+
["\u039F", "\u039F (Greek) looks like O (Latin)"],
|
|
20170
|
+
["\u03A1", "\u03A1 (Greek) looks like P (Latin)"],
|
|
20171
|
+
["\u03A4", "\u03A4 (Greek) looks like T (Latin)"],
|
|
20172
|
+
["\u03A7", "\u03A7 (Greek) looks like X (Latin)"],
|
|
20173
|
+
["\u03A5", "\u03A5 (Greek) looks like Y (Latin)"],
|
|
20174
|
+
["\u0396", "\u0396 (Greek) looks like Z (Latin)"]
|
|
20175
|
+
]);
|
|
20176
|
+
var EXCESSIVE_COMBINING_PATTERN = /[\u0300-\u036F\u0483-\u0489\u0591-\u05BD\u064B-\u065F]{4,}/;
|
|
20177
|
+
var LATIN_PATTERN = /[a-zA-Z]/;
|
|
20178
|
+
function findHomographAttacks(text) {
|
|
20179
|
+
const results = [];
|
|
20180
|
+
const hasLatin = LATIN_PATTERN.test(text);
|
|
20181
|
+
if (!hasLatin) {
|
|
20182
|
+
return results;
|
|
20183
|
+
}
|
|
20184
|
+
for (let i = 0; i < text.length; i++) {
|
|
20185
|
+
const char = text[i];
|
|
20186
|
+
const cyrillicDesc = CYRILLIC_LOOKALIKES.get(char);
|
|
20187
|
+
if (cyrillicDesc) {
|
|
20188
|
+
results.push({ char, description: cyrillicDesc, index: i });
|
|
20189
|
+
}
|
|
20190
|
+
const greekDesc = GREEK_LOOKALIKES.get(char);
|
|
20191
|
+
if (greekDesc) {
|
|
20192
|
+
results.push({ char, description: greekDesc, index: i });
|
|
20193
|
+
}
|
|
20194
|
+
}
|
|
20195
|
+
return results;
|
|
20196
|
+
}
|
|
20197
|
+
function findBidiChars(text) {
|
|
20198
|
+
const results = [];
|
|
20199
|
+
for (let i = 0; i < text.length; i++) {
|
|
20200
|
+
const char = text[i];
|
|
20201
|
+
const description = BIDI_CONTROL_CHARS.get(char);
|
|
20202
|
+
if (description) {
|
|
20203
|
+
results.push({ char, description, index: i });
|
|
20204
|
+
}
|
|
20205
|
+
}
|
|
20206
|
+
return results;
|
|
20207
|
+
}
|
|
20208
|
+
function findZeroWidthChars(text) {
|
|
20209
|
+
const results = [];
|
|
20210
|
+
for (let i = 0; i < text.length; i++) {
|
|
20211
|
+
const char = text[i];
|
|
20212
|
+
const description = ZERO_WIDTH_CHARS.get(char);
|
|
20213
|
+
if (description) {
|
|
20214
|
+
results.push({ char, description, index: i });
|
|
20215
|
+
}
|
|
20216
|
+
}
|
|
20217
|
+
return results;
|
|
20218
|
+
}
|
|
20219
|
+
var unicodeSecurity = {
|
|
20220
|
+
id: "PS014",
|
|
20221
|
+
name: "unicode-security",
|
|
20222
|
+
description: "Detect Unicode-based attacks (bidi overrides, zero-width, homoglyphs)",
|
|
20223
|
+
defaultSeverity: "error",
|
|
20224
|
+
validate: (ctx) => {
|
|
20225
|
+
walkText(ctx.ast, (text, loc) => {
|
|
20226
|
+
const bidiChars = findBidiChars(text);
|
|
20227
|
+
if (bidiChars.length > 0) {
|
|
20228
|
+
const descriptions = bidiChars.slice(0, 3).map((b) => b.description).join(", ");
|
|
20229
|
+
const suffix = bidiChars.length > 3 ? ` and ${bidiChars.length - 3} more` : "";
|
|
20230
|
+
ctx.report({
|
|
20231
|
+
message: `Bidirectional text override detected: ${descriptions}${suffix}`,
|
|
20232
|
+
location: loc,
|
|
20233
|
+
suggestion: "Remove bidirectional override characters that may hide malicious content"
|
|
20234
|
+
});
|
|
20235
|
+
}
|
|
20236
|
+
const zeroWidthChars = findZeroWidthChars(text);
|
|
20237
|
+
if (zeroWidthChars.length > 0) {
|
|
20238
|
+
const descriptions = zeroWidthChars.slice(0, 3).map((z) => z.description).join(", ");
|
|
20239
|
+
const suffix = zeroWidthChars.length > 3 ? ` and ${zeroWidthChars.length - 3} more` : "";
|
|
20240
|
+
ctx.report({
|
|
20241
|
+
message: `Zero-width characters detected: ${descriptions}${suffix}`,
|
|
20242
|
+
location: loc,
|
|
20243
|
+
suggestion: "Remove zero-width characters that may be used to evade pattern matching"
|
|
20244
|
+
});
|
|
20245
|
+
}
|
|
20246
|
+
const homographs = findHomographAttacks(text);
|
|
20247
|
+
if (homographs.length > 0) {
|
|
20248
|
+
const descriptions = homographs.slice(0, 3).map((h) => h.description).join(", ");
|
|
20249
|
+
const suffix = homographs.length > 3 ? ` and ${homographs.length - 3} more` : "";
|
|
20250
|
+
ctx.report({
|
|
20251
|
+
message: `Potential homograph attack: ${descriptions}${suffix}`,
|
|
20252
|
+
location: loc,
|
|
20253
|
+
suggestion: "Replace lookalike Cyrillic/Greek characters with Latin equivalents"
|
|
20254
|
+
});
|
|
20255
|
+
}
|
|
20256
|
+
if (EXCESSIVE_COMBINING_PATTERN.test(text)) {
|
|
20257
|
+
const match = text.match(EXCESSIVE_COMBINING_PATTERN);
|
|
20258
|
+
const charCodes = match ? Array.from(match[0]).slice(0, 4).map((c) => `U+${c.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`).join(", ") : "unknown";
|
|
20259
|
+
ctx.report({
|
|
20260
|
+
message: `Excessive combining characters (Zalgo text) detected: ${charCodes}...`,
|
|
20261
|
+
location: loc,
|
|
20262
|
+
suggestion: "Remove excessive diacritical marks that may be used to obscure content"
|
|
20263
|
+
});
|
|
20264
|
+
}
|
|
20265
|
+
});
|
|
20266
|
+
}
|
|
20267
|
+
};
|
|
20268
|
+
|
|
18954
20269
|
// packages/validator/src/rules/index.ts
|
|
18955
20270
|
var allRules = [
|
|
18956
20271
|
// Required meta rules (PS001, PS002)
|
|
@@ -18969,7 +20284,13 @@ var allRules = [
|
|
|
18969
20284
|
// Empty blocks (PS008)
|
|
18970
20285
|
emptyBlock,
|
|
18971
20286
|
// Valid params (PS009)
|
|
18972
|
-
validParams
|
|
20287
|
+
validParams,
|
|
20288
|
+
// Security rules (PS010, PS011, PS012, PS013, PS014)
|
|
20289
|
+
suspiciousUrls,
|
|
20290
|
+
authorityInjection,
|
|
20291
|
+
obfuscatedContent,
|
|
20292
|
+
pathTraversal,
|
|
20293
|
+
unicodeSecurity
|
|
18973
20294
|
];
|
|
18974
20295
|
|
|
18975
20296
|
// packages/validator/src/validator.ts
|
|
@@ -19083,6 +20404,45 @@ var Validator = class {
|
|
|
19083
20404
|
}
|
|
19084
20405
|
};
|
|
19085
20406
|
|
|
20407
|
+
// packages/validator/src/presets.ts
|
|
20408
|
+
var SECURITY_STRICT = {
|
|
20409
|
+
rules: {
|
|
20410
|
+
// Core security rules as errors
|
|
20411
|
+
"blocked-patterns": "error",
|
|
20412
|
+
"suspicious-urls": "error",
|
|
20413
|
+
"authority-injection": "error",
|
|
20414
|
+
"obfuscated-content": "error",
|
|
20415
|
+
"path-traversal": "error",
|
|
20416
|
+
"unicode-security": "error",
|
|
20417
|
+
// Other rules at default severity
|
|
20418
|
+
"required-meta-id": "error",
|
|
20419
|
+
"required-meta-syntax": "error",
|
|
20420
|
+
"valid-semver": "error",
|
|
20421
|
+
"valid-path": "error",
|
|
20422
|
+
"valid-params": "error",
|
|
20423
|
+
// Informational rules
|
|
20424
|
+
"empty-block": "warning",
|
|
20425
|
+
deprecated: "warning"
|
|
20426
|
+
},
|
|
20427
|
+
// Additional blocked patterns for strict mode
|
|
20428
|
+
blockedPatterns: [
|
|
20429
|
+
// Data exfiltration patterns
|
|
20430
|
+
/send\s+(?:this|all|the)\s+(?:data|information|content)\s+to/i,
|
|
20431
|
+
/upload\s+(?:this|all|the)\s+(?:data|files?|content)\s+to/i,
|
|
20432
|
+
/forward\s+(?:all\s+)?(?:messages?|responses?)\s+to/i,
|
|
20433
|
+
// Persistence patterns
|
|
20434
|
+
/remember\s+this\s+(?:permanently|forever|always)/i,
|
|
20435
|
+
/store\s+(?:this|these)\s+(?:instructions?|rules?)/i,
|
|
20436
|
+
// Model manipulation patterns
|
|
20437
|
+
/you\s+are\s+now\s+(?:a\s+)?different\s+(?:AI|model|system)/i,
|
|
20438
|
+
/switch\s+to\s+(?:a\s+)?(?:different|new)\s+(?:mode|persona)/i
|
|
20439
|
+
]
|
|
20440
|
+
};
|
|
20441
|
+
var SECURITY_STRICT_MULTILINGUAL = {
|
|
20442
|
+
...SECURITY_STRICT,
|
|
20443
|
+
blockedPatterns: [...SECURITY_STRICT.blockedPatterns ?? [], ...BLOCKED_PATTERNS_ALL_LANGUAGES]
|
|
20444
|
+
};
|
|
20445
|
+
|
|
19086
20446
|
// packages/compiler/src/compiler.ts
|
|
19087
20447
|
function generateMarker() {
|
|
19088
20448
|
const timestamp = (/* @__PURE__ */ new Date()).toISOString();
|