@resq-systems/security 1.0.5 → 2.1.0

package/lib/threats/rules/markup.mjs

@@ -0,0 +1,373 @@
+import { ALL_THREAT_CONTEXTS } from "../types.mjs";
+//#region src/threats/rules/markup.ts
+/**
+* Copyright 2026 ResQ Systems, Inc.
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+/**
+* @fileoverview Document- and prompt-level signatures: XML/XXE, server-side template
+* and SSI injection, LLM prompt injection, plus the small set of universal rules that
+* apply in every context because no legitimate input needs them.
+*
+* XXE and SSTI are configuration weaknesses, not filtering ones. XXE is prevented by
+* disabling DTD processing and external entity resolution in the parser; SSTI is
+* prevented by passing untrusted values as template *data* rather than splicing them
+* into template *source*. Both rule groups exist to catch a payload that a
+* misconfigured parser or a `renderString(userInput)` call would otherwise execute.
+*
+* @module @resq-systems/security/threats/rules/markup
+*/
+/** Repeated across every XML rule. */
+const XML_CONTROL = "Disable DTD processing and external entity resolution in the XML parser (noent:false, resolveExternals:false)";
+/** XML external entity and entity-expansion signatures. */
+const XML_INJECTION_RULES = [
+	{
+		id: "XML-ENTITY-DECL-001",
+		type: "xml_injection",
+		contexts: ["xml"],
+		severity: "critical",
+		confidence: "high",
+		description: "Inline ENTITY declaration",
+		cwe: 611,
+		primaryControl: XML_CONTROL,
+		pattern: /<!ENTITY\b/i
+	},
+	{
+		id: "XML-EXTERNAL-ID-001",
+		type: "xml_injection",
+		contexts: ["xml"],
+		severity: "critical",
+		confidence: "high",
+		description: "SYSTEM or PUBLIC external identifier",
+		cwe: 611,
+		primaryControl: XML_CONTROL,
+		pattern: /\b(?:SYSTEM|PUBLIC)\s+["']/
+	},
+	{
+		id: "XML-DOCTYPE-001",
+		type: "xml_injection",
+		contexts: ["xml"],
+		severity: "high",
+		confidence: "high",
+		description: "DOCTYPE declaration in untrusted XML",
+		cwe: 611,
+		primaryControl: XML_CONTROL,
+		pattern: /<!DOCTYPE\b/i
+	},
+	{
+		id: "XML-XINCLUDE-001",
+		type: "xml_injection",
+		contexts: ["xml"],
+		severity: "high",
+		confidence: "high",
+		description: "XInclude directive — an entity-free route to the same file read",
+		cwe: 611,
+		primaryControl: XML_CONTROL,
+		pattern: /<\s{0,8}xi:include\b|www\.w3\.org\/2001\/XInclude/i
+	},
+	{
+		id: "XML-CDATA-001",
+		type: "xml_injection",
+		contexts: ["xml"],
+		severity: "low",
+		confidence: "low",
+		description: "CDATA section, used to smuggle markup past naive filters",
+		cwe: 91,
+		primaryControl: XML_CONTROL,
+		pattern: /<!\[CDATA\[/
+	}
+];
+/** Repeated across most template-injection rules. */
+const SSTI_CONTROL = "Pass untrusted values as template data (context variables), never as template source; render with autoescaping on";
+/** Server-side template injection and SSI directives. */
+const TEMPLATE_INJECTION_RULES = [
+	{
+		id: "SSTI-SANDBOX-ESCAPE-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "critical",
+		confidence: "high",
+		description: "Python object-graph traversal used to escape a template sandbox",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /\b__(?:class|globals|subclasses|mro|builtins|import|base|init|reduce)__\b/
+	},
+	{
+		id: "SSTI-OGNL-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "critical",
+		confidence: "high",
+		description: "OGNL/EL expression reaching a runtime execution class",
+		cwe: 917,
+		primaryControl: SSTI_CONTROL,
+		pattern: /_memberAccess|\bRuntime\s{0,8}\.\s{0,8}getRuntime|\bProcessBuilder\b|@java\.lang\b/i
+	},
+	{
+		id: "SSTI-MUSTACHE-DELIMITER-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "high",
+		confidence: "medium",
+		description: "Handlebars/Jinja/Twig expression delimiters",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /\{\{[^{}]{0,200}\}\}/
+	},
+	{
+		id: "SSTI-STATEMENT-DELIMITER-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "high",
+		confidence: "medium",
+		description: "Jinja/Twig statement delimiters",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /\{%[^%]{0,200}%\}/
+	},
+	{
+		id: "SSTI-EL-DELIMITER-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "high",
+		confidence: "medium",
+		description: "JSP EL, Freemarker, or JS template-literal interpolation",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /[$#]\{[^{}]{0,200}\}/
+	},
+	{
+		id: "SSI-DIRECTIVE-001",
+		type: "template_injection",
+		contexts: ["template", "html"],
+		severity: "critical",
+		confidence: "high",
+		description: "Server-side include directive",
+		cwe: 97,
+		primaryControl: "Disable server-side includes, or serve untrusted content from a path with SSI turned off",
+		pattern: /<!--#\s{0,8}(?:exec|include|echo|config|fsize|flastmod|printenv|set)\b/i
+	},
+	{
+		id: "SSTI-SCRIPTLET-DELIMITER-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "high",
+		confidence: "medium",
+		description: "ERB / JSP / ASP / EJS scriptlet delimiters",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /<%[=\-@#!]|<%[^%]{0,200}%>/
+	},
+	{
+		id: "SSTI-FREEMARKER-DIRECTIVE-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "high",
+		confidence: "high",
+		description: "FreeMarker directive or user-defined directive call",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /<#\s{0,8}(?:assign|list|if|else|import|include|macro|function|setting|attempt|global|local|nested|recurse|switch|visit|compress|noparse|outputformat)\b|<@[\w.$]{1,64}\s{0,8}\(/i
+	},
+	{
+		id: "SSTI-VELOCITY-DIRECTIVE-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "high",
+		confidence: "medium",
+		description: "Velocity directive",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /#(?:set|parse|evaluate|macro|foreach|include)\s{0,8}\(/i
+	},
+	{
+		id: "SSTI-DOTNET-REFLECTION-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "critical",
+		confidence: "high",
+		description: "Razor/.NET expression reaching a process or assembly-loading class",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /\bSystem\.Diagnostics\.Process|\bProcess\.Start\s{0,8}\(|\bActivator\.CreateInstance\s{0,8}\(|\bAssembly\.Load\s{0,8}\(/i
+	},
+	{
+		id: "SSTI-NODE-REQUIRE-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "critical",
+		confidence: "high",
+		description: "Node module-graph traversal reaching a process or filesystem module",
+		cwe: 1336,
+		primaryControl: SSTI_CONTROL,
+		pattern: /\bprocess\s{0,8}\.\s{0,8}(?:mainModule|binding|constructor)\b|\brequire\s{0,8}\(\s{0,8}["'](?:node:)?(?:child_process|fs|vm|os)["']/i
+	},
+	{
+		id: "SSTI-SMARTY-PHP-001",
+		type: "template_injection",
+		contexts: ["template"],
+		severity: "critical",
+		confidence: "high",
+		description: "Smarty {php} tag",
+		cwe: 94,
+		primaryControl: "Disable the {php} tag; it was removed entirely in Smarty 4",
+		pattern: /\{\s{0,8}\/?\s{0,8}php\s{0,8}\}/i
+	}
+];
+/** Repeated across every prompt-injection rule. */
+const PROMPT_CONTROL = "Keep untrusted content in a clearly delimited data channel, constrain tool scopes, and require confirmation for consequential tool calls";
+/**
+* LLM prompt injection.
+*
+* These are the weakest signatures in the catalog by construction — prompt injection
+* is expressed in natural language, so no finite pattern set bounds it. They are
+* graded accordingly (mostly `medium` confidence) and are useful as telemetry and as
+* a tripwire for human review, never as an authorization decision.
+*/
+const PROMPT_INJECTION_RULES = [
+	{
+		id: "PROMPT-OVERRIDE-001",
+		type: "prompt_injection",
+		contexts: ["llm_prompt"],
+		severity: "high",
+		confidence: "medium",
+		description: "Instruction to disregard prior directives",
+		cwe: 1427,
+		primaryControl: PROMPT_CONTROL,
+		pattern: /\b(?:ignore|disregard|forget|override|bypass)\s+(?:all\s+|any\s+|the\s+|your\s+|previous\s+|prior\s+|earlier\s+|above\s+){0,3}(?:instructions?|prompts?|rules?|directions?|guidelines?|constraints?)\b/i
+	},
+	{
+		id: "PROMPT-DELIMITER-SPOOF-001",
+		type: "prompt_injection",
+		contexts: ["llm_prompt"],
+		severity: "high",
+		confidence: "high",
+		description: "Chat-template control token forged in user content",
+		cwe: 1427,
+		primaryControl: PROMPT_CONTROL,
+		pattern: /<\|(?:im_start|im_end|endoftext|system|user|assistant|channel)\|>/i
+	},
+	{
+		id: "PROMPT-ROLE-SPOOF-001",
+		type: "prompt_injection",
+		contexts: ["llm_prompt"],
+		severity: "medium",
+		confidence: "medium",
+		description: "Line beginning with a conversational role label",
+		cwe: 1427,
+		primaryControl: PROMPT_CONTROL,
+		pattern: /^\s{0,8}(?:system|assistant|developer|tool)\s{0,8}:/im
+	},
+	{
+		id: "PROMPT-EXFIL-001",
+		type: "prompt_injection",
+		contexts: ["llm_prompt"],
+		severity: "high",
+		confidence: "medium",
+		description: "Request to disclose the system prompt or hidden instructions",
+		cwe: 1427,
+		primaryControl: PROMPT_CONTROL,
+		pattern: /\b(?:reveal|repeat|print|output|show|display|summarize)\s+(?:me\s+)?(?:your|the)\s+(?:system\s+|initial\s+|original\s+|hidden\s+){0,2}(?:prompt|instructions?|rules?|directives?)\b/i
+	},
+	{
+		id: "PROMPT-TOOL-COERCION-001",
+		type: "prompt_injection",
+		contexts: ["llm_prompt"],
+		severity: "high",
+		confidence: "medium",
+		description: "Directive coercing a specific tool or function invocation",
+		cwe: 1427,
+		primaryControl: PROMPT_CONTROL,
+		pattern: /\b(?:you\s+must|always|immediately|be\s+sure\s+to)\s+(?:call|invoke|run|use|execute)\s+(?:the\s+)?[\w.-]{1,64}\s+(?:tool|function|command|api)\b/i
+	}
+];
+/**
+* Rules that apply in every context, including `general_text`.
+*
+* The bar for membership is high: a rule belongs here only if there is no legitimate
+* reason for the character to appear in *any* user-supplied value. Bidirectional
+* overrides (the "Trojan Source" class, CVE-2021-42574), zero-width characters used
+* to spoof identity, and C0 control characters all clear it. SQL keywords and `../`
+* emphatically do not, which is why they are context-scoped instead.
+*/
+const UNIVERSAL_RULES = [
+	{
+		id: "UNICODE-BIDI-OVERRIDE-001",
+		type: "homoglyph",
+		contexts: ALL_THREAT_CONTEXTS,
+		severity: "critical",
+		confidence: "high",
+		description: "Bidirectional override character — reorders rendered text away from its logical order",
+		cwe: 451,
+		primaryControl: "Reject bidi controls outright, or render with them stripped",
+		pattern: /[\u202a-\u202e\u2066-\u2069]/
+	},
+	{
+		id: "UNICODE-INVISIBLE-001",
+		type: "homoglyph",
+		contexts: [
+			"general_text",
+			"html",
+			"identifier",
+			"object_merge",
+			"url",
+			"url_parameter",
+			"sql",
+			"nosql",
+			"shell",
+			"filesystem",
+			"ldap",
+			"xpath",
+			"xml",
+			"template",
+			"spreadsheet",
+			"jwt",
+			"http_header",
+			"log",
+			"llm_prompt"
+		],
+		severity: "medium",
+		confidence: "medium",
+		description: "Zero-width or invisible formatting character",
+		cwe: 1007,
+		primaryControl: "Strip default-ignorable code points before comparison or storage",
+		pattern: /[\u00ad\u200b-\u200f\u2060-\u2064\ufeff]/
+	},
+	{
+		id: "UNICODE-INVISIBLE-IDENTIFIER-001",
+		type: "homoglyph",
+		contexts: ["identifier"],
+		severity: "high",
+		confidence: "medium",
+		description: "Invisible formatting character in a protected identifier",
+		cwe: 1007,
+		primaryControl: "Strip default-ignorable code points, then compare UTS #39 skeletons at registration time",
+		pattern: /[\u00ad\u200b-\u200f\u2060-\u2064\ufeff]/
+	},
+	{
+		id: "CONTROL-CHAR-001",
+		type: "resource_abuse",
+		contexts: ALL_THREAT_CONTEXTS,
+		severity: "medium",
+		confidence: "medium",
+		description: "C0/C1 control character other than tab, CR, or LF",
+		cwe: 74,
+		primaryControl: "Reject or strip control characters at the trust boundary",
+		pattern: /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/
+	}
+];
+//#endregion
+export { PROMPT_INJECTION_RULES, TEMPLATE_INJECTION_RULES, UNIVERSAL_RULES, XML_INJECTION_RULES };
+
+//# sourceMappingURL=markup.mjs.map

package/lib/threats/rules/markup.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"markup.mjs","names":[],"sources":["../../../src/threats/rules/markup.ts"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * @fileoverview Document- and prompt-level signatures: XML/XXE, server-side template\n * and SSI injection, LLM prompt injection, plus the small set of universal rules that\n * apply in every context because no legitimate input needs them.\n *\n * XXE and SSTI are configuration weaknesses, not filtering ones. XXE is prevented by\n * disabling DTD processing and external entity resolution in the parser; SSTI is\n * prevented by passing untrusted values as template *data* rather than splicing them\n * into template *source*. Both rule groups exist to catch a payload that a\n * misconfigured parser or a `renderString(userInput)` call would otherwise execute.\n *\n * @module @resq-systems/security/threats/rules/markup\n */\n\nimport { ALL_THREAT_CONTEXTS, type ThreatRule } from \"../types.js\";\n\n//#region XML / XXE\n\n/** Repeated across every XML rule. */\nconst XML_CONTROL =\n\t\"Disable DTD processing and external entity resolution in the XML parser (noent:false, resolveExternals:false)\";\n\n/** XML external entity and entity-expansion signatures. */\nexport const XML_INJECTION_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"XML-ENTITY-DECL-001\",\n\t\ttype: \"xml_injection\",\n\t\tcontexts: [\"xml\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Inline ENTITY declaration\",\n\t\tcwe: 611,\n\t\tprimaryControl: XML_CONTROL,\n\t\tpattern: /<!ENTITY\\b/i,\n\t},\n\t{\n\t\tid: \"XML-EXTERNAL-ID-001\",\n\t\ttype: \"xml_injection\",\n\t\tcontexts: [\"xml\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"SYSTEM or PUBLIC external identifier\",\n\t\tcwe: 611,\n\t\tprimaryControl: XML_CONTROL,\n\t\tpattern: /\\b(?:SYSTEM|PUBLIC)\\s+[\"']/,\n\t},\n\t{\n\t\tid: \"XML-DOCTYPE-001\",\n\t\ttype: \"xml_injection\",\n\t\tcontexts: [\"xml\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"DOCTYPE declaration in untrusted XML\",\n\t\tcwe: 611,\n\t\tprimaryControl: XML_CONTROL,\n\t\tpattern: /<!DOCTYPE\\b/i,\n\t},\n\t{\n\t\tid: \"XML-XINCLUDE-001\",\n\t\ttype: \"xml_injection\",\n\t\tcontexts: [\"xml\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"XInclude directive — an entity-free route to the same file read\",\n\t\tcwe: 611,\n\t\tprimaryControl: XML_CONTROL,\n\t\tpattern: /<\\s{0,8}xi:include\\b|www\\.w3\\.org\\/2001\\/XInclude/i,\n\t},\n\t{\n\t\tid: \"XML-CDATA-001\",\n\t\ttype: \"xml_injection\",\n\t\tcontexts: [\"xml\"],\n\t\tseverity: \"low\",\n\t\tconfidence: \"low\",\n\t\tdescription: \"CDATA section, used to smuggle markup past naive filters\",\n\t\tcwe: 91,\n\t\tprimaryControl: XML_CONTROL,\n\t\tpattern: /<!\\[CDATA\\[/,\n\t},\n];\n\n//#endregion\n\n//#region Template injection\n\n/** Repeated across most template-injection rules. */\nconst SSTI_CONTROL =\n\t\"Pass untrusted values as template data (context variables), never as template source; render with autoescaping on\";\n\n/** Server-side template injection and SSI directives. */\nexport const TEMPLATE_INJECTION_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"SSTI-SANDBOX-ESCAPE-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Python object-graph traversal used to escape a template sandbox\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\tpattern: /\\b__(?:class|globals|subclasses|mro|builtins|import|base|init|reduce)__\\b/,\n\t},\n\t{\n\t\tid: \"SSTI-OGNL-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"OGNL/EL expression reaching a runtime execution class\",\n\t\tcwe: 917,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\tpattern: /_memberAccess|\\bRuntime\\s{0,8}\\.\\s{0,8}getRuntime|\\bProcessBuilder\\b|@java\\.lang\\b/i,\n\t},\n\t{\n\t\tid: \"SSTI-MUSTACHE-DELIMITER-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Handlebars/Jinja/Twig expression delimiters\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\t// The inner class excludes `{` as well as `}`. With only `}` excluded, an\n\t\t// input of 100 000 `{` characters makes the engine consume 200 of them at\n\t\t// every start position and then backtrack — ~40ms per scan, measured by\n\t\t// tests/regex-safety.test.ts. Excluding `{` makes the failure immediate, and\n\t\t// costs nothing: a template expression does not contain a bare `{`.\n\t\tpattern: /\\{\\{[^{}]{0,200}\\}\\}/,\n\t},\n\t{\n\t\tid: \"SSTI-STATEMENT-DELIMITER-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Jinja/Twig statement delimiters\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\tpattern: /\\{%[^%]{0,200}%\\}/,\n\t},\n\t{\n\t\tid: \"SSTI-EL-DELIMITER-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"JSP EL, Freemarker, or JS template-literal interpolation\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\t// `{` excluded from the inner class for the same reason as the rule above.\n\t\tpattern: /[$#]\\{[^{}]{0,200}\\}/,\n\t},\n\t{\n\t\tid: \"SSI-DIRECTIVE-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\", \"html\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Server-side include directive\",\n\t\tcwe: 97,\n\t\tprimaryControl:\n\t\t\t\"Disable server-side includes, or serve untrusted content from a path with SSI turned off\",\n\t\tpattern: /<!--#\\s{0,8}(?:exec|include|echo|config|fsize|flastmod|printenv|set)\\b/i,\n\t},\n\t{\n\t\tid: \"SSTI-SCRIPTLET-DELIMITER-001\",\n\t\ttype: \"template_injection\",\n\t\t// `template` only. A scriptlet spliced into an already-rendered response does\n\t\t// not execute — only template *source* is an execution path. SSI-DIRECTIVE-001\n\t\t// is in both because Apache and nginx post-process served HTML; no equivalent\n\t\t// stage exists for ERB, JSP, ASP, or EJS.\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"ERB / JSP / ASP / EJS scriptlet delimiters\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\tpattern: /<%[=\\-@#!]|<%[^%]{0,200}%>/,\n\t},\n\t{\n\t\tid: \"SSTI-FREEMARKER-DIRECTIVE-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"FreeMarker directive or user-defined directive call\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\tpattern:\n\t\t\t/<#\\s{0,8}(?:assign|list|if|else|import|include|macro|function|setting|attempt|global|local|nested|recurse|switch|visit|compress|noparse|outputformat)\\b|<@[\\w.$]{1,64}\\s{0,8}\\(/i,\n\t},\n\t{\n\t\tid: \"SSTI-VELOCITY-DIRECTIVE-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Velocity directive\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\tpattern: /#(?:set|parse|evaluate|macro|foreach|include)\\s{0,8}\\(/i,\n\t},\n\t{\n\t\tid: \"SSTI-DOTNET-REFLECTION-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Razor/.NET expression reaching a process or assembly-loading class\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\t// A bare Razor `@(` / `@{` delimiter rule was rejected: two characters of common\n\t\t// punctuation that matched Objective-C literals and `@media` queries. This\n\t\t// targets capability reach instead, mirroring how SSTI-OGNL-001 handles Java.\n\t\t// `Process\\.Start` is required literally — the spaced form matched the sentence\n\t\t// \"Our deployment process. Start(ing) Monday\".\n\t\tpattern:\n\t\t\t/\\bSystem\\.Diagnostics\\.Process|\\bProcess\\.Start\\s{0,8}\\(|\\bActivator\\.CreateInstance\\s{0,8}\\(|\\bAssembly\\.Load\\s{0,8}\\(/i,\n\t},\n\t{\n\t\tid: \"SSTI-NODE-REQUIRE-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Node module-graph traversal reaching a process or filesystem module\",\n\t\tcwe: 1336,\n\t\tprimaryControl: SSTI_CONTROL,\n\t\tpattern:\n\t\t\t/\\bprocess\\s{0,8}\\.\\s{0,8}(?:mainModule|binding|constructor)\\b|\\brequire\\s{0,8}\\(\\s{0,8}[\"'](?:node:)?(?:child_process|fs|vm|os)[\"']/i,\n\t},\n\t{\n\t\tid: \"SSTI-SMARTY-PHP-001\",\n\t\ttype: \"template_injection\",\n\t\tcontexts: [\"template\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Smarty {php} tag\",\n\t\tcwe: 94,\n\t\tprimaryControl: \"Disable the {php} tag; it was removed entirely in Smarty 4\",\n\t\tpattern: /\\{\\s{0,8}\\/?\\s{0,8}php\\s{0,8}\\}/i,\n\t},\n];\n\n//#endregion\n\n//#region Prompt injection\n\n/** Repeated across every prompt-injection rule. */\nconst PROMPT_CONTROL =\n\t\"Keep untrusted content in a clearly delimited data channel, constrain tool scopes, and require confirmation for consequential tool calls\";\n\n/**\n * LLM prompt injection.\n *\n * These are the weakest signatures in the catalog by construction — prompt injection\n * is expressed in natural language, so no finite pattern set bounds it. They are\n * graded accordingly (mostly `medium` confidence) and are useful as telemetry and as\n * a tripwire for human review, never as an authorization decision.\n */\nexport const PROMPT_INJECTION_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"PROMPT-OVERRIDE-001\",\n\t\ttype: \"prompt_injection\",\n\t\tcontexts: [\"llm_prompt\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Instruction to disregard prior directives\",\n\t\tcwe: 1427,\n\t\tprimaryControl: PROMPT_CONTROL,\n\t\tpattern:\n\t\t\t/\\b(?:ignore|disregard|forget|override|bypass)\\s+(?:all\\s+|any\\s+|the\\s+|your\\s+|previous\\s+|prior\\s+|earlier\\s+|above\\s+){0,3}(?:instructions?|prompts?|rules?|directions?|guidelines?|constraints?)\\b/i,\n\t},\n\t{\n\t\tid: \"PROMPT-DELIMITER-SPOOF-001\",\n\t\ttype: \"prompt_injection\",\n\t\tcontexts: [\"llm_prompt\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Chat-template control token forged in user content\",\n\t\tcwe: 1427,\n\t\tprimaryControl: PROMPT_CONTROL,\n\t\tpattern: /<\\|(?:im_start|im_end|endoftext|system|user|assistant|channel)\\|>/i,\n\t},\n\t{\n\t\tid: \"PROMPT-ROLE-SPOOF-001\",\n\t\ttype: \"prompt_injection\",\n\t\tcontexts: [\"llm_prompt\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Line beginning with a conversational role label\",\n\t\tcwe: 1427,\n\t\tprimaryControl: PROMPT_CONTROL,\n\t\tpattern: /^\\s{0,8}(?:system|assistant|developer|tool)\\s{0,8}:/im,\n\t},\n\t{\n\t\tid: \"PROMPT-EXFIL-001\",\n\t\ttype: \"prompt_injection\",\n\t\tcontexts: [\"llm_prompt\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Request to disclose the system prompt or hidden instructions\",\n\t\tcwe: 1427,\n\t\tprimaryControl: PROMPT_CONTROL,\n\t\tpattern:\n\t\t\t/\\b(?:reveal|repeat|print|output|show|display|summarize)\\s+(?:me\\s+)?(?:your|the)\\s+(?:system\\s+|initial\\s+|original\\s+|hidden\\s+){0,2}(?:prompt|instructions?|rules?|directives?)\\b/i,\n\t},\n\t{\n\t\tid: \"PROMPT-TOOL-COERCION-001\",\n\t\ttype: \"prompt_injection\",\n\t\tcontexts: [\"llm_prompt\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Directive coercing a specific tool or function invocation\",\n\t\tcwe: 1427,\n\t\tprimaryControl: PROMPT_CONTROL,\n\t\tpattern:\n\t\t\t/\\b(?:you\\s+must|always|immediately|be\\s+sure\\s+to)\\s+(?:call|invoke|run|use|execute)\\s+(?:the\\s+)?[\\w.-]{1,64}\\s+(?:tool|function|command|api)\\b/i,\n\t},\n];\n\n//#endregion\n\n//#region Universal\n\n/**\n * Every sink. An invisible formatting character has no legitimate place in a value\n * bound to any of them.\n *\n * This list previously excluded `sql`, `shell`, `ldap` and the other machine-syntax\n * sinks, on the stated grounds that those \"get the stricter {@link UNIVERSAL_RULES}\n * bidi and control-character rules instead\". Mutation testing showed that reasoning was\n * wrong: the bidi rule matches only U+202A-202E and U+2066-2069, and the control-character\n * rule only C0/C1 — neither matches U+200B. A zero-width space inside a SQL keyword\n * therefore raised **no finding at all**, and `1 U<ZWSP>NION SELECT` scored zero.\n *\n * The severity stays `medium`/`medium` rather than rising, because at the human-text\n * sinks the same code points are orthographic in Persian and Hindi and structural in\n * every ZWJ emoji sequence. The finding is raised everywhere; the verdict is left to\n * scoring.\n */\nconst INVISIBLE_CONTEXTS = [\n\t\"general_text\",\n\t\"html\",\n\t\"identifier\",\n\t\"object_merge\",\n\t\"url\",\n\t\"url_parameter\",\n\t\"sql\",\n\t\"nosql\",\n\t\"shell\",\n\t\"filesystem\",\n\t\"ldap\",\n\t\"xpath\",\n\t\"xml\",\n\t\"template\",\n\t\"spreadsheet\",\n\t\"jwt\",\n\t\"http_header\",\n\t\"log\",\n\t\"llm_prompt\",\n] as const;\n\n/**\n * Rules that apply in every context, including `general_text`.\n *\n * The bar for membership is high: a rule belongs here only if there is no legitimate\n * reason for the character to appear in *any* user-supplied value. Bidirectional\n * overrides (the \"Trojan Source\" class, CVE-2021-42574), zero-width characters used\n * to spoof identity, and C0 control characters all clear it. SQL keywords and `../`\n * emphatically do not, which is why they are context-scoped instead.\n */\nexport const UNIVERSAL_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"UNICODE-BIDI-OVERRIDE-001\",\n\t\ttype: \"homoglyph\",\n\t\tcontexts: ALL_THREAT_CONTEXTS,\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription:\n\t\t\t\"Bidirectional override character — reorders rendered text away from its logical order\",\n\t\tcwe: 451,\n\t\tprimaryControl: \"Reject bidi controls outright, or render with them stripped\",\n\t\tpattern: /[\\u202a-\\u202e\\u2066-\\u2069]/,\n\t},\n\t{\n\t\tid: \"UNICODE-INVISIBLE-001\",\n\t\ttype: \"homoglyph\",\n\t\tcontexts: INVISIBLE_CONTEXTS,\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Zero-width or invisible formatting character\",\n\t\tcwe: 1007,\n\t\tprimaryControl: \"Strip default-ignorable code points before comparison or storage\",\n\t\tpattern: /[\\u00ad\\u200b-\\u200f\\u2060-\\u2064\\ufeff]/,\n\t},\n\t{\n\t\tid: \"UNICODE-INVISIBLE-IDENTIFIER-001\",\n\t\ttype: \"homoglyph\",\n\t\t// Scoped to identifiers alone, and graded harder than UNICODE-INVISIBLE-001.\n\t\t// ZWNJ and ZWJ are required for correct Persian and Hindi rendering and appear\n\t\t// in ordinary emoji sequences, so the general rule stays at medium/medium. In a\n\t\t// username, domain, or package name there is no such defence: an invisible\n\t\t// character exists only to make two different identifiers render alike.\n\t\tcontexts: [\"identifier\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Invisible formatting character in a protected identifier\",\n\t\tcwe: 1007,\n\t\tprimaryControl:\n\t\t\t\"Strip default-ignorable code points, then compare UTS #39 skeletons at registration time\",\n\t\tpattern: /[\\u00ad\\u200b-\\u200f\\u2060-\\u2064\\ufeff]/,\n\t},\n\t{\n\t\tid: \"CONTROL-CHAR-001\",\n\t\ttype: \"resource_abuse\",\n\t\tcontexts: ALL_THREAT_CONTEXTS,\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"C0/C1 control character other than tab, CR, or LF\",\n\t\tcwe: 74,\n\t\tprimaryControl: \"Reject or strip control characters at the trust boundary\",\n\t\t// biome-ignore lint/suspicious/noControlCharactersInRegex: detecting control characters is this rule's entire purpose\n\t\tpattern: /[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f]/,\n\t},\n];\n\n//#endregion\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAM,cACL;;AAGD,MAAa,sBAA6C;CACzD;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;AACD;;AAOA,MAAM,eACL;;AAGD,MAAa,2BAAkD;CAC9D;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAMhB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAEhB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,YAAY,MAAM;EAC7B,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBACC;EACD,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EAKN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAMhB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,UAAU;EACrB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;AACD;;AAOA,MAAM,iBACL;;;;;;;;;AAUD,MAAa,yBAAgD;CAC5D;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,YAAY;EACvB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,YAAY;EACvB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,YAAY;EACvB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,YAAY;EACvB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,YAAY;EACvB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;AACD;;;;;;;;;;AAqDA,MAAa,kBAAyC;CACrD;EACC,IAAI;EACJ,MAAM;EACN,UAAU;EACV,UAAU;EACV,YAAY;EACZ,aACC;EACD,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU;GA9CX;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EA4BW;EACV,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EAMN,UAAU,CAAC,YAAY;EACvB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBACC;EACD,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU;EACV,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAEhB,SAAS;CACV;AACD"}

package/lib/threats/rules/protocol.d.mts

@@ -0,0 +1,49 @@
+import { ThreatRule } from "../types.mjs";
+//#region src/threats/rules/protocol.d.ts
+/**
+ * Parameter pollution.
+ *
+ * Only the *injected-parameter* half is detectable here. Duplicate-key pollution —
+ * `?id=1&id=2` exploiting parser disagreement between ASP.NET, PHP, and Servlet
+ * stacks — is not: the engine sees one string and never the parameter map, and
+ * duplicate keys are legal and routine (`?tag=a&tag=b`). That half is a parsing
+ * decision, documented as such rather than faked with a signature.
+ */
+declare const PARAMETER_POLLUTION_RULES: readonly ThreatRule[];
+/**
+ * Credential material appearing where it will be stored, logged, or sent onward.
+ *
+ * A generic `password=…` / `api_key: …` assignment rule was written and then dropped:
+ * it produced false positives on every realistic log line of the form
+ * `"api_key: required for this endpoint"` and `"validation failed: password: too_short"`.
+ * Shipping it weakened would trade the category's credibility for coverage.
+ */
+declare const CREDENTIAL_EXPOSURE_RULES: readonly ThreatRule[];
+/**
+ * Double percent-encoding.
+ *
+ * `%253Cscript%253E` decodes once to `%3Cscript%3E` and twice to `<script>`. The
+ * scanner decodes once, so the payload was invisible to every signature — verified at
+ * 0/allow before this rule existed. The traversal case had an explicit
+ * `%252e%252e%252f` rule; nothing covered the general class.
+ *
+ * Its own category rather than a subtype of whatever it eventually decodes to: at scan
+ * time the eventual sink is unknown, and the signal — "this input is shaped to survive
+ * one decoding pass" — is itself the finding. The real fix is to decode exactly once,
+ * at a defined boundary, and never again.
+ */
+declare const DOUBLE_ENCODING_RULES: readonly ThreatRule[];
+/**
+ * JWT tampering.
+ *
+ * Scoped to the unsecured-token case alone. `kid`, `jku`, and `x5u` injection are
+ * *already covered* — extract the claim and declare its real sink, and the existing
+ * rules fire: `kid=../../../../dev/null` with `filesystem` hits PATH-TRAVERSAL-001,
+ * `jku=http://169.254.169.254/` with `url` hits SSRF-METADATA-001. Re-scanning a whole
+ * opaque token with every detector would be the run-everything-against-everything
+ * anti-pattern the engine exists to avoid.
+ */
+declare const JWT_RULES: readonly ThreatRule[];
+//#endregion
+export { CREDENTIAL_EXPOSURE_RULES, DOUBLE_ENCODING_RULES, JWT_RULES, PARAMETER_POLLUTION_RULES };
+//# sourceMappingURL=protocol.d.mts.map

package/lib/threats/rules/protocol.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.mts","names":[],"sources":["../../../src/threats/rules/protocol.ts"],"mappings":";;;;;;;;;;;cA0Ca,oCAAoC;;;;;;;;;cA2DpC,oCAAoC;;;;;;;;;;;;;;cAwEpC,gCAAgC;;;;;;;;;;;cAyDhC,oBAAoB"}

package/lib/threats/rules/protocol.mjs

@@ -0,0 +1,175 @@
+//#region src/threats/rules/protocol.ts
+/**
+* Parameter pollution.
+*
+* Only the *injected-parameter* half is detectable here. Duplicate-key pollution —
+* `?id=1&id=2` exploiting parser disagreement between ASP.NET, PHP, and Servlet
+* stacks — is not: the engine sees one string and never the parameter map, and
+* duplicate keys are legal and routine (`?tag=a&tag=b`). That half is a parsing
+* decision, documented as such rather than faked with a signature.
+*/
+const PARAMETER_POLLUTION_RULES = [{
+	id: "PARAM-POLLUTION-PRIVILEGED-001",
+	type: "parameter_pollution",
+	contexts: ["url_parameter"],
+	severity: "high",
+	confidence: "medium",
+	description: "Injected parameter naming a privilege, price, or credential field",
+	cwe: 235,
+	primaryControl: "Build query strings with URLSearchParams or encodeURIComponent per value; read parameters through one parser and reject duplicate keys server-side",
+	pattern: /[&;][a-z0-9_.[-]{0,24}(?:role|is_?admin|admin|user_?id|userid|uid|account_?id|amount|price|total|quantity|qty|access_?token|api_?key|apikey|client_?secret|secret|password|passwd|pwd|session_?id|sessionid|signature|hmac|permissions?|privilege|is_?staff|superuser|debug)[\]"']{0,2}\s{0,4}=/i
+}, {
+	id: "PARAM-POLLUTION-APPEND-001",
+	type: "parameter_pollution",
+	contexts: ["url_parameter"],
+	severity: "medium",
+	confidence: "low",
+	description: "Value appends an additional query parameter",
+	cwe: 235,
+	primaryControl: "Build query strings with URLSearchParams or encodeURIComponent per value; read parameters through one parser and reject duplicate keys server-side",
+	pattern: /^[^?]{0,256}&[a-z_][a-z0-9_.-]{1,48}(?:\[[a-z0-9_.-]{0,32}\])?\s{0,4}=/i
+}];
+/** Repeated across the URL-borne credential rules. */
+const CRED_URL_CONTROL = "Carry credentials in the Authorization header or a POST body, never a query string; set Referrer-Policy: no-referrer and rotate any token that reached a URL";
+/**
+* Credential material appearing where it will be stored, logged, or sent onward.
+*
+* A generic `password=…` / `api_key: …` assignment rule was written and then dropped:
+* it produced false positives on every realistic log line of the form
+* `"api_key: required for this endpoint"` and `"validation failed: password: too_short"`.
+* Shipping it weakened would trade the category's credibility for coverage.
+*/
+const CREDENTIAL_EXPOSURE_RULES = [
+	{
+		id: "CRED-URL-QUERY-001",
+		type: "credential_exposure",
+		contexts: ["url", "log"],
+		severity: "high",
+		confidence: "medium",
+		description: "Credential-bearing query parameter — leaks via Referer, proxies, and logs",
+		cwe: 598,
+		primaryControl: CRED_URL_CONTROL,
+		pattern: /[?&](?:access[_-]?token|auth[_-]?token|id[_-]?token|refresh[_-]?token|api[_-]?key|api[_-]?secret|client[_-]?secret|secret[_-]?key|session[_-]?id|session[_-]?token|jsessionid|phpsessid|password|passwd|pwd)=[^&#\s]{4,256}/i
+	},
+	{
+		id: "CRED-AUTH-SCHEME-001",
+		type: "credential_exposure",
+		contexts: ["log"],
+		severity: "high",
+		confidence: "high",
+		description: "Authorization header value written to a log",
+		cwe: 532,
+		primaryControl: "Log structured records with an allowlist of loggable fields; redact by key with safeStringify",
+		pattern: /\b(?:proxy-)?authorization\s{0,4}:\s{0,4}(?:bearer|basic|digest|token|apikey)\s{0,4}[A-Za-z0-9+/=._~-]{8,512}/i
+	},
+	{
+		id: "CRED-JWT-001",
+		type: "credential_exposure",
+		contexts: ["url", "log"],
+		severity: "high",
+		confidence: "high",
+		description: "JSON Web Token in a URL or log line",
+		cwe: 522,
+		primaryControl: CRED_URL_CONTROL,
+		pattern: /\beyJ[A-Za-z0-9_-]{10,400}\.eyJ[A-Za-z0-9_-]{10,400}\./
+	},
+	{
+		id: "CRED-PROVIDER-KEY-001",
+		type: "credential_exposure",
+		contexts: ["url", "log"],
+		severity: "critical",
+		confidence: "high",
+		description: "Provider API key or personal access token",
+		cwe: 532,
+		primaryControl: "Load provider keys from a secret manager, never from source or a URL; rotate immediately on exposure",
+		pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b|\bgh[pousr]_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,82}\b|\bxox[abprs]-[A-Za-z0-9-]{10,120}|\bsk_live_[A-Za-z0-9]{16,64}\b|\bsk-(?:ant|proj)-[A-Za-z0-9_-]{20,120}/
+	}
+];
+/**
+* Double percent-encoding.
+*
+* `%253Cscript%253E` decodes once to `%3Cscript%3E` and twice to `<script>`. The
+* scanner decodes once, so the payload was invisible to every signature — verified at
+* 0/allow before this rule existed. The traversal case had an explicit
+* `%252e%252e%252f` rule; nothing covered the general class.
+*
+* Its own category rather than a subtype of whatever it eventually decodes to: at scan
+* time the eventual sink is unknown, and the signal — "this input is shaped to survive
+* one decoding pass" — is itself the finding. The real fix is to decode exactly once,
+* at a defined boundary, and never again.
+*/
+const DOUBLE_ENCODING_RULES = [{
+	id: "ENCODING-DOUBLE-PERCENT-002",
+	type: "double_encoding",
+	contexts: [
+		"url",
+		"url_parameter",
+		"html",
+		"filesystem",
+		"sql",
+		"http_header",
+		"xml"
+	],
+	severity: "high",
+	confidence: "high",
+	description: "Percent sign and its hex digits each encoded separately",
+	cwe: 177,
+	primaryControl: "Decode exactly once at a defined boundary and never re-decode; reject input that still contains an escape prefix after decoding",
+	pattern: /%25%[0-9a-f]{2}%[0-9a-f]{2}/i
+}, {
+	id: "ENCODING-DOUBLE-PERCENT-001",
+	type: "double_encoding",
+	contexts: [
+		"url",
+		"url_parameter",
+		"html",
+		"filesystem",
+		"sql",
+		"http_header",
+		"xml"
+	],
+	severity: "high",
+	confidence: "medium",
+	description: "Escape prefix that decodes to a metacharacter only after a second pass",
+	cwe: 177,
+	primaryControl: "Decode exactly once at a defined boundary and never re-decode; reject input that still contains an escape prefix after decoding",
+	variants: ["raw"],
+	pattern: /%25(?:2[0257CEFcef]|3[CEce]|22|26|27|28|29|3[BbDd]|5[Cc]|00|0[ADad])/
+}];
+/** Repeated across the JWT rules. */
+const JWT_CONTROL = "Verify with an explicit algorithm allowlist (jwtVerify(token, key, { algorithms: ['RS256'] })); never let the token's own header select the algorithm, and reject 'none' unconditionally";
+/**
+* JWT tampering.
+*
+* Scoped to the unsecured-token case alone. `kid`, `jku`, and `x5u` injection are
+* *already covered* — extract the claim and declare its real sink, and the existing
+* rules fire: `kid=../../../../dev/null` with `filesystem` hits PATH-TRAVERSAL-001,
+* `jku=http://169.254.169.254/` with `url` hits SSRF-METADATA-001. Re-scanning a whole
+* opaque token with every detector would be the run-everything-against-everything
+* anti-pattern the engine exists to avoid.
+*/
+const JWT_RULES = [{
+	id: "JWT-ALG-NONE-UNSECURED-001",
+	type: "jwt_tampering",
+	contexts: ["jwt", "http_header"],
+	severity: "high",
+	confidence: "high",
+	description: "Unsecured JWT — three segments with an empty signature",
+	cwe: 347,
+	primaryControl: JWT_CONTROL,
+	pattern: /(?:^|[\s,;=("'[])eyJ[A-Za-z0-9_-]{16,2000}\.eyJ[A-Za-z0-9_-]{8,4000}\.(?:$|[\s,;)"'\]&#])/
+}, {
+	id: "JWT-ALG-NONE-HEADER-001",
+	type: "jwt_tampering",
+	contexts: ["jwt"],
+	severity: "high",
+	confidence: "high",
+	description: "Decoded JWT header selecting the 'none' algorithm",
+	cwe: 347,
+	primaryControl: JWT_CONTROL,
+	pattern: /"alg"\s{0,8}:\s{0,8}"\s{0,8}none\s{0,8}"/i
+}];
+//#endregion
+export { CREDENTIAL_EXPOSURE_RULES, DOUBLE_ENCODING_RULES, JWT_RULES, PARAMETER_POLLUTION_RULES };
+
+//# sourceMappingURL=protocol.mjs.map