@resq-systems/security 1.0.5 → 2.1.0

package/lib/threats/rules/web.mjs

@@ -0,0 +1,412 @@
+//#region src/threats/rules/web.ts
+/** Repeated across every XSS rule — the control that actually prevents the weakness. */
+const XSS_CONTROL = "Escape at the HTML sink; sanitize rich HTML with DOMPurify";
+/** XSS signatures. Meaningful only where the value is interpolated into markup. */
+const XSS_RULES = [
+	{
+		id: "XSS-SCRIPT-TAG-001",
+		type: "xss",
+		contexts: ["html", "xml"],
+		severity: "high",
+		confidence: "high",
+		description: "Opening <script> tag",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /<\s*script\b/i
+	},
+	{
+		id: "XSS-EVENT-HANDLER-001",
+		type: "xss",
+		contexts: ["html", "xml"],
+		severity: "high",
+		confidence: "high",
+		description: "Inline event handler attribute inside a tag",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /<[a-z][^>]{0,300}\bon[a-z]{3,20}\s{0,8}=/i
+	},
+	{
+		id: "XSS-EVENT-HANDLER-002",
+		type: "xss",
+		contexts: ["html"],
+		severity: "medium",
+		confidence: "medium",
+		description: "Event-handler-shaped assignment to a quoted value",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /\bon(?:error|load|click|focus|blur|submit|change|toggle|mouse[a-z]{2,12}|key[a-z]{2,6}|animation[a-z]{3,10}|pointer[a-z]{2,12})\s{0,8}=\s{0,8}["'`]/i
+	},
+	{
+		id: "XSS-URI-SCHEME-001",
+		type: "xss",
+		contexts: [
+			"html",
+			"url",
+			"xml"
+		],
+		severity: "high",
+		confidence: "medium",
+		description: "Script-bearing URI scheme",
+		cwe: 79,
+		primaryControl: "Allowlist the URL scheme before rendering or navigating",
+		pattern: /\b(?:javascript|vbscript|livescript|mocha)\s{0,8}:/i
+	},
+	{
+		id: "XSS-DATA-URI-001",
+		type: "xss",
+		contexts: ["html", "url"],
+		severity: "high",
+		confidence: "high",
+		description: "data: URI carrying an active content type",
+		cwe: 79,
+		primaryControl: "Allowlist the URL scheme before rendering or navigating",
+		pattern: /\bdata\s{0,8}:\s{0,8}(?:text\/html|image\/svg\+xml|application\/(?:javascript|xhtml\+xml|ecmascript))/i
+	},
+	{
+		id: "XSS-DANGEROUS-TAG-001",
+		type: "xss",
+		contexts: ["html", "xml"],
+		severity: "high",
+		confidence: "medium",
+		description: "Tag that can load or reframe active content",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /<\s{0,8}(?:iframe|object|embed|applet|base|meta|link|svg|math|portal|frameset)\b/i
+	},
+	{
+		id: "XSS-STYLE-EXPRESSION-001",
+		type: "xss",
+		contexts: ["html"],
+		severity: "medium",
+		confidence: "medium",
+		description: "CSS expression() — legacy IE script execution vector",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /\bexpression\s{0,8}\(/i
+	},
+	{
+		id: "XSS-DOM-SINK-001",
+		type: "xss",
+		contexts: ["html"],
+		severity: "medium",
+		confidence: "medium",
+		description: "Reference to a credential- or navigation-bearing DOM property",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /\b(?:document|window)\s{0,8}\.\s{0,8}(?:cookie|domain|write|writeln|location|open)\b/i
+	},
+	{
+		id: "XSS-DOM-SINK-002",
+		type: "xss",
+		contexts: ["html"],
+		severity: "medium",
+		confidence: "medium",
+		description: "Assignment to a raw-markup DOM sink",
+		cwe: 79,
+		primaryControl: "Assign via textContent, or sanitize with DOMPurify first",
+		pattern: /\b(?:innerHTML|outerHTML|srcdoc)\s{0,8}=|\binsertAdjacentHTML\s{0,8}\(/i
+	},
+	{
+		id: "XSS-DYNAMIC-EVAL-001",
+		type: "xss",
+		contexts: ["html"],
+		severity: "high",
+		confidence: "medium",
+		description: "Dynamic code evaluation (eval / Function constructor)",
+		cwe: 95,
+		primaryControl: "Never evaluate strings; a CSP without 'unsafe-eval' blocks this",
+		pattern: /\beval\s{0,8}\(|\bnew\s+Function\s{0,8}\(/i
+	},
+	{
+		id: "XSS-URI-SCHEME-002",
+		type: "xss",
+		contexts: ["html", "url"],
+		severity: "high",
+		confidence: "medium",
+		description: "Script-bearing URI scheme split by tab, CR, or LF",
+		cwe: 79,
+		primaryControl: "Allowlist the URL scheme after canonicalization: decode HTML character references, strip ASCII tab/CR/LF, then compare against an allowlist (http, https, mailto)",
+		pattern: /(?=[a-z\t\n\r]{0,16}[\t\n\r])j[\t\n\r]{0,8}a[\t\n\r]{0,8}v[\t\n\r]{0,8}a[\t\n\r]{0,8}s[\t\n\r]{0,8}c[\t\n\r]{0,8}r[\t\n\r]{0,8}i[\t\n\r]{0,8}p[\t\n\r]{0,8}t[\t\n\r ]{0,8}:/i
+	},
+	{
+		id: "XSS-DYNAMIC-EVAL-002",
+		type: "xss",
+		contexts: ["html"],
+		severity: "high",
+		confidence: "medium",
+		description: "String-argument timer or Function call — an implicit eval sink",
+		cwe: 95,
+		primaryControl: "Never evaluate strings; a CSP without 'unsafe-eval' blocks this",
+		pattern: /\b(?:setTimeout|setInterval|setImmediate|Function)\s{0,8}\(\s{0,8}["'`]|\bexecScript\s{0,8}\(/i
+	},
+	{
+		id: "XSS-DYNAMIC-EVAL-003",
+		type: "xss",
+		contexts: ["html"],
+		severity: "medium",
+		confidence: "medium",
+		description: "constructor.constructor chain used to reach the Function constructor",
+		cwe: 95,
+		primaryControl: "Never evaluate strings; a CSP without 'unsafe-eval' blocks this",
+		pattern: /\bconstructor\s{0,8}(?:\.\s{0,8}constructor|\[\s{0,8}["'`]constructor)/i
+	},
+	{
+		id: "XSS-EVENT-HANDLER-003",
+		type: "xss",
+		contexts: ["html"],
+		severity: "high",
+		confidence: "medium",
+		description: "Event handler introduced by breaking out of a quoted attribute",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /["'`]\s{0,8}on(?:error|load|click|focus|blur|submit|change|toggle|wheel|scroll|input|select|paste|copy|cut|contextmenu|auxclick|mouse[a-z]{2,12}|key[a-z]{2,6}|animation[a-z]{3,10}|pointer[a-z]{2,12}|drag[a-z]{0,10}|touch[a-z]{2,10})\s{0,8}=/i
+	},
+	{
+		id: "XSS-EVENT-HANDLER-004",
+		type: "xss",
+		contexts: ["html"],
+		severity: "high",
+		confidence: "medium",
+		description: "Unquoted event handler assigned a callable expression",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /(?:^|[^.\w-])on(?:error|load|click|focus|blur|submit|change|toggle|wheel|scroll|input|select|paste|copy|cut|contextmenu|auxclick|mouse[a-z]{2,12}|key[a-z]{2,6}|animation[a-z]{3,10}|pointer[a-z]{2,12}|drag[a-z]{0,10}|touch[a-z]{2,10})=\s{0,8}[\w$.[\]]{1,40}\s{0,8}[(`]/i
+	},
+	{
+		id: "XSS-FORM-TAG-001",
+		type: "xss",
+		contexts: ["html"],
+		severity: "high",
+		confidence: "medium",
+		description: "Injected form or input element — credential-harvesting overlay",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		variants: [
+			"raw",
+			"nfc",
+			"nfkc",
+			"percent_decoded"
+		],
+		pattern: /<\s{0,8}(?:form|input|textarea|button|select|keygen|isindex)\b/i
+	},
+	{
+		id: "XSS-STYLE-TAG-001",
+		type: "xss",
+		contexts: ["html"],
+		severity: "medium",
+		confidence: "medium",
+		description: "Injected style element",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		variants: [
+			"raw",
+			"nfc",
+			"nfkc",
+			"percent_decoded"
+		],
+		pattern: /<\s{0,8}style\b/i
+	},
+	{
+		id: "XSS-DANGLING-MARKUP-001",
+		type: "xss",
+		contexts: ["html"],
+		severity: "high",
+		confidence: "medium",
+		description: "Unterminated resource attribute — exfiltrates the following markup",
+		cwe: 79,
+		primaryControl: XSS_CONTROL,
+		pattern: /\b(?:src|href|action|formaction|poster|background)\s{0,8}=\s{0,8}["'][^"'<>]{0,300}$/i
+	}
+];
+/** Repeated across the prototype-pollution rules. */
+const PROTO_CONTROL = "Reject unknown keys via schema validation; use Object.create(null) maps and a merge that skips __proto__/constructor/prototype";
+/**
+* Prototype-pollution signatures.
+*
+* Deliberately its own {@link ThreatRule.type} rather than a subcategory of XSS:
+* this is an object-graph manipulation weakness, not a markup one, and it is fixed
+* by different controls (`Object.create(null)` dictionaries, schema validation that
+* rejects unknown keys, merge helpers that skip inherited and forbidden keys).
+*
+* The patterns match structural property paths, so `__proto__` reached via bracket
+* notation or as a quoted JSON key is caught while prose that merely mentions the
+* word is not.
+*/
+const PROTOTYPE_POLLUTION_RULES = [
+	{
+		id: "PROTO-POLLUTION-PROTO-001",
+		type: "prototype_pollution",
+		contexts: [
+			"object_merge",
+			"nosql",
+			"url",
+			"template"
+		],
+		severity: "critical",
+		confidence: "high",
+		description: "__proto__ used as a structural property path segment",
+		cwe: 1321,
+		primaryControl: PROTO_CONTROL,
+		pattern: /(?:^|[.[\]"'])__proto__(?:$|[.[\]"'])/
+	},
+	{
+		id: "PROTO-POLLUTION-PROTOTYPE-001",
+		type: "prototype_pollution",
+		contexts: [
+			"object_merge",
+			"nosql",
+			"url",
+			"template"
+		],
+		severity: "high",
+		confidence: "medium",
+		description: "'prototype' used as a structural property path segment",
+		cwe: 1321,
+		primaryControl: PROTO_CONTROL,
+		pattern: /(?:^|[.[\]"'])prototype(?:$|[.[\]"'])/
+	},
+	{
+		id: "PROTO-POLLUTION-CONSTRUCTOR-001",
+		type: "prototype_pollution",
+		contexts: [
+			"object_merge",
+			"nosql",
+			"url",
+			"template"
+		],
+		severity: "critical",
+		confidence: "high",
+		description: "constructor.prototype access chain",
+		cwe: 1321,
+		primaryControl: PROTO_CONTROL,
+		pattern: /\bconstructor\s{0,8}(?:\.|\[)\s{0,8}["']?prototype\b|["']constructor["']\s{0,8}:\s{0,8}\{\s{0,8}["']prototype["']/i
+	}
+];
+/** Repeated across the header-injection rules. */
+const HEADER_CONTROL = "Use a header API that rejects CR/LF; never concatenate raw header strings";
+/** CRLF injection into HTTP or SMTP header values (response splitting). */
+const HEADER_INJECTION_RULES = [
+	{
+		id: "HEADER-CRLF-001",
+		type: "header_injection",
+		contexts: ["http_header"],
+		severity: "high",
+		confidence: "high",
+		description: "Raw CR or LF in a header value",
+		cwe: 113,
+		primaryControl: HEADER_CONTROL,
+		pattern: /[\r\n]/
+	},
+	{
+		id: "HEADER-CRLF-ENCODED-001",
+		type: "header_injection",
+		contexts: ["http_header", "url"],
+		severity: "high",
+		confidence: "medium",
+		description: "Percent-encoded CR/LF or NUL, decodable into a header break",
+		cwe: 113,
+		primaryControl: HEADER_CONTROL,
+		pattern: /%0d|%0a|%00/i,
+		variants: ["raw"]
+	},
+	{
+		id: "HEADER-SMUGGLED-NAME-001",
+		type: "header_injection",
+		contexts: ["http_header"],
+		severity: "critical",
+		confidence: "high",
+		description: "Line break followed by a security-relevant header name",
+		cwe: 113,
+		primaryControl: HEADER_CONTROL,
+		pattern: /[\r\n]\s{0,8}(?:set-cookie|location|content-length|transfer-encoding|host|authorization|bcc|cc|to)\s{0,8}:/i
+	},
+	{
+		id: "HEADER-UNICODE-LINEBREAK-001",
+		type: "header_injection",
+		contexts: ["http_header", "log"],
+		severity: "high",
+		confidence: "high",
+		description: "Unicode line break — treated as a newline by some parsers and loggers",
+		cwe: 113,
+		primaryControl: HEADER_CONTROL,
+		pattern: /[\u2028\u2029\u0085]/
+	},
+	{
+		id: "HEADER-CRLF-OVERLONG-001",
+		type: "header_injection",
+		contexts: ["http_header", "url"],
+		severity: "high",
+		confidence: "high",
+		description: "Overlong or Unicode-squeezed encoding of CR/LF",
+		cwe: 113,
+		primaryControl: HEADER_CONTROL,
+		variants: ["raw"],
+		pattern: /%e5%98%8[ad]|%c0%8[ad]|%c1%8[ad]/i
+	}
+];
+/** Repeated across the formula-injection rules. */
+const FORMULA_CONTROL = "Escape exported cells with escapeCsvField / toCsvRow before writing the file";
+/** CSV/XLSX formula injection — the payload executes in the *recipient's* spreadsheet. */
+const FORMULA_INJECTION_RULES = [{
+	id: "CSV-FORMULA-LEAD-001",
+	type: "formula_injection",
+	contexts: ["spreadsheet"],
+	severity: "high",
+	confidence: "medium",
+	description: "Cell value begins with a formula-trigger character",
+	cwe: 1236,
+	primaryControl: FORMULA_CONTROL,
+	pattern: /^[\s'"]{0,8}[=+\-@\t\r]/
+}, {
+	id: "CSV-DDE-001",
+	type: "formula_injection",
+	contexts: ["spreadsheet"],
+	severity: "critical",
+	confidence: "high",
+	description: "Spreadsheet function capable of remote fetch or command execution",
+	cwe: 1236,
+	primaryControl: FORMULA_CONTROL,
+	pattern: /\b(?:DDE|DDEAUTO|WEBSERVICE|HYPERLINK|IMPORTXML|IMPORTDATA|IMPORTFEED|IMPORTHTML|IMPORTRANGE|RTD)\s{0,8}\(/i
+}];
+/** Repeated across the log-injection rules. */
+const LOG_CONTROL = "Log structured records; encode field values with encodeLogValue before writing them";
+/** Log injection — forged entries, and terminal escape sequences in logged content. */
+const LOG_INJECTION_RULES = [
+	{
+		id: "LOG-CRLF-001",
+		type: "log_injection",
+		contexts: ["log"],
+		severity: "medium",
+		confidence: "medium",
+		description: "Line break in a value written to a line-based log",
+		cwe: 117,
+		primaryControl: LOG_CONTROL,
+		pattern: /[\r\n]/
+	},
+	{
+		id: "LOG-FORGED-ENTRY-001",
+		type: "log_injection",
+		contexts: ["log"],
+		severity: "high",
+		confidence: "medium",
+		description: "Line break followed by a forged log-level marker",
+		cwe: 117,
+		primaryControl: LOG_CONTROL,
+		pattern: /[\r\n]\s{0,8}[[{(]?\s{0,8}(?:INFO|WARN|WARNING|ERROR|DEBUG|FATAL|TRACE|CRITICAL)\b/i
+	},
+	{
+		id: "LOG-ANSI-ESCAPE-001",
+		type: "log_injection",
+		contexts: ["log"],
+		severity: "medium",
+		confidence: "high",
+		description: "ANSI/terminal escape sequence in logged content",
+		cwe: 117,
+		primaryControl: "Encode with encodeLogValue, or strip with stripAnsi when the rendering matters more than the record",
+		pattern: /\u001b\[[0-9;?]{0,32}[\x40-\x7e]/
+	}
+];
+//#endregion
+export { FORMULA_INJECTION_RULES, HEADER_INJECTION_RULES, LOG_INJECTION_RULES, PROTOTYPE_POLLUTION_RULES, XSS_RULES };
+
+//# sourceMappingURL=web.mjs.map

package/lib/threats/rules/web.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.mjs","names":[],"sources":["../../../src/threats/rules/web.ts"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * @fileoverview Browser- and protocol-facing signatures: XSS, prototype pollution,\n * HTTP/SMTP header injection (CRLF), spreadsheet formula injection, and log forging.\n *\n * None of these rules is the control that stops the attack. XSS is stopped by\n * context-correct output encoding plus a parser-based sanitizer; prototype pollution\n * by schema validation that rejects unknown keys and by null-prototype dictionaries;\n * header injection by a header API that refuses CR/LF; formula injection by prefixing\n * exported cells; log forging by structured logging that encodes field values.\n *\n * @module @resq-systems/security/threats/rules/web\n */\n\nimport type { ThreatRule } from \"../types.js\";\n\n//#region Cross-site scripting\n\n/** Repeated across every XSS rule — the control that actually prevents the weakness. */\nconst XSS_CONTROL = \"Escape at the HTML sink; sanitize rich HTML with DOMPurify\";\n\n/** XSS signatures. Meaningful only where the value is interpolated into markup. */\nexport const XSS_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"XSS-SCRIPT-TAG-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\", \"xml\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Opening <script> tag\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\t// Opening tag only — a greedy `<script>[\\s\\S]*</script>` invites backtracking\n\t\t// blowups on crafted input and adds no detection value.\n\t\tpattern: /<\\s*script\\b/i,\n\t},\n\t{\n\t\tid: \"XSS-EVENT-HANDLER-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\", \"xml\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Inline event handler attribute inside a tag\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\tpattern: /<[a-z][^>]{0,300}\\bon[a-z]{3,20}\\s{0,8}=/i,\n\t},\n\t{\n\t\tid: \"XSS-EVENT-HANDLER-002\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Event-handler-shaped assignment to a quoted value\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\tpattern:\n\t\t\t/\\bon(?:error|load|click|focus|blur|submit|change|toggle|mouse[a-z]{2,12}|key[a-z]{2,6}|animation[a-z]{3,10}|pointer[a-z]{2,12})\\s{0,8}=\\s{0,8}[\"'`]/i,\n\t},\n\t{\n\t\tid: \"XSS-URI-SCHEME-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\", \"url\", \"xml\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Script-bearing URI scheme\",\n\t\tcwe: 79,\n\t\tprimaryControl: \"Allowlist the URL scheme before rendering or navigating\",\n\t\tpattern: /\\b(?:javascript|vbscript|livescript|mocha)\\s{0,8}:/i,\n\t},\n\t{\n\t\tid: \"XSS-DATA-URI-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\", \"url\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"data: URI carrying an active content type\",\n\t\tcwe: 79,\n\t\tprimaryControl: \"Allowlist the URL scheme before rendering or navigating\",\n\t\tpattern:\n\t\t\t/\\bdata\\s{0,8}:\\s{0,8}(?:text\\/html|image\\/svg\\+xml|application\\/(?:javascript|xhtml\\+xml|ecmascript))/i,\n\t},\n\t{\n\t\tid: \"XSS-DANGEROUS-TAG-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\", \"xml\"],\n\t\t// High rather than medium: these tags load or reframe active content, which\n\t\t// buys clickjacking, phishing overlays, and drive-by loads even without script\n\t\t// execution. Confidence stays medium because a rich-text field may legitimately\n\t\t// permit some of them — that is what `excludeRuleIds` is for.\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Tag that can load or reframe active content\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\tpattern: /<\\s{0,8}(?:iframe|object|embed|applet|base|meta|link|svg|math|portal|frameset)\\b/i,\n\t},\n\t{\n\t\tid: \"XSS-STYLE-EXPRESSION-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"CSS expression() — legacy IE script execution vector\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\tpattern: /\\bexpression\\s{0,8}\\(/i,\n\t},\n\t{\n\t\tid: \"XSS-DOM-SINK-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Reference to a credential- or navigation-bearing DOM property\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\tpattern:\n\t\t\t/\\b(?:document|window)\\s{0,8}\\.\\s{0,8}(?:cookie|domain|write|writeln|location|open)\\b/i,\n\t},\n\t{\n\t\tid: \"XSS-DOM-SINK-002\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Assignment to a raw-markup DOM sink\",\n\t\tcwe: 79,\n\t\tprimaryControl: \"Assign via textContent, or sanitize with DOMPurify first\",\n\t\tpattern: /\\b(?:innerHTML|outerHTML|srcdoc)\\s{0,8}=|\\binsertAdjacentHTML\\s{0,8}\\(/i,\n\t},\n\t{\n\t\tid: \"XSS-DYNAMIC-EVAL-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Dynamic code evaluation (eval / Function constructor)\",\n\t\tcwe: 95,\n\t\tprimaryControl: \"Never evaluate strings; a CSP without 'unsafe-eval' blocks this\",\n\t\tpattern: /\\beval\\s{0,8}\\(|\\bnew\\s+Function\\s{0,8}\\(/i,\n\t},\n\t{\n\t\tid: \"XSS-URI-SCHEME-002\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\", \"url\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Script-bearing URI scheme split by tab, CR, or LF\",\n\t\tcwe: 79,\n\t\tprimaryControl:\n\t\t\t\"Allowlist the URL scheme after canonicalization: decode HTML character references, strip ASCII tab/CR/LF, then compare against an allowlist (http, https, mailto)\",\n\t\t// XSS-URI-SCHEME-001 allows whitespace only *between* the token and the colon,\n\t\t// so `jav&#x09;ascript:alert(1)` scanned clean and still executes in current\n\t\t// browsers — the WHATWG URL parser strips exactly tab, CR, and LF from a scheme.\n\t\t// The leading lookahead requires an intra-token separator, so a plain\n\t\t// `javascript:` is not double-scored by this rule and -001 together.\n\t\tpattern:\n\t\t\t/(?=[a-z\\t\\n\\r]{0,16}[\\t\\n\\r])j[\\t\\n\\r]{0,8}a[\\t\\n\\r]{0,8}v[\\t\\n\\r]{0,8}a[\\t\\n\\r]{0,8}s[\\t\\n\\r]{0,8}c[\\t\\n\\r]{0,8}r[\\t\\n\\r]{0,8}i[\\t\\n\\r]{0,8}p[\\t\\n\\r]{0,8}t[\\t\\n\\r ]{0,8}:/i,\n\t},\n\t{\n\t\tid: \"XSS-DYNAMIC-EVAL-002\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\t// Graded to match XSS-DYNAMIC-EVAL-001: a string-argument timer is\n\t\t// eval-equivalent, so the same severity applies. Confidence stays medium\n\t\t// because the token appears in ordinary code discussion.\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"String-argument timer or Function call — an implicit eval sink\",\n\t\tcwe: 95,\n\t\tprimaryControl: \"Never evaluate strings; a CSP without 'unsafe-eval' blocks this\",\n\t\tpattern:\n\t\t\t/\\b(?:setTimeout|setInterval|setImmediate|Function)\\s{0,8}\\(\\s{0,8}[\"'`]|\\bexecScript\\s{0,8}\\(/i,\n\t},\n\t{\n\t\tid: \"XSS-DYNAMIC-EVAL-003\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"constructor.constructor chain used to reach the Function constructor\",\n\t\tcwe: 95,\n\t\tprimaryControl: \"Never evaluate strings; a CSP without 'unsafe-eval' blocks this\",\n\t\tpattern: /\\bconstructor\\s{0,8}(?:\\.\\s{0,8}constructor|\\[\\s{0,8}[\"'`]constructor)/i,\n\t},\n\t{\n\t\tid: \"XSS-EVENT-HANDLER-003\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Event handler introduced by breaking out of a quoted attribute\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\t// XSS-EVENT-HANDLER-001 needs a preceding `<tag`; -002 needs a quote *after*\n\t\t// the `=`. An attribute-breakout payload (`\" onmouseover=alert(1) x=\"`) has\n\t\t// neither, so it scanned clean while its quoted twin scored 2 — the pair was\n\t\t// inconsistent precisely on the harder case.\n\t\t// Handler names are an explicit allowlist rather than `on[a-z]{3,20}`, so\n\t\t// `\"onboarding=\"` and `\"onlineStatus=\"` cannot trip it.\n\t\tpattern:\n\t\t\t/[\"'`]\\s{0,8}on(?:error|load|click|focus|blur|submit|change|toggle|wheel|scroll|input|select|paste|copy|cut|contextmenu|auxclick|mouse[a-z]{2,12}|key[a-z]{2,6}|animation[a-z]{3,10}|pointer[a-z]{2,12}|drag[a-z]{0,10}|touch[a-z]{2,10})\\s{0,8}=/i,\n\t},\n\t{\n\t\tid: \"XSS-EVENT-HANDLER-004\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\t// High, matching every other event-handler rule: an inline handler assigned a\n\t\t// call expression *is* script execution. Confidence stays medium because the\n\t\t// same text appears in escaped documentation.\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Unquoted event handler assigned a callable expression\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\t// The `(?:^|[^.\\w-])` prefix is a consuming class rather than a lookbehind, to\n\t\t// match catalog style; it excludes ordinary property assignment (`el.onclick=`).\n\t\t// Whitespace before `=` is forbidden, which kills prose false positives such as\n\t\t// \"onload = init()\" at the cost of missing spaced payloads into unquoted sinks.\n\t\tpattern:\n\t\t\t/(?:^|[^.\\w-])on(?:error|load|click|focus|blur|submit|change|toggle|wheel|scroll|input|select|paste|copy|cut|contextmenu|auxclick|mouse[a-z]{2,12}|key[a-z]{2,6}|animation[a-z]{3,10}|pointer[a-z]{2,12}|drag[a-z]{0,10}|touch[a-z]{2,10})=\\s{0,8}[\\w$.[\\]]{1,40}\\s{0,8}[(`]/i,\n\t},\n\t{\n\t\tid: \"XSS-FORM-TAG-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Injected form or input element — credential-harvesting overlay\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\t// Must exclude `html_decoded`: without that it fires on any CMS body that\n\t\t// documents HTML in escaped form (`&lt;form action=\"/login\"&gt;`). An\n\t\t// entity-encoded form tag is already neutralized — the encoding *is* the\n\t\t// control. Percent-encoded evasion stays covered.\n\t\tvariants: [\"raw\", \"nfc\", \"nfkc\", \"percent_decoded\"],\n\t\tpattern: /<\\s{0,8}(?:form|input|textarea|button|select|keygen|isindex)\\b/i,\n\t},\n\t{\n\t\tid: \"XSS-STYLE-TAG-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Injected style element\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\tvariants: [\"raw\", \"nfc\", \"nfkc\", \"percent_decoded\"],\n\t\tpattern: /<\\s{0,8}style\\b/i,\n\t},\n\t{\n\t\tid: \"XSS-DANGLING-MARKUP-001\",\n\t\ttype: \"xss\",\n\t\tcontexts: [\"html\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Unterminated resource attribute — exfiltrates the following markup\",\n\t\tcwe: 79,\n\t\tprimaryControl: XSS_CONTROL,\n\t\tpattern:\n\t\t\t/\\b(?:src|href|action|formaction|poster|background)\\s{0,8}=\\s{0,8}[\"'][^\"'<>]{0,300}$/i,\n\t},\n];\n\n//#endregion\n\n//#region Prototype pollution\n\n/** Repeated across the prototype-pollution rules. */\nconst PROTO_CONTROL =\n\t\"Reject unknown keys via schema validation; use Object.create(null) maps and a merge that skips __proto__/constructor/prototype\";\n\n/**\n * Prototype-pollution signatures.\n *\n * Deliberately its own {@link ThreatRule.type} rather than a subcategory of XSS:\n * this is an object-graph manipulation weakness, not a markup one, and it is fixed\n * by different controls (`Object.create(null)` dictionaries, schema validation that\n * rejects unknown keys, merge helpers that skip inherited and forbidden keys).\n *\n * The patterns match structural property paths, so `__proto__` reached via bracket\n * notation or as a quoted JSON key is caught while prose that merely mentions the\n * word is not.\n */\nexport const PROTOTYPE_POLLUTION_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"PROTO-POLLUTION-PROTO-001\",\n\t\ttype: \"prototype_pollution\",\n\t\tcontexts: [\"object_merge\", \"nosql\", \"url\", \"template\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"__proto__ used as a structural property path segment\",\n\t\tcwe: 1321,\n\t\tprimaryControl: PROTO_CONTROL,\n\t\tpattern: /(?:^|[.[\\]\"'])__proto__(?:$|[.[\\]\"'])/,\n\t},\n\t{\n\t\tid: \"PROTO-POLLUTION-PROTOTYPE-001\",\n\t\ttype: \"prototype_pollution\",\n\t\tcontexts: [\"object_merge\", \"nosql\", \"url\", \"template\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"'prototype' used as a structural property path segment\",\n\t\tcwe: 1321,\n\t\tprimaryControl: PROTO_CONTROL,\n\t\tpattern: /(?:^|[.[\\]\"'])prototype(?:$|[.[\\]\"'])/,\n\t},\n\t{\n\t\tid: \"PROTO-POLLUTION-CONSTRUCTOR-001\",\n\t\ttype: \"prototype_pollution\",\n\t\tcontexts: [\"object_merge\", \"nosql\", \"url\", \"template\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"constructor.prototype access chain\",\n\t\tcwe: 1321,\n\t\tprimaryControl: PROTO_CONTROL,\n\t\t// Two shapes: property/bracket access (`constructor.prototype`,\n\t\t// `constructor[\"prototype\"]`) and the nested-object form that arrives through\n\t\t// a JSON body or query-string expansion (`\"constructor\":{\"prototype\":…}`).\n\t\tpattern:\n\t\t\t/\\bconstructor\\s{0,8}(?:\\.|\\[)\\s{0,8}[\"']?prototype\\b|[\"']constructor[\"']\\s{0,8}:\\s{0,8}\\{\\s{0,8}[\"']prototype[\"']/i,\n\t},\n];\n\n//#endregion\n\n//#region Header injection\n\n/** Repeated across the header-injection rules. */\nconst HEADER_CONTROL = \"Use a header API that rejects CR/LF; never concatenate raw header strings\";\n\n/** CRLF injection into HTTP or SMTP header values (response splitting). */\nexport const HEADER_INJECTION_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"HEADER-CRLF-001\",\n\t\ttype: \"header_injection\",\n\t\tcontexts: [\"http_header\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Raw CR or LF in a header value\",\n\t\tcwe: 113,\n\t\tprimaryControl: HEADER_CONTROL,\n\t\tpattern: /[\\r\\n]/,\n\t},\n\t{\n\t\tid: \"HEADER-CRLF-ENCODED-001\",\n\t\ttype: \"header_injection\",\n\t\tcontexts: [\"http_header\", \"url\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Percent-encoded CR/LF or NUL, decodable into a header break\",\n\t\tcwe: 113,\n\t\tprimaryControl: HEADER_CONTROL,\n\t\tpattern: /%0d|%0a|%00/i,\n\t\tvariants: [\"raw\"],\n\t},\n\t{\n\t\tid: \"HEADER-SMUGGLED-NAME-001\",\n\t\ttype: \"header_injection\",\n\t\tcontexts: [\"http_header\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Line break followed by a security-relevant header name\",\n\t\tcwe: 113,\n\t\tprimaryControl: HEADER_CONTROL,\n\t\tpattern:\n\t\t\t/[\\r\\n]\\s{0,8}(?:set-cookie|location|content-length|transfer-encoding|host|authorization|bcc|cc|to)\\s{0,8}:/i,\n\t},\n\t{\n\t\tid: \"HEADER-UNICODE-LINEBREAK-001\",\n\t\ttype: \"header_injection\",\n\t\tcontexts: [\"http_header\", \"log\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Unicode line break — treated as a newline by some parsers and loggers\",\n\t\tcwe: 113,\n\t\tprimaryControl: HEADER_CONTROL,\n\t\t// U+2028 LINE SEPARATOR, U+2029 PARAGRAPH SEPARATOR, U+0085 NEL. None is matched\n\t\t// by `[\\r\\n]`, yet each terminates a line in JS string literals, in several log\n\t\t// processors, and in some header parsers. All three scanned clean before this.\n\t\tpattern: /[\\u2028\\u2029\\u0085]/,\n\t},\n\t{\n\t\tid: \"HEADER-CRLF-OVERLONG-001\",\n\t\ttype: \"header_injection\",\n\t\tcontexts: [\"http_header\", \"url\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Overlong or Unicode-squeezed encoding of CR/LF\",\n\t\tcwe: 113,\n\t\tprimaryControl: HEADER_CONTROL,\n\t\t// `%e5%98%8a` is U+560A, whose low byte is 0x0A: any component that narrows\n\t\t// UTF-16 to a byte emits a bare LF. `%c0%8a` is the overlong UTF-8 form of the\n\t\t// same byte. Both slip past a filter that only looks for `%0a`.\n\t\tvariants: [\"raw\"],\n\t\tpattern: /%e5%98%8[ad]|%c0%8[ad]|%c1%8[ad]/i,\n\t},\n];\n\n//#endregion\n\n//#region Spreadsheet formula injection\n\n/** Repeated across the formula-injection rules. */\nconst FORMULA_CONTROL =\n\t\"Escape exported cells with escapeCsvField / toCsvRow before writing the file\";\n\n/** CSV/XLSX formula injection — the payload executes in the *recipient's* spreadsheet. */\nexport const FORMULA_INJECTION_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"CSV-FORMULA-LEAD-001\",\n\t\ttype: \"formula_injection\",\n\t\tcontexts: [\"spreadsheet\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Cell value begins with a formula-trigger character\",\n\t\tcwe: 1236,\n\t\tprimaryControl: FORMULA_CONTROL,\n\t\tpattern: /^[\\s'\"]{0,8}[=+\\-@\\t\\r]/,\n\t},\n\t{\n\t\tid: \"CSV-DDE-001\",\n\t\ttype: \"formula_injection\",\n\t\tcontexts: [\"spreadsheet\"],\n\t\tseverity: \"critical\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"Spreadsheet function capable of remote fetch or command execution\",\n\t\tcwe: 1236,\n\t\tprimaryControl: FORMULA_CONTROL,\n\t\tpattern:\n\t\t\t/\\b(?:DDE|DDEAUTO|WEBSERVICE|HYPERLINK|IMPORTXML|IMPORTDATA|IMPORTFEED|IMPORTHTML|IMPORTRANGE|RTD)\\s{0,8}\\(/i,\n\t},\n];\n\n//#endregion\n\n//#region Log forging\n\n/** Repeated across the log-injection rules. */\nconst LOG_CONTROL =\n\t\"Log structured records; encode field values with encodeLogValue before writing them\";\n\n/** Log injection — forged entries, and terminal escape sequences in logged content. */\nexport const LOG_INJECTION_RULES: readonly ThreatRule[] = [\n\t{\n\t\tid: \"LOG-CRLF-001\",\n\t\ttype: \"log_injection\",\n\t\tcontexts: [\"log\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Line break in a value written to a line-based log\",\n\t\tcwe: 117,\n\t\tprimaryControl: LOG_CONTROL,\n\t\tpattern: /[\\r\\n]/,\n\t},\n\t{\n\t\tid: \"LOG-FORGED-ENTRY-001\",\n\t\ttype: \"log_injection\",\n\t\tcontexts: [\"log\"],\n\t\tseverity: \"high\",\n\t\tconfidence: \"medium\",\n\t\tdescription: \"Line break followed by a forged log-level marker\",\n\t\tcwe: 117,\n\t\tprimaryControl: LOG_CONTROL,\n\t\tpattern: /[\\r\\n]\\s{0,8}[[{(]?\\s{0,8}(?:INFO|WARN|WARNING|ERROR|DEBUG|FATAL|TRACE|CRITICAL)\\b/i,\n\t},\n\t{\n\t\tid: \"LOG-ANSI-ESCAPE-001\",\n\t\ttype: \"log_injection\",\n\t\tcontexts: [\"log\"],\n\t\tseverity: \"medium\",\n\t\tconfidence: \"high\",\n\t\tdescription: \"ANSI/terminal escape sequence in logged content\",\n\t\tcwe: 117,\n\t\tprimaryControl:\n\t\t\t\"Encode with encodeLogValue, or strip with stripAnsi when the rendering matters more than the record\",\n\t\t// biome-ignore lint/suspicious/noControlCharactersInRegex: ANSI sequences are defined by the ESC control character\n\t\tpattern: /\\u001b\\[[0-9;?]{0,32}[\\x40-\\x7e]/,\n\t},\n];\n\n//#endregion\n"],"mappings":";;AAkCA,MAAM,cAAc;;AAGpB,MAAa,YAAmC;CAC/C;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,QAAQ,KAAK;EACxB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAGhB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,QAAQ,KAAK;EACxB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU;GAAC;GAAQ;GAAO;EAAK;EAC/B,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,QAAQ,KAAK;EACxB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,QAAQ,KAAK;EAKxB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,QAAQ,KAAK;EACxB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBACC;EAMD,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EAIjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAOhB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EAIjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAKhB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAKhB,UAAU;GAAC;GAAO;GAAO;GAAQ;EAAiB;EAClD,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,UAAU;GAAC;GAAO;GAAO;GAAQ;EAAiB;EAClD,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,MAAM;EACjB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;AACD;;AAOA,MAAM,gBACL;;;;;;;;;;;;;AAcD,MAAa,4BAAmD;CAC/D;EACC,IAAI;EACJ,MAAM;EACN,UAAU;GAAC;GAAgB;GAAS;GAAO;EAAU;EACrD,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU;GAAC;GAAgB;GAAS;GAAO;EAAU;EACrD,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU;GAAC;GAAgB;GAAS;GAAO;EAAU;EACrD,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAIhB,SACC;CACF;AACD;;AAOA,MAAM,iBAAiB;;AAGvB,MAAa,yBAAgD;CAC5D;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,aAAa;EACxB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,eAAe,KAAK;EAC/B,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;EACT,UAAU,CAAC,KAAK;CACjB;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,aAAa;EACxB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SACC;CACF;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,eAAe,KAAK;EAC/B,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAIhB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,eAAe,KAAK;EAC/B,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAIhB,UAAU,CAAC,KAAK;EAChB,SAAS;CACV;AACD;;AAOA,MAAM,kBACL;;AAGD,MAAa,0BAAiD,CAC7D;CACC,IAAI;CACJ,MAAM;CACN,UAAU,CAAC,aAAa;CACxB,UAAU;CACV,YAAY;CACZ,aAAa;CACb,KAAK;CACL,gBAAgB;CAChB,SAAS;AACV,GACA;CACC,IAAI;CACJ,MAAM;CACN,UAAU,CAAC,aAAa;CACxB,UAAU;CACV,YAAY;CACZ,aAAa;CACb,KAAK;CACL,gBAAgB;CAChB,SACC;AACF,CACD;;AAOA,MAAM,cACL;;AAGD,MAAa,sBAA6C;CACzD;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBAAgB;EAChB,SAAS;CACV;CACA;EACC,IAAI;EACJ,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,UAAU;EACV,YAAY;EACZ,aAAa;EACb,KAAK;EACL,gBACC;EAED,SAAS;CACV;AACD"}

package/lib/threats/scoring.d.mts

@@ -0,0 +1,59 @@
+import { ThreatFinding, ThreatPolicy, ThreatType, ThreatVerdict } from "./types.mjs";
+//#region src/threats/scoring.d.ts
+/**
+ * Points a single finding contributes: severity weight scaled by confidence.
+ *
+ * @param finding - The finding to weigh.
+ * @returns A non-negative score contribution.
+ */
+declare function scoreForFinding(finding: ThreatFinding): number;
+/**
+ * Total anomaly score for a set of findings.
+ *
+ * Each **rule** counts once no matter how many variants it matched in. Without that
+ * collapse a payload written as `%3Cscript%3E` would score twice — once for `raw` and
+ * once for `percent_decoded` — penalizing an input for being encoded rather than for
+ * what it contains.
+ *
+ * @param findings - Findings from one scan.
+ * @returns The summed score; `0` for an empty list.
+ *
+ * @example
+ * ```ts
+ * // one high/high finding (4 × 1.5) plus one medium/low finding (2 × 0.5)
+ * calculateThreatScore(findings); // 7
+ * ```
+ */
+declare function calculateThreatScore(findings: readonly ThreatFinding[]): number;
+/**
+ * Map a score onto a policy band.
+ *
+ * @param score - Output of {@link calculateThreatScore}.
+ * @param policy - Thresholds. Defaults to {@link DEFAULT_THREAT_POLICY} — `review`
+ *   at 4, `block` at 8.
+ * @returns `"allow"`, `"review"`, or `"block"`.
+ */
+declare function verdictForScore(score: number, policy?: ThreatPolicy): ThreatVerdict;
+/** One category's contribution to a scan result. */
+interface ThreatTypeSummary {
+  /** The weakness category. */
+  readonly type: ThreatType;
+  /** How many findings carried this category. */
+  readonly count: number;
+  /** Summed score contribution, before per-rule deduplication. */
+  readonly score: number;
+}
+/**
+ * Summarize findings by weakness category, highest score first.
+ *
+ * Useful for dashboards and alert routing, where "three SQL findings and one XSS
+ * finding" is more actionable than a flat list.
+ *
+ * @param findings - Findings from one scan.
+ * @returns Category totals sorted by descending score, then by category name so ties
+ *   are ordered deterministically.
+ */
+declare function summarizeByType(findings: readonly ThreatFinding[]): readonly ThreatTypeSummary[];
+//#endregion
+export { ThreatTypeSummary, calculateThreatScore, scoreForFinding, summarizeByType, verdictForScore };
+//# sourceMappingURL=scoring.d.mts.map

package/lib/threats/scoring.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.d.mts","names":[],"sources":["../../src/threats/scoring.ts"],"mappings":";;;;;;;;iBAgDgB,gBAAgB,SAAS;;;;;;;;;;;;;;;;;;iBAqBzB,qBAAqB,mBAAmB;;;;;;;;;iBA8BxC,gBACf,eACA,SAAQ,eACN;;UAOc;;WAEP,MAAM;;WAEN;;WAEA;;;;;;;;;;;;iBAaM,gBAAgB,mBAAmB,2BAA2B"}

package/lib/threats/scoring.mjs

@@ -0,0 +1,111 @@
+import { CONFIDENCE_MULTIPLIERS, DEFAULT_THREAT_POLICY, SEVERITY_WEIGHTS } from "./types.mjs";
+//#region src/threats/scoring.ts
+/**
+* Copyright 2026 ResQ Systems, Inc.
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+/**
+* @fileoverview Anomaly scoring — turns a list of findings into a number and a
+* policy verdict.
+*
+* The point of scoring is that no single signature is trustworthy enough to reject a
+* request on its own. A lone low-confidence hit should raise a signal; a cluster of
+* high-confidence hits should stop the request. This is the model OWASP CRS uses —
+* anomaly score plus tunable thresholds — rather than one-rule-one-block, and it is
+* what makes per-route tuning possible: an operator raises `blockAt` for a field that
+* legitimately carries code samples instead of disabling detection wholesale.
+*
+* @module @resq-systems/security/threats/scoring
+*/
+/**
+* Points a single finding contributes: severity weight scaled by confidence.
+*
+* @param finding - The finding to weigh.
+* @returns A non-negative score contribution.
+*/
+function scoreForFinding(finding) {
+	return SEVERITY_WEIGHTS[finding.severity] * CONFIDENCE_MULTIPLIERS[finding.confidence];
+}
+/**
+* Total anomaly score for a set of findings.
+*
+* Each **rule** counts once no matter how many variants it matched in. Without that
+* collapse a payload written as `%3Cscript%3E` would score twice — once for `raw` and
+* once for `percent_decoded` — penalizing an input for being encoded rather than for
+* what it contains.
+*
+* @param findings - Findings from one scan.
+* @returns The summed score; `0` for an empty list.
+*
+* @example
+* ```ts
+* // one high/high finding (4 × 1.5) plus one medium/low finding (2 × 0.5)
+* calculateThreatScore(findings); // 7
+* ```
+*/
+function calculateThreatScore(findings) {
+	const bestPerRule = /* @__PURE__ */ new Map();
+	for (const finding of findings) {
+		const score = scoreForFinding(finding);
+		const existing = bestPerRule.get(finding.ruleId);
+		if (existing === void 0 || score > existing) bestPerRule.set(finding.ruleId, score);
+	}
+	let total = 0;
+	for (const score of bestPerRule.values()) total += score;
+	return total;
+}
+/**
+* Map a score onto a policy band.
+*
+* @param score - Output of {@link calculateThreatScore}.
+* @param policy - Thresholds. Defaults to {@link DEFAULT_THREAT_POLICY} — `review`
+*   at 4, `block` at 8.
+* @returns `"allow"`, `"review"`, or `"block"`.
+*/
+function verdictForScore(score, policy = DEFAULT_THREAT_POLICY) {
+	if (score >= policy.blockAt) return "block";
+	if (score >= policy.reviewAt) return "review";
+	return "allow";
+}
+/**
+* Summarize findings by weakness category, highest score first.
+*
+* Useful for dashboards and alert routing, where "three SQL findings and one XSS
+* finding" is more actionable than a flat list.
+*
+* @param findings - Findings from one scan.
+* @returns Category totals sorted by descending score, then by category name so ties
+*   are ordered deterministically.
+*/
+function summarizeByType(findings) {
+	const totals = /* @__PURE__ */ new Map();
+	for (const finding of findings) {
+		const entry = totals.get(finding.type) ?? {
+			count: 0,
+			score: 0
+		};
+		entry.count += 1;
+		entry.score += scoreForFinding(finding);
+		totals.set(finding.type, entry);
+	}
+	return [...totals.entries()].map(([type, entry]) => ({
+		type,
+		count: entry.count,
+		score: entry.score
+	})).sort((a, b) => b.score - a.score || a.type.localeCompare(b.type));
+}
+//#endregion
+export { calculateThreatScore, scoreForFinding, summarizeByType, verdictForScore };
+
+//# sourceMappingURL=scoring.mjs.map

package/lib/threats/scoring.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.mjs","names":[],"sources":["../../src/threats/scoring.ts"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * @fileoverview Anomaly scoring — turns a list of findings into a number and a\n * policy verdict.\n *\n * The point of scoring is that no single signature is trustworthy enough to reject a\n * request on its own. A lone low-confidence hit should raise a signal; a cluster of\n * high-confidence hits should stop the request. This is the model OWASP CRS uses —\n * anomaly score plus tunable thresholds — rather than one-rule-one-block, and it is\n * what makes per-route tuning possible: an operator raises `blockAt` for a field that\n * legitimately carries code samples instead of disabling detection wholesale.\n *\n * @module @resq-systems/security/threats/scoring\n */\n\nimport {\n\tCONFIDENCE_MULTIPLIERS,\n\tDEFAULT_THREAT_POLICY,\n\tSEVERITY_WEIGHTS,\n\ttype ThreatFinding,\n\ttype ThreatPolicy,\n\ttype ThreatType,\n\ttype ThreatVerdict,\n} from \"./types.js\";\n\n//#region Scoring\n\n/**\n * Points a single finding contributes: severity weight scaled by confidence.\n *\n * @param finding - The finding to weigh.\n * @returns A non-negative score contribution.\n */\nexport function scoreForFinding(finding: ThreatFinding): number {\n\treturn SEVERITY_WEIGHTS[finding.severity] * CONFIDENCE_MULTIPLIERS[finding.confidence];\n}\n\n/**\n * Total anomaly score for a set of findings.\n *\n * Each **rule** counts once no matter how many variants it matched in. Without that\n * collapse a payload written as `%3Cscript%3E` would score twice — once for `raw` and\n * once for `percent_decoded` — penalizing an input for being encoded rather than for\n * what it contains.\n *\n * @param findings - Findings from one scan.\n * @returns The summed score; `0` for an empty list.\n *\n * @example\n * ```ts\n * // one high/high finding (4 × 1.5) plus one medium/low finding (2 × 0.5)\n * calculateThreatScore(findings); // 7\n * ```\n */\nexport function calculateThreatScore(findings: readonly ThreatFinding[]): number {\n\tconst bestPerRule = new Map<string, number>();\n\n\tfor (const finding of findings) {\n\t\tconst score = scoreForFinding(finding);\n\t\tconst existing = bestPerRule.get(finding.ruleId);\n\t\tif (existing === undefined || score > existing) {\n\t\t\tbestPerRule.set(finding.ruleId, score);\n\t\t}\n\t}\n\n\tlet total = 0;\n\tfor (const score of bestPerRule.values()) {\n\t\ttotal += score;\n\t}\n\treturn total;\n}\n\n//#endregion\n\n//#region Policy\n\n/**\n * Map a score onto a policy band.\n *\n * @param score - Output of {@link calculateThreatScore}.\n * @param policy - Thresholds. Defaults to {@link DEFAULT_THREAT_POLICY} — `review`\n *   at 4, `block` at 8.\n * @returns `\"allow\"`, `\"review\"`, or `\"block\"`.\n */\nexport function verdictForScore(\n\tscore: number,\n\tpolicy: ThreatPolicy = DEFAULT_THREAT_POLICY,\n): ThreatVerdict {\n\tif (score >= policy.blockAt) return \"block\";\n\tif (score >= policy.reviewAt) return \"review\";\n\treturn \"allow\";\n}\n\n/** One category's contribution to a scan result. */\nexport interface ThreatTypeSummary {\n\t/** The weakness category. */\n\treadonly type: ThreatType;\n\t/** How many findings carried this category. */\n\treadonly count: number;\n\t/** Summed score contribution, before per-rule deduplication. */\n\treadonly score: number;\n}\n\n/**\n * Summarize findings by weakness category, highest score first.\n *\n * Useful for dashboards and alert routing, where \"three SQL findings and one XSS\n * finding\" is more actionable than a flat list.\n *\n * @param findings - Findings from one scan.\n * @returns Category totals sorted by descending score, then by category name so ties\n *   are ordered deterministically.\n */\nexport function summarizeByType(findings: readonly ThreatFinding[]): readonly ThreatTypeSummary[] {\n\tconst totals = new Map<ThreatType, { count: number; score: number }>();\n\n\tfor (const finding of findings) {\n\t\tconst entry = totals.get(finding.type) ?? { count: 0, score: 0 };\n\t\tentry.count += 1;\n\t\tentry.score += scoreForFinding(finding);\n\t\ttotals.set(finding.type, entry);\n\t}\n\n\treturn [...totals.entries()]\n\t\t.map(([type, entry]) => ({ type, count: entry.count, score: entry.score }))\n\t\t.sort((a, b) => b.score - a.score || a.type.localeCompare(b.type));\n}\n\n//#endregion\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,SAAgB,gBAAgB,SAAgC;CAC/D,OAAO,iBAAiB,QAAQ,YAAY,uBAAuB,QAAQ;AAC5E;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,qBAAqB,UAA4C;CAChF,MAAM,8BAAc,IAAI,IAAoB;CAE5C,KAAK,MAAM,WAAW,UAAU;EAC/B,MAAM,QAAQ,gBAAgB,OAAO;EACrC,MAAM,WAAW,YAAY,IAAI,QAAQ,MAAM;EAC/C,IAAI,aAAa,KAAA,KAAa,QAAQ,UACrC,YAAY,IAAI,QAAQ,QAAQ,KAAK;CAEvC;CAEA,IAAI,QAAQ;CACZ,KAAK,MAAM,SAAS,YAAY,OAAO,GACtC,SAAS;CAEV,OAAO;AACR;;;;;;;;;AAcA,SAAgB,gBACf,OACA,SAAuB,uBACP;CAChB,IAAI,SAAS,OAAO,SAAS,OAAO;CACpC,IAAI,SAAS,OAAO,UAAU,OAAO;CACrC,OAAO;AACR;;;;;;;;;;;AAsBA,SAAgB,gBAAgB,UAAkE;CACjG,MAAM,yBAAS,IAAI,IAAkD;CAErE,KAAK,MAAM,WAAW,UAAU;EAC/B,MAAM,QAAQ,OAAO,IAAI,QAAQ,IAAI,KAAK;GAAE,OAAO;GAAG,OAAO;EAAE;EAC/D,MAAM,SAAS;EACf,MAAM,SAAS,gBAAgB,OAAO;EACtC,OAAO,IAAI,QAAQ,MAAM,KAAK;CAC/B;CAEA,OAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,CAAC,CAC1B,KAAK,CAAC,MAAM,YAAY;EAAE;EAAM,OAAO,MAAM;EAAO,OAAO,MAAM;CAAM,EAAE,CAAC,CAC1E,MAAM,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AACnE"}