@tellescope/sdk 1.255.19 → 1.256.0

package/lib/cjs/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.js

@@ -0,0 +1,231 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.proxy_image_ssrf_tests = void 0;
+require('source-map-support').install();
+var http_1 = __importDefault(require("http"));
+var axios_1 = __importDefault(require("axios"));
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+var LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1'];
+/**
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel below would never be contacted, every assertion
+ * here would pass for the wrong reason, and we would be probing a live environment. Fail loudly.
+ */
+var assert_local_api = function () {
+    var hostname = new URL(host).hostname;
+    if (!LOCAL_HOSTNAMES.includes(hostname)) {
+        throw new Error("F-0025 SSRF tests must run against a local API (got ".concat(host, "). ")
+            + "127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.");
+    }
+};
+/**
+ * Regression tests for F-0025
+ * (security-audit/findings/F-0025-proxy-image-unauth-ssrf.md).
+ *
+ * GET /v1/proxy-image accepted an arbitrary ?url= and streamed the upstream response body straight
+ * back with Access-Control-Allow-Origin: *, with no authentication, no destination validation and no
+ * content-type restriction. That reaches http://169.254.169.254/ (EC2 instance credentials under
+ * IMDSv1), 127.0.0.1, and anything else inside the VPC.
+ *
+ * The endpoint's only legitimate job is to re-serve an image that ALREADY renders in the staff
+ * browser, with permissive CORS headers, so html2canvas can rasterize a form-response PDF without
+ * tainting the canvas (canvas.toDataURL() throws on a tainted canvas, and the form-response view sets
+ * crossOrigin="anonymous"). Anything reachable only from inside our network was therefore never a
+ * legitimate input — which is why refusing non-public destinations cannot regress the feature.
+ *
+ * Repro: stand up a local HTTP server that serves a JSON secret, point proxy-image at it with no
+ * credentials, and assert the secret does not come back.
+ *   - red  (unfixed): the sentinel body is streamed back to an unauthenticated caller
+ *   - green (fixed):  the request is refused and the sentinel server is never contacted
+ *
+ * Assertions are deliberately written as "4xx and nothing leaked" rather than pinning an exact status,
+ * because the fix both authenticates the endpoint and moves it to POST (the url moves into the body so
+ * presigned S3 URLs for patient attachments stop landing in access logs). Either 401 or 404/405 on the
+ * old GET shape is an acceptable outcome; streaming the body is not.
+ *
+ * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
+ * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
+ * the vulnerability proof.
+ */
+var proxy_image_ssrf_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var SENTINEL, sentinelHits, sentinel, sentinelPort, sentinelURL_1, call_unauthenticated, call_authenticated_1;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    (0, testing_1.log_header)("F-0025: proxy-image unauthenticated SSRF");
+                    assert_local_api();
+                    SENTINEL = "f0025-sentinel-".concat(Date.now(), "-").concat(Math.random().toString(36).slice(2));
+                    sentinelHits = 0;
+                    sentinel = http_1.default.createServer(function (_, res) {
+                        sentinelHits++;
+                        res.writeHead(200, { 'content-type': 'application/json' });
+                        res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }));
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 9, 10]);
+                    return [4 /*yield*/, new Promise(function (resolve) { return sentinel.listen(0, '127.0.0.1', function () { return resolve(); }); })];
+                case 2:
+                    _b.sent();
+                    sentinelPort = sentinel.address().port;
+                    sentinelURL_1 = "http://127.0.0.1:".concat(sentinelPort, "/latest/meta-data/iam/security-credentials/");
+                    call_unauthenticated = function () { return __awaiter(void 0, void 0, void 0, function () {
+                        var res, body;
+                        var _a;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0:
+                                    sentinelHits = 0;
+                                    return [4 /*yield*/, axios_1.default.get("".concat(host, "/v1/proxy-image"), {
+                                            params: { url: sentinelURL_1 },
+                                            validateStatus: function () { return true; },
+                                            responseType: 'text',
+                                            transformResponse: [function (d) { return d; }],
+                                            timeout: 10000,
+                                        })];
+                                case 1:
+                                    res = _b.sent();
+                                    body = typeof res.data === 'string' ? res.data : JSON.stringify((_a = res.data) !== null && _a !== void 0 ? _a : '');
+                                    return [2 /*return*/, { status: res.status, leaked: body.includes(SENTINEL), sentinelHits: sentinelHits }];
+                            }
+                        });
+                    }); };
+                    // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0025: proxy-image does not stream an internal non-image resource to an unauthenticated caller', call_unauthenticated, {
+                            // Positive control: a numeric status proves we actually reached our API rather than failing to
+                            // connect (a connection error would make "nothing leaked" true for the wrong reason).
+                            onResult: function (r) { return (typeof r.status === 'number'
+                                && r.leaked === false
+                                && r.sentinelHits === 0); },
+                        })
+                        // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+                        // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+                    ];
+                case 3:
+                    // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
+                    _b.sent();
+                    // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+                    // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0025: proxy-image refuses an unauthenticated request without contacting the destination', call_unauthenticated, { onResult: function (r) { return r.status >= 400 && r.status < 500 && r.sentinelHits === 0; } })
+                        // Authenticating is not enough on its own — a staff session must not be able to reach an internal
+                        // address either. These use the real session, and are deterministic (no external network).
+                    ];
+                case 4:
+                    // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+                    // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+                    _b.sent();
+                    call_authenticated_1 = function (url) { return __awaiter(void 0, void 0, void 0, function () {
+                        var res;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    sentinelHits = 0;
+                                    return [4 /*yield*/, axios_1.default.post("".concat(host, "/v1/proxy-image"), { url: url }, {
+                                            headers: { Authorization: "Bearer ".concat(sdk.authToken) },
+                                            validateStatus: function () { return true; },
+                                            timeout: 10000,
+                                        })];
+                                case 1:
+                                    res = _a.sent();
+                                    return [2 /*return*/, { status: res.status, sentinelHits: sentinelHits }];
+                            }
+                        });
+                    }); };
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0025: proxy-image refuses a private destination even for an authenticated staff session', function () { return call_authenticated_1(sentinelURL_1); }, { onResult: function (r) { return r.status === 400 && r.sentinelHits === 0; } })];
+                case 5:
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0025: proxy-image refuses cloud metadata for an authenticated staff session', function () { return call_authenticated_1('https://169.254.169.254/latest/meta-data/'); }, { onResult: function (r) { return r.status === 400; } })
+                        // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+                    ];
+                case 6:
+                    _b.sent();
+                    // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0025: proxy-image refuses a plain http destination', function () { return call_authenticated_1('http://example.com/logo.png'); }, { onResult: function (r) { return r.status === 400; } })];
+                case 7:
+                    // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+                    _b.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0025: proxy-image refuses a non-443 port', function () { return call_authenticated_1('https://example.com:8443/logo.png'); }, { onResult: function (r) { return r.status === 400; } })];
+                case 8:
+                    _b.sent();
+                    return [3 /*break*/, 10];
+                case 9:
+                    sentinel.close();
+                    return [7 /*endfinally*/];
+                case 10: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.proxy_image_ssrf_tests = proxy_image_ssrf_tests;
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.proxy_image_ssrf_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0025 proxy-image SSRF test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0025 proxy-image SSRF test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0025-proxy-image-unauth-ssrf.test.js.map

package/lib/cjs/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0025-proxy-image-unauth-ssrf.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,8CAAuB;AACvB,gDAAyB;AACzB,oCAAsC;AACtC,+CAG4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,eAAe,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;AAEzD;;;;GAIG;AACH,IAAM,gBAAgB,GAAG;IACvB,IAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAA;IACvC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACvC,MAAM,IAAI,KAAK,CACb,8DAAuD,IAAI,QAAK;cAC9D,wGAAwG,CAC3G,CAAA;KACF;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACI,IAAM,sBAAsB,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAChD,IAAA,oBAAU,EAAC,0CAA0C,CAAC,CAAA;oBACtD,gBAAgB,EAAE,CAAA;oBAEZ,QAAQ,GAAG,yBAAkB,IAAI,CAAC,GAAG,EAAE,cAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAA;oBAClF,YAAY,GAAG,CAAC,CAAA;oBAId,QAAQ,GAAG,cAAI,CAAC,YAAY,CAAC,UAAC,CAAC,EAAE,GAAG;wBACxC,YAAY,EAAE,CAAA;wBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;wBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;oBAC/E,CAAC,CAAC,CAAA;;;;oBAGA,qBAAM,IAAI,OAAO,CAAO,UAAA,OAAO,IAAI,OAAA,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,cAAM,OAAA,OAAO,EAAE,EAAT,CAAS,CAAC,EAAhD,CAAgD,CAAC,EAAA;;oBAApF,SAAoF,CAAA;oBAC9E,YAAY,GAAI,QAAQ,CAAC,OAAO,EAAU,CAAC,IAAI,CAAA;oBAC/C,gBAAc,2BAAoB,YAAY,gDAA6C,CAAA;oBAI3F,oBAAoB,GAAG;;;;;;oCAC3B,YAAY,GAAG,CAAC,CAAA;oCACJ,qBAAM,eAAK,CAAC,GAAG,CAAC,UAAG,IAAI,oBAAiB,EAAE;4CACpD,MAAM,EAAE,EAAE,GAAG,EAAE,aAAW,EAAE;4CAC5B,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4CAC1B,YAAY,EAAE,MAAM;4CACpB,iBAAiB,EAAE,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,EAAD,CAAC,CAAC;4CAClC,OAAO,EAAE,KAAM;yCACT,CAAC,EAAA;;oCANH,GAAG,GAAG,SAMH;oCAEH,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAA,GAAG,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA;oCACrF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,cAAA,EAAE,EAAA;;;yBAC7E,CAAA;oBAED,+FAA+F;oBAC/F,qBAAM,IAAA,oBAAU,EACd,iGAAiG,EACjG,oBAAoB,EACpB;4BACE,+FAA+F;4BAC/F,sFAAsF;4BACtF,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CACpB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;mCACzB,CAAC,CAAC,MAAM,KAAK,KAAK;mCAClB,CAAC,CAAC,YAAY,KAAK,CAAC,CACxB,EAJqB,CAIrB;yBACF,CACF;wBAED,yFAAyF;wBACzF,iGAAiG;sBAHhG;;oBAbD,+FAA+F;oBAC/F,SAYC,CAAA;oBAED,yFAAyF;oBACzF,iGAAiG;oBACjG,qBAAM,IAAA,oBAAU,EACd,2FAA2F,EAC3F,oBAAoB,EACpB,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAAzD,CAAyD,EAAE,CACpF;wBAED,kGAAkG;wBAClG,2FAA2F;sBAH1F;;oBAND,yFAAyF;oBACzF,iGAAiG;oBACjG,SAIC,CAAA;oBAIK,uBAAqB,UAAO,GAAW;;;;;oCAC3C,YAAY,GAAG,CAAC,CAAA;oCACJ,qBAAM,eAAK,CAAC,IAAI,CAAC,UAAG,IAAI,oBAAiB,EAAE,EAAE,GAAG,KAAA,EAAE,EAAE;4CAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE;4CACrD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4CAC1B,OAAO,EAAE,KAAM;yCACT,CAAC,EAAA;;oCAJH,GAAG,GAAG,SAIH;oCACT,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,cAAA,EAAE,EAAA;;;yBAC5C,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,2FAA2F,EAC3F,cAAM,OAAA,oBAAkB,CAAC,aAAW,CAAC,EAA/B,CAA+B,EACrC,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAAxC,CAAwC,EAAE,CACnE,EAAA;;oBAJD,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,+EAA+E,EAC/E,cAAM,OAAA,oBAAkB,CAAC,2CAA2C,CAAC,EAA/D,CAA+D,EACrE,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C;wBAED,yFAAyF;sBAFxF;;oBAJD,SAIC,CAAA;oBAED,yFAAyF;oBACzF,qBAAM,IAAA,oBAAU,EACd,sDAAsD,EACtD,cAAM,OAAA,oBAAkB,CAAC,6BAA6B,CAAC,EAAjD,CAAiD,EACvD,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C,EAAA;;oBALD,yFAAyF;oBACzF,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,4CAA4C,EAC5C,cAAM,OAAA,oBAAkB,CAAC,mCAAmC,CAAC,EAAvD,CAAuD,EAC7D,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C,EAAA;;oBAJD,SAIC,CAAA;;;oBAED,QAAQ,CAAC,KAAK,EAAE,CAAA;;;;;;CAEnB,CAAA;AAlGY,QAAA,sBAAsB,0BAkGlC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,8BAAsB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAlD,SAAkD,CAAA;;;;SACnD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"F-0166-allowed-paths-wildcard-bypass.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AAkEtD,eAAO,MAAM,+BAA+B;SAA2B,OAAO;iBAAe,OAAO;mBA8ZnG,CAAA"}
+{"version":3,"file":"F-0166-allowed-paths-wildcard-bypass.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0166-allowed-paths-wildcard-bypass.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAkB,MAAM,cAAc,CAAA;AAkEtD,eAAO,MAAM,+BAA+B;SAA2B,OAAO;iBAAe,OAAO;mBAqnBnG,CAAA"}