@thymian/rules-rfc-9110 0.0.0-PLACEHOLDER

package/dist/rules/range-requests/range/server-should-send-416-response-for-unsatisfiable-range.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-should-send-416-response-for-unsatisfiable-range.rule.d.ts.map

package/dist/rules/range-requests/range/server-should-send-416-response-for-unsatisfiable-range.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-should-send-416-response-for-unsatisfiable-range.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/range-requests/range/server-should-send-416-response-for-unsatisfiable-range.rule.ts"],"names":[],"mappings":";AAEA,wBAaU"}

package/dist/rules/range-requests/range/server-should-send-416-response-for-unsatisfiable-range.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/server-should-send-416-response-for-unsatisfiable-range')
+    .severity('warn')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-range')
+    .description('If all of the preconditions are true, the server supports the Range header field for the target resource, the received Range field-value contains a valid ranges-specifier, and either the range-unit is not supported for that target resource or the ranges-specifier is unsatisfiable with respect to the selected representation, the server SHOULD send a 416 (Range Not Satisfiable) response.')
+    .summary('Server should send 416 response when Range header is valid but range-unit is unsupported or range is unsatisfiable.')
+    .appliesTo('server')
+    .done();
+//# sourceMappingURL=server-should-send-416-response-for-unsatisfiable-range.rule.js.map

package/dist/rules/range-requests/range/server-should-send-416-response-for-unsatisfiable-range.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-should-send-416-response-for-unsatisfiable-range.rule.js","sourceRoot":"","sources":["../../../../src/rules/range-requests/range/server-should-send-416-response-for-unsatisfiable-range.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,iEAAiE,CAClE;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CAAC,wDAAwD,CAAC;KAC7D,WAAW,CACV,sYAAsY,CACvY;KACA,OAAO,CACN,qHAAqH,CACtH;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,EAAE,CAAC"}

package/dist/rules/range-requests/range/utils.d.ts

@@ -0,0 +1,6 @@
+export type ByteRange = {
+    start: number;
+    end: number;
+};
+export declare function parseRangeHeader(header: string | string[]): ByteRange[];
+//# sourceMappingURL=utils.d.ts.map

package/dist/rules/range-requests/range/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/rules/range-requests/range/utils.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAwBvE"}

package/dist/rules/range-requests/range/utils.js

@@ -0,0 +1,21 @@
+export function parseRangeHeader(header) {
+    if (Array.isArray(header)) {
+        return header.flatMap(parseRangeHeader);
+    }
+    const [, rangesString] = header.match(/bytes=(.+)/) ?? [];
+    if (!rangesString) {
+        return [];
+    }
+    return rangesString.split(',').map((part) => {
+        const [start, end] = part
+            .trim()
+            .split('-')
+            .filter((x) => x !== '')
+            .map(Number);
+        if (typeof start === 'undefined' || typeof end === 'undefined') {
+            throw new Error('Invalid range');
+        }
+        return { start, end };
+    });
+}
+//# sourceMappingURL=utils.js.map

package/dist/rules/range-requests/range/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../src/rules/range-requests/range/utils.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAE1D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1C,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,IAAI;aACtB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,CAAC;aACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;aACvB,GAAG,CAAC,MAAM,CAAC,CAAC;QAEf,IAAI,OAAO,KAAK,KAAK,WAAW,IAAI,OAAO,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/rules/range-requests/range-units/recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.d.ts.map

package/dist/rules/range-requests/range-units/recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/range-requests/range-units/recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.ts"],"names":[],"mappings":";AAGA,wBA8CU"}

package/dist/rules/range-requests/range-units/recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.js

@@ -0,0 +1,37 @@
+import { getHeader, requestHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/recipient-must-anticipate-large-decimal-numerals-for-byte-range')
+    .severity('error')
+    .type('analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-byte-ranges')
+    .description('In the byte-range syntax, first-pos, last-pos, and suffix-length are expressed as decimal number of octets. Since there is no predefined limit to the length of content, recipients MUST anticipate potentially large decimal numerals and prevent parsing errors due to integer conversion overflows.')
+    .summary('Recipients MUST anticipate potentially large decimal numerals and prevent parsing errors due to integer conversion overflows.')
+    .rule((ctx, _, logger) => ctx.validateHttpTransactions(requestHeader('range'), (req) => {
+    const rangeHeaders = getHeader(req.headers, 'range');
+    if (!rangeHeaders) {
+        return false;
+    }
+    const ranges = Array.isArray(rangeHeaders)
+        ? rangeHeaders
+        : [rangeHeaders];
+    return ranges.some((range) => {
+        const numbers = range.match(/\d+/g);
+        if (!numbers) {
+            return false;
+        }
+        return numbers.some((number) => {
+            try {
+                return BigInt(number) > BigInt(Number.MAX_SAFE_INTEGER);
+            }
+            catch (e) {
+                logger.warn(`Cannot parse number in Range header to BigInt: ${e}`);
+                return {
+                    message: `Invalid range: ${range}`,
+                };
+            }
+        });
+    });
+    return false;
+}))
+    .done();
+//# sourceMappingURL=recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.js.map

package/dist/rules/range-requests/range-units/recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.js","sourceRoot":"","sources":["../../../../src/rules/range-requests/range-units/recipient-must-anticipate-large-decimal-numerals-for-byte-range.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,yEAAyE,CAC1E;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,WAAW,CAAC;KACjB,GAAG,CAAC,8DAA8D,CAAC;KACnE,WAAW,CACV,wSAAwS,CACzS;KACA,OAAO,CACN,+HAA+H,CAChI;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CACvB,GAAG,CAAC,wBAAwB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;IAC3D,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAErD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QACxC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,EAAE,CAAC,CAAC;gBACnE,OAAO;oBACL,OAAO,EAAE,kBAAkB,KAAK,EAAE;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CACH;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-encoding/content-encoding-should-not-include-identity.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=content-encoding-should-not-include-identity.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-encoding/content-encoding-should-not-include-identity.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-encoding-should-not-include-identity.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/content-encoding-should-not-include-identity.rule.ts"],"names":[],"mappings":";AAGA,wBAcU"}

package/dist/rules/representation-data-and-metadata/content-encoding/content-encoding-should-not-include-identity.rule.js

@@ -0,0 +1,12 @@
+import { responseHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/content-encoding-should-not-include-identity')
+    .severity('warn')
+    .type('test', 'analytics')
+    .appliesTo('server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.4')
+    .description(`The coding named "identity" is reserved for its special role in Accept-Encoding and thus SHOULD NOT be included in Content-Encoding.`)
+    .summary('Content-Encoding header SHOULD NOT include "identity" coding.')
+    .rule((ctx) => ctx.validateHttpTransactions(responseHeader('content-encoding', 'identity')))
+    .done();
+//# sourceMappingURL=content-encoding-should-not-include-identity.rule.js.map

package/dist/rules/representation-data-and-metadata/content-encoding/content-encoding-should-not-include-identity.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-encoding-should-not-include-identity.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/content-encoding-should-not-include-identity.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,sDAAsD,CAAC;KAC5E,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;KACzB,SAAS,CAAC,QAAQ,CAAC;KACnB,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,sIAAsI,CACvI;KACA,OAAO,CAAC,+DAA+D,CAAC;KACxE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAC1B,cAAc,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAC/C,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-encoding/origin-server-may-respond-415-for-unacceptable-content-coding.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=origin-server-may-respond-415-for-unacceptable-content-coding.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-encoding/origin-server-may-respond-415-for-unacceptable-content-coding.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-may-respond-415-for-unacceptable-content-coding.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/origin-server-may-respond-415-for-unacceptable-content-coding.rule.ts"],"names":[],"mappings":";AAWA,wBAuCU"}

package/dist/rules/representation-data-and-metadata/content-encoding/origin-server-may-respond-415-for-unacceptable-content-coding.rule.js

@@ -0,0 +1,25 @@
+import { and, not, origin, path, requestHeader, responseWith, statusCode, } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/origin-server-may-respond-415-for-unacceptable-content-coding')
+    .severity('hint')
+    .type('analytics', 'static')
+    .appliesTo('origin server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.4')
+    .description(`An origin server MAY respond with a status code of 415 (Unsupported Media Type) if a representation in the request message has a content coding that is not acceptable.`)
+    .summary('Origin servers MAY respond with 415 for unacceptable content-coding in requests.')
+    .rule((ctx) => ctx.validateCommonHttpTransactions(and(requestHeader('content-encoding'), not(responseWith(statusCode(415))))))
+    .overrideAnalyticsRule((ctx) => 
+// responseWith() cannot be compiled to SQL, so for analytics mode
+// we group by endpoint and check within each group whether any
+// transaction with Content-Encoding received a 415 response.
+ctx.validateGroupedCommonHttpTransactions(requestHeader('content-encoding'), and(origin(), path()), (_, transactions) => {
+    const has415 = transactions.some(([, res]) => res.statusCode === 415);
+    if (has415) {
+        return undefined;
+    }
+    // No 415 response for this endpoint — report the first transaction
+    const [, , location] = transactions[0] ?? [];
+    return location ? { location } : undefined;
+}))
+    .done();
+//# sourceMappingURL=origin-server-may-respond-415-for-unacceptable-content-coding.rule.js.map

package/dist/rules/representation-data-and-metadata/content-encoding/origin-server-may-respond-415-for-unacceptable-content-coding.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-may-respond-415-for-unacceptable-content-coding.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/origin-server-may-respond-415-for-unacceptable-content-coding.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,IAAI,EACJ,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,uEAAuE,CACxE;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;KAC3B,SAAS,CAAC,eAAe,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,yKAAyK,CAC1K;KACA,OAAO,CACN,kFAAkF,CACnF;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,8BAA8B,CAChC,GAAG,CACD,aAAa,CAAC,kBAAkB,CAAC,EACjC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CACnC,CACF,CACF;KACA,qBAAqB,CAAC,CAAC,GAAG,EAAE,EAAE;AAC7B,kEAAkE;AAClE,+DAA+D;AAC/D,6DAA6D;AAC7D,GAAG,CAAC,qCAAqC,CACvC,aAAa,CAAC,kBAAkB,CAAC,EACjC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EACrB,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE;IAClB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IACtE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,mEAAmE;IACnE,MAAM,CAAC,EAAE,AAAD,EAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC,CACF,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-compress-as-compress.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=recipient-should-treat-x-compress-as-compress.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-compress-as-compress.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-should-treat-x-compress-as-compress.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-compress-as-compress.rule.ts"],"names":[],"mappings":";AAGA,wBAgBU"}

package/dist/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-compress-as-compress.rule.js

@@ -0,0 +1,12 @@
+import { responseHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/recipient-should-treat-x-compress-as-compress')
+    .severity('hint')
+    .type('analytics')
+    .appliesTo('server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.4.1.1')
+    .description(`The "compress" coding is an adaptive Lempel-Ziv-Welch (LZW) coding [Welch] that is commonly produced by the UNIX file compression program "compress". A recipient SHOULD consider "x-compress" to be equivalent to "compress".`)
+    .summary('A recipient SHOULD consider "x-compress" to be equivalent to "compress".')
+    .rule((ctx) => ctx.validateHttpTransactions(responseHeader('content-encoding', 'x-compress')))
+    .done();
+//# sourceMappingURL=recipient-should-treat-x-compress-as-compress.rule.js.map

package/dist/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-compress-as-compress.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-should-treat-x-compress-as-compress.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-compress-as-compress.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,uDAAuD,CAAC;KAC7E,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,WAAW,CAAC;KACjB,SAAS,CAAC,QAAQ,CAAC;KACnB,GAAG,CAAC,6DAA6D,CAAC;KAClE,WAAW,CACV,gOAAgO,CACjO;KACA,OAAO,CACN,0EAA0E,CAC3E;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAC1B,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC,CACjD,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-gzip-as-gzip.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=recipient-should-treat-x-gzip-as-gzip.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-gzip-as-gzip.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-should-treat-x-gzip-as-gzip.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-gzip-as-gzip.rule.ts"],"names":[],"mappings":";AAGA,wBAYU"}

package/dist/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-gzip-as-gzip.rule.js

@@ -0,0 +1,12 @@
+import { responseHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/recipient-should-treat-x-gzip-as-gzip')
+    .severity('hint')
+    .type('analytics')
+    .appliesTo('server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.4.1.3')
+    .description(`The "gzip" coding is an LZ77 coding with a 32-bit Cyclic Redundancy Check (CRC) that is commonly produced by the gzip file compression program [RFC1952]. A recipient SHOULD consider "x-gzip" to be equivalent to "gzip".`)
+    .summary('A recipient SHOULD consider "x-gzip" to be equivalent to "gzip".')
+    .rule((ctx) => ctx.validateHttpTransactions(responseHeader('content-encoding', 'x-gzip')))
+    .done();
+//# sourceMappingURL=recipient-should-treat-x-gzip-as-gzip.rule.js.map

package/dist/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-gzip-as-gzip.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-should-treat-x-gzip-as-gzip.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/recipient-should-treat-x-gzip-as-gzip.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,+CAA+C,CAAC;KACrE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,WAAW,CAAC;KACjB,SAAS,CAAC,QAAQ,CAAC;KACnB,GAAG,CAAC,6DAA6D,CAAC;KAClE,WAAW,CACV,4NAA4N,CAC7N;KACA,OAAO,CAAC,kEAAkE,CAAC;KAC3E,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAAC,cAAc,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAC3E;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-encoding/sender-must-generate-content-encoding-header-if-encodings-applied.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=sender-must-generate-content-encoding-header-if-encodings-applied.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-encoding/sender-must-generate-content-encoding-header-if-encodings-applied.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-must-generate-content-encoding-header-if-encodings-applied.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/sender-must-generate-content-encoding-header-if-encodings-applied.rule.ts"],"names":[],"mappings":";AAGA,wBAUU"}

package/dist/rules/representation-data-and-metadata/content-encoding/sender-must-generate-content-encoding-header-if-encodings-applied.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+// in the future, we could analyze the request/response body and check if we can detect encodings that are not present in the headers
+export default httpRule('rfc9110/sender-must-generate-content-encoding-header-if-encodings-applied')
+    .severity('error')
+    .type('informational')
+    .appliesTo('server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.4')
+    .description(`If one or more encodings have been applied to a representation, the sender that applied the encodings MUST generate a Content-Encoding header field that lists the content codings in the order in which they were applied.`)
+    .done();
+//# sourceMappingURL=sender-must-generate-content-encoding-header-if-encodings-applied.rule.js.map

package/dist/rules/representation-data-and-metadata/content-encoding/sender-must-generate-content-encoding-header-if-encodings-applied.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-must-generate-content-encoding-header-if-encodings-applied.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-encoding/sender-must-generate-content-encoding-header-if-encodings-applied.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,qIAAqI;AACrI,eAAe,QAAQ,CACrB,2EAA2E,CAC5E;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,SAAS,CAAC,QAAQ,CAAC;KACnB,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,6NAA6N,CAC9N;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-language/content-language-may-be-applied-to-any-media-type.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=content-language-may-be-applied-to-any-media-type.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-language/content-language-may-be-applied-to-any-media-type.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-language-may-be-applied-to-any-media-type.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-language/content-language-may-be-applied-to-any-media-type.rule.ts"],"names":[],"mappings":";AAGA,wBAWU"}

package/dist/rules/representation-data-and-metadata/content-language/content-language-may-be-applied-to-any-media-type.rule.js

@@ -0,0 +1,9 @@
+import { responseHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/content-language-may-be-applied-to-any-media-type')
+    .severity('hint')
+    .type('analytics')
+    .description('Content-Language MAY be applied to any media type -- it is not limited to textual documents.')
+    .rule((ctx) => ctx.validateHttpTransactions(responseHeader('content-language')))
+    .done();
+//# sourceMappingURL=content-language-may-be-applied-to-any-media-type.rule.js.map

package/dist/rules/representation-data-and-metadata/content-language/content-language-may-be-applied-to-any-media-type.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-language-may-be-applied-to-any-media-type.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-language/content-language-may-be-applied-to-any-media-type.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,2DAA2D,CAC5D;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CACV,8FAA8F,CAC/F;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CACjE;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-language/multiple-languages-may-be-listed-for-multiple-audiences.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=multiple-languages-may-be-listed-for-multiple-audiences.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-language/multiple-languages-may-be-listed-for-multiple-audiences.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multiple-languages-may-be-listed-for-multiple-audiences.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-language/multiple-languages-may-be-listed-for-multiple-audiences.rule.ts"],"names":[],"mappings":";AAGA,wBAWU"}

package/dist/rules/representation-data-and-metadata/content-language/multiple-languages-may-be-listed-for-multiple-audiences.rule.js

@@ -0,0 +1,9 @@
+import { responseHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/multiple-languages-may-be-listed-for-multiple-audiences')
+    .severity('hint')
+    .type('analytics')
+    .description('Multiple languages MAY be listed for content that is intended for multiple audiences.')
+    .rule((ctx) => ctx.validateHttpTransactions(responseHeader('content-language')))
+    .done();
+//# sourceMappingURL=multiple-languages-may-be-listed-for-multiple-audiences.rule.js.map

package/dist/rules/representation-data-and-metadata/content-language/multiple-languages-may-be-listed-for-multiple-audiences.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multiple-languages-may-be-listed-for-multiple-audiences.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-language/multiple-languages-may-be-listed-for-multiple-audiences.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,iEAAiE,CAClE;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CACV,uFAAuF,CACxF;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CACjE;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-length/origin-server-should-send-content-length-when-size-known.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=origin-server-should-send-content-length-when-size-known.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-length/origin-server-should-send-content-length-when-size-known.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-should-send-content-length-when-size-known.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/origin-server-should-send-content-length-when-size-known.rule.ts"],"names":[],"mappings":";AAUA,wBA2BU"}

package/dist/rules/representation-data-and-metadata/content-length/origin-server-should-send-content-length-when-size-known.rule.js

@@ -0,0 +1,15 @@
+import { and, hasResponseBody, not, responseHeader, statusCode, statusCodeRange, } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/origin-server-should-send-content-length-when-size-known')
+    .severity('warn')
+    .type('static', 'test', 'analytics')
+    .appliesTo('origin server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6')
+    .description(`In the absence of Transfer-Encoding, an origin server SHOULD send a Content-Length header field
+    when the content size is known prior to sending the complete header section.`)
+    .summary('Origin servers SHOULD send Content-Length when content size is known.')
+    .rule((ctx) => ctx.validateCommonHttpTransactions(and(hasResponseBody(), not(responseHeader('transfer-encoding')), not(responseHeader('content-length')), 
+// Exclude cases where Content-Length MUST NOT be sent
+not(statusCodeRange(100, 199)), not(statusCode(204)), not(statusCode(304)))))
+    .done();
+//# sourceMappingURL=origin-server-should-send-content-length-when-size-known.rule.js.map

package/dist/rules/representation-data-and-metadata/content-length/origin-server-should-send-content-length-when-size-known.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-should-send-content-length-when-size-known.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/origin-server-should-send-content-length-when-size-known.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,GAAG,EACH,eAAe,EACf,GAAG,EACH,cAAc,EACd,UAAU,EACV,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,kEAAkE,CACnE;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC;KACnC,SAAS,CAAC,eAAe,CAAC;KAC1B,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV;iFAC6E,CAC9E;KACA,OAAO,CACN,uEAAuE,CACxE;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,8BAA8B,CAChC,GAAG,CACD,eAAe,EAAE,EACjB,GAAG,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,EACxC,GAAG,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;AACrC,sDAAsD;AACtD,GAAG,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAC9B,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EACpB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CACrB,CACF,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-length/recipient-must-handle-large-content-length.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=recipient-must-handle-large-content-length.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-length/recipient-must-handle-large-content-length.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-handle-large-content-length.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/recipient-must-handle-large-content-length.rule.ts"],"names":[],"mappings":";AAOA,wBA+CU"}

package/dist/rules/representation-data-and-metadata/content-length/recipient-must-handle-large-content-length.rule.js

@@ -0,0 +1,38 @@
+import { getHeader, httpTransactionToLabel, responseHeader, } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/recipient-must-handle-large-content-length')
+    .severity('warn')
+    .type('test', 'analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6')
+    .description(`A recipient MUST anticipate potentially large decimal numerals and prevent parsing errors due to integer
+    conversion overflows or precision loss due to integer conversion. Content-Length values should be validated
+    to ensure they don't exceed reasonable limits that could cause security issues.`)
+    .summary('Content-Length values should be checked for integer overflow risks.')
+    .rule((ctx) => ctx.validateHttpTransactions(responseHeader('content-length'), (req, res) => {
+    const contentLengthHeader = getHeader(res.headers, 'content-length');
+    if (typeof contentLengthHeader !== 'string') {
+        return false;
+    }
+    // Check for extremely large values that could cause issues
+    // JavaScript Number.MAX_SAFE_INTEGER is 2^53 - 1
+    // But we'll warn for values > 2^40 (1TB) as that's unusually large
+    const MAX_REASONABLE_SIZE = Math.pow(2, 40); // 1 TB
+    try {
+        const numericValue = BigInt(contentLengthHeader);
+        if (numericValue > BigInt(MAX_REASONABLE_SIZE)) {
+            return {
+                message: `Content-Length value ${numericValue.toString()} exceeds reasonable size limit (>1TB), potential overflow risk`,
+                location: httpTransactionToLabel(req, res),
+            };
+        }
+    }
+    catch (e) {
+        return {
+            message: `Content-Length value "${contentLengthHeader}" is too large to parse safely`,
+            location: httpTransactionToLabel(req, res),
+        };
+    }
+    return false;
+}))
+    .done();
+//# sourceMappingURL=recipient-must-handle-large-content-length.rule.js.map

package/dist/rules/representation-data-and-metadata/content-length/recipient-must-handle-large-content-length.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-must-handle-large-content-length.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/recipient-must-handle-large-content-length.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,oDAAoD,CAAC;KAC1E,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;KACzB,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV;;oFAEgF,CACjF;KACA,OAAO,CACN,qEAAqE,CACtE;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAC1B,cAAc,CAAC,gBAAgB,CAAC,EAChC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACX,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAErE,IAAI,OAAO,mBAAmB,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2DAA2D;IAC3D,iDAAiD;IACjD,mEAAmE;IACnE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO;IAEpD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAEjD,IAAI,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,OAAO,EAAE,wBAAwB,YAAY,CAAC,QAAQ,EAAE,gEAAgE;gBACxH,QAAQ,EAAE,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;aAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,yBAAyB,mBAAmB,gCAAgC;YACrF,QAAQ,EAAE,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CACF,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-incorrect-content-length.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=sender-must-not-forward-incorrect-content-length.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-incorrect-content-length.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-must-not-forward-incorrect-content-length.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/sender-must-not-forward-incorrect-content-length.rule.ts"],"names":[],"mappings":";AAEA,wBAaU"}

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-incorrect-content-length.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/sender-must-not-forward-incorrect-content-length')
+    .severity('error')
+    .type('informational')
+    .appliesTo('server', 'intermediary')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6')
+    .description(`A sender MUST NOT forward a message with a Content-Length header field value that is known to be incorrect.`)
+    .summary('Servers and intermediaries MUST NOT forward messages with known incorrect Content-Length.')
+    .done();
+//# sourceMappingURL=sender-must-not-forward-incorrect-content-length.rule.js.map

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-incorrect-content-length.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-must-not-forward-incorrect-content-length.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/sender-must-not-forward-incorrect-content-length.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,0DAA0D,CAC3D;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,SAAS,CAAC,QAAQ,EAAE,cAAc,CAAC;KACnC,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,6GAA6G,CAC9G;KACA,OAAO,CACN,2FAA2F,CAC5F;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-incorrect-content-length-header.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=sender-must-not-forward-message-with-incorrect-content-length-header.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-incorrect-content-length-header.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-must-not-forward-message-with-incorrect-content-length-header.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-incorrect-content-length-header.rule.ts"],"names":[],"mappings":";AAEA,wBAaU"}

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-incorrect-content-length-header.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/sender-must-not-forward-message-with-incorrect-content-length-header')
+    .severity('error')
+    .type('informational')
+    .appliesTo('server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6')
+    .description(`Because Content-Length is used for message delimitation in HTTP/1.1, its field value can impact how the message is parsed by downstream recipients even when the immediate connection is not using HTTP/1.1. If the message is forwarded by a downstream intermediary, a Content-Length field value that is inconsistent with the received message framing might cause a security failure due to request smuggling or response splitting. As a result, a sender MUST NOT forward a message with a Content-Length header field value that is known to be incorrect.`)
+    .summary('A sender MUST NOT forward a message with a Content-Length header field value that is known to be incorrect.')
+    .done();
+//# sourceMappingURL=sender-must-not-forward-message-with-incorrect-content-length-header.rule.js.map

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-incorrect-content-length-header.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-must-not-forward-message-with-incorrect-content-length-header.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-incorrect-content-length-header.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,8EAA8E,CAC/E;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,SAAS,CAAC,QAAQ,CAAC;KACnB,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,oiBAAoiB,CACriB;KACA,OAAO,CACN,6GAA6G,CAC9G;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-invalid-content-length.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=sender-must-not-forward-message-with-invalid-content-length.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-invalid-content-length.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-must-not-forward-message-with-invalid-content-length.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-invalid-content-length.rule.ts"],"names":[],"mappings":";AAEA,wBAaU"}

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-invalid-content-length.rule.js

@@ -0,0 +1,10 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/sender-must-not-forward-message-with-invalid-content-length')
+    .severity('error')
+    .type('informational')
+    .appliesTo('server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6')
+    .description('Likewise, a sender MUST NOT forward a message with a Content-Length header field value that does not match the ABNF above, with one exception: a recipient of a Content-Length header field value consisting of the same decimal value repeated as a comma-separated list (e.g, "Content-Length: 42, 42") MAY either reject the message as invalid or replace that invalid field value with a single instance of the decimal value, since this likely indicates that a duplicate was generated or combined by an upstream message processor.')
+    .summary('a sender MUST NOT forward a message with a Content-Length header field value that does not match the ABNF.')
+    .done();
+//# sourceMappingURL=sender-must-not-forward-message-with-invalid-content-length.rule.js.map

package/dist/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-invalid-content-length.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-must-not-forward-message-with-invalid-content-length.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/sender-must-not-forward-message-with-invalid-content-length.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,qEAAqE,CACtE;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,SAAS,CAAC,QAAQ,CAAC;KACnB,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV,8gBAA8gB,CAC/gB;KACA,OAAO,CACN,4GAA4G,CAC7G;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-304.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-may-send-content-length-for-304.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-304.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-may-send-content-length-for-304.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-304.rule.ts"],"names":[],"mappings":";AAYA,wBA6DU"}

package/dist/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-304.rule.js

@@ -0,0 +1,39 @@
+import { and, getHeader, method, not, or, requestHeader, responseHeader, statusCode, } from '@thymian/core';
+import { httpRule, singleTestCase } from '@thymian/core';
+export default httpRule('rfc9110/server-may-send-content-length-for-304')
+    .severity('error')
+    .type('test')
+    .appliesTo('server')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6')
+    .description(`A server MAY send a Content-Length header field in a 304 (Not Modified) response to a conditional GET request;
+    a server MUST NOT send Content-Length in such a response unless its field value equals the decimal number of
+    octets that would have been sent in the content of a 200 (OK) response to the same request. This is useful for
+    cache validation but cannot be automatically validated without access to what the 200 response would contain.`)
+    .summary('Servers MAY send Content-Length in 304 responses if it matches what 200 would return.')
+    .rule((ctx) => ctx.httpTest(singleTestCase()
+    .forTransactionsWith(and(method('GET'), statusCode(200)))
+    .run()
+    .skipIf(not(or(responseHeader('etag'), responseHeader('last-modified'))), '200 OK response does not include ETag or Last-Modified header and therefore no 304 Not Modified response can be triggered.')
+    .replayStep((step) => step
+    .set(requestHeader('if-none-match'), responseHeader('etag'))
+    .set(requestHeader('if-modified-since'), responseHeader('last-modified'))
+    .run({ expectStatusCode: 304 })
+    .done())
+    .transactions(([okResponse, notModifiedResponse]) => {
+    const okResponseLength = getHeader(okResponse.response.headers, 'content-length');
+    const notModifiedLength = getHeader(notModifiedResponse.response.headers, 'content-length');
+    if (typeof okResponseLength === 'string' &&
+        typeof notModifiedLength === 'string' &&
+        okResponseLength !== notModifiedLength) {
+        ctx.reportViolation({
+            message: `Content-Length in HEAD response does not match GET response (${okResponseLength} != ${notModifiedLength}).`,
+            location: {
+                elementType: 'edge',
+                elementId: okResponse.source.transactionId,
+            },
+        });
+    }
+})
+    .done()))
+    .done();
+//# sourceMappingURL=server-may-send-content-length-for-304.rule.js.map

package/dist/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-304.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-may-send-content-length-for-304.rule.js","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-304.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,GAAG,EACH,EAAE,EACF,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzD,eAAe,QAAQ,CAAC,gDAAgD,CAAC;KACtE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,MAAM,CAAC;KACZ,SAAS,CAAC,QAAQ,CAAC;KACnB,GAAG,CAAC,yDAAyD,CAAC;KAC9D,WAAW,CACV;;;kHAG8G,CAC/G;KACA,OAAO,CACN,uFAAuF,CACxF;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,QAAQ,CACV,cAAc,EAAE;KACb,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;KACxD,GAAG,EAAE;KACL,MAAM,CACL,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC,CAAC,EAChE,4HAA4H,CAC7H;KACA,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CACnB,IAAI;KACD,GAAG,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;KAC3D,GAAG,CACF,aAAa,CAAC,mBAAmB,CAAC,EAClC,cAAc,CAAC,eAAe,CAAC,CAChC;KACA,GAAG,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;KAC9B,IAAI,EAAE,CACV;KACA,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,mBAAmB,CAAC,EAAE,EAAE;IAClD,MAAM,gBAAgB,GAAG,SAAS,CAChC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAC3B,gBAAgB,CACjB,CAAC;IAEF,MAAM,iBAAiB,GAAG,SAAS,CACjC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EACpC,gBAAgB,CACjB,CAAC;IAEF,IACE,OAAO,gBAAgB,KAAK,QAAQ;QACpC,OAAO,iBAAiB,KAAK,QAAQ;QACrC,gBAAgB,KAAK,iBAAiB,EACtC,CAAC;QACD,GAAG,CAAC,eAAe,CAAC;YAClB,OAAO,EAAE,gEAAgE,gBAAgB,OAAO,iBAAiB,IAAI;YACrH,QAAQ,EAAE;gBACR,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,aAAa;aAC3C;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;KACD,IAAI,EAAE,CACV,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-head-response.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-may-send-content-length-for-head-response.rule.d.ts.map

package/dist/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-head-response.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-may-send-content-length-for-head-response.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/representation-data-and-metadata/content-length/server-may-send-content-length-for-head-response.rule.ts"],"names":[],"mappings":";AASA,wBAsDU"}