@toewpq/edgeshield 0.0.0-stage → 2026.10.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (158) hide show
  1. package/LICENSE +202 -0
  2. package/NOTICE +10 -0
  3. package/README.md +206 -2
  4. package/config.yml +29 -0
  5. package/origin/cloudflare/app/config.yml +2 -0
  6. package/origin/cloudflare/app/index.js +4 -0
  7. package/origin/edgeone/app/config.yml +2 -0
  8. package/origin/edgeone/app/index.js +4 -0
  9. package/origin/esa/app/config.yml +2 -0
  10. package/origin/esa/app/index.js +4 -0
  11. package/origin/netlify/app/config.yml +2 -0
  12. package/origin/netlify/app/index.js +4 -0
  13. package/origin/vercel/app/config.yml +2 -0
  14. package/origin/vercel/app/index.js +4 -0
  15. package/package.json +121 -4
  16. package/respond/403.html +2 -0
  17. package/respond/403.json +1 -0
  18. package/rules/allowlist.yml +2 -0
  19. package/rules/emergency.conf +4 -0
  20. package/rules/local.conf +2 -0
  21. package/rules/seclang-bundle.json +360 -0
  22. package/rules/seclang-upstreams.json +14 -0
  23. package/rules/setup.conf +15 -0
  24. package/secret/credentials.example.yml +7 -0
  25. package/secret/relay-server.example.yml +10 -0
  26. package/tools/.build/scr/adapters/cloudflare/runtime.d.ts +18 -0
  27. package/tools/.build/scr/adapters/cloudflare/runtime.js +16 -0
  28. package/tools/.build/scr/adapters/cloudflare/runtime.js.map +1 -0
  29. package/tools/.build/scr/adapters/cloudflare/worker.js +25 -0
  30. package/tools/.build/scr/adapters/edgeone/worker.js +7 -0
  31. package/tools/.build/scr/adapters/esa/worker.js +5 -0
  32. package/tools/.build/scr/adapters/forward.d.ts +4 -0
  33. package/tools/.build/scr/adapters/forward.js +25 -0
  34. package/tools/.build/scr/adapters/forward.js.map +1 -0
  35. package/tools/.build/scr/adapters/handler.js +39 -0
  36. package/tools/.build/scr/adapters/ingress.d.ts +10 -0
  37. package/tools/.build/scr/adapters/ingress.js +62 -0
  38. package/tools/.build/scr/adapters/ingress.js.map +1 -0
  39. package/tools/.build/scr/adapters/netlify/worker.js +7 -0
  40. package/tools/.build/scr/adapters/runtime.d.ts +33 -0
  41. package/tools/.build/scr/adapters/runtime.js +50 -0
  42. package/tools/.build/scr/adapters/runtime.js.map +1 -0
  43. package/tools/.build/scr/adapters/vercel/worker.js +7 -0
  44. package/tools/.build/scr/cli/config.d.ts +2 -0
  45. package/tools/.build/scr/cli/config.js +23 -0
  46. package/tools/.build/scr/cli/config.js.map +1 -0
  47. package/tools/.build/scr/cli/deployment.d.ts +15 -0
  48. package/tools/.build/scr/cli/deployment.js +108 -0
  49. package/tools/.build/scr/cli/deployment.js.map +1 -0
  50. package/tools/.build/scr/cli/init.d.ts +2 -0
  51. package/tools/.build/scr/cli/init.js +62 -0
  52. package/tools/.build/scr/cli/init.js.map +1 -0
  53. package/tools/.build/scr/cli/main.d.ts +2 -0
  54. package/tools/.build/scr/cli/main.js +99 -0
  55. package/tools/.build/scr/cli/main.js.map +1 -0
  56. package/tools/.build/scr/cli/relay-serve.d.ts +1 -0
  57. package/tools/.build/scr/cli/relay-serve.js +48 -0
  58. package/tools/.build/scr/cli/relay-serve.js.map +1 -0
  59. package/tools/.build/scr/cli/responses.d.ts +2 -0
  60. package/tools/.build/scr/cli/responses.js +31 -0
  61. package/tools/.build/scr/cli/responses.js.map +1 -0
  62. package/tools/.build/scr/cli/serve.d.ts +1 -0
  63. package/tools/.build/scr/cli/serve.js +132 -0
  64. package/tools/.build/scr/cli/serve.js.map +1 -0
  65. package/tools/.build/scr/config.d.ts +39 -0
  66. package/tools/.build/scr/config.js +89 -0
  67. package/tools/.build/scr/config.js.map +1 -0
  68. package/tools/.build/scr/core/types.d.ts +27 -0
  69. package/tools/.build/scr/core/types.js +34 -0
  70. package/tools/.build/scr/core/types.js.map +1 -0
  71. package/tools/.build/scr/core/version.d.ts +1 -0
  72. package/tools/.build/scr/core/version.js +3 -0
  73. package/tools/.build/scr/core/version.js.map +1 -0
  74. package/tools/.build/scr/http-boundary/index.d.ts +19 -0
  75. package/tools/.build/scr/http-boundary/index.js +173 -0
  76. package/tools/.build/scr/http-boundary/index.js.map +1 -0
  77. package/tools/.build/scr/http-boundary/json.d.ts +2 -0
  78. package/tools/.build/scr/http-boundary/json.js +90 -0
  79. package/tools/.build/scr/http-boundary/json.js.map +1 -0
  80. package/tools/.build/scr/origin/relay.d.ts +20 -0
  81. package/tools/.build/scr/origin/relay.js +221 -0
  82. package/tools/.build/scr/origin/relay.js.map +1 -0
  83. package/tools/.build/scr/origin/replay-node.d.ts +8 -0
  84. package/tools/.build/scr/origin/replay-node.js +36 -0
  85. package/tools/.build/scr/origin/replay-node.js.map +1 -0
  86. package/tools/.build/scr/origin/types.d.ts +18 -0
  87. package/tools/.build/scr/origin/types.js +2 -0
  88. package/tools/.build/scr/origin/types.js.map +1 -0
  89. package/tools/.build/scr/runtime/allowlist.d.ts +21 -0
  90. package/tools/.build/scr/runtime/allowlist.js +84 -0
  91. package/tools/.build/scr/runtime/allowlist.js.map +1 -0
  92. package/tools/.build/scr/runtime/browser-cache.d.ts +7 -0
  93. package/tools/.build/scr/runtime/browser-cache.js +50 -0
  94. package/tools/.build/scr/runtime/browser-cache.js.map +1 -0
  95. package/tools/.build/scr/runtime/error-pages.d.ts +10 -0
  96. package/tools/.build/scr/runtime/error-pages.js +72 -0
  97. package/tools/.build/scr/runtime/error-pages.js.map +1 -0
  98. package/tools/.build/scr/runtime/index.d.ts +54 -0
  99. package/tools/.build/scr/runtime/index.js +355 -0
  100. package/tools/.build/scr/runtime/index.js.map +1 -0
  101. package/tools/.build/scr/runtime/node.d.ts +3 -0
  102. package/tools/.build/scr/runtime/node.js +97 -0
  103. package/tools/.build/scr/runtime/node.js.map +1 -0
  104. package/tools/.build/scr/runtime/proxy.d.ts +12 -0
  105. package/tools/.build/scr/runtime/proxy.js +177 -0
  106. package/tools/.build/scr/runtime/proxy.js.map +1 -0
  107. package/tools/.build/scr/runtime/stream.d.ts +8 -0
  108. package/tools/.build/scr/runtime/stream.js +72 -0
  109. package/tools/.build/scr/runtime/stream.js.map +1 -0
  110. package/tools/.build/scr/seclang/body.d.ts +13 -0
  111. package/tools/.build/scr/seclang/body.js +109 -0
  112. package/tools/.build/scr/seclang/body.js.map +1 -0
  113. package/tools/.build/scr/seclang/bytes.d.ts +5 -0
  114. package/tools/.build/scr/seclang/bytes.js +38 -0
  115. package/tools/.build/scr/seclang/bytes.js.map +1 -0
  116. package/tools/.build/scr/seclang/index.d.ts +166 -0
  117. package/tools/.build/scr/seclang/index.js +1484 -0
  118. package/tools/.build/scr/seclang/index.js.map +1 -0
  119. package/tools/.build/scr/seclang/json.d.ts +2 -0
  120. package/tools/.build/scr/seclang/json.js +87 -0
  121. package/tools/.build/scr/seclang/json.js.map +1 -0
  122. package/tools/.build/scr/seclang/libinjection.d.ts +9 -0
  123. package/tools/.build/scr/seclang/libinjection.js +59 -0
  124. package/tools/.build/scr/seclang/libinjection.js.map +1 -0
  125. package/tools/.build/scr/seclang/node.d.ts +22 -0
  126. package/tools/.build/scr/seclang/node.js +113 -0
  127. package/tools/.build/scr/seclang/node.js.map +1 -0
  128. package/tools/.build/scr/seclang/pcre2.d.ts +23 -0
  129. package/tools/.build/scr/seclang/pcre2.js +153 -0
  130. package/tools/.build/scr/seclang/pcre2.js.map +1 -0
  131. package/tools/.build/scr/seclang/sources.d.ts +6 -0
  132. package/tools/.build/scr/seclang/sources.js +59 -0
  133. package/tools/.build/scr/seclang/sources.js.map +1 -0
  134. package/tools/.build/scr/seclang/state.d.ts +17 -0
  135. package/tools/.build/scr/seclang/state.js +50 -0
  136. package/tools/.build/scr/seclang/state.js.map +1 -0
  137. package/tools/.build/scr/seclang/syntax.d.ts +9 -0
  138. package/tools/.build/scr/seclang/syntax.js +74 -0
  139. package/tools/.build/scr/seclang/syntax.js.map +1 -0
  140. package/tools/.build/scr/seclang/transforms.d.ts +3 -0
  141. package/tools/.build/scr/seclang/transforms.js +157 -0
  142. package/tools/.build/scr/seclang/transforms.js.map +1 -0
  143. package/tools/.build/scr/seclang/unicode.d.ts +2 -0
  144. package/tools/.build/scr/seclang/unicode.js +19 -0
  145. package/tools/.build/scr/seclang/unicode.js.map +1 -0
  146. package/tools/.build/scr/seclang/vendor/LIBINJECTION-LICENSE +33 -0
  147. package/tools/.build/scr/seclang/vendor/PCRE2-NOTICE +47 -0
  148. package/tools/.build/scr/seclang/vendor/PCRE2-WRAPPER-LICENSE +21 -0
  149. package/tools/.build/scr/seclang/vendor/UNICODE-DATA-NOTICE +6 -0
  150. package/tools/.build/scr/seclang/vendor/libinjection.json +7 -0
  151. package/tools/.build/scr/seclang/vendor/libinjection.wasm +0 -0
  152. package/tools/.build/scr/seclang/vendor/pcre2.json +7 -0
  153. package/tools/.build/scr/seclang/vendor/pcre2.wasm +0 -0
  154. package/tools/.build/scr/seclang/vendor/unicode.json +378 -0
  155. package/tools/build-platform.mjs +199 -0
  156. package/tools/platform-command.mjs +59 -0
  157. package/tools/sync-native-seclang.mjs +155 -0
  158. package/tools/verify-full-crs.mjs +118 -0
package/rules/allowlist.yml ADDED
@@ -0,0 +1,2 @@
1
+ # Operator-owned exemptions. Upstream synchronization never changes this file.
2
+ []
package/rules/emergency.conf ADDED
@@ -0,0 +1,4 @@
1
+ # Native SecLang virtual patches maintained and tested with the engine.
2
+ # CVE-2025-29927: reject the externally supplied Next.js internal subrequest header.
3
+ # Vendor workaround: https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw
4
+ SecRule &REQUEST_HEADERS:x-middleware-subrequest "@gt 0" "id:1000300,phase:1,deny,status:403,log,msg:'Next.js middleware authorization bypass',tag:'CVE-2025-29927',setvar:tx.edgeshield_attack=1"
package/rules/local.conf ADDED
@@ -0,0 +1,2 @@
1
+ # Operator-owned SecLang rules. Upstream synchronization never modifies this file.
2
+ # Put phase 1 initialization, exclusions, and phase 5 counters here as needed.