edgeaegis 2026.10.1

package/tools/sync-native-seclang.mjs

@@ -0,0 +1,155 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { verifyFullCrs } from "./verify-full-crs.mjs";
+
+function option(name, fallback) {
+  const index = process.argv.indexOf(name);
+  if (index < 0) return fallback;
+  const value = process.argv[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`Missing ${name} path`);
+  return pathToFileURL(resolve(value));
+}
+const registryUrl = option(
+  "--registry",
+  new URL("../rules/seclang-upstreams.json", import.meta.url),
+);
+const registry = JSON.parse(await readFile(registryUrl, "utf8"));
+if (registry.version !== 1 || !Array.isArray(registry.sources) || !registry.sources.length)
+  throw new Error("Invalid SecLang upstream registry");
+const update = process.argv.includes("--latest");
+const files = {},
+  upstreams = [];
+let total = 0,
+  source = "";
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+async function github(path, limit = 2 * 1024 * 1024) {
+  const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN;
+  const response = await fetch(`https://api.github.com/${path}`, {
+    redirect: "error",
+    signal: AbortSignal.timeout(30000),
+    headers: {
+      accept: "application/vnd.github+json",
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+    },
+  });
+  if (!response.ok) throw new Error(`GitHub source request failed: HTTP ${response.status}`);
+  const chunks = [];
+  let length = 0;
+  for await (const chunk of response.body) {
+    length += chunk.length;
+    if (length > limit) throw new Error("Upstream response exceeds limit");
+    chunks.push(chunk);
+  }
+  return JSON.parse(Buffer.concat(chunks));
+}
+async function rawBlob(repository, commit, path) {
+  const response = await fetch(
+    `https://raw.githubusercontent.com/${repository}/${commit}/${path.split("/").map(encodeURIComponent).join("/")}`,
+    {
+      redirect: "error",
+      signal: AbortSignal.timeout(30000),
+    },
+  );
+  if (!response.ok) throw new Error(`GitHub source file request failed: HTTP ${response.status}`);
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of response.body) {
+    size += chunk.length;
+    if (size > 2 * 1024 * 1024) throw new Error("Upstream file exceeds limit");
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+const ids = new Set();
+for (const spec of registry.sources) {
+  if (
+    !/^[a-z0-9-]{1,64}$/.test(spec.id) ||
+    ids.has(spec.id) ||
+    !/^[a-f0-9]{40}$/.test(spec.commit) ||
+    !/^[\w.-]+\/[\w.-]+$/.test(spec.repository) ||
+    ![spec.rulesDirectory, spec.setup, spec.license].every(
+      (path) =>
+        typeof path === "string" && !path.startsWith("/") && !path.split("/").includes(".."),
+    )
+  )
+    throw new Error("Invalid SecLang source");
+  ids.add(spec.id);
+  const ref = update
+    ? (await github(`repos/${spec.repository}/releases/latest`)).tag_name
+    : spec.ref;
+  if (typeof ref !== "string" || ref.length > 128) throw new Error("Invalid upstream ref");
+  const revision = update ? ref : spec.commit;
+  const commit = (await github(`repos/${spec.repository}/commits/${encodeURIComponent(revision)}`))
+    .sha;
+  if (!/^[a-f0-9]{40}$/.test(commit)) throw new Error("Invalid upstream commit");
+  if (!update && commit !== spec.commit) throw new Error("Upstream commit differs from its pin");
+  const tree = await github(
+    `repos/${spec.repository}/git/trees/${commit}?recursive=1`,
+    8 * 1024 * 1024,
+  );
+  if (tree.truncated || !Array.isArray(tree.tree)) throw new Error("Incomplete upstream tree");
+  const entries = tree.tree.filter(
+    (item) =>
+      item.type === "blob" &&
+      ((item.path.startsWith(`${spec.rulesDirectory}/`) &&
+        /\.(conf|data|txt|ipset|list)$/.test(item.path)) ||
+        item.path === spec.setup ||
+        item.path === spec.license),
+  );
+  if (
+    !entries.some((item) => item.path === spec.setup) ||
+    !entries.some((item) => item.path === spec.license)
+  )
+    throw new Error("Missing upstream setup/license");
+  const manifest = [];
+  // Bound network concurrency while preserving deterministic upstream file order.
+  for (let offset = 0; offset < entries.length; offset += 8) {
+    const batch = await Promise.all(
+      entries.slice(offset, offset + 8).map(async (item) => {
+        if (process.env.GH_TOKEN || process.env.GITHUB_TOKEN) {
+          const blob = await github(
+            `repos/${spec.repository}/git/blobs/${item.sha}`,
+            4 * 1024 * 1024,
+          );
+          if (blob.encoding !== "base64" || blob.sha !== item.sha)
+            throw new Error("Unexpected upstream blob");
+          return { item, bytes: Buffer.from(blob.content, "base64") };
+        }
+        return { item, bytes: await rawBlob(spec.repository, commit, item.path) };
+      }),
+    );
+    for (const { item, bytes } of batch) {
+      total += bytes.length;
+      if (total > 16 * 1024 * 1024 || bytes.length > 2 * 1024 * 1024)
+        throw new Error("SecLang source bundle exceeds limit");
+      const gitHash = createHash("sha1")
+        .update(`blob ${bytes.length}\0`)
+        .update(bytes)
+        .digest("hex");
+      if (gitHash !== item.sha) throw new Error("Upstream Git blob hash mismatch");
+      const path = `${spec.id}/${item.path === spec.setup ? "setup.conf" : item.path}`;
+      files[path] = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+      manifest.push({ path, bytes: bytes.length, sha256: digest(bytes), gitBlob: item.sha });
+    }
+  }
+  source += `Include ${spec.id}/setup.conf\nInclude ${spec.id}/${spec.rulesDirectory}/*.conf\n`;
+  upstreams.push({ id: spec.id, repository: spec.repository, ref, commit, files: manifest });
+  spec.ref = ref;
+  spec.commit = commit;
+}
+const bundle = { version: 1, format: "seclang-source-bundle", source, files, upstreams };
+const validation = await verifyFullCrs(bundle);
+const destination = option("--output", new URL("../rules/seclang-bundle.json", import.meta.url));
+await mkdir(new URL("./", destination), { recursive: true });
+const temporary = new URL(`${destination.href}.tmp`);
+await writeFile(temporary, `${JSON.stringify(bundle, null, 2)}\n`);
+await rename(temporary, destination);
+if (update) await writeFile(registryUrl, `${JSON.stringify(registry, null, 2)}\n`);
+console.log(
+  JSON.stringify({
+    upstreams: upstreams.map(({ id, ref, commit }) => ({ id, ref, commit })),
+    validation,
+  }),
+);

package/tools/verify-full-crs.mjs

@@ -0,0 +1,118 @@
+import assert from "node:assert/strict";
+import { compileSecLang, executeSecLang } from "./.build/scr/seclang/index.js";
+import { loadSecLangBackends } from "./.build/scr/seclang/node.js";
+import { parseSecLangSyntax } from "./.build/scr/seclang/syntax.js";
+
+/** Required full-corpus gate: any missing data or unsupported statement aborts compilation. */
+export async function verifyFullCrs(bundle) {
+  const compiled = compileSecLang(bundle.source, {
+    strict: true,
+    files: bundle.files,
+    ...(await loadSecLangBackends()),
+  });
+  let steps = 0;
+  for (const root of compiled.instructions) {
+    if (root.type !== "rule") continue;
+    for (let node = root; node; node = node.next) steps++;
+  }
+  const expected = Object.entries(bundle.files)
+    .filter(([path]) => path.endsWith(".conf"))
+    .reduce(
+      (n, [, text]) =>
+        n +
+        parseSecLangSyntax(text).filter(
+          (stmt) => stmt.directive === "SecRule" || stmt.directive === "SecAction",
+        ).length,
+      0,
+    );
+  assert.equal(steps, expected, "Every source rule/action must have an executable instruction");
+  const normal = [
+    "/?q=hello",
+    "/api?item=123",
+    "/health",
+    "/.well-known/security.txt",
+    `/?q=${encodeURIComponent("你好世界")}`,
+  ];
+  const attacks = [
+    ["SQL injection", "/?q=1%20UNION%20SELECT%20password%20FROM%20users"],
+    ["XSS", "/?q=%3Cscript%3Ealert(1)%3C/script%3E"],
+    ["LFI", "/?file=../../../../etc/passwd"],
+    ["RCE", "/?cmd=;cat%20/etc/passwd"],
+  ];
+  const request = (path) => ({
+    url: `https://example.test${path}`,
+    method: "GET",
+    protocol: "HTTP/1.1",
+    remoteAddr: "192.0.2.5",
+    headers: { host: "example.test", "user-agent": "Mozilla/5.0", accept: "text/html" },
+  });
+  const timings = [];
+  try {
+    for (const path of normal) {
+      const start = performance.now();
+      const result = executeSecLang(compiled, request(path));
+      timings.push(performance.now() - start);
+      assert.equal(result.blocked, false, `Normal request blocked: ${path}`);
+      const response = executeSecLang(
+        compiled,
+        {
+          ...request(path),
+          responseStatus: 200,
+          responseHeaders: { "content-type": "text/html" },
+          responseBody: "<html><p>Hello</p></html>",
+        },
+        { phases: [3, 4, 5], transaction: result.transaction },
+      );
+      assert.equal(response.blocked, false, `Normal response blocked: ${path}`);
+    }
+    for (const [name, path] of attacks) {
+      const result = executeSecLang(compiled, request(path));
+      assert.equal(result.blocked, true, `${name} bypassed full CRS`);
+      assert.ok(
+        result.matched.includes("949110") || result.matched.includes("949111"),
+        `${name} must reach actual CRS blocking evaluation`,
+      );
+    }
+    const incoming = executeSecLang(compiled, request("/"));
+    const leak = executeSecLang(
+      compiled,
+      {
+        ...request("/"),
+        responseStatus: 200,
+        responseHeaders: { "content-type": "text/html" },
+        responseBody: "<title>=[ 1n73ct10n privat shell ]=</title>",
+      },
+      { phases: [3, 4, 5], transaction: incoming.transaction },
+    );
+    assert.equal(leak.blocked, true, "Official PHP web-shell phrase file must execute");
+    assert.ok(
+      leak.matched.includes("955100"),
+      "Web-shell detection must be from official data, not a replacement regex",
+    );
+    assert.ok(
+      leak.matched.includes("959100"),
+      "Response must reach CRS outbound blocking evaluation",
+    );
+    for (let i = 0; i < 20; i++) {
+      const start = performance.now();
+      assert.equal(executeSecLang(compiled, request("/?q=normal")).blocked, false);
+      timings.push(performance.now() - start);
+    }
+    timings.sort((a, b) => a - b);
+    const p95 = timings[Math.floor(timings.length * 0.95)];
+    assert.ok(p95 < 500, "Full CRS normal-request p95 exceeds the 500ms regression ceiling");
+    return {
+      sourceRules: compiled.sourceRules,
+      executableSteps: steps,
+      rootRules: compiled.supportedRules,
+      normal: normal.length,
+      attacks: attacks.length,
+      responseAttack: 1,
+      p95Ms: Number(p95.toFixed(3)),
+      unsupported: 0,
+      convertedToIR: false,
+    };
+  } finally {
+    compiled.dispose();
+  }
+}