fullshield 0.3.0 → 1.0.0

package/dist/runtime/dlp.js

@@ -1,313 +1 @@
-// src/runtime/dlp/index.ts
-var DLP_FLAG = "FULLSHIELD_EXPERIMENTAL_DLP";
-var DLP_MAX_BYTES = 64 * 1024;
-var DLP_GENERIC = { error: "internal error" };
-var SECRET_RES = [
-  /\bAKIA[0-9A-Z]{16}\b/g,
-  /\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g,
-  /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b/g,
-  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
-  /\bAIza[0-9A-Za-z_-]{35}\b/g,
-  /\bsk-ant-[A-Za-z0-9_-]{16,}\b|\bsk-[A-Za-z0-9_-]{20,}\b/g,
-  /-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----/g,
-  /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s'"@/:]+:[^\s'"@]+@/g
-];
-var STACK_RE = /(?:Error|Exception|TypeError|ReferenceError|SyntaxError|RangeError)[^\n]{0,240}(?:\n|\r\n|\\n)[ \t]*at[ \t]+\S+[^\n]{0,320}(?:\n|\r\n|\\n)[ \t]*at[ \t]+/g;
-var INTERNAL_IP_RE = /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})\b/g;
-var HOST_TLDS = [".internal", ".corp", ".lan", ".local"];
-var BULK_EMAILS = 5;
-var PII_LEARN = 2;
-var REDACT = "[REDACTED]";
-var EMPTY_HITS = [];
-function isDlpEnabled() {
-  return process.env[DLP_FLAG] === "1";
-}
-function allMatches(re, text) {
-  re.lastIndex = 0;
-  return [...text.matchAll(re)];
-}
-function maskSample(value) {
-  if (value.length <= 4) return "****";
-  return `${value.slice(0, 4)}****`.slice(0, 40);
-}
-function luhnOk(digits) {
-  if (digits.length < 13 || digits.length > 19) return false;
-  const first = digits.charCodeAt(0) - 48;
-  if (first < 3 || first > 6) return false;
-  if (digits.split("").every((c) => c === digits[0])) return false;
-  let sum = 0;
-  let alt = false;
-  for (let i = digits.length - 1; i >= 0; i -= 1) {
-    let n = digits.charCodeAt(i) - 48;
-    if (alt) {
-      n *= 2;
-      if (n > 9) n -= 9;
-    }
-    sum += n;
-    alt = !alt;
-  }
-  return sum % 10 === 0;
-}
-var SECRET_MARKERS = [
-  "AKIA",
-  "sk_",
-  "ghp_",
-  "gho_",
-  "ghu_",
-  "ghs_",
-  "ghr_",
-  "xox",
-  "AIza",
-  "sk-",
-  "BEGIN ",
-  "postgres",
-  "mysql",
-  "mariadb",
-  "mongodb",
-  "redis",
-  "amqp"
-];
-function hasAny(text, markers) {
-  for (const m of markers) {
-    if (text.includes(m)) return true;
-  }
-  return false;
-}
-function collectSpans(text) {
-  const spans = [];
-  if (hasAny(text, SECRET_MARKERS)) {
-    for (const re of SECRET_RES) {
-      for (const m of allMatches(re, text)) {
-        if (m[0] === void 0 || m.index === void 0) continue;
-        if (re.source.includes("postgres") && /\$\{|^<[^>]+>$|^\{[^}]+\}$/.test(m[0])) continue;
-        spans.push({ start: m.index, end: m.index + m[0].length, ruleId: "DLP-SECRET-001", text: m[0] });
-      }
-    }
-  }
-  if (text.includes(" at ") || text.includes("Error") || text.includes("Exception")) {
-    for (const m of allMatches(STACK_RE, text)) {
-      if (m[0] === void 0 || m.index === void 0) continue;
-      spans.push({ start: m.index, end: m.index + m[0].length, ruleId: "DLP-STACK-001", text: m[0] });
-    }
-  }
-  if (/\d/.test(text)) {
-    for (const m of allMatches(INTERNAL_IP_RE, text)) {
-      if (m[0] === void 0 || m.index === void 0) continue;
-      spans.push({ start: m.index, end: m.index + m[0].length, ruleId: "DLP-INTERNAL-001", text: m[0] });
-    }
-    spans.push(...findCards(text));
-  }
-  if (text.includes("localhost") || text.includes("LOCALHOST")) {
-    spans.push(...findLocalhost(text));
-  }
-  if (text.includes(".internal") || text.includes(".corp") || text.includes(".lan") || text.includes(".local") || text.includes(".INTERNAL") || text.includes(".CORP") || text.includes(".LAN") || text.includes(".LOCAL")) {
-    spans.push(...findInternalHosts(text));
-  }
-  return spans;
-}
-function isWord(c) {
-  return c !== void 0 && /[A-Za-z0-9-]/.test(c);
-}
-function findIgnoreCase(hay, needle, from) {
-  const n = needle.length;
-  outer: for (let i = from; i <= hay.length - n; i += 1) {
-    for (let j = 0; j < n; j += 1) {
-      const a = hay.charCodeAt(i + j);
-      const b = needle.charCodeAt(j);
-      if (a !== b && a !== b - 32 && a !== b + 32) continue outer;
-    }
-    return i;
-  }
-  return -1;
-}
-function findLocalhost(text) {
-  const spans = [];
-  let from = 0;
-  while (from < text.length) {
-    const idx = findIgnoreCase(text, "localhost", from);
-    if (idx < 0) break;
-    if (!isWord(text[idx - 1]) && !isWord(text[idx + 9])) {
-      spans.push({ start: idx, end: idx + 9, ruleId: "DLP-INTERNAL-001", text: text.slice(idx, idx + 9) });
-    }
-    from = idx + 9;
-  }
-  return spans;
-}
-function findInternalHosts(text) {
-  const spans = [];
-  for (const tld of HOST_TLDS) {
-    let from = 0;
-    while (from < text.length) {
-      const idx = findIgnoreCase(text, tld, from);
-      if (idx < 0) break;
-      let start = idx - 1;
-      while (start >= 0 && /[A-Za-z0-9.-]/.test(text[start] ?? "")) start -= 1;
-      start += 1;
-      const label = text.slice(start, idx).toLowerCase();
-      const end = idx + tld.length;
-      if (label.length > 0 && /^[a-z0-9-]+(?:\.[a-z0-9-]+)*$/.test(label) && !isWord(text[end])) {
-        spans.push({ start, end, ruleId: "DLP-INTERNAL-001", text: text.slice(start, end) });
-      }
-      from = idx + tld.length;
-    }
-  }
-  return spans;
-}
-function findCards(text) {
-  const spans = [];
-  let i = 0;
-  while (i < text.length) {
-    const code = text.charCodeAt(i);
-    if (code < 48 || code > 57) {
-      i += 1;
-      continue;
-    }
-    let j = i;
-    let digits = "";
-    while (j < text.length) {
-      const c = text.charCodeAt(j);
-      if (c >= 48 && c <= 57) {
-        digits += text[j] ?? "";
-        j += 1;
-      } else if (c === 32 || c === 9 || c === 45) {
-        j += 1;
-      } else {
-        break;
-      }
-    }
-    if (luhnOk(digits)) {
-      spans.push({ start: i, end: j, ruleId: "DLP-CARD-001", text: text.slice(i, j) });
-    }
-    i = j > i ? j : i + 1;
-  }
-  return spans;
-}
-function findEmails(text) {
-  const spans = [];
-  let from = 0;
-  while (from < text.length) {
-    const at = text.indexOf("@", from);
-    if (at < 0) break;
-    let start = at - 1;
-    while (start >= 0 && /[A-Za-z0-9._%+-]/.test(text[start] ?? "")) start -= 1;
-    start += 1;
-    let end = at + 1;
-    while (end < text.length && /[A-Za-z0-9.-]/.test(text[end] ?? "")) end += 1;
-    const local = text.slice(start, at);
-    const domain = text.slice(at + 1, end);
-    const dot = domain.lastIndexOf(".");
-    const tld = dot > 0 ? domain.slice(dot + 1) : "";
-    if (local.length >= 1 && local.length <= 64 && domain.length >= 3 && domain.length <= 255 && /^[A-Za-z]{2,24}$/.test(tld)) {
-      spans.push({ start, end, ruleId: "DLP-PII-001", text: text.slice(start, end) });
-    }
-    from = at + 1;
-  }
-  return spans;
-}
-function countEmails(text) {
-  if (!text.includes("@")) return { count: 0, spans: [] };
-  const spans = findEmails(text);
-  return { count: spans.length, spans };
-}
-function redact(text, spans) {
-  const ordered = [...spans].sort((a, b) => b.start - a.start);
-  let out = text;
-  const taken = [];
-  for (const s of ordered) {
-    if (taken.some(([a, b]) => s.start < b && s.end > a)) continue;
-    taken.push([s.start, s.end]);
-    out = `${out.slice(0, s.start)}${REDACT}${out.slice(s.end)}`;
-  }
-  return out;
-}
-function uniqueHits(spans) {
-  const seen = /* @__PURE__ */ new Set();
-  const hits = [];
-  for (const s of spans) {
-    if (seen.has(s.ruleId)) continue;
-    seen.add(s.ruleId);
-    hits.push({ ruleId: s.ruleId, sample: maskSample(s.text) });
-  }
-  return hits;
-}
-function toText(body) {
-  if (body === null || body === void 0) return void 0;
-  if (typeof body === "string") return { text: body, kind: "string" };
-  if (typeof body === "number" || typeof body === "boolean") return { text: String(body), kind: "string" };
-  if (typeof Buffer !== "undefined" && Buffer.isBuffer(body)) return void 0;
-  try {
-    return { text: JSON.stringify(body), kind: "json" };
-  } catch {
-    return void 0;
-  }
-}
-function createDlpInspector(options = {}) {
-  if (!isDlpEnabled() || options.dlp === void 0) return void 0;
-  const mode = options.dlp.mode;
-  const maxBytes = options.dlp.maxBytes ?? DLP_MAX_BYTES;
-  const routes = /* @__PURE__ */ new Map();
-  let skipped = 0;
-  const inspect = (body, ctx) => {
-    const ct = ctx.contentType ?? "";
-    if (ct.length > 0 && !/json|text|javascript|xml/i.test(ct)) {
-      return { action: "allow", body, hits: [], skippedOverCap: false };
-    }
-    const serialized = toText(body);
-    if (serialized === void 0) {
-      return { action: "allow", body, hits: [], skippedOverCap: false };
-    }
-    if (serialized.text.length > maxBytes) {
-      skipped += 1;
-      return { action: "skip", body, hits: [], skippedOverCap: true };
-    }
-    const spans = collectSpans(serialized.text);
-    const emails = countEmails(serialized.text);
-    let pii = routes.get(ctx.path);
-    if (pii === void 0) {
-      pii = { samples: 0, seenLow: false, seenHigh: false };
-      routes.set(ctx.path, pii);
-    }
-    if (pii.samples < PII_LEARN) {
-      pii.samples += 1;
-      if (emails.count <= 1) pii.seenLow = true;
-      if (emails.count >= BULK_EMAILS) pii.seenHigh = true;
-    } else if (pii.seenLow && !pii.seenHigh && emails.count >= BULK_EMAILS) {
-      spans.push(...emails.spans);
-    }
-    const hits = uniqueHits(spans);
-    if (hits.length === 0) {
-      return { action: "allow", body, hits: EMPTY_HITS, skippedOverCap: false };
-    }
-    const ip = ctx.ip ?? "unknown";
-    for (const hit of hits) {
-      const event = { ruleId: hit.ruleId, path: ctx.path, ip, sample: hit.sample };
-      options.onEvent?.(event);
-    }
-    if (mode === "monitor") {
-      return { action: "allow", body, hits, skippedOverCap: false };
-    }
-    if (mode === "block") {
-      return { action: "block", body: { ...DLP_GENERIC }, hits, skippedOverCap: false };
-    }
-    const maskedText = redact(serialized.text, spans);
-    let masked = maskedText;
-    if (serialized.kind === "json") {
-      try {
-        masked = JSON.parse(maskedText);
-      } catch {
-        masked = maskedText;
-      }
-    }
-    return { action: "mask", body: masked, hits, skippedOverCap: false };
-  };
-  const api = inspect;
-  Object.defineProperty(api, "inspect", { value: inspect });
-  Object.defineProperty(api, "skippedOverCap", { get: () => skipped });
-  return api;
-}
-function applyDlpWrite(dlp, body, ctx) {
-  const result = dlp.inspect(body, ctx);
-  return { body: result.body, block: result.action === "block" };
-}
-
-export { DLP_FLAG, DLP_GENERIC, DLP_MAX_BYTES, applyDlpWrite, createDlpInspector, isDlpEnabled };
+var D="FULLSHIELD_EXPERIMENTAL_DLP",X=65536,R={error:"internal error"},C=[/\bAKIA[0-9A-Z]{16}\b/g,/\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/g,/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b/g,/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,/\bAIza[0-9A-Za-z_-]{35}\b/g,/\bsk-ant-[A-Za-z0-9_-]{16,}\b|\bsk-[A-Za-z0-9_-]{20,}\b/g,/-----BEGIN (?:[A-Z]+ )*PRIVATE KEY-----/g,/\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s'"@/:]+:[^\s'"@]+@/g],w=/(?:Error|Exception|TypeError|ReferenceError|SyntaxError|RangeError)[^\n]{0,240}(?:\n|\r\n|\\n)[ \t]*at[ \t]+\S+[^\n]{0,320}(?:\n|\r\n|\\n)[ \t]*at[ \t]+/g,_=/\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})\b/g,T=[".internal",".corp",".lan",".local"],A=5,O=2,y="[REDACTED]",P=[];function v(){return process.env[D]==="1"}function E(n,s){return n.lastIndex=0,[...s.matchAll(n)]}function N(n){return n.length<=4?"****":`${n.slice(0,4)}****`.slice(0,40)}function z(n){if(n.length<13||n.length>19)return  false;let s=n.charCodeAt(0)-48;if(s<3||s>6||n.split("").every(r=>r===n[0]))return  false;let e=0,t=false;for(let r=n.length-1;r>=0;r-=1){let i=n.charCodeAt(r)-48;t&&(i*=2,i>9&&(i-=9)),e+=i,t=!t;}return e%10===0}var x=["AKIA","sk_","ghp_","gho_","ghu_","ghs_","ghr_","xox","AIza","sk-","BEGIN ","postgres","mysql","mariadb","mongodb","redis","amqp"];function H(n,s){for(let e of s)if(n.includes(e))return  true;return  false}function Z(n){let s=[];if(H(n,x))for(let e of C)for(let t of E(e,n))t[0]===void 0||t.index===void 0||e.source.includes("postgres")&&/\$\{|^<[^>]+>$|^\{[^}]+\}$/.test(t[0])||s.push({start:t.index,end:t.index+t[0].length,ruleId:"DLP-SECRET-001",text:t[0]});if(n.includes(" at ")||n.includes("Error")||n.includes("Exception"))for(let e of E(w,n))e[0]===void 0||e.index===void 0||s.push({start:e.index,end:e.index+e[0].length,ruleId:"DLP-STACK-001",text:e[0]});if(/\d/.test(n)){for(let e of E(_,n))e[0]===void 0||e.index===void 0||s.push({start:e.index,end:e.index+e[0].length,ruleId:"DLP-INTERNAL-001",text:e[0]});s.push(...M(n));}return (n.includes("localhost")||n.includes("LOCALHOST"))&&s.push(...j(n)),(n.includes(".internal")||n.includes(".corp")||n.includes(".lan")||n.includes(".local")||n.includes(".INTERNAL")||n.includes(".CORP")||n.includes(".LAN")||n.includes(".LOCAL"))&&s.push(...B(n)),s}function k(n){return n!==void 0&&/[A-Za-z0-9-]/.test(n)}function I(n,s,e){let t=s.length;n:for(let r=e;r<=n.length-t;r+=1){for(let i=0;i<t;i+=1){let o=n.charCodeAt(r+i),l=s.charCodeAt(i);if(o!==l&&o!==l-32&&o!==l+32)continue n}return r}return  -1}function j(n){let s=[],e=0;for(;e<n.length;){let t=I(n,"localhost",e);if(t<0)break;!k(n[t-1])&&!k(n[t+9])&&s.push({start:t,end:t+9,ruleId:"DLP-INTERNAL-001",text:n.slice(t,t+9)}),e=t+9;}return s}function B(n){let s=[];for(let e of T){let t=0;for(;t<n.length;){let r=I(n,e,t);if(r<0)break;let i=r-1;for(;i>=0&&/[A-Za-z0-9.-]/.test(n[i]??"");)i-=1;i+=1;let o=n.slice(i,r).toLowerCase(),l=r+e.length;o.length>0&&/^[a-z0-9-]+(?:\.[a-z0-9-]+)*$/.test(o)&&!k(n[l])&&s.push({start:i,end:l,ruleId:"DLP-INTERNAL-001",text:n.slice(i,l)}),t=r+e.length;}}return s}function M(n){let s=[],e=0;for(;e<n.length;){let t=n.charCodeAt(e);if(t<48||t>57){e+=1;continue}let r=e,i="";for(;r<n.length;){let o=n.charCodeAt(r);if(o>=48&&o<=57)i+=n[r]??"",r+=1;else if(o===32||o===9||o===45)r+=1;else break}z(i)&&s.push({start:e,end:r,ruleId:"DLP-CARD-001",text:n.slice(e,r)}),e=r>e?r:e+1;}return s}function $(n){let s=[],e=0;for(;e<n.length;){let t=n.indexOf("@",e);if(t<0)break;let r=t-1;for(;r>=0&&/[A-Za-z0-9._%+-]/.test(n[r]??"");)r-=1;r+=1;let i=t+1;for(;i<n.length&&/[A-Za-z0-9.-]/.test(n[i]??"");)i+=1;let o=n.slice(r,t),l=n.slice(t+1,i),c=l.lastIndexOf("."),d=c>0?l.slice(c+1):"";o.length>=1&&o.length<=64&&l.length>=3&&l.length<=255&&/^[A-Za-z]{2,24}$/.test(d)&&s.push({start:r,end:i,ruleId:"DLP-PII-001",text:n.slice(r,i)}),e=t+1;}return s}function G(n){if(!n.includes("@"))return {count:0,spans:[]};let s=$(n);return {count:s.length,spans:s}}function K(n,s){let e=[...s].sort((i,o)=>o.start-i.start),t=n,r=[];for(let i of e)r.some(([o,l])=>i.start<l&&i.end>o)||(r.push([i.start,i.end]),t=`${t.slice(0,i.start)}${y}${t.slice(i.end)}`);return t}function q(n){let s=new Set,e=[];for(let t of n)s.has(t.ruleId)||(s.add(t.ruleId),e.push({ruleId:t.ruleId,sample:N(t.text)}));return e}function Y(n){if(n!=null){if(typeof n=="string")return {text:n,kind:"string"};if(typeof n=="number"||typeof n=="boolean")return {text:String(n),kind:"string"};if(!(typeof Buffer<"u"&&Buffer.isBuffer(n)))try{return {text:JSON.stringify(n),kind:"json"}}catch{return}}}function F(n={}){if(!v()||n.dlp===void 0)return;let s=n.dlp.mode,e=n.dlp.maxBytes??65536,t=new Map,r=0,i=(l,c)=>{let d=c.contentType??"";if(d.length>0&&!/json|text|javascript|xml/i.test(d))return {action:"allow",body:l,hits:[],skippedOverCap:false};let u=Y(l);if(u===void 0)return {action:"allow",body:l,hits:[],skippedOverCap:false};if(u.text.length>e)return r+=1,{action:"skip",body:l,hits:[],skippedOverCap:true};let g=Z(u.text),f=G(u.text),a=t.get(c.path);a===void 0&&(a={samples:0,seenLow:false,seenHigh:false},t.set(c.path,a)),a.samples<O?(a.samples+=1,f.count<=1&&(a.seenLow=true),f.count>=A&&(a.seenHigh=true)):a.seenLow&&!a.seenHigh&&f.count>=A&&g.push(...f.spans);let p=q(g);if(p.length===0)return {action:"allow",body:l,hits:P,skippedOverCap:false};let L=c.ip??"unknown";for(let b of p){let S={ruleId:b.ruleId,path:c.path,ip:L,sample:b.sample};n.onEvent?.(S);}if(s==="monitor")return {action:"allow",body:l,hits:p,skippedOverCap:false};if(s==="block")return {action:"block",body:{...R},hits:p,skippedOverCap:false};let h=K(u.text,g),m=h;if(u.kind==="json")try{m=JSON.parse(h);}catch{m=h;}return {action:"mask",body:m,hits:p,skippedOverCap:false}},o=i;return Object.defineProperty(o,"inspect",{value:i}),Object.defineProperty(o,"skippedOverCap",{get:()=>r}),o}function J(n,s,e){let t=n.inspect(s,e);return {body:t.body,block:t.action==="block"}}export{D as DLP_FLAG,R as DLP_GENERIC,X as DLP_MAX_BYTES,J as applyDlpWrite,F as createDlpInspector,v as isDlpEnabled};