fullshield 1.0.0 → 1.2.0

package/dist/runtime/auto.js

@@ -1,5 +1,5 @@
-import Un from'dns';import {createRequire}from'module';import {AsyncLocalStorage}from'async_hooks';function J(n){return n===null||typeof n!="object"||Array.isArray(n)?false:Object.keys(n).some(t=>t.startsWith("$"))}function H(n,t){if(n===t)return  true;if(n===null||t===null||typeof n!="object"||typeof t!="object")return  false;if(Array.isArray(n)||Array.isArray(t))return !Array.isArray(n)||!Array.isArray(t)||n.length!==t.length?false:n.every((o,s)=>H(o,t[s]));let e=Object.keys(n),r=Object.keys(t);return e.length!==r.length?false:e.every(o=>H(n[o],t[o]))}function M(n,t,e){if(!(e>8||n===null||typeof n!="object")){if(t.push(n),Array.isArray(n)){for(let r of n)M(r,t,e+1);return}for(let r of Object.values(n))M(r,t,e+1);}}function nn(n,t){let e=[];for(let i of t.objects)M(i,e,0);let r=e.filter(J);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),J(i)&&r.some(c=>c===i||H(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(n,0)}function W(n){let t=n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n),e=[];for(let r of n.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (t?"/":"")+e.join("/")}function Hn(n,t){let e=W(n).replace(/\/+$/,""),r=W(t);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function Mn(n,t){let e=n.indexOf(t);return e<=0?"":n.slice(0,e)}function tn(n){let t=W(n).split("/").filter(Boolean);return t[t.length-1]}function en(n,t,e){if(!t)return  false;if(t.includes("\0")||n.includes("\0"))return  true;if(n.includes(t)){if(t.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:Mn(n,t);return r===""?t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t)||t.includes(".."):!Hn(r,n)}if(t.includes("..")||t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t)){let r=tn(t),o=tn(n);if(r&&r===o)return  true}return  false}var Wn=new Set(["__proto__","constructor","prototype"]);function B(n,t,e){if(t>8||n===null||typeof n!="object"||e.has(n))return  false;e.add(n);for(let r of Object.getOwnPropertyNames(n))if(Wn.has(r))return  true;return Array.isArray(n)?n.some(r=>B(r,t+1,e)):Object.values(n).some(r=>B(r,t+1,e))}function rn(n){let t=new Set;return n.objects.some(e=>B(e,0,t))}function Bn(n){let t=[],e=0,r=n.length;for(;e<r;){let o=n[e];if(o===" "||o==="	"||o===`
-`){let i=e;for(;e<r&&(n[e]===" "||n[e]==="	"||n[e]===`
-`);)e+=1;t.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&n[e]!==i;)i==='"'&&n[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),t.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&n[e]!=="`";)e+=1;e<r&&(e+=1),t.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(n[e+1]==="("||n[e+1]==="{")){let i=n[e+1],u=i==="("?")":"}",c=e;e+=2;let k=1;for(;e<r&&k>0;)n[e]===i?k+=1:n[e]===u&&(k-=1),e+=1;t.push({kind:"op",start:c,end:e});continue}if(n.startsWith("||",e)||n.startsWith("&&",e)||n.startsWith(">>",e)||n.startsWith("<<",e)){t.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){t.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(n[e]);)e+=1;t.push({kind:"word",start:s,end:e});}return t}function on(n,t){if(!t)return  false;let e=Bn(n),r=0;for(;r<=n.length;){let o=n.indexOf(t,r);if(o===-1)return  false;let s=o+t.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(t.length,1);}return  false}function Kn(n){let t=[],e=0,r=n.length;for(;e<r;){let o=n[e];if(o<=" "){let i=e;for(;e<r&&n[e]<=" ";)e+=1;t.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(n[e]===i){if(n[e+1]===i){e+=2;continue}e+=1;break}e+=1;}t.push({kind:"string",start:u,end:e});continue}if(o==="-"&&n[e+1]==="-"){let i=e;for(e+=2;e<r&&n[e]!==`
-`;)e+=1;t.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&n[e+1]==="*"){let i=e;for(e+=2;e<r&&!(n[e]==="*"&&n[e+1]==="/");)e+=1;e+1<r&&(e+=2),t.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&n[e]!==`
-`;)e+=1;t.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&n[e+1]>="0"&&n[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(n[e]);)e+=1;t.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(n[e]);)e+=1;t.push({kind:"ident",start:i,end:e});continue}let s=e;n.startsWith("<=",e)||n.startsWith(">=",e)||n.startsWith("<>",e)||n.startsWith("!=",e)||n.startsWith("||",e)||n.startsWith("&&",e)?e+=2:e+=1,t.push({kind:"op",start:s,end:e});}return t}function Nn(n,t,e){let r=n.filter(o=>o.kind!=="space"&&o.start<e&&o.end>t);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>t||o.end<e}return r.length>0}function K(n,t){if(!t)return  false;let e=Kn(n),r=0;for(;r<=n.length;){let o=n.indexOf(t,r);if(o===-1)return  false;if(Nn(e,o,o+t.length))return  true;r=o+Math.max(t.length,1);}return  false}function N(n){let t=n.trim().toLowerCase();return t=t.replace(/\.+$/,""),t.startsWith("[")&&t.endsWith("]")&&(t=t.slice(1,-1)),t.startsWith("::ffff:")&&(t=t.slice(7)),t.startsWith("[")&&t.endsWith("]")&&(t=t.slice(1,-1)),t}function $n(n){if(/^0x[0-9a-f]+$/i.test(n)){let t=Number.parseInt(n,16);return Number.isFinite(t)?t:void 0}if(/^0[0-7]+$/.test(n)){let t=Number.parseInt(n,8);return Number.isFinite(t)?t:void 0}if(/^\d+$/.test(n)){let t=Number(n);return Number.isFinite(t)?t:void 0}}function fn(n){let t=N(n);if(!t||t.includes(":"))return;let e=t.split(".");if(e.length===0||e.length>4)return;let r=e.map($n);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],k=r[2];return o>255||c>255||k>65535?void 0:[o,c,k>>>8&255,k&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Dn(n){let[t,e]=n;return t===127||t===0||t===10||t===169&&e===254||t===192&&e===168||t===172&&e>=16&&e<=31}function zn(n){return !!(n==="::1"||n==="::"||n==="0:0:0:0:0:0:0:1"||n.startsWith("fc")||n.startsWith("fd")||n.startsWith("fe80:"))}function un(n){let t=N(n);if(t==="localhost"||t.endsWith(".localhost")||t==="metadata.google.internal")return  true;let e=fn(t);return e?Dn(e):t.includes(":")?zn(t):false}function Qn(n){let t=N(n);if(fn(t)||t.includes(":"))return [t];try{let e=Un.lookupSync;if(typeof e=="function")return e(t,{all:!0}).map(r=>r.address)}catch{}return []}function Vn(n){try{return Qn(n)}catch{return []}}function cn(n){if(un(n))return  true;for(let t of Vn(n))if(un(t))return  true;return  false}function an(n,t){if(!t||!n.includes(t))return  false;let e;try{e=new URL(n);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(n)?.[1]??r).replace(/:\d+$/,"");return t===n||t.includes(r)||t.includes(s)||s.includes(t)&&t.length>=3?cn(r)||cn(s):false}function C(n){let t=n[0];if(typeof t=="string")return t;if(t instanceof URL)return t.href;if(t&&typeof t=="object"){let e=t;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function ln(n){return typeof n=="string"?n:n instanceof URL?n.href:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}var pn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001"},j="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(t){super(`fullshield rasp blocked ${t}`),this.name="RaspBlockedError",this.ruleId=t;}};function Zn(n){return typeof n=="string"?[n]:typeof n=="number"||typeof n=="boolean"?[String(n)]:[]}function Yn(n,t){let e="";if(typeof n=="string")e=n;else if(n!==null&&typeof n=="object"&&!Array.isArray(n)&&"$where"in n){let r=n.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of t.strings)if(r&&K(e,r))return  true;return  false}function Gn(n,t,e,r){if(n==="proto")return rn(e);if(n==="nosql")return nn(t,e)?true:Yn(t,e);for(let o of Zn(t))for(let s of e.strings)if(s&&(n==="sql"&&K(o,s)||n==="shell"&&on(o,s)||n==="path"&&en(o,s,r)||n==="ssrf"&&an(o,s)))return  true;return  false}function dn(n,t,e,r){return Gn(n,t,e,r)?{block:true,ruleId:pn[n]}:{block:false}}var Jn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),hn=new AsyncLocalStorage;function v(n,t,e){if(!(e>8||t.length>200)){if(typeof n=="string"){t.push(n);return}if(typeof n=="number"||typeof n=="boolean"){t.push(String(n));return}if(Array.isArray(n)){for(let r of n)v(r,t,e+1);return}if(n!==null&&typeof n=="object")for(let r of Object.values(n))v(r,t,e+1);}}function O(n,t,e){if(!(e>8||n===null||typeof n!="object")){if(t.push(n),Array.isArray(n)){for(let r of n)O(r,t,e+1);return}for(let r of Object.values(n))O(r,t,e+1);}}function gn(n){let t=[],e=[];for(let r of [n.query,n.body,n.params,n.cookies])v(r,t,0),O(r,e,0);if(n.headers&&typeof n.headers=="object"){for(let[r,o]of Object.entries(n.headers))Jn.has(r.toLowerCase())||v(o,t,0);O(n.headers,e,0);}return {path:n.path??n.url?.split("?")[0]??"/",ip:n.ip??"unknown",strings:t,objects:e}}function kn(n,t){return hn.run(n,t)}function R(){return hn.getStore()}function yn(n,t){let e=n.toLowerCase().replace(/\.+$/,"");for(let r of t){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var mn=new Map,U=new Map,nt={block:2,honey:5,anomaly:1},tt=900*1e3,$=false,bn=tt;function wn(n={}){$=n.autoBlock===true,typeof n.maxBlockMs=="number"&&n.maxBlockMs>0&&(bn=n.maxBlockMs);}function A(n,t,e=Date.now()){let r=(mn.get(n)??0)+nt[t];return mn.set(n,r),$&&r>=10&&U.set(n,e+bn),r}function Rn(n,t=Date.now()){if(!$)return  false;let e=U.get(n);return e===void 0?false:t>=e?(U.delete(n),false):true}var et=["/admin.php","/.git/config","/wp-login.php"],rt=new Set,ot=6e4,Sn=new Map;function xn(n){let t=n.split("?")[0]??n;return et.includes(t)}function jn(n){if(!n)return  false;for(let t of rt)if(t&&n.includes(t))return  true;return  false}function An(n,t=Date.now()){let e=Sn.get(n);return e===void 0||t-e.start>ot?(Sn.set(n,{count:1,start:t}),1):(e.count+=1,e.count)}function En(){return function(t,e,r){let o=gn(t);try{let s=o.strings.some(c=>jn(c));if(xn(o.path)&&!s){let c=An(o.ip);A(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(A(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),Rn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=q("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}kn(o,()=>{r();});}}var m=createRequire(import.meta.url),T=[],l=new WeakSet,Ln=false,In=false;function it(n){return typeof n=="string"?n.slice(0,40):n==null?"":"[object]"}function ut(n){let t=R();if(t)for(let e of t.strings){if(!e)continue;let r=n.indexOf(e);if(r>0)return n.slice(0,r)}}function Q(n,t,e){try{let r=R();if(r){let o=q(n,t,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:it(t)}),A(r.ip,"block"),L(r.path,n)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=R();g({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function y(n,t,e,r){return Q(n,t,e),r()}function b(n,t,e){let r=n,o=r[t];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[t]=s,T.push(()=>{r[t]=o;});}function ct(n){if(typeof n=="string")return n;if(Array.isArray(n))return n.filter(t=>typeof t=="string").join(" ");if(n!==null&&typeof n=="object"){let t=n;if(typeof t.text=="string")return t.text;if(typeof t.sql=="string")return t.sql;if(Array.isArray(t.strings))return t.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(n,t){b(n,t,e=>function(r,...o){return y("sql",ct(r),void 0,()=>e.call(this,r,...o))});}function Pn(n,t){b(n,t,e=>function(r,...o){return y("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(n,t,e){b(n,t,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return y("shell",u,void 0,()=>r.call(this,...o))});}function Cn(n,t){b(n,t,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return y("path",s,ut(s),()=>e.call(this,r,...o))});}function vn(n){let t=qn();if(!t||t.length===0)return;let e="";try{e=new URL(n).hostname;}catch{return}if(e&&!yn(e,t)){let r=R();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&A(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}function S(n,t,e){b(n,t,r=>function(...o){let s=e(o);return vn(s),y("ssrf",s,void 0,()=>r.call(this,...o))});}var ft=Symbol.for("fullshield.rasp.wrapSqlite"),D=Symbol.for("fullshield.rasp.sqliteWrapped"),F;function z(n){if(!n||typeof n!="object")return;let t=n.DatabaseSync?.prototype;if(t&&typeof t=="object")return t}function at(n){let t=z(n);if(t)return t;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=z(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(F)try{return z(F("node:sqlite",void 0,!1))}catch{}}function lt(){let n=process.moduleLoadList;return Array.isArray(n)&&n.some(t=>/(?:^| )sqlite$/i.test(t))}function _(n){try{let t=at(n);if(!t||t[D])return;Object.defineProperty(t,D,{value:!0,configurable:!0}),a(t,"exec"),a(t,"prepare"),T.push(()=>{delete t[D];});}catch{}}function pt(){globalThis[ft]=_;let n=m("node:child_process"),t=m("child_process");for(let f of new Set([n,t]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=m("node:fs"),o=m("fs");for(let f of new Set([r,o]))for(let p of e)Cn(f,p);try{let f=m("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Cn(f,p);}catch{}let s=m("node:http"),i=m("node:https");if(S(s,"request",C),S(s,"get",C),S(i,"request",C),S(i,"get",C),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=ln(p);return vn(h),(d?.redirect??"follow")!=="follow"?y("ssrf",h,void 0,()=>f.call(this,p,d)):(Q("ssrf",h),(async()=>{let I=h,Y=p;for(let G=0;G<8;G+=1){let P=await f.call(this,Y,{...d,redirect:"manual"});if(P.status<300||P.status>=400)return P;let X=P.headers.get("location");if(!X)return P;I=new URL(X,I).href,Q("ssrf",I),Y=I;}return f.call(this,I,d)})())},T.push(()=>{globalThis.fetch=f;});}let u=m("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return y("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=m("node:module");F=c._load.bind(c);let k=c._load;c._load=function(f,p,d){let h=k.call(this,f,p,d);try{return ht(String(f),h)}catch{return g({ruleId:j,path:R()?.path??"/",ip:R()?.ip??"unknown",sample:"hook-error"}),h}},T.push(()=>{c._load=k,F=void 0;});let Z=c.registerHooks;typeof Z=="function"&&!In&&(In=true,Z({load(f,p,d){let h=d(f,p);return Ln&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&_(),h}})),lt()&&_();}function dt(n){if(typeof n!="function")return;let t=n;if(l.has(t))return;function e(...r){let o=t.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(En()),o.__fullshieldRasp=!0);}catch{g({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,t),Object.setPrototypeOf(e,t),l.add(t),n.__fullshieldExpressPatch=e;}function ht(n,t){if(t===null||typeof t!="object"&&typeof t!="function")return t;let e=t;if(l.has(e))return t;let r=n.replace(/^node:/,"");if(r==="sqlite")return _(t),t;if(r==="pg"||r.endsWith("/pg")){let o=t;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),t}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=t,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),t}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=t.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),t}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=t.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=t.Prisma;return s&&a(s,"raw"),l.add(e),t}if(r==="sequelize"||r.endsWith("/sequelize")){let o=t,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),t}if(r==="knex"||r.endsWith("/knex")){typeof t.raw=="function"&&a(e,"raw");let o=t.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),t}if(r==="typeorm"||r.endsWith("/typeorm")){let o=t;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),t}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=t.sql;return o&&a(o,"raw"),l.add(e),t}if(r==="mongodb"||r.includes("mongodb")){let o=t.Collection?.prototype;return o&&b(o,"find",s=>function(i,...u){return y("nosql",i??{},void 0,()=>s.call(this,i,...u))}),l.add(e),t}if(r==="mongoose"||r.includes("mongoose")){let o=t.Query?.prototype;o&&(b(o,"find",i=>function(u,...c){return y("nosql",u??{},void 0,()=>i.call(this,u,...c))}),Pn(o,"$where"));let s=t.Model?.prototype;return s&&Pn(s,"$where"),l.add(e),t}if(r==="axios"){let o=t,s=i=>{let u=i[0];return typeof u=="string"?u:u&&typeof u=="object"&&"url"in u&&typeof u.url=="string"?u.url:""};return S(o,"request",s),S(o,"get",s),S(o,"post",s),l.add(e),t}if(r==="express"){dt(t);let o=t.__fullshieldExpressPatch;if(typeof o=="function"){let s=t.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return y("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return t}function On(){Ln=true,pt();}function _n(n,t,e){return n.some(r=>{let o=r.route===void 0||r.route===t,s=r.sink===void 0||r.sink===e;return o&&s})}var Tn=false,x={};function kt(){return x.mode??"monitor"}function L(n,t){return _n(x.virtualPatches??[],n,t)?"block":kt()}function qn(){return x.egress?.allow}function q(n,t,e,r){return x.decide?x.decide(n,t,e):dn(n,t,e,r)}function g(n){x.onEvent?.(n);}function yt(n={}){!n.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...n,experimental:true},wn({autoBlock:n.threatAutoBlock===true,maxBlockMs:n.threatMaxBlockMs}),Tn||(On(),Tn=true));}function Fn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&yt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Fn();
+import {AsyncLocalStorage}from'async_hooks';import st from'dns';import mt from'diagnostics_channel';import {createRequire}from'module';var Xn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),sn=new AsyncLocalStorage;function O(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)O(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))O(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function un(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])O(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))Xn.has(r.toLowerCase())||O(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function cn(t,n){return sn.run(t,n)}function m(){return sn.getStore()}var an=6e4,Yn=1e3,j=new Map,ln=an,Gn=()=>Date.now();function pn(t){ln=t!==void 0&&Number.isFinite(t)&&t>=0?t:an;}function fn(t,n){for(j.delete(t),j.set(t,n);j.size>Yn;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function dn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Gn(),i=j.get(o);return !i||s-i.at>ln?(fn(o,{addresses:new Set(n),at:s}),false):(fn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function hn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function B(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>B(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>B(t[o],n[o]))}function D(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)D(r,n,e+1);return}for(let r of Object.values(t))D(r,n,e+1);}}function gn(t,n){let e=[];for(let i of n.objects)D(i,e,0);let r=e.filter(hn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),hn(i)&&r.some(c=>c===i||B(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function U(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function Jn(t,n){let e=U(t).replace(/\/+$/,""),r=U(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function nt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function yn(t){let n=U(t).split("/").filter(Boolean);return n[n.length-1]}function kn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:nt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!Jn(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=yn(n),o=yn(t);if(r&&r===o)return  true}return  false}var tt=new Set(["__proto__","constructor","prototype"]);function $(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(tt.has(r))return  true;return Array.isArray(t)?t.some(r=>$(r,n+1,e)):Object.values(t).some(r=>$(r,n+1,e))}function bn(t){let n=new Set;return t.objects.some(e=>$(e,0,n))}function et(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+`){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function mn(t,n){if(!n)return  false;let e=et(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function rt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function ot(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function N(t,n){if(!n)return  false;let e=rt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(ot(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function z(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function it(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Sn(t){let n=z(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(it);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ut(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function ct(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function K(t){let n=z(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Sn(n);return e?ut(e):n.includes(":")?ct(n):false}function ft(t){let n=z(t);if(Sn(n)||n.includes(":"))return [n];try{let e=st.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function at(t){try{return ft(t)}catch{return []}}function Rn(t){if(K(t))return  true;let n=at(t);for(let e of n)if(K(e))return  true;return dn(t,n,K)}function xn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Rn(r)||Rn(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function _(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var jn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function lt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&N(e,r))return  true;return  false}function dt(t,n,e,r){if(t==="proto")return bn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return gn(n,e)?true:pt(n,e);for(let o of lt(n))for(let s of e.strings)if(s&&(t==="sql"&&N(o,s)||t==="shell"&&mn(o,s)||t==="path"&&kn(o,s,r)||t==="ssrf"&&xn(o,s)))return  true;return  false}function An(t,n,e,r){return dt(t,n,e,r)?{block:true,ruleId:jn[t]}:{block:false}}function Pn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var En=new Map,Q=new Map,ht={block:2,honey:5,anomaly:1},gt=900*1e3,V=false,In=gt;function Cn(t={}){V=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(In=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(En.get(t)??0)+ht[n];return En.set(t,r),V&&r>=10&&Q.set(t,e+In),r}function vn(t,n=Date.now()){if(!V)return  false;let e=Q.get(t);return e===void 0?false:n>=e?(Q.delete(t),false):true}var yt=["/admin.php","/.git/config","/wp-login.php"],kt=new Set,bt=6e4,Ln=new Map;function qn(t){let n=t.split("?")[0]??t;return yt.includes(n)}function On(t){if(!t)return  false;for(let n of kt)if(n&&t.includes(n))return  true;return  false}function Tn(t,n=Date.now()){let e=Ln.get(t);return e===void 0||n-e.start>bt?(Ln.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function _n(){return function(n,e,r){let o=un(n);try{let s=o.strings.some(c=>On(c));if(qn(o.path)&&!s){let c=Tn(o.ip);P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),vn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=M("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}cn(o,()=>{r();});}}var R=createRequire(import.meta.url),q=[],l=new WeakSet,Un=false,Mn=false;function Rt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function St(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function H(t,n,e){try{let r=m();if(r){let o=M(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Rt(n)}),P(r.ip,"block"),L(r.path,t)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=m();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function k(t,n,e,r){return H(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,q.push(()=>{r[n]=o;});}function xt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return k("sql",xt(r),void 0,()=>e.call(this,r,...o))});}function Fn(t,n){b(t,n,e=>function(r,...o){return k("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return k("shell",u,void 0,()=>r.call(this,...o))});}function Hn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return k("path",s,St(s),()=>e.call(this,r,...o))});}function $n(t){let n=Kn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Pn(e,n)){let r=m();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}var Wn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Z(t,n){b(t,n,e=>function(r,...o){return k("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function X(t,n){b(t,n,e=>function(r,...o){return k("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function jt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Bn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,jt);}function Y(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return _(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return _(n)}function At(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Dn(t){try{let n=At(t);n&&H("ssrf",n);}catch(n){if(n instanceof w)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return $n(s),k("ssrf",s,void 0,()=>r.call(this,...o))});}var Pt=Symbol.for("fullshield.rasp.wrapSqlite"),G=Symbol.for("fullshield.rasp.sqliteWrapped"),W;function J(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Et(t){let n=J(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=J(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(W)try{return J(W("node:sqlite",void 0,!1))}catch{}}function It(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function F(t){try{let n=Et(t);if(!n||n[G])return;Object.defineProperty(n,G,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),q.push(()=>{delete n[G];});}catch{}}function Ct(){globalThis[Pt]=F;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Hn(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Hn(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",v),S(s,"get",v),S(i,"request",v),S(i,"get",v),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=_(p);return $n(h),(d?.redirect??"follow")!=="follow"?k("ssrf",h,void 0,()=>f.call(this,p,d)):(H("ssrf",h),(async()=>{let I=h,en=p;for(let rn=0;rn<8;rn+=1){let C=await f.call(this,en,{...d,redirect:"manual"});if(C.status<300||C.status>=400)return C;let on=C.headers.get("location");if(!on)return C;I=new URL(on,I).href,H("ssrf",I),en=I;}return f.call(this,I,d)})())},q.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return k("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");W=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Lt(String(f),h)}catch{return g({ruleId:A,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),h}},q.push(()=>{c._load=y,W=void 0;});let tn=c.registerHooks;typeof tn=="function"&&!Mn&&(Mn=true,tn({load(f,p,d){let h=d(f,p);return Un&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&F(),h}})),It()&&F();}function vt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(_n()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Lt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return F(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Wn)Z(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Wn)Z(o,u);Fn(o,"$where");}let s=n.Model;s&&Z(s,"aggregate");let i=s?.prototype;return i&&Fn(i,"$where"),l.add(e),n}if(r==="axios")return Bn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Bn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",Y);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",Y),o.Agent?.prototype&&S(o.Agent.prototype,"request",Y),l.add(e),n}if(r==="ejs"||r==="pug")return X(e,"render"),X(e,"compile"),l.add(e),n;if(r==="nunjucks")return X(e,"renderString"),l.add(e),n;if(r==="express"){vt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return k("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Nn(){Un=true,Ct();let t=mt.channel("undici:request:create");t.subscribe(Dn),q.push(()=>{t.unsubscribe(Dn);});}function zn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Qn=false,x={};function Ot(){return x.mode??"monitor"}function L(t,n){return zn(x.virtualPatches??[],t,n)?"block":Ot()}function Kn(){return x.egress?.allow}function M(t,n,e,r){return x.decide?x.decide(t,n,e):An(t,n,e,r)}function g(t){x.onEvent?.(t);}function Tt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},pn(t.dnsPinTtlMs),Cn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Qn||(Nn(),Qn=true));}function Vn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Tt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Vn();

package/dist/runtime/rasp.js

@@ -1,14 +1,14 @@
-import {AsyncLocalStorage}from'async_hooks';import cn from'dns';import {createRequire}from'module';import {mkdirSync,writeFileSync,readFileSync,existsSync}from'fs';import {dirname,join}from'path';var tn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),Et=new AsyncLocalStorage;function _(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)_(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))_(r,n,e+1);}}function H(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)H(r,n,e+1);return}for(let r of Object.values(t))H(r,n,e+1);}}function D(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])_(r,n,0),H(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))tn.has(r.toLowerCase())||_(o,n,0);H(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function $(t,n){return Et.run(t,n)}function R(){return Et.getStore()}function Ct(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function V(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>V(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>V(t[o],n[o]))}function z(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)z(r,n,e+1);return}for(let r of Object.values(t))z(r,n,e+1);}}function Pt(t,n){let e=[];for(let i of n.objects)z(i,e,0);let r=e.filter(Ct);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),Ct(i)&&r.some(c=>c===i||V(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function Q(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function nn(t,n){let e=Q(t).replace(/\/+$/,""),r=Q(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function en(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function It(t){let n=Q(t).split("/").filter(Boolean);return n[n.length-1]}function Lt(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:en(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!nn(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=It(n),o=It(t);if(r&&r===o)return  true}return  false}var rn=new Set(["__proto__","constructor","prototype"]);function Y(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(rn.has(r))return  true;return Array.isArray(t)?t.some(r=>Y(r,n+1,e)):Object.values(t).some(r=>Y(r,n+1,e))}function vt(t){let n=new Set;return t.objects.some(e=>Y(e,0,n))}function on(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {AsyncLocalStorage}from'async_hooks';import xt from'dns';import Ht from'diagnostics_channel';import {createRequire}from'module';import {mkdirSync,writeFileSync,readFileSync,existsSync}from'fs';import {dirname,join}from'path';var ht=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),_n=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function F(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)F(r,n,e+1);return}for(let r of Object.values(t))F(r,n,e+1);}}function Q(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),F(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))ht.has(r.toLowerCase())||q(o,n,0);F(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function Y(t,n){return _n.run(t,n)}function m(){return _n.getStore()}function Tn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function J(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>J(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>J(t[o],n[o]))}function Z(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)Z(r,n,e+1);return}for(let r of Object.values(t))Z(r,n,e+1);}}function qn(t,n){let e=[];for(let i of n.objects)Z(i,e,0);let r=e.filter(Tn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),Tn(i)&&r.some(c=>c===i||J(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function G(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function gt(t,n){let e=G(t).replace(/\/+$/,""),r=G(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function yt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Fn(t){let n=G(t).split("/").filter(Boolean);return n[n.length-1]}function Hn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:yt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!gt(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Fn(n),o=Fn(t);if(r&&r===o)return  true}return  false}var mt=new Set(["__proto__","constructor","prototype"]);function X(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(mt.has(r))return  true;return Array.isArray(t)?t.some(r=>X(r,n+1,e)):Object.values(t).some(r=>X(r,n+1,e))}function Mn(t){let n=new Set;return t.objects.some(e=>X(e,0,n))}function kt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let p=1;for(;e<r&&p>0;)t[e]===i?p+=1:t[e]===u&&(p-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Ot(t,n){if(!n)return  false;let e=on(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function sn(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let p=1;for(;e<r&&p>0;)t[e]===i?p+=1:t[e]===u&&(p-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Wn(t,n){if(!n)return  false;let e=kt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function bt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function un(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function J(t,n){if(!n)return  false;let e=sn(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(un(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}var Z;function tt(t){Z=t;}function q(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function an(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Ft(t){let n=q(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(an);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],p=r[2];return o>255||c>255||p>65535?void 0:[o,c,p>>>8&255,p&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function fn(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function ln(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function G(t){let n=q(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Ft(n);return e?fn(e):n.includes(":")?ln(n):false}function pn(t){let n=q(t);if(Ft(n)||n.includes(":"))return [n];if(Z)return Z(n);try{let e=cn.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function dn(t){try{return pn(t)}catch{return []}}function X(t){if(G(t))return  true;for(let n of dn(t))if(G(n))return  true;return  false}function nt(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?X(r)||X(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function _t(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var et={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001"},S="RASP-FAIL-OPEN-001",m=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function hn(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function yn(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&J(e,r))return  true;return  false}function Ht(t,n,e,r){if(t==="proto")return vt(e);if(t==="nosql")return Pt(n,e)?true:yn(n,e);for(let o of hn(n))for(let s of e.strings)if(s&&(t==="sql"&&J(o,s)||t==="shell"&&Ot(o,s)||t==="path"&&Lt(o,s,r)||t==="ssrf"&&nt(o,s)))return  true;return  false}function T(t,n,e,r){return Ht(t,n,e,r)?{block:true,ruleId:et[t]}:{block:false}}function gn(t){let n=t.kind,e=t.input;if(n==="proto"||e!==null&&typeof e=="object")return {path:"/",ip:"test",strings:[],objects:e!==null&&typeof e=="object"?[e]:[]};let r=typeof e=="string"||typeof e=="number"||typeof e=="boolean"?String(e):"";return {path:"/",ip:"test",strings:r?[r]:[],objects:[]}}function qt(t){let n={},e=0;for(let r of t){let o=typeof r.kind=="string"?r.kind:"unknown",s=gn(r),i=o==="proto"?null:r.sink??r.input,u=typeof r.base=="string"?r.base:void 0,c=T(o,i,s,u).block,p=n[o]??{blocked:0,total:0};p.total+=1,c&&(p.blocked+=1,e+=1),n[o]=p;}return {blocked:e,total:t.length,byKind:n}}function kn(t){let{blocked:n,total:e}=qt(t);return {blocked:n,total:e}}function rt(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var M=new Map,W=new Map,mn={block:2,honey:5,anomaly:1},Tt=900*1e3,B=false,ot=Tt;function Mt(t={}){B=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(ot=t.maxBlockMs);}function j(t,n,e=Date.now()){let r=(M.get(t)??0)+mn[n];return M.set(t,r),B&&r>=10&&W.set(t,e+ot),r}function bn(t){return M.get(t)??0}function st(){M.clear(),W.clear(),B=false,ot=Tt;}function wn(t){return t>=10?"block":t>=5?"challenge":"log"}function it(t,n=Date.now()){if(!B)return  false;let e=W.get(t);return e===void 0?false:n>=e?(W.delete(t),false):true}var ct=["/admin.php","/.git/config","/wp-login.php"],at=new Set,Rn=6e4,ut=new Map;function Wt(t){for(let n of t)at.add(n);}function Bt(){at.clear(),ut.clear();}function ft(t){let n=t.split("?")[0]??t;return ct.includes(n)}function lt(t){if(!t)return  false;for(let n of at)if(n&&t.includes(n))return  true;return  false}function pt(t,n=Date.now()){let e=ut.get(t);return e===void 0||n-e.start>Rn?(ut.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function dt(){return function(n,e,r){let o=D(n);try{let s=o.strings.some(c=>lt(c));if(ft(o.path)&&!s){let c=pt(o.ip);j(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(j(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),it(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=K("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),E(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof m){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:S,path:o.path,ip:o.ip,sample:"hook-error"});}$(o,()=>{r();});}}var b=createRequire(import.meta.url),P=[],l=new WeakSet,kt=false,Kt=false;function Sn(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function jn(t){let n=R();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function gt(t,n,e){try{let r=R();if(r){let o=K(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Sn(n)}),j(r.ip,"block"),E(r.path,t)==="block"))throw new m(o.ruleId)}}catch(r){if(r instanceof m)throw r;let o=R();g({ruleId:S,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function k(t,n,e,r){return gt(t,n,e),r()}function w(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,P.push(()=>{r[n]=o;});}function An(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function f(t,n){w(t,n,e=>function(r,...o){return k("sql",An(r),void 0,()=>e.call(this,r,...o))});}function Nt(t,n){w(t,n,e=>function(r,...o){return k("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function C(t,n,e){w(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return k("shell",u,void 0,()=>r.call(this,...o))});}function Ut(t,n){w(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return k("path",s,jn(s),()=>e.call(this,r,...o))});}function Dt(t){let n=Yt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!rt(e,n)){let r=R();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&j(r.ip,"block"),E(r?.path??"/","ssrf")==="block")throw new m("RASP-EGRESS-001")}}function A(t,n,e){w(t,n,r=>function(...o){let s=e(o);return Dt(s),k("ssrf",s,void 0,()=>r.call(this,...o))});}var $t=Symbol.for("fullshield.rasp.wrapSqlite"),ht=Symbol.for("fullshield.rasp.sqliteWrapped"),U;function yt(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function En(t){let n=yt(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=yt(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(U)try{return yt(U("node:sqlite",void 0,!1))}catch{}}function Cn(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function N(t){try{let n=En(t);if(!n||n[ht])return;Object.defineProperty(n,ht,{value:!0,configurable:!0}),f(n,"exec"),f(n,"prepare"),P.push(()=>{delete n[ht];});}catch{}}function Pn(){globalThis[$t]=N;let t=b("node:child_process"),n=b("child_process");for(let a of new Set([t,n]))C(a,"exec",true),C(a,"execSync",true),C(a,"spawn",false),C(a,"spawnSync",false),C(a,"execFile",false),C(a,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=b("node:fs"),o=b("fs");for(let a of new Set([r,o]))for(let d of e)Ut(a,d);try{let a=b("node:fs/promises");for(let d of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Ut(a,d);}catch{}let s=b("node:http"),i=b("node:https");if(A(s,"request",v),A(s,"get",v),A(i,"request",v),A(i,"get",v),typeof globalThis.fetch=="function"){let a=globalThis.fetch;globalThis.fetch=function(d,h){let y=_t(d);return Dt(y),(h?.redirect??"follow")!=="follow"?k("ssrf",y,void 0,()=>a.call(this,d,h)):(gt("ssrf",y),(async()=>{let I=y,St=d;for(let jt=0;jt<8;jt+=1){let L=await a.call(this,St,{...h,redirect:"manual"});if(L.status<300||L.status>=400)return L;let At=L.headers.get("location");if(!At)return L;I=new URL(At,I).href,gt("ssrf",I),St=I;}return a.call(this,I,h)})())},P.push(()=>{globalThis.fetch=a;});}let u=b("node:vm");for(let a of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,a,d=>function(h,...y){return k("sql",typeof h=="string"?h:"",void 0,()=>d.call(this,h,...y))});let c=b("node:module");U=c._load.bind(c);let p=c._load;c._load=function(a,d,h){let y=p.call(this,a,d,h);try{return Vt(String(a),y)}catch{return g({ruleId:S,path:R()?.path??"/",ip:R()?.ip??"unknown",sample:"hook-error"}),y}},P.push(()=>{c._load=p,U=void 0;});let xt=c.registerHooks;typeof xt=="function"&&!Kt&&(Kt=true,xt({load(a,d,h){let y=h(a,d);return kt&&typeof a=="string"&&(a==="node:sqlite"||a.startsWith("node:sqlite"))&&N(),y}})),Cn()&&N();}function In(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(dt()),o.__fullshieldRasp=!0);}catch{g({ruleId:S,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Vt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return N(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&f(o.Client.prototype,"query"),o.Pool?.prototype&&f(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(f(s,"query"),f(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(f(o,"exec"),f(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(f(o,"$queryRawUnsafe"),f(o,"$executeRawUnsafe"),f(o,"$queryRaw"),f(o,"$executeRaw"));let s=n.Prisma;return s&&f(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&f(s,"query"),typeof o.literal=="function"&&f(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&f(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&f(e,"raw");let o=n.Client?.prototype;return o&&(f(o,"raw"),f(o,"whereRaw"),f(o,"orderByRaw"),f(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&f(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&f(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&f(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;return o&&w(o,"find",s=>function(i,...u){return k("nosql",i??{},void 0,()=>s.call(this,i,...u))}),l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;o&&(w(o,"find",i=>function(u,...c){return k("nosql",u??{},void 0,()=>i.call(this,u,...c))}),Nt(o,"$where"));let s=n.Model?.prototype;return s&&Nt(s,"$where"),l.add(e),n}if(r==="axios"){let o=n,s=i=>{let u=i[0];return typeof u=="string"?u:u&&typeof u=="object"&&"url"in u&&typeof u.url=="string"?u.url:""};return A(o,"request",s),A(o,"get",s),A(o,"post",s),l.add(e),n}if(r==="express"){In(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return k("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function zt(){kt=true,Pn();}function Qt(){for(kt=false,delete globalThis[$t];P.length>0;)P.pop()?.();}function Jt(t){let n=t.toUpperCase();if(n.includes("SQLI")||n.includes("SQL-"))return "sql";if(n.includes("CMDI")||n.includes("SHELL"))return "shell";if(n.includes("PATH"))return "path";if(n.includes("NOSQL"))return "nosql";if(n.includes("SSRF"))return "ssrf";if(n.includes("PROTO"))return "proto"}function Zt(t){if(typeof t.route=="string"&&t.route.startsWith("/"))return t.route;let n=(t.message??"").match(/\/[A-Za-z0-9._/-]+/);if(n)return n[0];if(t.file){let e=Math.max(t.file.lastIndexOf("/"),t.file.lastIndexOf("\\")),r=e>=0?t.file.slice(e+1):t.file,o=r.lastIndexOf("."),s=o>0?r.slice(0,o):r;if(s&&s!=="index")return `/${s}`}}function mt(t){return t.map(n=>({ruleId:n.ruleId,file:n.file,line:n.line,sink:Jt(n.ruleId),route:Zt(n)}))}function bt(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var F=false,x={},O=[],Ln=1e3;function vn(){return F}function On(){return x.mode??"monitor"}function E(t,n){return bt(x.virtualPatches??[],t,n)?"block":On()}function Yt(){return x.egress?.allow}function K(t,n,e,r){return x.decide?x.decide(t,n,e):T(t,n,e,r)}function g(t){O.length>=Ln&&O.shift(),O.push(t),x.onEvent?.(t);}function Fn(){return O}function _n(){O.length=0;}function Gt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},Mt({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),F||(zt(),F=true));}function Hn(){F&&(Qt(),F=false,x={},tt(void 0),Bt(),st());}function qn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Gt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}function Kn(t,n){let e=mt(t);return mkdirSync(dirname(n),{recursive:true}),writeFileSync(n,`${JSON.stringify({patches:e},null,2)}
-`,"utf8"),e}function Nn(t){let n=JSON.parse(readFileSync(t,"utf8"));return Array.isArray(n)?n:n.patches??[]}function Vn(t,n){let e=join(t,".gitignore"),r=existsSync(e)?readFileSync(e,"utf8"):"",o=new Set(r.split(`
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function wt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function nn(t,n){if(!n)return  false;let e=bt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(wt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}var Dn=6e4,Rt=1e3,j=new Map,Un=Dn,St=()=>Date.now();function tn(t){Un=t!==void 0&&Number.isFinite(t)&&t>=0?t:Dn;}function Nn(){j.clear();}function Bn(t,n){for(j.delete(t),j.set(t,n);j.size>Rt;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function $n(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=St(),i=j.get(o);return !i||s-i.at>Un?(Bn(o,{addresses:new Set(n),at:s}),false):(Bn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}var en;function on(t){en=t;}function M(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function jt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Kn(t){let n=M(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(jt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],p=r[2];return o>255||c>255||p>65535?void 0:[o,c,p>>>8&255,p&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function At(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function Pt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function H(t){let n=M(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Kn(n);return e?At(e):n.includes(":")?Pt(n):false}function Et(t){let n=M(t);if(Kn(n)||n.includes(":"))return [n];if(en)return en(n);try{let e=xt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function Ct(t){try{return Et(t)}catch{return []}}function rn(t){if(H(t))return  true;let n=Ct(t);for(let e of n)if(H(e))return  true;return $n(t,n,H)}function sn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?rn(r)||rn(s):false}function O(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function W(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var un={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function vt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function It(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&nn(e,r))return  true;return  false}function Vn(t,n,e,r){if(t==="proto")return Mn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return qn(n,e)?true:It(n,e);for(let o of vt(n))for(let s of e.strings)if(s&&(t==="sql"&&nn(o,s)||t==="shell"&&Wn(o,s)||t==="path"&&Hn(o,s,r)||t==="ssrf"&&sn(o,s)))return  true;return  false}function B(t,n,e,r){return Vn(t,n,e,r)?{block:true,ruleId:un[t]}:{block:false}}function Lt(t){let n=t.kind,e=t.input;if(n==="proto"||e!==null&&typeof e=="object")return {path:"/",ip:"test",strings:[],objects:e!==null&&typeof e=="object"?[e]:[]};let r=typeof e=="string"||typeof e=="number"||typeof e=="boolean"?String(e):"";return {path:"/",ip:"test",strings:r?[r]:[],objects:[]}}function zn(t){let n={},e=0;for(let r of t){let o=typeof r.kind=="string"?r.kind:"unknown",s=Lt(r),i=o==="proto"?null:r.sink??r.input,u=typeof r.base=="string"?r.base:void 0,c=B(o,i,s,u).block,p=n[o]??{blocked:0,total:0};p.total+=1,c&&(p.blocked+=1,e+=1),n[o]=p;}return {blocked:e,total:t.length,byKind:n}}function Ot(t){let{blocked:n,total:e}=zn(t);return {blocked:n,total:e}}function cn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var D=new Map,U=new Map,_t={block:2,honey:5,anomaly:1},Qn=900*1e3,N=false,an=Qn;function Yn(t={}){N=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(an=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(D.get(t)??0)+_t[n];return D.set(t,r),N&&r>=10&&U.set(t,e+an),r}function Tt(t){return D.get(t)??0}function fn(){D.clear(),U.clear(),N=false,an=Qn;}function qt(t){return t>=10?"block":t>=5?"challenge":"log"}function ln(t,n=Date.now()){if(!N)return  false;let e=U.get(t);return e===void 0?false:n>=e?(U.delete(t),false):true}var dn=["/admin.php","/.git/config","/wp-login.php"],hn=new Set,Ft=6e4,pn=new Map;function Jn(t){for(let n of t)hn.add(n);}function Zn(){hn.clear(),pn.clear();}function gn(t){let n=t.split("?")[0]??t;return dn.includes(n)}function yn(t){if(!t)return  false;for(let n of hn)if(n&&t.includes(n))return  true;return  false}function mn(t,n=Date.now()){let e=pn.get(t);return e===void 0||n-e.start>Ft?(pn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function kn(){return function(n,e,r){let o=Q(n);try{let s=o.strings.some(c=>yn(c));if(gn(o.path)&&!s){let c=mn(o.ip);P(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),ln(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=$("proto",null,o);if(u.block&&u.ruleId&&(y({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),C(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}y({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}Y(o,()=>{r();});}}var R=createRequire(import.meta.url),E=[],l=new WeakSet,jn=false,Gn=false;function Wt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Bt(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function V(t,n,e){try{let r=m();if(r){let o=$(t,n,r,e);if(o.block&&o.ruleId&&(y({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Wt(n)}),P(r.ip,"block"),C(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=m();y({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return V(t,n,e),r()}function w(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,E.push(()=>{r[n]=o;});}function Dt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function f(t,n){w(t,n,e=>function(r,...o){return b("sql",Dt(r),void 0,()=>e.call(this,r,...o))});}function Xn(t,n){w(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function v(t,n,e){w(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function nt(t,n){w(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,Bt(s),()=>e.call(this,r,...o))});}function ot(t){let n=at();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!cn(e,n)){let r=m();if(y({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),C(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var tt=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function bn(t,n){w(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function wn(t,n){w(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Ut(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function et(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Ut);}function Rn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return W(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return W(n)}function Nt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function rt(t){try{let n=Nt(t);n&&V("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){w(t,n,r=>function(...o){let s=e(o);return ot(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var st=Symbol.for("fullshield.rasp.wrapSqlite"),Sn=Symbol.for("fullshield.rasp.sqliteWrapped"),z;function xn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function $t(t){let n=xn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=xn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(z)try{return xn(z("node:sqlite",void 0,!1))}catch{}}function Kt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function K(t){try{let n=$t(t);if(!n||n[Sn])return;Object.defineProperty(n,Sn,{value:!0,configurable:!0}),f(n,"exec"),f(n,"prepare"),E.push(()=>{delete n[Sn];});}catch{}}function Vt(){globalThis[st]=K;let t=R("node:child_process"),n=R("child_process");for(let a of new Set([t,n]))v(a,"exec",true),v(a,"execSync",true),v(a,"spawn",false),v(a,"spawnSync",false),v(a,"execFile",false),v(a,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let a of new Set([r,o]))for(let d of e)nt(a,d);try{let a=R("node:fs/promises");for(let d of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])nt(a,d);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",O),S(s,"get",O),S(i,"request",O),S(i,"get",O),typeof globalThis.fetch=="function"){let a=globalThis.fetch;globalThis.fetch=function(d,h){let g=W(d);return ot(g),(h?.redirect??"follow")!=="follow"?b("ssrf",g,void 0,()=>a.call(this,d,h)):(V("ssrf",g),(async()=>{let I=g,In=d;for(let Ln=0;Ln<8;Ln+=1){let L=await a.call(this,In,{...h,redirect:"manual"});if(L.status<300||L.status>=400)return L;let On=L.headers.get("location");if(!On)return L;I=new URL(On,I).href,V("ssrf",I),In=I;}return a.call(this,I,h)})())},E.push(()=>{globalThis.fetch=a;});}let u=R("node:vm");for(let a of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,a,d=>function(h,...g){return b("sql",typeof h=="string"?h:"",void 0,()=>d.call(this,h,...g))});let c=R("node:module");z=c._load.bind(c);let p=c._load;c._load=function(a,d,h){let g=p.call(this,a,d,h);try{return it(String(a),g)}catch{return y({ruleId:A,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),g}},E.push(()=>{c._load=p,z=void 0;});let vn=c.registerHooks;typeof vn=="function"&&!Gn&&(Gn=true,vn({load(a,d,h){let g=h(a,d);return jn&&typeof a=="string"&&(a==="node:sqlite"||a.startsWith("node:sqlite"))&&K(),g}})),Kt()&&K();}function zt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(kn()),o.__fullshieldRasp=!0);}catch{y({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function it(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return K(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&f(o.Client.prototype,"query"),o.Pool?.prototype&&f(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(f(s,"query"),f(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(f(o,"exec"),f(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(f(o,"$queryRawUnsafe"),f(o,"$executeRawUnsafe"),f(o,"$queryRaw"),f(o,"$executeRaw"));let s=n.Prisma;return s&&f(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&f(s,"query"),typeof o.literal=="function"&&f(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&f(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&f(e,"raw");let o=n.Client?.prototype;return o&&(f(o,"raw"),f(o,"whereRaw"),f(o,"orderByRaw"),f(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&f(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&f(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&f(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of tt)bn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of tt)bn(o,u);Xn(o,"$where");}let s=n.Model;s&&bn(s,"aggregate");let i=s?.prototype;return i&&Xn(i,"$where"),l.add(e),n}if(r==="axios")return et(e),w(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&et(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",Rn);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",Rn),o.Agent?.prototype&&S(o.Agent.prototype,"request",Rn),l.add(e),n}if(r==="ejs"||r==="pug")return wn(e,"render"),wn(e,"compile"),l.add(e),n;if(r==="nunjucks")return wn(e,"renderString"),l.add(e),n;if(r==="express"){zt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function ut(){jn=true,Vt();let t=Ht.channel("undici:request:create");t.subscribe(rt),E.push(()=>{t.unsubscribe(rt);});}function ct(){for(jn=false,delete globalThis[st];E.length>0;)E.pop()?.();}function ft(t){let n=t.toUpperCase();if(n.includes("SQLI")||n.includes("SQL-"))return "sql";if(n.includes("CMDI")||n.includes("SHELL"))return "shell";if(n.includes("PATH"))return "path";if(n.includes("NOSQL"))return "nosql";if(n.includes("SSRF"))return "ssrf";if(n.includes("PROTO"))return "proto"}function lt(t){if(typeof t.route=="string"&&t.route.startsWith("/"))return t.route;let n=(t.message??"").match(/\/[A-Za-z0-9._/-]+/);if(n)return n[0];if(t.file){let e=Math.max(t.file.lastIndexOf("/"),t.file.lastIndexOf("\\")),r=e>=0?t.file.slice(e+1):t.file,o=r.lastIndexOf("."),s=o>0?r.slice(0,o):r;if(s&&s!=="index")return `/${s}`}}function An(t){return t.map(n=>({ruleId:n.ruleId,file:n.file,line:n.line,sink:ft(n.ruleId),route:lt(n)}))}function Pn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var T=false,x={},_=[],Qt=1e3;function Yt(){return T}function Jt(){return x.mode??"monitor"}function C(t,n){return Pn(x.virtualPatches??[],t,n)?"block":Jt()}function at(){return x.egress?.allow}function $(t,n,e,r){return x.decide?x.decide(t,n,e):B(t,n,e,r)}function y(t){_.length>=Qt&&_.shift(),_.push(t),x.onEvent?.(t);}function Zt(){return _}function Gt(){_.length=0;}function pt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},tn(t.dnsPinTtlMs),Yn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),T||(ut(),T=true));}function Xt(){T&&(ct(),T=false,x={},on(void 0),Nn(),tn(void 0),Zn(),fn());}function ne(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&pt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}function se(t,n){let e=An(t);return mkdirSync(dirname(n),{recursive:true}),writeFileSync(n,`${JSON.stringify({patches:e},null,2)}
+`,"utf8"),e}function ie(t){let n=JSON.parse(readFileSync(t,"utf8"));return Array.isArray(n)?n:n.patches??[]}function fe(t,n){let e=join(t,".gitignore"),r=existsSync(e)?readFileSync(e,"utf8"):"",o=new Set(r.split(`
 `).map(s=>s.trim()));for(let s of n)o.has(s)||(r.length>0&&!r.endsWith(`
 `)&&(r+=`
 `),r+=`${s}
-`,o.add(s));writeFileSync(e,r,"utf8");}function zn(t){let n="FULLSHIELD-HONEY-CANARY-NOT-A-CLOUD-KEY",e="fullshield-honey-db-canary://local";return mkdirSync(t,{recursive:true}),writeFileSync(join(t,".env.backup"),`# fullshield honeytoken decoy \u2014 not real credentials
+`,o.add(s));writeFileSync(e,r,"utf8");}function le(t){let n="FULLSHIELD-HONEY-CANARY-NOT-A-CLOUD-KEY",e="fullshield-honey-db-canary://local";return mkdirSync(t,{recursive:true}),writeFileSync(join(t,".env.backup"),`# fullshield honeytoken decoy \u2014 not real credentials
 AWS_ACCESS_KEY_ID=${n}
 DATABASE_URL=${e}
-`,"utf8"),writeFileSync(join(t,".fullshield-honey.json"),`${JSON.stringify({decoys:ct,canaries:{awsKey:n,dbUrl:e}},null,2)}
-`,"utf8"),Vn(t,[".env.backup",".fullshield-honey.json"]),Wt([n,e]),{awsKey:n,dbUrl:e}}export{S as RASP_FAIL_OPEN,et as RASP_RULE,m as RaspBlockedError,j as addThreat,_n as clearRaspEvents,st as clearThreats,D as contextFromRequest,R as currentRaspContext,wn as decideResponse,T as decideSink,Ht as detectStructureChange,Hn as disableRasp,rt as egressAllowed,Kn as emitVirtualPatches,Gt as enableRasp,qn as enableRaspFromEnv,$ as enterRaspContext,mt as findingsToVpatches,Fn as getRaspEvents,zn as honeyInit,X as hostIsBlocked,lt as isHoneyCanary,ft as isHoneyRoute,it as isIpBlocked,G as isPrivateOrMetadata,vn as isRaspEnabled,Nn as loadVirtualPatches,q as normalizeHost,pt as noteHoneyRouteHit,bt as patchForcesBlock,dt as raspContext,E as raspModeFor,Zt as routeFromFinding,kn as scoreCorpus,qt as scoreCorpusByKind,tt as setSsrfLookup,Jt as sinkFromRule,nt as ssrfHostFromUser,bn as threatScore,Vt as wrapKnownPackage};
+`,"utf8"),writeFileSync(join(t,".fullshield-honey.json"),`${JSON.stringify({decoys:dn,canaries:{awsKey:n,dbUrl:e}},null,2)}
+`,"utf8"),fe(t,[".env.backup",".fullshield-honey.json"]),Jn([n,e]),{awsKey:n,dbUrl:e}}export{A as RASP_FAIL_OPEN,un as RASP_RULE,k as RaspBlockedError,P as addThreat,Gt as clearRaspEvents,fn as clearThreats,Q as contextFromRequest,m as currentRaspContext,qt as decideResponse,B as decideSink,Vn as detectStructureChange,Xt as disableRasp,cn as egressAllowed,se as emitVirtualPatches,pt as enableRasp,ne as enableRaspFromEnv,Y as enterRaspContext,An as findingsToVpatches,Zt as getRaspEvents,le as honeyInit,rn as hostIsBlocked,yn as isHoneyCanary,gn as isHoneyRoute,ln as isIpBlocked,H as isPrivateOrMetadata,Yt as isRaspEnabled,ie as loadVirtualPatches,M as normalizeHost,mn as noteHoneyRouteHit,Pn as patchForcesBlock,kn as raspContext,C as raspModeFor,lt as routeFromFinding,Ot as scoreCorpus,zn as scoreCorpusByKind,on as setSsrfLookup,ft as sinkFromRule,sn as ssrfHostFromUser,Tt as threatScore,it as wrapKnownPackage};

package/dist/runtime/register.js

@@ -1,6 +1,6 @@
-import {createRequire,register}from'module';import Un from'dns';import {AsyncLocalStorage}from'async_hooks';function tn(n){return n===null||typeof n!="object"||Array.isArray(n)?false:Object.keys(n).some(t=>t.startsWith("$"))}function H(n,t){if(n===t)return  true;if(n===null||t===null||typeof n!="object"||typeof t!="object")return  false;if(Array.isArray(n)||Array.isArray(t))return !Array.isArray(n)||!Array.isArray(t)||n.length!==t.length?false:n.every((o,s)=>H(o,t[s]));let e=Object.keys(n),r=Object.keys(t);return e.length!==r.length?false:e.every(o=>H(n[o],t[o]))}function M(n,t,e){if(!(e>8||n===null||typeof n!="object")){if(t.push(n),Array.isArray(n)){for(let r of n)M(r,t,e+1);return}for(let r of Object.values(n))M(r,t,e+1);}}function en(n,t){let e=[];for(let i of t.objects)M(i,e,0);let r=e.filter(tn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),tn(i)&&r.some(c=>c===i||H(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(n,0)}function W(n){let t=n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n),e=[];for(let r of n.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (t?"/":"")+e.join("/")}function Hn(n,t){let e=W(n).replace(/\/+$/,""),r=W(t);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function Mn(n,t){let e=n.indexOf(t);return e<=0?"":n.slice(0,e)}function rn(n){let t=W(n).split("/").filter(Boolean);return t[t.length-1]}function on(n,t,e){if(!t)return  false;if(t.includes("\0")||n.includes("\0"))return  true;if(n.includes(t)){if(t.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:Mn(n,t);return r===""?t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t)||t.includes(".."):!Hn(r,n)}if(t.includes("..")||t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t)){let r=rn(t),o=rn(n);if(r&&r===o)return  true}return  false}var Wn=new Set(["__proto__","constructor","prototype"]);function B(n,t,e){if(t>8||n===null||typeof n!="object"||e.has(n))return  false;e.add(n);for(let r of Object.getOwnPropertyNames(n))if(Wn.has(r))return  true;return Array.isArray(n)?n.some(r=>B(r,t+1,e)):Object.values(n).some(r=>B(r,t+1,e))}function sn(n){let t=new Set;return n.objects.some(e=>B(e,0,t))}function Bn(n){let t=[],e=0,r=n.length;for(;e<r;){let o=n[e];if(o===" "||o==="	"||o===`
-`){let i=e;for(;e<r&&(n[e]===" "||n[e]==="	"||n[e]===`
-`);)e+=1;t.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&n[e]!==i;)i==='"'&&n[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),t.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&n[e]!=="`";)e+=1;e<r&&(e+=1),t.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(n[e+1]==="("||n[e+1]==="{")){let i=n[e+1],u=i==="("?")":"}",c=e;e+=2;let k=1;for(;e<r&&k>0;)n[e]===i?k+=1:n[e]===u&&(k-=1),e+=1;t.push({kind:"op",start:c,end:e});continue}if(n.startsWith("||",e)||n.startsWith("&&",e)||n.startsWith(">>",e)||n.startsWith("<<",e)){t.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){t.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(n[e]);)e+=1;t.push({kind:"word",start:s,end:e});}return t}function un(n,t){if(!t)return  false;let e=Bn(n),r=0;for(;r<=n.length;){let o=n.indexOf(t,r);if(o===-1)return  false;let s=o+t.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(t.length,1);}return  false}function Kn(n){let t=[],e=0,r=n.length;for(;e<r;){let o=n[e];if(o<=" "){let i=e;for(;e<r&&n[e]<=" ";)e+=1;t.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(n[e]===i){if(n[e+1]===i){e+=2;continue}e+=1;break}e+=1;}t.push({kind:"string",start:u,end:e});continue}if(o==="-"&&n[e+1]==="-"){let i=e;for(e+=2;e<r&&n[e]!==`
-`;)e+=1;t.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&n[e+1]==="*"){let i=e;for(e+=2;e<r&&!(n[e]==="*"&&n[e+1]==="/");)e+=1;e+1<r&&(e+=2),t.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&n[e]!==`
-`;)e+=1;t.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&n[e+1]>="0"&&n[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(n[e]);)e+=1;t.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(n[e]);)e+=1;t.push({kind:"ident",start:i,end:e});continue}let s=e;n.startsWith("<=",e)||n.startsWith(">=",e)||n.startsWith("<>",e)||n.startsWith("!=",e)||n.startsWith("||",e)||n.startsWith("&&",e)?e+=2:e+=1,t.push({kind:"op",start:s,end:e});}return t}function Nn(n,t,e){let r=n.filter(o=>o.kind!=="space"&&o.start<e&&o.end>t);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>t||o.end<e}return r.length>0}function K(n,t){if(!t)return  false;let e=Kn(n),r=0;for(;r<=n.length;){let o=n.indexOf(t,r);if(o===-1)return  false;if(Nn(e,o,o+t.length))return  true;r=o+Math.max(t.length,1);}return  false}function N(n){let t=n.trim().toLowerCase();return t=t.replace(/\.+$/,""),t.startsWith("[")&&t.endsWith("]")&&(t=t.slice(1,-1)),t.startsWith("::ffff:")&&(t=t.slice(7)),t.startsWith("[")&&t.endsWith("]")&&(t=t.slice(1,-1)),t}function $n(n){if(/^0x[0-9a-f]+$/i.test(n)){let t=Number.parseInt(n,16);return Number.isFinite(t)?t:void 0}if(/^0[0-7]+$/.test(n)){let t=Number.parseInt(n,8);return Number.isFinite(t)?t:void 0}if(/^\d+$/.test(n)){let t=Number(n);return Number.isFinite(t)?t:void 0}}function ln(n){let t=N(n);if(!t||t.includes(":"))return;let e=t.split(".");if(e.length===0||e.length>4)return;let r=e.map($n);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],k=r[2];return o>255||c>255||k>65535?void 0:[o,c,k>>>8&255,k&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Dn(n){let[t,e]=n;return t===127||t===0||t===10||t===169&&e===254||t===192&&e===168||t===172&&e>=16&&e<=31}function zn(n){return !!(n==="::1"||n==="::"||n==="0:0:0:0:0:0:0:1"||n.startsWith("fc")||n.startsWith("fd")||n.startsWith("fe80:"))}function fn(n){let t=N(n);if(t==="localhost"||t.endsWith(".localhost")||t==="metadata.google.internal")return  true;let e=ln(t);return e?Dn(e):t.includes(":")?zn(t):false}function Qn(n){let t=N(n);if(ln(t)||t.includes(":"))return [t];try{let e=Un.lookupSync;if(typeof e=="function")return e(t,{all:!0}).map(r=>r.address)}catch{}return []}function Vn(n){try{return Qn(n)}catch{return []}}function an(n){if(fn(n))return  true;for(let t of Vn(n))if(fn(t))return  true;return  false}function pn(n,t){if(!t||!n.includes(t))return  false;let e;try{e=new URL(n);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(n)?.[1]??r).replace(/:\d+$/,"");return t===n||t.includes(r)||t.includes(s)||s.includes(t)&&t.length>=3?an(r)||an(s):false}function P(n){let t=n[0];if(typeof t=="string")return t;if(t instanceof URL)return t.href;if(t&&typeof t=="object"){let e=t;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function dn(n){return typeof n=="string"?n:n instanceof URL?n.href:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}var hn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001"},j="RASP-FAIL-OPEN-001",m=class extends Error{ruleId;constructor(t){super(`fullshield rasp blocked ${t}`),this.name="RaspBlockedError",this.ruleId=t;}};function Zn(n){return typeof n=="string"?[n]:typeof n=="number"||typeof n=="boolean"?[String(n)]:[]}function Yn(n,t){let e="";if(typeof n=="string")e=n;else if(n!==null&&typeof n=="object"&&!Array.isArray(n)&&"$where"in n){let r=n.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of t.strings)if(r&&K(e,r))return  true;return  false}function Gn(n,t,e,r){if(n==="proto")return sn(e);if(n==="nosql")return en(t,e)?true:Yn(t,e);for(let o of Zn(t))for(let s of e.strings)if(s&&(n==="sql"&&K(o,s)||n==="shell"&&un(o,s)||n==="path"&&on(o,s,r)||n==="ssrf"&&pn(o,s)))return  true;return  false}function gn(n,t,e,r){return Gn(n,t,e,r)?{block:true,ruleId:hn[n]}:{block:false}}var Jn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),kn=new AsyncLocalStorage;function v(n,t,e){if(!(e>8||t.length>200)){if(typeof n=="string"){t.push(n);return}if(typeof n=="number"||typeof n=="boolean"){t.push(String(n));return}if(Array.isArray(n)){for(let r of n)v(r,t,e+1);return}if(n!==null&&typeof n=="object")for(let r of Object.values(n))v(r,t,e+1);}}function O(n,t,e){if(!(e>8||n===null||typeof n!="object")){if(t.push(n),Array.isArray(n)){for(let r of n)O(r,t,e+1);return}for(let r of Object.values(n))O(r,t,e+1);}}function U(n){let t=[],e=[];for(let r of [n.query,n.body,n.params,n.cookies])v(r,t,0),O(r,e,0);if(n.headers&&typeof n.headers=="object"){for(let[r,o]of Object.entries(n.headers))Jn.has(r.toLowerCase())||v(o,t,0);O(n.headers,e,0);}return {path:n.path??n.url?.split("?")[0]??"/",ip:n.ip??"unknown",strings:t,objects:e}}function $(n,t){return kn.run(n,t)}function R(){return kn.getStore()}function yn(n,t){let e=n.toLowerCase().replace(/\.+$/,"");for(let r of t){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var mn=new Map,D=new Map,nt={block:2,honey:5,anomaly:1},tt=900*1e3,z=false,bn=tt;function wn(n={}){z=n.autoBlock===true,typeof n.maxBlockMs=="number"&&n.maxBlockMs>0&&(bn=n.maxBlockMs);}function A(n,t,e=Date.now()){let r=(mn.get(n)??0)+nt[t];return mn.set(n,r),z&&r>=10&&D.set(n,e+bn),r}function Rn(n,t=Date.now()){if(!z)return  false;let e=D.get(n);return e===void 0?false:t>=e?(D.delete(n),false):true}var et=["/admin.php","/.git/config","/wp-login.php"],rt=new Set,ot=6e4,Sn=new Map;function xn(n){let t=n.split("?")[0]??n;return et.includes(t)}function jn(n){if(!n)return  false;for(let t of rt)if(t&&n.includes(t))return  true;return  false}function An(n,t=Date.now()){let e=Sn.get(n);return e===void 0||t-e.start>ot?(Sn.set(n,{count:1,start:t}),1):(e.count+=1,e.count)}function En(){return function(t,e,r){let o=U(t);try{let s=o.strings.some(c=>jn(c));if(xn(o.path)&&!s){let c=An(o.ip);A(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(A(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),Rn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=q("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof m){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}$(o,()=>{r();});}}var b=createRequire(import.meta.url),F=[],l=new WeakSet,Ln=false,In=false;function it(n){return typeof n=="string"?n.slice(0,40):n==null?"":"[object]"}function ut(n){let t=R();if(t)for(let e of t.strings){if(!e)continue;let r=n.indexOf(e);if(r>0)return n.slice(0,r)}}function Z(n,t,e){try{let r=R();if(r){let o=q(n,t,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:it(t)}),A(r.ip,"block"),L(r.path,n)==="block"))throw new m(o.ruleId)}}catch(r){if(r instanceof m)throw r;let o=R();g({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function y(n,t,e,r){return Z(n,t,e),r()}function w(n,t,e){let r=n,o=r[t];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[t]=s,F.push(()=>{r[t]=o;});}function ct(n){if(typeof n=="string")return n;if(Array.isArray(n))return n.filter(t=>typeof t=="string").join(" ");if(n!==null&&typeof n=="object"){let t=n;if(typeof t.text=="string")return t.text;if(typeof t.sql=="string")return t.sql;if(Array.isArray(t.strings))return t.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(n,t){w(n,t,e=>function(r,...o){return y("sql",ct(r),void 0,()=>e.call(this,r,...o))});}function Cn(n,t){w(n,t,e=>function(r,...o){return y("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(n,t,e){w(n,t,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return y("shell",u,void 0,()=>r.call(this,...o))});}function Pn(n,t){w(n,t,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return y("path",s,ut(s),()=>e.call(this,r,...o))});}function vn(n){let t=qn();if(!t||t.length===0)return;let e="";try{e=new URL(n).hostname;}catch{return}if(e&&!yn(e,t)){let r=R();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&A(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new m("RASP-EGRESS-001")}}function S(n,t,e){w(n,t,r=>function(...o){let s=e(o);return vn(s),y("ssrf",s,void 0,()=>r.call(this,...o))});}var ft=Symbol.for("fullshield.rasp.wrapSqlite"),Q=Symbol.for("fullshield.rasp.sqliteWrapped"),T;function V(n){if(!n||typeof n!="object")return;let t=n.DatabaseSync?.prototype;if(t&&typeof t=="object")return t}function at(n){let t=V(n);if(t)return t;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=V(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(T)try{return V(T("node:sqlite",void 0,!1))}catch{}}function lt(){let n=process.moduleLoadList;return Array.isArray(n)&&n.some(t=>/(?:^| )sqlite$/i.test(t))}function _(n){try{let t=at(n);if(!t||t[Q])return;Object.defineProperty(t,Q,{value:!0,configurable:!0}),a(t,"exec"),a(t,"prepare"),F.push(()=>{delete t[Q];});}catch{}}function pt(){globalThis[ft]=_;let n=b("node:child_process"),t=b("child_process");for(let f of new Set([n,t]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=b("node:fs"),o=b("fs");for(let f of new Set([r,o]))for(let p of e)Pn(f,p);try{let f=b("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Pn(f,p);}catch{}let s=b("node:http"),i=b("node:https");if(S(s,"request",P),S(s,"get",P),S(i,"request",P),S(i,"get",P),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=dn(p);return vn(h),(d?.redirect??"follow")!=="follow"?y("ssrf",h,void 0,()=>f.call(this,p,d)):(Z("ssrf",h),(async()=>{let I=h,X=p;for(let J=0;J<8;J+=1){let C=await f.call(this,X,{...d,redirect:"manual"});if(C.status<300||C.status>=400)return C;let nn=C.headers.get("location");if(!nn)return C;I=new URL(nn,I).href,Z("ssrf",I),X=I;}return f.call(this,I,d)})())},F.push(()=>{globalThis.fetch=f;});}let u=b("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,f,p=>function(d,...h){return y("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=b("node:module");T=c._load.bind(c);let k=c._load;c._load=function(f,p,d){let h=k.call(this,f,p,d);try{return ht(String(f),h)}catch{return g({ruleId:j,path:R()?.path??"/",ip:R()?.ip??"unknown",sample:"hook-error"}),h}},F.push(()=>{c._load=k,T=void 0;});let G=c.registerHooks;typeof G=="function"&&!In&&(In=true,G({load(f,p,d){let h=d(f,p);return Ln&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&_(),h}})),lt()&&_();}function dt(n){if(typeof n!="function")return;let t=n;if(l.has(t))return;function e(...r){let o=t.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(En()),o.__fullshieldRasp=!0);}catch{g({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,t),Object.setPrototypeOf(e,t),l.add(t),n.__fullshieldExpressPatch=e;}function ht(n,t){if(t===null||typeof t!="object"&&typeof t!="function")return t;let e=t;if(l.has(e))return t;let r=n.replace(/^node:/,"");if(r==="sqlite")return _(t),t;if(r==="pg"||r.endsWith("/pg")){let o=t;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),t}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=t,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),t}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=t.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),t}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=t.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=t.Prisma;return s&&a(s,"raw"),l.add(e),t}if(r==="sequelize"||r.endsWith("/sequelize")){let o=t,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),t}if(r==="knex"||r.endsWith("/knex")){typeof t.raw=="function"&&a(e,"raw");let o=t.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),t}if(r==="typeorm"||r.endsWith("/typeorm")){let o=t;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),t}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=t.sql;return o&&a(o,"raw"),l.add(e),t}if(r==="mongodb"||r.includes("mongodb")){let o=t.Collection?.prototype;return o&&w(o,"find",s=>function(i,...u){return y("nosql",i??{},void 0,()=>s.call(this,i,...u))}),l.add(e),t}if(r==="mongoose"||r.includes("mongoose")){let o=t.Query?.prototype;o&&(w(o,"find",i=>function(u,...c){return y("nosql",u??{},void 0,()=>i.call(this,u,...c))}),Cn(o,"$where"));let s=t.Model?.prototype;return s&&Cn(s,"$where"),l.add(e),t}if(r==="axios"){let o=t,s=i=>{let u=i[0];return typeof u=="string"?u:u&&typeof u=="object"&&"url"in u&&typeof u.url=="string"?u.url:""};return S(o,"request",s),S(o,"get",s),S(o,"post",s),l.add(e),t}if(r==="express"){dt(t);let o=t.__fullshieldExpressPatch;if(typeof o=="function"){let s=t.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return y("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return t}function On(){Ln=true,pt();}function _n(n,t,e){return n.some(r=>{let o=r.route===void 0||r.route===t,s=r.sink===void 0||r.sink===e;return o&&s})}var Fn=false,x={};function kt(){return x.mode??"monitor"}function L(n,t){return _n(x.virtualPatches??[],n,t)?"block":kt()}function qn(){return x.egress?.allow}function q(n,t,e,r){return x.decide?x.decide(n,t,e):gn(n,t,e,r)}function g(n){x.onEvent?.(n);}function yt(n={}){!n.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...n,experimental:true},wn({autoBlock:n.threatAutoBlock===true,maxBlockMs:n.threatMaxBlockMs}),Fn||(On(),Fn=true));}function Tn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&yt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Tn();try{register("./rasp/loader.js",import.meta.url);}catch{}
-export{m as RaspBlockedError,U as contextFromRequest,$ as enterRaspContext};
+import {createRequire,register}from'module';import {AsyncLocalStorage}from'async_hooks';import st from'dns';import bt from'diagnostics_channel';var Xn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),cn=new AsyncLocalStorage;function O(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)O(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))O(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function B(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])O(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))Xn.has(r.toLowerCase())||O(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function D(t,n){return cn.run(t,n)}function w(){return cn.getStore()}var an=6e4,Yn=1e3,j=new Map,ln=an,Gn=()=>Date.now();function pn(t){ln=t!==void 0&&Number.isFinite(t)&&t>=0?t:an;}function fn(t,n){for(j.delete(t),j.set(t,n);j.size>Yn;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function dn(t,n,e){let r=w();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Gn(),i=j.get(o);return !i||s-i.at>ln?(fn(o,{addresses:new Set(n),at:s}),false):(fn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function hn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function U(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>U(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>U(t[o],n[o]))}function $(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)$(r,n,e+1);return}for(let r of Object.values(t))$(r,n,e+1);}}function gn(t,n){let e=[];for(let i of n.objects)$(i,e,0);let r=e.filter(hn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),hn(i)&&r.some(c=>c===i||U(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function N(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function Jn(t,n){let e=N(t).replace(/\/+$/,""),r=N(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function nt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function yn(t){let n=N(t).split("/").filter(Boolean);return n[n.length-1]}function kn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:nt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!Jn(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=yn(n),o=yn(t);if(r&&r===o)return  true}return  false}var tt=new Set(["__proto__","constructor","prototype"]);function K(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(tt.has(r))return  true;return Array.isArray(t)?t.some(r=>K(r,n+1,e)):Object.values(t).some(r=>K(r,n+1,e))}function mn(t){let n=new Set;return t.objects.some(e=>K(e,0,n))}function et(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+`){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function bn(t,n){if(!n)return  false;let e=et(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function rt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function ot(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function z(t,n){if(!n)return  false;let e=rt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(ot(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function V(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function it(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Sn(t){let n=V(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(it);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ut(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function ct(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function Q(t){let n=V(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Sn(n);return e?ut(e):n.includes(":")?ct(n):false}function ft(t){let n=V(t);if(Sn(n)||n.includes(":"))return [n];try{let e=st.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function at(t){try{return ft(t)}catch{return []}}function Rn(t){if(Q(t))return  true;let n=at(t);for(let e of n)if(Q(e))return  true;return dn(t,n,Q)}function xn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Rn(r)||Rn(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function _(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var jn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function lt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&z(e,r))return  true;return  false}function dt(t,n,e,r){if(t==="proto")return mn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return gn(n,e)?true:pt(n,e);for(let o of lt(n))for(let s of e.strings)if(s&&(t==="sql"&&z(o,s)||t==="shell"&&bn(o,s)||t==="path"&&kn(o,s,r)||t==="ssrf"&&xn(o,s)))return  true;return  false}function An(t,n,e,r){return dt(t,n,e,r)?{block:true,ruleId:jn[t]}:{block:false}}function Pn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var En=new Map,Z=new Map,ht={block:2,honey:5,anomaly:1},gt=900*1e3,X=false,Cn=gt;function In(t={}){X=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(Cn=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(En.get(t)??0)+ht[n];return En.set(t,r),X&&r>=10&&Z.set(t,e+Cn),r}function vn(t,n=Date.now()){if(!X)return  false;let e=Z.get(t);return e===void 0?false:n>=e?(Z.delete(t),false):true}var yt=["/admin.php","/.git/config","/wp-login.php"],kt=new Set,mt=6e4,Ln=new Map;function qn(t){let n=t.split("?")[0]??t;return yt.includes(n)}function On(t){if(!t)return  false;for(let n of kt)if(n&&t.includes(n))return  true;return  false}function Tn(t,n=Date.now()){let e=Ln.get(t);return e===void 0||n-e.start>mt?(Ln.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function _n(){return function(n,e,r){let o=B(n);try{let s=o.strings.some(c=>On(c));if(qn(o.path)&&!s){let c=Tn(o.ip);P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),vn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=M("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}D(o,()=>{r();});}}var R=createRequire(import.meta.url),q=[],l=new WeakSet,Un=false,Mn=false;function Rt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function St(t){let n=w();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function H(t,n,e){try{let r=w();if(r){let o=M(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Rt(n)}),P(r.ip,"block"),L(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=w();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function m(t,n,e,r){return H(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,q.push(()=>{r[n]=o;});}function xt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return m("sql",xt(r),void 0,()=>e.call(this,r,...o))});}function Fn(t,n){b(t,n,e=>function(r,...o){return m("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return m("shell",u,void 0,()=>r.call(this,...o))});}function Hn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return m("path",s,St(s),()=>e.call(this,r,...o))});}function $n(t){let n=Kn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Pn(e,n)){let r=w();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var Wn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Y(t,n){b(t,n,e=>function(r,...o){return m("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function G(t,n){b(t,n,e=>function(r,...o){return m("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function jt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Bn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,jt);}function J(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return _(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return _(n)}function At(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Dn(t){try{let n=At(t);n&&H("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return $n(s),m("ssrf",s,void 0,()=>r.call(this,...o))});}var Pt=Symbol.for("fullshield.rasp.wrapSqlite"),nn=Symbol.for("fullshield.rasp.sqliteWrapped"),W;function tn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Et(t){let n=tn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=tn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(W)try{return tn(W("node:sqlite",void 0,!1))}catch{}}function Ct(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function F(t){try{let n=Et(t);if(!n||n[nn])return;Object.defineProperty(n,nn,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),q.push(()=>{delete n[nn];});}catch{}}function It(){globalThis[Pt]=F;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Hn(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Hn(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",v),S(s,"get",v),S(i,"request",v),S(i,"get",v),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=_(p);return $n(h),(d?.redirect??"follow")!=="follow"?m("ssrf",h,void 0,()=>f.call(this,p,d)):(H("ssrf",h),(async()=>{let C=h,on=p;for(let sn=0;sn<8;sn+=1){let I=await f.call(this,on,{...d,redirect:"manual"});if(I.status<300||I.status>=400)return I;let un=I.headers.get("location");if(!un)return I;C=new URL(un,C).href,H("ssrf",C),on=C;}return f.call(this,C,d)})())},q.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return m("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");W=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Lt(String(f),h)}catch{return g({ruleId:A,path:w()?.path??"/",ip:w()?.ip??"unknown",sample:"hook-error"}),h}},q.push(()=>{c._load=y,W=void 0;});let rn=c.registerHooks;typeof rn=="function"&&!Mn&&(Mn=true,rn({load(f,p,d){let h=d(f,p);return Un&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&F(),h}})),Ct()&&F();}function vt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(_n()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Lt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return F(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Wn)Y(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Wn)Y(o,u);Fn(o,"$where");}let s=n.Model;s&&Y(s,"aggregate");let i=s?.prototype;return i&&Fn(i,"$where"),l.add(e),n}if(r==="axios")return Bn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Bn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",J);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",J),o.Agent?.prototype&&S(o.Agent.prototype,"request",J),l.add(e),n}if(r==="ejs"||r==="pug")return G(e,"render"),G(e,"compile"),l.add(e),n;if(r==="nunjucks")return G(e,"renderString"),l.add(e),n;if(r==="express"){vt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return m("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Nn(){Un=true,It();let t=bt.channel("undici:request:create");t.subscribe(Dn),q.push(()=>{t.unsubscribe(Dn);});}function zn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Qn=false,x={};function Ot(){return x.mode??"monitor"}function L(t,n){return zn(x.virtualPatches??[],t,n)?"block":Ot()}function Kn(){return x.egress?.allow}function M(t,n,e,r){return x.decide?x.decide(t,n,e):An(t,n,e,r)}function g(t){x.onEvent?.(t);}function Tt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},pn(t.dnsPinTtlMs),In({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Qn||(Nn(),Qn=true));}function Vn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Tt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Vn();try{register("./rasp/loader.js",import.meta.url);}catch{}
+export{k as RaspBlockedError,B as contextFromRequest,D as enterRaspContext};

package/dist/supply.js

@@ -1,8 +1,8 @@
-import {existsSync,statSync,readFileSync,readdirSync}from'fs';import {join,relative}from'path';import {createHash}from'crypto';function S(t,e,n){let i=(n??"").replace(/\s+/g," ").trim();return createHash("sha256").update(`${t}\0${e??""}\0${i}`).digest("hex").slice(0,16)}function v(){return process.env.FULLSHIELD_EXPERIMENTAL_VEX==="1"}var y="registry.npmjs.org",I=["preinstall","install","postinstall"];function j(t){let e;try{e=new URL(t);}catch{throw new Error("supply: registry URL must be https://registry.npmjs.org/...")}if(e.protocol!=="https:"||e.hostname!==y)throw new Error(`supply: only ${y} is allowed (got ${e.hostname||t})`)}function C(t){if(t.startsWith("@")){let n=t.indexOf("/");if(n<0)return t;let i=t.slice(0,n),r=t.slice(n+1),s=r.includes("@")?r.slice(0,r.indexOf("@")):r;return `${i}/${s}`}let e=t.indexOf("@");return e>0?t.slice(0,e):t}function a(t,e,n,i,r="high"){return {id:S(t,i,n),ruleId:t,module:"deps",title:e,severity:r,confidence:"high",file:i,message:n,remediation:"Do not install this package until the behavior is reviewed. Use --ignore-scripts."}}function f(t,e=[]){if(!existsSync(t))return e;for(let n of readdirSync(t,{withFileTypes:true})){let i=join(t,n.name);if(n.isDirectory()){if(n.name==="node_modules")continue;f(i,e);}else n.isFile()&&/\.(js|cjs|mjs|ts)$/.test(n.name)&&e.push(i);}return e}function x(t){return JSON.parse(readFileSync(t,"utf8"))}function T(t){return t?I.filter(e=>typeof t[e]=="string"):[]}function $(t){let e=[],n=join(t,"package.json");if(!existsSync(n)||!statSync(n).isFile())return e;let r=x(n).scripts??{},s=T(r);s.length>0&&e.push(a("SUPPLY-INSTALLSCRIPT-001","Package declares an install script",`install scripts: ${s.join(", ")}`,"package.json"));let o=f(t).map(c=>({file:relative(t,c)||c,text:readFileSync(c,"utf8")})),m=o.some(c=>c.text.includes(".npmrc")||c.text.includes(".ssh")),h=o.some(c=>/https\.request|http\.request|fetch\s*\(|axios\./.test(c.text));if(m&&h){let c=o.find(d=>d.text.includes(".npmrc")||d.text.includes(".ssh"));e.push(a("SUPPLY-NPMRC-NET-001","Install-time code reads npm/ssh credentials and uses the network","static: credential file read combined with http(s)/fetch",c?.file,"critical"));}for(let c of o)/eval\s*\(\s*(Buffer|atob|fromCharCode|decodeURIComponent)/.test(c.text)&&e.push(a("SUPPLY-OBFUSCATE-001","Package evals a decoded/obfuscated string","static: eval of decoded payload",c.file));return v()&&(e.push(..._(t)),e.push(...A(t))),e}function B(t,e){let n=existsSync(join(t,"package.json"))?x(join(t,"package.json")):{},i=existsSync(join(e,"package.json"))?x(join(e,"package.json")):{},r=n.scripts??{},s=i.scripts??{},o=I.filter(u=>typeof s[u]=="string"&&r[u]===void 0),m=f(t).map(u=>readFileSync(u,"utf8")).join(`
+import {existsSync,statSync,readFileSync,readdirSync}from'fs';import {join,relative}from'path';import {createHash}from'crypto';function S(t,e,n){let r=(n??"").replace(/\s+/g," ").trim();return createHash("sha256").update(`${t}\0${e??""}\0${r}`).digest("hex").slice(0,16)}function v(){return process.env.FULLSHIELD_EXPERIMENTAL_VEX==="1"}var y="registry.npmjs.org",I=["preinstall","install","postinstall"];function j(t){let e;try{e=new URL(t);}catch{throw new Error("supply: registry URL must be https://registry.npmjs.org/...")}if(e.protocol!=="https:"||e.hostname!==y)throw new Error(`supply: only ${y} is allowed (got ${e.hostname||t})`)}function C(t){if(t.startsWith("@")){let n=t.indexOf("/");if(n<0)return t;let r=t.slice(0,n),i=t.slice(n+1),s=i.includes("@")?i.slice(0,i.indexOf("@")):i;return `${r}/${s}`}let e=t.indexOf("@");return e>0?t.slice(0,e):t}function a(t,e,n,r,i="high"){return {id:S(t,r,n),ruleId:t,module:"deps",title:e,severity:i,confidence:"high",file:r,message:n,remediation:"Do not install this package until the behavior is reviewed. Use --ignore-scripts."}}function f(t,e=[]){if(!existsSync(t))return e;for(let n of readdirSync(t,{withFileTypes:true})){let r=join(t,n.name);if(n.isDirectory()){if(n.name==="node_modules")continue;f(r,e);}else n.isFile()&&/\.(js|cjs|mjs|ts)$/.test(n.name)&&e.push(r);}return e}function x(t){return JSON.parse(readFileSync(t,"utf8"))}function T(t){return t?I.filter(e=>typeof t[e]=="string"):[]}function $(t){let e=[],n=join(t,"package.json");if(!existsSync(n)||!statSync(n).isFile())return e;let i=x(n).scripts??{},s=T(i);s.length>0&&e.push(a("SUPPLY-INSTALLSCRIPT-001","Package declares an install script",`install scripts: ${s.join(", ")}`,"package.json"));let o=f(t).map(c=>({file:relative(t,c)||c,text:readFileSync(c,"utf8")})),m=o.some(c=>c.text.includes(".npmrc")||c.text.includes(".ssh")),h=o.some(c=>/https\.request|http\.request|fetch\s*\(|axios\./.test(c.text));if(m&&h){let c=o.find(d=>d.text.includes(".npmrc")||d.text.includes(".ssh"));e.push(a("SUPPLY-NPMRC-NET-001","Install-time code reads npm/ssh credentials and uses the network","static: credential file read combined with http(s)/fetch",c?.file,"critical"));}for(let c of o)/eval\s*\(\s*(Buffer|atob|fromCharCode|decodeURIComponent)/.test(c.text)&&e.push(a("SUPPLY-OBFUSCATE-001","Package evals a decoded/obfuscated string","static: eval of decoded payload",c.file));return v()&&(e.push(..._(t)),e.push(...A(t))),e}function B(t,e){let n=existsSync(join(t,"package.json"))?x(join(t,"package.json")):{},r=existsSync(join(e,"package.json"))?x(join(e,"package.json")):{},i=n.scripts??{},s=r.scripts??{},o=I.filter(u=>typeof s[u]=="string"&&i[u]===void 0),m=f(t).map(u=>readFileSync(u,"utf8")).join(`
 `),h=f(e).map(u=>readFileSync(u,"utf8")).join(`
-`),c=/child_process/.test(h)&&!/child_process/.test(m),d=/https?\.request|fetch\s*\(/.test(h)&&!/https?\.request|fetch\s*\(/.test(m);return o.length===0&&!c&&!d?[]:[a("SUPPLY-BEHAVIOR-001","Package version adds install-script or process/network behavior",`added scripts=${o.join(",")||"none"} child_process=${c} network=${d}`,"package.json")]}function V(t,e,n=72,i=Date.now()){let r=t.time?.[e];if(!r)return [];let s=Date.parse(r);if(Number.isNaN(s))return [];let o=(i-s)/36e5;return o>=n?[]:[a("SUPPLY-COOLDOWN-001","Package version is younger than the release cooldown",`${e} published ${o.toFixed(1)}h ago (min ${n}h)`,void 0,"medium")]}function z(t){let e=[];for(let[n,i]of Object.entries(t.packages??{})){if(n==="")continue;let r=i.resolved;if(r){(i.integrity===void 0||i.integrity.length===0)&&e.push(a("SUPPLY-LOCKINTEGRITY-001","Lockfile entry has no integrity hash",`${n} resolved without an integrity hash`,"package-lock.json"));try{let s=new URL(r);(s.protocol!=="https:"||s.hostname!==y)&&e.push(a("SUPPLY-LOCKURL-001","Lockfile entry resolves from a non-npm registry host",`${n} resolved host ${s.hostname||r}`,"package-lock.json"));}catch{e.push(a("SUPPLY-LOCKURL-001","Lockfile entry has a non-URL resolved field",`${n} resolved ${r}`,"package-lock.json"));}}}return e}function q(t,e,n){let i=t.startsWith("@"),r=/@[\w-]+\s*:\s*registry\s*=/.test(e)||/registry\s*=\s*https?:\/\/(?!registry\.npmjs\.org)/.test(e);return i&&r&&n?[a("SUPPLY-CONFUSION-001","Private-scope name also exists on the public registry",`${t} is configured for a private registry but a public package exists`)]:[]}function J(t,e){return t&&!e?[a("SUPPLY-PROVENANCE-001","Package dropped npm provenance since the last scan","previous version had provenance; current version does not")]:[]}async function X(t,e={}){if(!e.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY!=="1")return {findings:[],skipped:true};let n=C(t),i=`https://${y}/${encodeURIComponent(n)}`;j(i),e.fetchPackument&&await e.fetchPackument(i);let r=e.extractDir!==void 0?$(e.extractDir):[];return r.length===0&&e.runNpm&&await e.runNpm(["install",t,"--ignore-scripts"]),{findings:r}}var b=/(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/,P=/\bnpm\s+publish\b|\bnpmPublish\b|\blibnpmpublish\b/,R=/registry\.npmjs\.org[\s\S]{0,800}\bPUT\b|\bmethod\s*:\s*['"]PUT['"][\s\S]{0,400}registry\.npmjs\.org/,w=/api\.github\.com\/(?:user\/repos|repos\/)|\/actions\/workflows/,E=/\.github\/workflows/,k=/\.github\/|\.git\/hooks\/|\.gitlab-ci\.yml|\.travis\.yml|azure-pipelines(?:\.yml)?|Jenkinsfile|\.circleci\//;function U(t){let e=join(t,"package.json"),n="";if(existsSync(e)&&statSync(e).isFile())try{let s=x(e).scripts??{};n=Object.values(s).join(`
-`);}catch{n="";}return {sources:f(t).map(r=>({file:relative(t,r)||r,text:readFileSync(r,"utf8")})),scripts:n}}function _(t){let{sources:e,scripts:n}=U(t);if(e.length===0&&n.length===0)return [];let i=`${e.map(o=>o.text).join(`
+`),c=/child_process/.test(h)&&!/child_process/.test(m),d=/https?\.request|fetch\s*\(/.test(h)&&!/https?\.request|fetch\s*\(/.test(m);return o.length===0&&!c&&!d?[]:[a("SUPPLY-BEHAVIOR-001","Package version adds install-script or process/network behavior",`added scripts=${o.join(",")||"none"} child_process=${c} network=${d}`,"package.json")]}function V(t,e,n=72,r=Date.now()){let i=t.time?.[e];if(!i)return [];let s=Date.parse(i);if(Number.isNaN(s))return [];let o=(r-s)/36e5;return o>=n?[]:[a("SUPPLY-COOLDOWN-001","Package version is younger than the release cooldown",`${e} published ${o.toFixed(1)}h ago (min ${n}h)`,void 0,"medium")]}function z(t){let e=[];for(let[n,r]of Object.entries(t.packages??{})){if(n==="")continue;let i=r.resolved;if(i){(r.integrity===void 0||r.integrity.length===0)&&e.push(a("SUPPLY-LOCKINTEGRITY-001","Lockfile entry has no integrity hash",`${n} resolved without an integrity hash`,"package-lock.json"));try{let s=new URL(i);(s.protocol!=="https:"||s.hostname!==y)&&e.push(a("SUPPLY-LOCKURL-001","Lockfile entry resolves from a non-npm registry host",`${n} resolved host ${s.hostname||i}`,"package-lock.json"));}catch{e.push(a("SUPPLY-LOCKURL-001","Lockfile entry has a non-URL resolved field",`${n} resolved ${i}`,"package-lock.json"));}}}return e}function q(t,e,n){let r=t.startsWith("@"),i=/@[\w-]+\s*:\s*registry\s*=/.test(e)||/registry\s*=\s*https?:\/\/(?!registry\.npmjs\.org)/.test(e);return r&&i&&n?[a("SUPPLY-CONFUSION-001","Private-scope name also exists on the public registry",`${t} is configured for a private registry but a public package exists`)]:[]}function J(t,e){return t&&!e?[a("SUPPLY-PROVENANCE-001","Package dropped npm provenance since the last scan","previous version had provenance; current version does not")]:[]}async function X(t,e={}){if(!e.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_SUPPLY!=="1")return {findings:[],skipped:true};let n=C(t),r=`https://${y}/${encodeURIComponent(n)}`;j(r),e.fetchPackument&&await e.fetchPackument(r);let i=e.extractDir!==void 0?$(e.extractDir):[];return i.length===0&&e.runNpm&&await e.runNpm(["install",t,"--ignore-scripts"]),{findings:i}}var b=/(?:~\/)?\.npmrc\b|\bNPM_TOKEN\b|\bGITHUB_TOKEN\b/,P=/\bnpm\s+publish\b|\bnpmPublish\b|\blibnpmpublish\b/,R=/registry\.npmjs\.org[\s\S]{0,800}\bPUT\b|\bmethod\s*:\s*['"]PUT['"][\s\S]{0,400}registry\.npmjs\.org/,w=/api\.github\.com\/(?:user\/repos|repos\/)|\/actions\/workflows/,E=/\.github\/workflows/,k=/\.github\/|\.git\/hooks\/|\.gitlab-ci\.yml|\.travis\.yml|azure-pipelines(?:\.yml)?|Jenkinsfile|\.circleci\//;function U(t){let e=join(t,"package.json"),n="";if(existsSync(e)&&statSync(e).isFile())try{let s=x(e).scripts??{};n=Object.values(s).join(`
+`);}catch{n="";}return {sources:f(t).map(i=>({file:relative(t,i)||i,text:readFileSync(i,"utf8")})),scripts:n}}function _(t){let{sources:e,scripts:n}=U(t);if(e.length===0&&n.length===0)return [];let r=`${e.map(o=>o.text).join(`
 `)}
-${n}`;if(!b.test(i))return [];if(!(P.test(i)||R.test(i)||w.test(i)||E.test(i)))return [];let s=e.find(o=>b.test(o.text)&&(P.test(o.text)||R.test(o.text)||w.test(o.text)||E.test(o.text)))??e.find(o=>b.test(o.text));return [a("SUPPLY-WORM-001","Self-replicating worm indicators in dependency code","static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",s?.file,"critical")]}function A(t){let{sources:e,scripts:n}=U(t),i=`${e.map(s=>s.text).join(`
+${n}`;if(!b.test(r))return [];if(!(P.test(r)||R.test(r)||w.test(r)||E.test(r)))return [];let s=e.find(o=>b.test(o.text)&&(P.test(o.text)||R.test(o.text)||w.test(o.text)||E.test(o.text)))??e.find(o=>b.test(o.text));return [a("SUPPLY-WORM-001","Self-replicating worm indicators in dependency code","static: npm/GitHub token read combined with publish, registry PUT, GitHub repo/workflow creation, or writing .github/workflows",s?.file,"critical")]}function A(t){let{sources:e,scripts:n}=U(t),r=`${e.map(s=>s.text).join(`
 `)}
-${n}`;if(!k.test(i))return [];let r=e.find(s=>k.test(s.text));return [a("SUPPLY-WORKFLOW-001","Dependency writes GitHub workflow, git hooks, or CI config","static: install script or package code writes .github/, .git/hooks/, or CI configuration",r?.file??(k.test(n)?"package.json":void 0),"critical")]}function Q(t,e){let n=0,i=0;for(let s of t){let o=e.get(`${s.name}@${s.version}`);o===true?n+=1:o===void 0&&(i+=1);}let r=t.length;return {total:r,withProvenance:n,unknown:i,percent:r===0?0:n/r*100}}export{$ as analyzePackageDir,A as analyzeWorkflowTampering,_ as analyzeWormIndicators,j as assertRegistryUrl,V as checkCooldown,q as checkDependencyConfusion,z as checkLockfileIntegrity,J as checkProvenance,B as diffPackageVersions,X as installGuard,C as packageNameFromSpec,Q as provenanceCoverage};
+${n}`;if(!k.test(r))return [];let i=e.find(s=>k.test(s.text));return [a("SUPPLY-WORKFLOW-001","Dependency writes GitHub workflow, git hooks, or CI config","static: install script or package code writes .github/, .git/hooks/, or CI configuration",i?.file??(k.test(n)?"package.json":void 0),"critical")]}function Q(t,e){let n=0,r=0;for(let s of t){let o=e.get(`${s.name}@${s.version}`);o===true?n+=1:o===void 0&&(r+=1);}let i=t.length;return {total:i,withProvenance:n,unknown:r,percent:i===0?0:n/i*100}}export{$ as analyzePackageDir,A as analyzeWorkflowTampering,_ as analyzeWormIndicators,j as assertRegistryUrl,V as checkCooldown,q as checkDependencyConfusion,z as checkLockfileIntegrity,J as checkProvenance,B as diffPackageVersions,X as installGuard,C as packageNameFromSpec,Q as provenanceCoverage};

package/models/index.json

@@ -1,5 +1,5 @@
 {
-  "fullshieldVersion": "1.0.0",
+  "fullshieldVersion": "1.2.0",
   "entries": [
     {
       "package": "express",

package/models/npm-builders.json

@@ -0,0 +1,3 @@
+{
+  "builders": []
+}