fullshield 3.2.2 → 3.3.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to FullShield are documented here.
 
+## 3.3.1 — 2026-10-29
+
+### Runtime guard
+
+- Phase 567: `FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD` keeps block mode to SQL and shell. Other sinks stay monitor. A runtime event may include a local `webhookJson` body, at most 5 per 60 seconds, and that body is not posted. No eBPF and no new host.
+
 ## 3.2.2 — 2026-10-29
 
 ### Stored response

package/README.md

@@ -1,6 +1,6 @@
 # FullShield
 
-**v3.2.2.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself. Scan when you want with `npx fullshield scan`, or install an every-2-hours timer with `npx fullshield schedule install`.
+**v3.3.1.** One install for Node.js/TypeScript backends: detect → classify → report → notify → fix → gate (CI `--fail-on` + runtime monitor). It does not stop attacks by itself. Scan when you want with `npx fullshield scan`, or install an every-2-hours timer with `npx fullshield schedule install`.
 
 **Headline: dependency reachability.** A lockfile CVE is not the same as an unused package. FullShield classifies each OSV hit as `reachable` (imported and called), `imported-not-called` (−1), `reachable-via-dependency` (lockfile path from an imported direct dep — **severity kept**, path shown, e.g. `express > body-parser > qs`), `not-imported` (−2, only when no such path exists), or `reachability-unknown` (severity kept) when the lockfile format has no parsed dependency edges. DevDependency-only vulns are `info` with a `dev-only` note unless production sources import the package. Pair it with `fullshield sbom --format cyclonedx`.
 
@@ -10,16 +10,16 @@ npx fullshield scan --json --fail-on high
 npx fullshield scan --sarif fullshield.sarif
 ```
 
-3.2.2 is the version of this tree. Python and other languages are out of scope. `schedule install` writes `fullShieldReport/fullShieldReport_YYYYMMDD_HHMM.md` every 2 hours and keeps 60 reports. `scan` does not create that folder. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. From `bench/perf-v2.json` (`measured: true`, `label: unreviewed`), the stored Next.js cold p50 is 107.95 seconds — still above the 60-second target (target unmet). Default scans share one AST, run modules in parallel, and use lazy taint. Multi-workspace repos scan each workspace lockfile by default; single-package finding keys stay the same as 2.3.0.
+3.3.1 is the version of this tree. Python and other languages are out of scope. `schedule install` writes `fullShieldReport/fullShieldReport_YYYYMMDD_HHMM.md` every 2 hours and keeps 60 reports. `scan` does not create that folder. The stable contract is [docs/stability.md](docs/stability.md). The 1.0.1 release moved values that only experimental flags produce out of Stable. Experimental flags stay off unless you set them. Do not treat a scan as a penetration test. Reviewed recall for untouched apps is not published. From `bench/perf-v2.json` (`measured: true`, `label: unreviewed`), the stored Next.js cold p50 is 107.95 seconds — still above the 60-second target (target unmet). Default scans share one AST, run modules in parallel, and use lazy taint. Multi-workspace repos scan each workspace lockfile by default; single-package finding keys stay the same as 2.3.0.
 
 ## Verify in 60 seconds
 
 ```bash
 # fresh temp / empty cache is enough — no install-guard phones home
-npx fullshield@3.2.2 --version
+npx fullshield@3.3.1 --version
 ```
 
-Package page: [npmjs.com/package/fullshield](https://www.npmjs.com/package/fullshield). Release tag: [v3.2.2](https://github.com/kathanp/fullshield/releases/tag/v3.2.2). Publish stages with npm provenance (OIDC). After install, the stranger checks in the build spec (scan / json / sarif / fail-on / fix / init / sbom) are the post-publish gate — no Rekor/sigstore SaaS dependency in the CLI.
+Package page: [npmjs.com/package/fullshield](https://www.npmjs.com/package/fullshield). Release tag: [v3.3.1](https://github.com/kathanp/fullshield/releases/tag/v3.3.1). Publish stages with npm provenance (OIDC). After install, the stranger checks in the build spec (scan / json / sarif / fail-on / fix / init / sbom) are the post-publish gate — no Rekor/sigstore SaaS dependency in the CLI.
 
 ## GitHub Action
 
@@ -28,7 +28,7 @@ Copy `templates/action/` into your repo (or use `kathanp/fullshield-action` once
 ```yaml
 - uses: your-org/your-repo/.github/actions/fullshield@<commit-sha>
   with:
-    version: '3.2.2'
+    version: '3.3.1'
 ```
 
 Or run `npx fullshield init --recommended` to write `profile: "recommended"` and a workflow that calls `./templates/action`. The Action runs `fullshield scan`, uploads SARIF, and may cache the baseline. It does not post a pull-request comment, open issues, or phone home.
@@ -86,7 +86,7 @@ Contributor quality gate: [docs/QUALITY.md](docs/QUALITY.md) (`npm run quality`)
 - Cross-file taint follows `require`/`import` and method calls up to 5 hops and records a `trace` (also SARIF `codeFlows`). Nested closures and some dynamic dispatch are still missed.
 - Runtime v1 is **signature-based** (payload regex + rate limit + body-size guard). It is a **stopgap monitor**, not a WAF. Prefer **`mode: 'monitor'`** in production until you have measured false-positive rate. Sink-hooking RASP is **experimental** (off by default; see below) and does not claim to prevent attacks.
 - Only scan hosts and repos you own or are authorized to test.
-- Does **not** scan container images or OS packages. Pass a Trivy SARIF file you already produced to `fullshield ingest`. FullShield does not pretend to be a container scanner.
+- Does **not** scan container images or OS packages, and does not implement eBPF or network-layer detection. Pass a Trivy SARIF file you already produced to `fullshield ingest`. FullShield does not pretend to be a container scanner.
 - **Experimental features are off by default and are not product claims:**
   - RASP / virtual patches / honeytokens / threat auto-block: fail-open hooks; decoy-route hits are low and never auto-block; auto-block is opt-in (shared-IP / NAT risk).
   - `install` / supply-chain: static heuristics only; never a substitute for `npm audit` policy or a malware sandbox.
@@ -230,7 +230,7 @@ app.use(shieldGuard({ mode: 'monitor', authRoutes: ['/login'] }));
 
 **Experimental ingest (off by default):** `FULLSHIELD_EXPERIMENTAL_INGEST=1` or `fullshield ingest --experimental-ingest <file...>`. Reads local SARIF 2.1.0, OSV-Scanner JSON, `npm audit --json`, and Semgrep JSON. It does not run those tools and does not fetch. Severity stays the tool's severity (`moderate` and Semgrep `WARNING` are stored as medium; the original token is `externalSeverity`). `fullshieldPriority` is not set.
 
-**Experimental RASP** (Frontier, off by default): structure-change sink hooks via `node --import fullshield/runtime/register app.js` or `import 'fullshield/runtime/auto'` as the first import. Enable only with `FULLSHIELD_EXPERIMENTAL_RASP=1`. Default mode is `monitor` (events only). `FULLSHIELD_RASP_MODE=block` throws on structure-changing SQL/shell/path/NoSQL/SSRF/prototype input. Hooks **fail open**: a hook error logs `RASP-FAIL-OPEN-001` and the original call proceeds. Do not use block mode in production until you have measured the benign corpus on your app.
+**Experimental RASP** (Frontier, off by default): structure-change sink hooks via `node --import fullshield/runtime/register app.js` or `import 'fullshield/runtime/auto'` as the first import. Enable only with `FULLSHIELD_EXPERIMENTAL_RASP=1`. Default mode is `monitor` (events only). `FULLSHIELD_RASP_MODE=block` throws on structure-changing SQL/shell/path/NoSQL/SSRF/prototype input. With `FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD=1`, block mode throws only for SQL and shell; path, NoSQL, SSRF, prototype, and SSTI stay monitor. A matching event may include `webhookJson` (`schema`, `kind`, `action`, `ruleId`) at most 5 times per 60 seconds. That JSON is not posted and has no request sample. Hooks **fail open**: a hook error logs `RASP-FAIL-OPEN-001` and the original call proceeds. Do not use block mode in production until you have measured the benign corpus on your app.
 
 `npm run bench` reports `inspect()` p50/p95 (must stay under 1ms) and full Express request overhead p50/p95 with the middleware on the stack.
 

package/dist/runtime/auto.js

@@ -1,5 +1,5 @@
-import {AsyncLocalStorage}from'async_hooks';import st from'dns';import mt from'diagnostics_channel';import {createRequire}from'module';var Xn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),sn=new AsyncLocalStorage;function O(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)O(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))O(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function un(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])O(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))Xn.has(r.toLowerCase())||O(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function cn(t,n){return sn.run(t,n)}function m(){return sn.getStore()}var an=6e4,Yn=1e3,j=new Map,ln=an,Gn=()=>Date.now();function pn(t){ln=t!==void 0&&Number.isFinite(t)&&t>=0?t:an;}function fn(t,n){for(j.delete(t),j.set(t,n);j.size>Yn;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function dn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Gn(),i=j.get(o);return !i||s-i.at>ln?(fn(o,{addresses:new Set(n),at:s}),false):(fn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function hn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function B(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>B(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>B(t[o],n[o]))}function D(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)D(r,n,e+1);return}for(let r of Object.values(t))D(r,n,e+1);}}function gn(t,n){let e=[];for(let i of n.objects)D(i,e,0);let r=e.filter(hn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),hn(i)&&r.some(c=>c===i||B(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function U(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function Jn(t,n){let e=U(t).replace(/\/+$/,""),r=U(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function nt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function yn(t){let n=U(t).split("/").filter(Boolean);return n[n.length-1]}function kn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:nt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!Jn(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=yn(n),o=yn(t);if(r&&r===o)return  true}return  false}var tt=new Set(["__proto__","constructor","prototype"]);function $(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(tt.has(r))return  true;return Array.isArray(t)?t.some(r=>$(r,n+1,e)):Object.values(t).some(r=>$(r,n+1,e))}function bn(t){let n=new Set;return t.objects.some(e=>$(e,0,n))}function et(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {AsyncLocalStorage}from'async_hooks';import pt from'dns';import Pt from'diagnostics_channel';import {createRequire}from'module';var nt="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var tt=new Set(["sql","shell"]),O=[];function fn(){return process.env[nt]==="1"}function an(t,n){return fn()?t!=="block"?"monitor":tt.has(n)?"block":"monitor":t}function ln(t,n,e,r){if(fn()&&(O=O.filter(o=>r-o<6e4),!(O.length>=5)))return O.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var rt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),pn=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function dn(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))rt.has(r.toLowerCase())||q(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function hn(t,n){return pn.run(t,n)}function m(){return pn.getStore()}var yn=6e4,ot=1e3,j=new Map,kn=yn,st=()=>Date.now();function bn(t){kn=t!==void 0&&Number.isFinite(t)&&t>=0?t:yn;}function gn(t,n){for(j.delete(t),j.set(t,n);j.size>ot;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function mn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=st(),i=j.get(o);return !i||s-i.at>kn?(gn(o,{addresses:new Set(n),at:s}),false):(gn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function wn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function U(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>U(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>U(t[o],n[o]))}function $(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)$(r,n,e+1);return}for(let r of Object.values(t))$(r,n,e+1);}}function Rn(t,n){let e=[];for(let i of n.objects)$(i,e,0);let r=e.filter(wn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),wn(i)&&r.some(c=>c===i||U(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function K(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function it(t,n){let e=K(t).replace(/\/+$/,""),r=K(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function ut(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Sn(t){let n=K(t).split("/").filter(Boolean);return n[n.length-1]}function xn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:ut(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!it(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Sn(n),o=Sn(t);if(r&&r===o)return  true}return  false}var ct=new Set(["__proto__","constructor","prototype"]);function z(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(ct.has(r))return  true;return Array.isArray(t)?t.some(r=>z(r,n+1,e)):Object.values(t).some(r=>z(r,n+1,e))}function jn(t){let n=new Set;return t.objects.some(e=>z(e,0,n))}function ft(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function mn(t,n){if(!n)return  false;let e=et(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function rt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function An(t,n){if(!n)return  false;let e=ft(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function at(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function ot(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function N(t,n){if(!n)return  false;let e=rt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(ot(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function z(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function it(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Sn(t){let n=z(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(it);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ut(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function ct(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function K(t){let n=z(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Sn(n);return e?ut(e):n.includes(":")?ct(n):false}function ft(t){let n=z(t);if(Sn(n)||n.includes(":"))return [n];try{let e=st.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function at(t){try{return ft(t)}catch{return []}}function Rn(t){if(K(t))return  true;let n=at(t);for(let e of n)if(K(e))return  true;return dn(t,n,K)}function xn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Rn(r)||Rn(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function _(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var jn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function lt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&N(e,r))return  true;return  false}function dt(t,n,e,r){if(t==="proto")return bn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return gn(n,e)?true:pt(n,e);for(let o of lt(n))for(let s of e.strings)if(s&&(t==="sql"&&N(o,s)||t==="shell"&&mn(o,s)||t==="path"&&kn(o,s,r)||t==="ssrf"&&xn(o,s)))return  true;return  false}function An(t,n,e,r){return dt(t,n,e,r)?{block:true,ruleId:jn[t]}:{block:false}}function Pn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var En=new Map,Q=new Map,ht={block:2,honey:5,anomaly:1},gt=900*1e3,V=false,In=gt;function Cn(t={}){V=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(In=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(En.get(t)??0)+ht[n];return En.set(t,r),V&&r>=10&&Q.set(t,e+In),r}function vn(t,n=Date.now()){if(!V)return  false;let e=Q.get(t);return e===void 0?false:n>=e?(Q.delete(t),false):true}var yt=["/admin.php","/.git/config","/wp-login.php"],kt=new Set,bt=6e4,Ln=new Map;function qn(t){let n=t.split("?")[0]??t;return yt.includes(n)}function On(t){if(!t)return  false;for(let n of kt)if(n&&t.includes(n))return  true;return  false}function Tn(t,n=Date.now()){let e=Ln.get(t);return e===void 0||n-e.start>bt?(Ln.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function _n(){return function(n,e,r){let o=un(n);try{let s=o.strings.some(c=>On(c));if(qn(o.path)&&!s){let c=Tn(o.ip);P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),vn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=M("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}cn(o,()=>{r();});}}var R=createRequire(import.meta.url),q=[],l=new WeakSet,Un=false,Mn=false;function Rt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function St(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function H(t,n,e){try{let r=m();if(r){let o=M(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Rt(n)}),P(r.ip,"block"),L(r.path,t)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=m();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function k(t,n,e,r){return H(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,q.push(()=>{r[n]=o;});}function xt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return k("sql",xt(r),void 0,()=>e.call(this,r,...o))});}function Fn(t,n){b(t,n,e=>function(r,...o){return k("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return k("shell",u,void 0,()=>r.call(this,...o))});}function Hn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return k("path",s,St(s),()=>e.call(this,r,...o))});}function $n(t){let n=Kn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Pn(e,n)){let r=m();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}var Wn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Z(t,n){b(t,n,e=>function(r,...o){return k("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function X(t,n){b(t,n,e=>function(r,...o){return k("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function jt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Bn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,jt);}function Y(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return _(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return _(n)}function At(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Dn(t){try{let n=At(t);n&&H("ssrf",n);}catch(n){if(n instanceof w)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return $n(s),k("ssrf",s,void 0,()=>r.call(this,...o))});}var Pt=Symbol.for("fullshield.rasp.wrapSqlite"),G=Symbol.for("fullshield.rasp.sqliteWrapped"),W;function J(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Et(t){let n=J(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=J(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(W)try{return J(W("node:sqlite",void 0,!1))}catch{}}function It(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function F(t){try{let n=Et(t);if(!n||n[G])return;Object.defineProperty(n,G,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),q.push(()=>{delete n[G];});}catch{}}function Ct(){globalThis[Pt]=F;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Hn(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Hn(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",v),S(s,"get",v),S(i,"request",v),S(i,"get",v),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=_(p);return $n(h),(d?.redirect??"follow")!=="follow"?k("ssrf",h,void 0,()=>f.call(this,p,d)):(H("ssrf",h),(async()=>{let I=h,en=p;for(let rn=0;rn<8;rn+=1){let C=await f.call(this,en,{...d,redirect:"manual"});if(C.status<300||C.status>=400)return C;let on=C.headers.get("location");if(!on)return C;I=new URL(on,I).href,H("ssrf",I),en=I;}return f.call(this,I,d)})())},q.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return k("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");W=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Lt(String(f),h)}catch{return g({ruleId:A,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),h}},q.push(()=>{c._load=y,W=void 0;});let tn=c.registerHooks;typeof tn=="function"&&!Mn&&(Mn=true,tn({load(f,p,d){let h=d(f,p);return Un&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&F(),h}})),It()&&F();}function vt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(_n()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Lt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return F(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Wn)Z(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Wn)Z(o,u);Fn(o,"$where");}let s=n.Model;s&&Z(s,"aggregate");let i=s?.prototype;return i&&Fn(i,"$where"),l.add(e),n}if(r==="axios")return Bn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Bn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",Y);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",Y),o.Agent?.prototype&&S(o.Agent.prototype,"request",Y),l.add(e),n}if(r==="ejs"||r==="pug")return X(e,"render"),X(e,"compile"),l.add(e),n;if(r==="nunjucks")return X(e,"renderString"),l.add(e),n;if(r==="express"){vt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return k("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Nn(){Un=true,Ct();let t=mt.channel("undici:request:create");t.subscribe(Dn),q.push(()=>{t.unsubscribe(Dn);});}function zn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Qn=false,x={};function Ot(){return x.mode??"monitor"}function L(t,n){return zn(x.virtualPatches??[],t,n)?"block":Ot()}function Kn(){return x.egress?.allow}function M(t,n,e,r){return x.decide?x.decide(t,n,e):An(t,n,e,r)}function g(t){x.onEvent?.(t);}function Tt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},pn(t.dnsPinTtlMs),Cn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Qn||(Nn(),Qn=true));}function Vn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Tt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Vn();
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function lt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function Q(t,n){if(!n)return  false;let e=at(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(lt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function G(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function dt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function In(t){let n=G(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(dt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ht(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function gt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function V(t){let n=G(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=In(n);return e?ht(e):n.includes(":")?gt(n):false}function yt(t){let n=G(t);if(In(n)||n.includes(":"))return [n];try{let e=pt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function kt(t){try{return yt(t)}catch{return []}}function En(t){if(V(t))return  true;let n=kt(t);for(let e of n)if(V(e))return  true;return mn(t,n,V)}function vn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?En(r)||En(s):false}function C(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function F(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var W={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function bt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function mt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&Q(e,r))return  true;return  false}function wt(t,n,e,r){if(t==="proto")return jn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return Rn(n,e)?true:mt(n,e);for(let o of bt(n))for(let s of e.strings)if(s&&(t==="sql"&&Q(o,s)||t==="shell"&&An(o,s)||t==="path"&&xn(o,s,r)||t==="ssrf"&&vn(o,s)))return  true;return  false}function Cn(t,n,e,r){return wt(t,n,e,r)?{block:true,ruleId:W[t]}:{block:false}}function Ln(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var Mn=new Map,X=new Map,Rt={block:2,honey:5,anomaly:1},St=900*1e3,J=false,_n=St;function On(t={}){J=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(_n=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(Mn.get(t)??0)+Rt[n];return Mn.set(t,r),J&&r>=10&&X.set(t,e+_n),r}function qn(t,n=Date.now()){if(!J)return  false;let e=X.get(t);return e===void 0?false:n>=e?(X.delete(t),false):true}var xt=["/admin.php","/.git/config","/wp-login.php"],jt=new Set,At=6e4,Tn=new Map;function Fn(t){let n=t.split("?")[0]??t;return xt.includes(n)}function Wn(t){if(!t)return  false;for(let n of jt)if(n&&t.includes(n))return  true;return  false}function Hn(t,n=Date.now()){let e=Tn.get(t);return e===void 0||n-e.start>At?(Tn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Dn(){return function(n,e,r){let o=dn(n);try{let s=o.strings.some(c=>Wn(c));if(Fn(o.path)&&!s){let c=Hn(o.ip);P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),qn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=H("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}hn(o,()=>{r();});}}var R=createRequire(import.meta.url),M=[],l=new WeakSet,Qn=false,Bn=false;function It(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function vt(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function B(t,n,e){try{let r=m();if(r){let o=H(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:It(n)}),P(r.ip,"block"),L(r.path,t)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=m();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function k(t,n,e,r){return B(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,M.push(()=>{r[n]=o;});}function Ct(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return k("sql",Ct(r),void 0,()=>e.call(this,r,...o))});}function Nn(t,n){b(t,n,e=>function(r,...o){return k("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return k("shell",u,void 0,()=>r.call(this,...o))});}function Un(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return k("path",s,vt(s),()=>e.call(this,r,...o))});}function Vn(t){let n=Xn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Ln(e,n)){let r=m();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}var $n=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Z(t,n){b(t,n,e=>function(r,...o){return k("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function Y(t,n){b(t,n,e=>function(r,...o){return k("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Lt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Kn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Lt);}function nn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return F(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return F(n)}function Mt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function zn(t){try{let n=Mt(t);n&&B("ssrf",n);}catch(n){if(n instanceof w)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return Vn(s),k("ssrf",s,void 0,()=>r.call(this,...o))});}var _t=Symbol.for("fullshield.rasp.wrapSqlite"),tn=Symbol.for("fullshield.rasp.sqliteWrapped"),N;function en(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Ot(t){let n=en(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=en(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(N)try{return en(N("node:sqlite",void 0,!1))}catch{}}function qt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function D(t){try{let n=Ot(t);if(!n||n[tn])return;Object.defineProperty(n,tn,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),M.push(()=>{delete n[tn];});}catch{}}function Tt(){globalThis[_t]=D;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Un(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Un(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",C),S(s,"get",C),S(i,"request",C),S(i,"get",C),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=F(p);return Vn(h),(d?.redirect??"follow")!=="follow"?k("ssrf",h,void 0,()=>f.call(this,p,d)):(B("ssrf",h),(async()=>{let I=h,sn=p;for(let un=0;un<8;un+=1){let v=await f.call(this,sn,{...d,redirect:"manual"});if(v.status<300||v.status>=400)return v;let cn=v.headers.get("location");if(!cn)return v;I=new URL(cn,I).href,B("ssrf",I),sn=I;}return f.call(this,I,d)})())},M.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return k("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");N=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Wt(String(f),h)}catch{return g({ruleId:A,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),h}},M.push(()=>{c._load=y,N=void 0;});let on=c.registerHooks;typeof on=="function"&&!Bn&&(Bn=true,on({load(f,p,d){let h=d(f,p);return Qn&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&D(),h}})),qt()&&D();}function Ft(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Dn()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Wt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return D(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of $n)Z(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of $n)Z(o,u);Nn(o,"$where");}let s=n.Model;s&&Z(s,"aggregate");let i=s?.prototype;return i&&Nn(i,"$where"),l.add(e),n}if(r==="axios")return Kn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Kn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",nn);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",nn),o.Agent?.prototype&&S(o.Agent.prototype,"request",nn),l.add(e),n}if(r==="ejs"||r==="pug")return Y(e,"render"),Y(e,"compile"),l.add(e),n;if(r==="nunjucks")return Y(e,"renderString"),l.add(e),n;if(r==="express"){Ft(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return k("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Gn(){Qn=true,Tt();let t=Pt.channel("undici:request:create");t.subscribe(zn),M.push(()=>{t.unsubscribe(zn);});}function Jn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Zn=false,x={},_=[],Ht=1e3,rn=false;function Dt(t,n){if(!rn)return;rn=false;let e=_[_.length-1];if(!e||e.ruleId!==W[t])return;let r=ln(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);}function Bt(){return x.mode??"monitor"}function L(t,n){let e=Jn(x.virtualPatches??[],t,n)?"block":Bt(),r=an(e,n);return Dt(n,r),r}function Xn(){return x.egress?.allow}function H(t,n,e,r){return x.decide?x.decide(t,n,e):Cn(t,n,e,r)}function g(t){_.length>=Ht&&_.shift(),_.push(t),rn=true,x.onEvent?.(t);}function Nt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},bn(t.dnsPinTtlMs),On({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Zn||(Gn(),Zn=true));}function Yn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Nt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Yn();

package/dist/runtime/rasp.js

@@ -1,14 +1,14 @@
-import {AsyncLocalStorage}from'async_hooks';import xt from'dns';import Ht from'diagnostics_channel';import {createRequire}from'module';import {mkdirSync,writeFileSync,readFileSync,existsSync}from'fs';import {dirname,join}from'path';var ht=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),_n=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function F(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)F(r,n,e+1);return}for(let r of Object.values(t))F(r,n,e+1);}}function Q(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),F(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))ht.has(r.toLowerCase())||q(o,n,0);F(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function Y(t,n){return _n.run(t,n)}function m(){return _n.getStore()}function Tn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function J(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>J(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>J(t[o],n[o]))}function Z(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)Z(r,n,e+1);return}for(let r of Object.values(t))Z(r,n,e+1);}}function qn(t,n){let e=[];for(let i of n.objects)Z(i,e,0);let r=e.filter(Tn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),Tn(i)&&r.some(c=>c===i||J(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function G(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function gt(t,n){let e=G(t).replace(/\/+$/,""),r=G(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function yt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Fn(t){let n=G(t).split("/").filter(Boolean);return n[n.length-1]}function Hn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:yt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!gt(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Fn(n),o=Fn(t);if(r&&r===o)return  true}return  false}var mt=new Set(["__proto__","constructor","prototype"]);function X(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(mt.has(r))return  true;return Array.isArray(t)?t.some(r=>X(r,n+1,e)):Object.values(t).some(r=>X(r,n+1,e))}function Mn(t){let n=new Set;return t.objects.some(e=>X(e,0,n))}function kt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {AsyncLocalStorage}from'async_hooks';import It from'dns';import Kt from'diagnostics_channel';import {createRequire}from'module';import {mkdirSync,writeFileSync,readFileSync,existsSync}from'fs';import {dirname,join}from'path';var wt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),Fn=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function H(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)H(r,n,e+1);return}for(let r of Object.values(t))H(r,n,e+1);}}function J(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),H(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))wt.has(r.toLowerCase())||q(o,n,0);H(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function X(t,n){return Fn.run(t,n)}function m(){return Fn.getStore()}function Tn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function Z(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>Z(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>Z(t[o],n[o]))}function nn(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)nn(r,n,e+1);return}for(let r of Object.values(t))nn(r,n,e+1);}}function qn(t,n){let e=[];for(let i of n.objects)nn(i,e,0);let r=e.filter(Tn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),Tn(i)&&r.some(c=>c===i||Z(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function tn(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function St(t,n){let e=tn(t).replace(/\/+$/,""),r=tn(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function Rt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Hn(t){let n=tn(t).split("/").filter(Boolean);return n[n.length-1]}function Wn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:Rt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!St(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Hn(n),o=Hn(t);if(r&&r===o)return  true}return  false}var xt=new Set(["__proto__","constructor","prototype"]);function en(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(xt.has(r))return  true;return Array.isArray(t)?t.some(r=>en(r,n+1,e)):Object.values(t).some(r=>en(r,n+1,e))}function Dn(t){let n=new Set;return t.objects.some(e=>en(e,0,n))}function At(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let p=1;for(;e<r&&p>0;)t[e]===i?p+=1:t[e]===u&&(p-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Wn(t,n){if(!n)return  false;let e=kt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function bt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let p=1;for(;e<r&&p>0;)t[e]===i?p+=1:t[e]===u&&(p-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Bn(t,n){if(!n)return  false;let e=At(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function jt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function wt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function nn(t,n){if(!n)return  false;let e=bt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(wt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}var Dn=6e4,Rt=1e3,j=new Map,Un=Dn,St=()=>Date.now();function tn(t){Un=t!==void 0&&Number.isFinite(t)&&t>=0?t:Dn;}function Nn(){j.clear();}function Bn(t,n){for(j.delete(t),j.set(t,n);j.size>Rt;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function $n(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=St(),i=j.get(o);return !i||s-i.at>Un?(Bn(o,{addresses:new Set(n),at:s}),false):(Bn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}var en;function on(t){en=t;}function M(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function jt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Kn(t){let n=M(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(jt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],p=r[2];return o>255||c>255||p>65535?void 0:[o,c,p>>>8&255,p&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function At(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function Pt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function H(t){let n=M(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Kn(n);return e?At(e):n.includes(":")?Pt(n):false}function Et(t){let n=M(t);if(Kn(n)||n.includes(":"))return [n];if(en)return en(n);try{let e=xt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function Ct(t){try{return Et(t)}catch{return []}}function rn(t){if(H(t))return  true;let n=Ct(t);for(let e of n)if(H(e))return  true;return $n(t,n,H)}function sn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?rn(r)||rn(s):false}function O(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function W(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var un={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function vt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function It(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&nn(e,r))return  true;return  false}function Vn(t,n,e,r){if(t==="proto")return Mn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return qn(n,e)?true:It(n,e);for(let o of vt(n))for(let s of e.strings)if(s&&(t==="sql"&&nn(o,s)||t==="shell"&&Wn(o,s)||t==="path"&&Hn(o,s,r)||t==="ssrf"&&sn(o,s)))return  true;return  false}function B(t,n,e,r){return Vn(t,n,e,r)?{block:true,ruleId:un[t]}:{block:false}}function Lt(t){let n=t.kind,e=t.input;if(n==="proto"||e!==null&&typeof e=="object")return {path:"/",ip:"test",strings:[],objects:e!==null&&typeof e=="object"?[e]:[]};let r=typeof e=="string"||typeof e=="number"||typeof e=="boolean"?String(e):"";return {path:"/",ip:"test",strings:r?[r]:[],objects:[]}}function zn(t){let n={},e=0;for(let r of t){let o=typeof r.kind=="string"?r.kind:"unknown",s=Lt(r),i=o==="proto"?null:r.sink??r.input,u=typeof r.base=="string"?r.base:void 0,c=B(o,i,s,u).block,p=n[o]??{blocked:0,total:0};p.total+=1,c&&(p.blocked+=1,e+=1),n[o]=p;}return {blocked:e,total:t.length,byKind:n}}function Ot(t){let{blocked:n,total:e}=zn(t);return {blocked:n,total:e}}function cn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var D=new Map,U=new Map,_t={block:2,honey:5,anomaly:1},Qn=900*1e3,N=false,an=Qn;function Yn(t={}){N=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(an=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(D.get(t)??0)+_t[n];return D.set(t,r),N&&r>=10&&U.set(t,e+an),r}function Tt(t){return D.get(t)??0}function fn(){D.clear(),U.clear(),N=false,an=Qn;}function qt(t){return t>=10?"block":t>=5?"challenge":"log"}function ln(t,n=Date.now()){if(!N)return  false;let e=U.get(t);return e===void 0?false:n>=e?(U.delete(t),false):true}var dn=["/admin.php","/.git/config","/wp-login.php"],hn=new Set,Ft=6e4,pn=new Map;function Jn(t){for(let n of t)hn.add(n);}function Zn(){hn.clear(),pn.clear();}function gn(t){let n=t.split("?")[0]??t;return dn.includes(n)}function yn(t){if(!t)return  false;for(let n of hn)if(n&&t.includes(n))return  true;return  false}function mn(t,n=Date.now()){let e=pn.get(t);return e===void 0||n-e.start>Ft?(pn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function kn(){return function(n,e,r){let o=Q(n);try{let s=o.strings.some(c=>yn(c));if(gn(o.path)&&!s){let c=mn(o.ip);P(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),ln(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=$("proto",null,o);if(u.block&&u.ruleId&&(y({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),C(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}y({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}Y(o,()=>{r();});}}var R=createRequire(import.meta.url),E=[],l=new WeakSet,jn=false,Gn=false;function Wt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Bt(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function V(t,n,e){try{let r=m();if(r){let o=$(t,n,r,e);if(o.block&&o.ruleId&&(y({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Wt(n)}),P(r.ip,"block"),C(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=m();y({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return V(t,n,e),r()}function w(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,E.push(()=>{r[n]=o;});}function Dt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function f(t,n){w(t,n,e=>function(r,...o){return b("sql",Dt(r),void 0,()=>e.call(this,r,...o))});}function Xn(t,n){w(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function v(t,n,e){w(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function nt(t,n){w(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,Bt(s),()=>e.call(this,r,...o))});}function ot(t){let n=at();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!cn(e,n)){let r=m();if(y({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),C(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var tt=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function bn(t,n){w(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function wn(t,n){w(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Ut(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function et(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Ut);}function Rn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return W(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return W(n)}function Nt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function rt(t){try{let n=Nt(t);n&&V("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){w(t,n,r=>function(...o){let s=e(o);return ot(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var st=Symbol.for("fullshield.rasp.wrapSqlite"),Sn=Symbol.for("fullshield.rasp.sqliteWrapped"),z;function xn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function $t(t){let n=xn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=xn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(z)try{return xn(z("node:sqlite",void 0,!1))}catch{}}function Kt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function K(t){try{let n=$t(t);if(!n||n[Sn])return;Object.defineProperty(n,Sn,{value:!0,configurable:!0}),f(n,"exec"),f(n,"prepare"),E.push(()=>{delete n[Sn];});}catch{}}function Vt(){globalThis[st]=K;let t=R("node:child_process"),n=R("child_process");for(let a of new Set([t,n]))v(a,"exec",true),v(a,"execSync",true),v(a,"spawn",false),v(a,"spawnSync",false),v(a,"execFile",false),v(a,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let a of new Set([r,o]))for(let d of e)nt(a,d);try{let a=R("node:fs/promises");for(let d of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])nt(a,d);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",O),S(s,"get",O),S(i,"request",O),S(i,"get",O),typeof globalThis.fetch=="function"){let a=globalThis.fetch;globalThis.fetch=function(d,h){let g=W(d);return ot(g),(h?.redirect??"follow")!=="follow"?b("ssrf",g,void 0,()=>a.call(this,d,h)):(V("ssrf",g),(async()=>{let I=g,In=d;for(let Ln=0;Ln<8;Ln+=1){let L=await a.call(this,In,{...h,redirect:"manual"});if(L.status<300||L.status>=400)return L;let On=L.headers.get("location");if(!On)return L;I=new URL(On,I).href,V("ssrf",I),In=I;}return a.call(this,I,h)})())},E.push(()=>{globalThis.fetch=a;});}let u=R("node:vm");for(let a of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,a,d=>function(h,...g){return b("sql",typeof h=="string"?h:"",void 0,()=>d.call(this,h,...g))});let c=R("node:module");z=c._load.bind(c);let p=c._load;c._load=function(a,d,h){let g=p.call(this,a,d,h);try{return it(String(a),g)}catch{return y({ruleId:A,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),g}},E.push(()=>{c._load=p,z=void 0;});let vn=c.registerHooks;typeof vn=="function"&&!Gn&&(Gn=true,vn({load(a,d,h){let g=h(a,d);return jn&&typeof a=="string"&&(a==="node:sqlite"||a.startsWith("node:sqlite"))&&K(),g}})),Kt()&&K();}function zt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(kn()),o.__fullshieldRasp=!0);}catch{y({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function it(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return K(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&f(o.Client.prototype,"query"),o.Pool?.prototype&&f(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(f(s,"query"),f(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(f(o,"exec"),f(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(f(o,"$queryRawUnsafe"),f(o,"$executeRawUnsafe"),f(o,"$queryRaw"),f(o,"$executeRaw"));let s=n.Prisma;return s&&f(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&f(s,"query"),typeof o.literal=="function"&&f(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&f(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&f(e,"raw");let o=n.Client?.prototype;return o&&(f(o,"raw"),f(o,"whereRaw"),f(o,"orderByRaw"),f(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&f(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&f(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&f(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of tt)bn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of tt)bn(o,u);Xn(o,"$where");}let s=n.Model;s&&bn(s,"aggregate");let i=s?.prototype;return i&&Xn(i,"$where"),l.add(e),n}if(r==="axios")return et(e),w(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&et(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",Rn);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",Rn),o.Agent?.prototype&&S(o.Agent.prototype,"request",Rn),l.add(e),n}if(r==="ejs"||r==="pug")return wn(e,"render"),wn(e,"compile"),l.add(e),n;if(r==="nunjucks")return wn(e,"renderString"),l.add(e),n;if(r==="express"){zt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function ut(){jn=true,Vt();let t=Ht.channel("undici:request:create");t.subscribe(rt),E.push(()=>{t.unsubscribe(rt);});}function ct(){for(jn=false,delete globalThis[st];E.length>0;)E.pop()?.();}function ft(t){let n=t.toUpperCase();if(n.includes("SQLI")||n.includes("SQL-"))return "sql";if(n.includes("CMDI")||n.includes("SHELL"))return "shell";if(n.includes("PATH"))return "path";if(n.includes("NOSQL"))return "nosql";if(n.includes("SSRF"))return "ssrf";if(n.includes("PROTO"))return "proto"}function lt(t){if(typeof t.route=="string"&&t.route.startsWith("/"))return t.route;let n=(t.message??"").match(/\/[A-Za-z0-9._/-]+/);if(n)return n[0];if(t.file){let e=Math.max(t.file.lastIndexOf("/"),t.file.lastIndexOf("\\")),r=e>=0?t.file.slice(e+1):t.file,o=r.lastIndexOf("."),s=o>0?r.slice(0,o):r;if(s&&s!=="index")return `/${s}`}}function An(t){return t.map(n=>({ruleId:n.ruleId,file:n.file,line:n.line,sink:ft(n.ruleId),route:lt(n)}))}function Pn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var T=false,x={},_=[],Qt=1e3;function Yt(){return T}function Jt(){return x.mode??"monitor"}function C(t,n){return Pn(x.virtualPatches??[],t,n)?"block":Jt()}function at(){return x.egress?.allow}function $(t,n,e,r){return x.decide?x.decide(t,n,e):B(t,n,e,r)}function y(t){_.length>=Qt&&_.shift(),_.push(t),x.onEvent?.(t);}function Zt(){return _}function Gt(){_.length=0;}function pt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},tn(t.dnsPinTtlMs),Yn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),T||(ut(),T=true));}function Xt(){T&&(ct(),T=false,x={},on(void 0),Nn(),tn(void 0),Zn(),fn());}function ne(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&pt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}function se(t,n){let e=An(t);return mkdirSync(dirname(n),{recursive:true}),writeFileSync(n,`${JSON.stringify({patches:e},null,2)}
-`,"utf8"),e}function ie(t){let n=JSON.parse(readFileSync(t,"utf8"));return Array.isArray(n)?n:n.patches??[]}function fe(t,n){let e=join(t,".gitignore"),r=existsSync(e)?readFileSync(e,"utf8"):"",o=new Set(r.split(`
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function Et(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function rn(t,n){if(!n)return  false;let e=jt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(Et(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}var Un=6e4,Pt=1e3,A=new Map,$n=Un,Ct=()=>Date.now();function on(t){$n=t!==void 0&&Number.isFinite(t)&&t>=0?t:Un;}function Kn(){A.clear();}function Nn(t,n){for(A.delete(t),A.set(t,n);A.size>Pt;){let e=A.keys().next().value;if(e===void 0)break;A.delete(e);}}function Vn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Ct(),i=A.get(o);return !i||s-i.at>$n?(Nn(o,{addresses:new Set(n),at:s}),false):(Nn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}var sn;function cn(t){sn=t;}function D(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function vt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function zn(t){let n=D(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(vt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],p=r[2];return o>255||c>255||p>65535?void 0:[o,c,p>>>8&255,p&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Lt(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function Ot(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function W(t){let n=D(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=zn(n);return e?Lt(e):n.includes(":")?Ot(n):false}function _t(t){let n=D(t);if(zn(n)||n.includes(":"))return [n];if(sn)return sn(n);try{let e=It.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function Mt(t){try{return _t(t)}catch{return []}}function un(t){if(W(t))return  true;let n=Mt(t);for(let e of n)if(W(e))return  true;return Vn(t,n,W)}function an(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?un(r)||un(s):false}function _(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function B(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var M={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},j="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function Ft(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function Tt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&rn(e,r))return  true;return  false}function Qn(t,n,e,r){if(t==="proto")return Dn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return qn(n,e)?true:Tt(n,e);for(let o of Ft(n))for(let s of e.strings)if(s&&(t==="sql"&&rn(o,s)||t==="shell"&&Bn(o,s)||t==="path"&&Wn(o,s,r)||t==="ssrf"&&an(o,s)))return  true;return  false}function N(t,n,e,r){return Qn(t,n,e,r)?{block:true,ruleId:M[t]}:{block:false}}function qt(t){let n=t.kind,e=t.input;if(n==="proto"||e!==null&&typeof e=="object")return {path:"/",ip:"test",strings:[],objects:e!==null&&typeof e=="object"?[e]:[]};let r=typeof e=="string"||typeof e=="number"||typeof e=="boolean"?String(e):"";return {path:"/",ip:"test",strings:r?[r]:[],objects:[]}}function Gn(t){let n={},e=0;for(let r of t){let o=typeof r.kind=="string"?r.kind:"unknown",s=qt(r),i=o==="proto"?null:r.sink??r.input,u=typeof r.base=="string"?r.base:void 0,c=N(o,i,s,u).block,p=n[o]??{blocked:0,total:0};p.total+=1,c&&(p.blocked+=1,e+=1),n[o]=p;}return {blocked:e,total:t.length,byKind:n}}function Ht(t){let{blocked:n,total:e}=Gn(t);return {blocked:n,total:e}}var Wt="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var Dt=new Set(["sql","shell"]),F=[];function Yn(){return process.env[Wt]==="1"}function Jn(t,n){return Yn()?t!=="block"?"monitor":Dt.has(n)?"block":"monitor":t}function Xn(){F=[];}function Zn(t,n,e,r){if(Yn()&&(F=F.filter(o=>r-o<6e4),!(F.length>=5)))return F.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}function fn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var U=new Map,$=new Map,Bt={block:2,honey:5,anomaly:1},nt=900*1e3,K=false,ln=nt;function tt(t={}){K=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(ln=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=(U.get(t)??0)+Bt[n];return U.set(t,r),K&&r>=10&&$.set(t,e+ln),r}function Nt(t){return U.get(t)??0}function pn(){U.clear(),$.clear(),K=false,ln=nt;}function Ut(t){return t>=10?"block":t>=5?"challenge":"log"}function dn(t,n=Date.now()){if(!K)return  false;let e=$.get(t);return e===void 0?false:n>=e?($.delete(t),false):true}var gn=["/admin.php","/.git/config","/wp-login.php"],yn=new Set,$t=6e4,hn=new Map;function et(t){for(let n of t)yn.add(n);}function rt(){yn.clear(),hn.clear();}function mn(t){let n=t.split("?")[0]??t;return gn.includes(n)}function kn(t){if(!t)return  false;for(let n of yn)if(n&&t.includes(n))return  true;return  false}function bn(t,n=Date.now()){let e=hn.get(t);return e===void 0||n-e.start>$t?(hn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function wn(){return function(n,e,r){let o=J(n);try{let s=o.strings.some(c=>kn(c));if(mn(o.path)&&!s){let c=bn(o.ip);E(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),dn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=V("proto",null,o);if(u.block&&u.ruleId&&(y({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),I(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}y({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}X(o,()=>{r();});}}var S=createRequire(import.meta.url),P=[],l=new WeakSet,En=false,ot=false;function zt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Qt(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function Q(t,n,e){try{let r=m();if(r){let o=V(t,n,r,e);if(o.block&&o.ruleId&&(y({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:zt(n)}),E(r.ip,"block"),I(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=m();y({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return Q(t,n,e),r()}function w(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,P.push(()=>{r[n]=o;});}function Gt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function f(t,n){w(t,n,e=>function(r,...o){return b("sql",Gt(r),void 0,()=>e.call(this,r,...o))});}function st(t,n){w(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function v(t,n,e){w(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function it(t,n){w(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,Qt(s),()=>e.call(this,r,...o))});}function ft(t){let n=gt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!fn(e,n)){let r=m();if(y({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),I(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var ut=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Sn(t,n){w(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function Rn(t,n){w(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Yt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function ct(t){for(let n of ["request","get","post","put","patch","delete","head","options"])R(t,n,Yt);}function xn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return B(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return B(n)}function Jt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function at(t){try{let n=Jt(t);n&&Q("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function R(t,n,e){w(t,n,r=>function(...o){let s=e(o);return ft(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var lt=Symbol.for("fullshield.rasp.wrapSqlite"),An=Symbol.for("fullshield.rasp.sqliteWrapped"),G;function jn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Xt(t){let n=jn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=jn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(G)try{return jn(G("node:sqlite",void 0,!1))}catch{}}function Zt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function z(t){try{let n=Xt(t);if(!n||n[An])return;Object.defineProperty(n,An,{value:!0,configurable:!0}),f(n,"exec"),f(n,"prepare"),P.push(()=>{delete n[An];});}catch{}}function ne(){globalThis[lt]=z;let t=S("node:child_process"),n=S("child_process");for(let a of new Set([t,n]))v(a,"exec",true),v(a,"execSync",true),v(a,"spawn",false),v(a,"spawnSync",false),v(a,"execFile",false),v(a,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=S("node:fs"),o=S("fs");for(let a of new Set([r,o]))for(let d of e)it(a,d);try{let a=S("node:fs/promises");for(let d of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])it(a,d);}catch{}let s=S("node:http"),i=S("node:https");if(R(s,"request",_),R(s,"get",_),R(i,"request",_),R(i,"get",_),typeof globalThis.fetch=="function"){let a=globalThis.fetch;globalThis.fetch=function(d,h){let g=B(d);return ft(g),(h?.redirect??"follow")!=="follow"?b("ssrf",g,void 0,()=>a.call(this,d,h)):(Q("ssrf",g),(async()=>{let L=g,On=d;for(let _n=0;_n<8;_n+=1){let O=await a.call(this,On,{...h,redirect:"manual"});if(O.status<300||O.status>=400)return O;let Mn=O.headers.get("location");if(!Mn)return O;L=new URL(Mn,L).href,Q("ssrf",L),On=L;}return a.call(this,L,h)})())},P.push(()=>{globalThis.fetch=a;});}let u=S("node:vm");for(let a of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,a,d=>function(h,...g){return b("sql",typeof h=="string"?h:"",void 0,()=>d.call(this,h,...g))});let c=S("node:module");G=c._load.bind(c);let p=c._load;c._load=function(a,d,h){let g=p.call(this,a,d,h);try{return pt(String(a),g)}catch{return y({ruleId:j,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),g}},P.push(()=>{c._load=p,G=void 0;});let Ln=c.registerHooks;typeof Ln=="function"&&!ot&&(ot=true,Ln({load(a,d,h){let g=h(a,d);return En&&typeof a=="string"&&(a==="node:sqlite"||a.startsWith("node:sqlite"))&&z(),g}})),Zt()&&z();}function te(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(wn()),o.__fullshieldRasp=!0);}catch{y({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function pt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return z(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&f(o.Client.prototype,"query"),o.Pool?.prototype&&f(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(f(s,"query"),f(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(f(o,"exec"),f(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(f(o,"$queryRawUnsafe"),f(o,"$executeRawUnsafe"),f(o,"$queryRaw"),f(o,"$executeRaw"));let s=n.Prisma;return s&&f(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&f(s,"query"),typeof o.literal=="function"&&f(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&f(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&f(e,"raw");let o=n.Client?.prototype;return o&&(f(o,"raw"),f(o,"whereRaw"),f(o,"orderByRaw"),f(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&f(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&f(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&f(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of ut)Sn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of ut)Sn(o,u);st(o,"$where");}let s=n.Model;s&&Sn(s,"aggregate");let i=s?.prototype;return i&&st(i,"$where"),l.add(e),n}if(r==="axios")return ct(e),w(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&ct(i),i}),l.add(e),n;if(r==="undici"){R(e,"request",xn);let o=n;return o.Dispatcher?.prototype&&R(o.Dispatcher.prototype,"request",xn),o.Agent?.prototype&&R(o.Agent.prototype,"request",xn),l.add(e),n}if(r==="ejs"||r==="pug")return Rn(e,"render"),Rn(e,"compile"),l.add(e),n;if(r==="nunjucks")return Rn(e,"renderString"),l.add(e),n;if(r==="express"){te(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function dt(){En=true,ne();let t=Kt.channel("undici:request:create");t.subscribe(at),P.push(()=>{t.unsubscribe(at);});}function ht(){for(En=false,delete globalThis[lt];P.length>0;)P.pop()?.();}function yt(t){let n=t.toUpperCase();if(n.includes("SQLI")||n.includes("SQL-"))return "sql";if(n.includes("CMDI")||n.includes("SHELL"))return "shell";if(n.includes("PATH"))return "path";if(n.includes("NOSQL"))return "nosql";if(n.includes("SSRF"))return "ssrf";if(n.includes("PROTO"))return "proto"}function mt(t){if(typeof t.route=="string"&&t.route.startsWith("/"))return t.route;let n=(t.message??"").match(/\/[A-Za-z0-9._/-]+/);if(n)return n[0];if(t.file){let e=Math.max(t.file.lastIndexOf("/"),t.file.lastIndexOf("\\")),r=e>=0?t.file.slice(e+1):t.file,o=r.lastIndexOf("."),s=o>0?r.slice(0,o):r;if(s&&s!=="index")return `/${s}`}}function Pn(t){return t.map(n=>({ruleId:n.ruleId,file:n.file,line:n.line,sink:yt(n.ruleId),route:mt(n)}))}function Cn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var T=false,x={},C=[],ee=1e3,Y=false;function re(t,n){if(!Y)return;Y=false;let e=C[C.length-1];if(!e||e.ruleId!==M[t])return;let r=Zn(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);}function oe(){return T}function se(){return x.mode??"monitor"}function I(t,n){let e=Cn(x.virtualPatches??[],t,n)?"block":se(),r=Jn(e,n);return re(n,r),r}function gt(){return x.egress?.allow}function V(t,n,e,r){return x.decide?x.decide(t,n,e):N(t,n,e,r)}function y(t){C.length>=ee&&C.shift(),C.push(t),Y=true,x.onEvent?.(t);}function ie(){return C}function ue(){C.length=0,Y=false,Xn();}function kt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},on(t.dnsPinTtlMs),tt({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),T||(dt(),T=true));}function ce(){T&&(ht(),T=false,x={},cn(void 0),Kn(),on(void 0),rt(),pn());}function ae(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&kt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}function he(t,n){let e=Pn(t);return mkdirSync(dirname(n),{recursive:true}),writeFileSync(n,`${JSON.stringify({patches:e},null,2)}
+`,"utf8"),e}function ge(t){let n=JSON.parse(readFileSync(t,"utf8"));return Array.isArray(n)?n:n.patches??[]}function be(t,n){let e=join(t,".gitignore"),r=existsSync(e)?readFileSync(e,"utf8"):"",o=new Set(r.split(`
 `).map(s=>s.trim()));for(let s of n)o.has(s)||(r.length>0&&!r.endsWith(`
 `)&&(r+=`
 `),r+=`${s}
-`,o.add(s));writeFileSync(e,r,"utf8");}function le(t){let n="FULLSHIELD-HONEY-CANARY-NOT-A-CLOUD-KEY",e="fullshield-honey-db-canary://local";return mkdirSync(t,{recursive:true}),writeFileSync(join(t,".env.backup"),`# fullshield honeytoken decoy \u2014 not real credentials
+`,o.add(s));writeFileSync(e,r,"utf8");}function we(t){let n="FULLSHIELD-HONEY-CANARY-NOT-A-CLOUD-KEY",e="fullshield-honey-db-canary://local";return mkdirSync(t,{recursive:true}),writeFileSync(join(t,".env.backup"),`# fullshield honeytoken decoy \u2014 not real credentials
 AWS_ACCESS_KEY_ID=${n}
 DATABASE_URL=${e}
-`,"utf8"),writeFileSync(join(t,".fullshield-honey.json"),`${JSON.stringify({decoys:dn,canaries:{awsKey:n,dbUrl:e}},null,2)}
-`,"utf8"),fe(t,[".env.backup",".fullshield-honey.json"]),Jn([n,e]),{awsKey:n,dbUrl:e}}export{A as RASP_FAIL_OPEN,un as RASP_RULE,k as RaspBlockedError,P as addThreat,Gt as clearRaspEvents,fn as clearThreats,Q as contextFromRequest,m as currentRaspContext,qt as decideResponse,B as decideSink,Vn as detectStructureChange,Xt as disableRasp,cn as egressAllowed,se as emitVirtualPatches,pt as enableRasp,ne as enableRaspFromEnv,Y as enterRaspContext,An as findingsToVpatches,Zt as getRaspEvents,le as honeyInit,rn as hostIsBlocked,yn as isHoneyCanary,gn as isHoneyRoute,ln as isIpBlocked,H as isPrivateOrMetadata,Yt as isRaspEnabled,ie as loadVirtualPatches,M as normalizeHost,mn as noteHoneyRouteHit,Pn as patchForcesBlock,kn as raspContext,C as raspModeFor,lt as routeFromFinding,Ot as scoreCorpus,zn as scoreCorpusByKind,on as setSsrfLookup,ft as sinkFromRule,sn as ssrfHostFromUser,Tt as threatScore,it as wrapKnownPackage};
+`,"utf8"),writeFileSync(join(t,".fullshield-honey.json"),`${JSON.stringify({decoys:gn,canaries:{awsKey:n,dbUrl:e}},null,2)}
+`,"utf8"),be(t,[".env.backup",".fullshield-honey.json"]),et([n,e]),{awsKey:n,dbUrl:e}}export{j as RASP_FAIL_OPEN,M as RASP_RULE,k as RaspBlockedError,E as addThreat,ue as clearRaspEvents,pn as clearThreats,J as contextFromRequest,m as currentRaspContext,Ut as decideResponse,N as decideSink,Qn as detectStructureChange,ce as disableRasp,fn as egressAllowed,he as emitVirtualPatches,kt as enableRasp,ae as enableRaspFromEnv,X as enterRaspContext,Pn as findingsToVpatches,ie as getRaspEvents,we as honeyInit,un as hostIsBlocked,kn as isHoneyCanary,mn as isHoneyRoute,dn as isIpBlocked,W as isPrivateOrMetadata,oe as isRaspEnabled,ge as loadVirtualPatches,D as normalizeHost,bn as noteHoneyRouteHit,Cn as patchForcesBlock,wn as raspContext,I as raspModeFor,mt as routeFromFinding,Ht as scoreCorpus,Gn as scoreCorpusByKind,cn as setSsrfLookup,yt as sinkFromRule,an as ssrfHostFromUser,Nt as threatScore,pt as wrapKnownPackage};

package/dist/runtime/register.js

@@ -1,6 +1,6 @@
-import {createRequire,register}from'module';import {AsyncLocalStorage}from'async_hooks';import st from'dns';import bt from'diagnostics_channel';var Xn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),cn=new AsyncLocalStorage;function O(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)O(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))O(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function B(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])O(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))Xn.has(r.toLowerCase())||O(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function D(t,n){return cn.run(t,n)}function w(){return cn.getStore()}var an=6e4,Yn=1e3,j=new Map,ln=an,Gn=()=>Date.now();function pn(t){ln=t!==void 0&&Number.isFinite(t)&&t>=0?t:an;}function fn(t,n){for(j.delete(t),j.set(t,n);j.size>Yn;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function dn(t,n,e){let r=w();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Gn(),i=j.get(o);return !i||s-i.at>ln?(fn(o,{addresses:new Set(n),at:s}),false):(fn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function hn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function U(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>U(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>U(t[o],n[o]))}function $(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)$(r,n,e+1);return}for(let r of Object.values(t))$(r,n,e+1);}}function gn(t,n){let e=[];for(let i of n.objects)$(i,e,0);let r=e.filter(hn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),hn(i)&&r.some(c=>c===i||U(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function N(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function Jn(t,n){let e=N(t).replace(/\/+$/,""),r=N(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function nt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function yn(t){let n=N(t).split("/").filter(Boolean);return n[n.length-1]}function kn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:nt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!Jn(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=yn(n),o=yn(t);if(r&&r===o)return  true}return  false}var tt=new Set(["__proto__","constructor","prototype"]);function K(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(tt.has(r))return  true;return Array.isArray(t)?t.some(r=>K(r,n+1,e)):Object.values(t).some(r=>K(r,n+1,e))}function mn(t){let n=new Set;return t.objects.some(e=>K(e,0,n))}function et(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {createRequire,register}from'module';import {AsyncLocalStorage}from'async_hooks';import pt from'dns';import Et from'diagnostics_channel';var nt="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var tt=new Set(["sql","shell"]),O=[];function ln(){return process.env[nt]==="1"}function pn(t,n){return ln()?t!=="block"?"monitor":tt.has(n)?"block":"monitor":t}function dn(t,n,e,r){if(ln()&&(O=O.filter(o=>r-o<6e4),!(O.length>=5)))return O.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var rt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),hn=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function U(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))rt.has(r.toLowerCase())||q(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function $(t,n){return hn.run(t,n)}function w(){return hn.getStore()}var yn=6e4,ot=1e3,j=new Map,kn=yn,st=()=>Date.now();function bn(t){kn=t!==void 0&&Number.isFinite(t)&&t>=0?t:yn;}function gn(t,n){for(j.delete(t),j.set(t,n);j.size>ot;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function mn(t,n,e){let r=w();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=st(),i=j.get(o);return !i||s-i.at>kn?(gn(o,{addresses:new Set(n),at:s}),false):(gn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function wn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function K(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>K(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>K(t[o],n[o]))}function z(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)z(r,n,e+1);return}for(let r of Object.values(t))z(r,n,e+1);}}function Rn(t,n){let e=[];for(let i of n.objects)z(i,e,0);let r=e.filter(wn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),wn(i)&&r.some(c=>c===i||K(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function Q(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function it(t,n){let e=Q(t).replace(/\/+$/,""),r=Q(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function ut(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Sn(t){let n=Q(t).split("/").filter(Boolean);return n[n.length-1]}function xn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:ut(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!it(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Sn(n),o=Sn(t);if(r&&r===o)return  true}return  false}var ct=new Set(["__proto__","constructor","prototype"]);function V(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(ct.has(r))return  true;return Array.isArray(t)?t.some(r=>V(r,n+1,e)):Object.values(t).some(r=>V(r,n+1,e))}function jn(t){let n=new Set;return t.objects.some(e=>V(e,0,n))}function ft(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function bn(t,n){if(!n)return  false;let e=et(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function rt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function An(t,n){if(!n)return  false;let e=ft(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function at(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function ot(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function z(t,n){if(!n)return  false;let e=rt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(ot(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function V(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function it(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Sn(t){let n=V(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(it);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ut(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function ct(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function Q(t){let n=V(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Sn(n);return e?ut(e):n.includes(":")?ct(n):false}function ft(t){let n=V(t);if(Sn(n)||n.includes(":"))return [n];try{let e=st.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function at(t){try{return ft(t)}catch{return []}}function Rn(t){if(Q(t))return  true;let n=at(t);for(let e of n)if(Q(e))return  true;return dn(t,n,Q)}function xn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Rn(r)||Rn(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function _(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var jn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function lt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&z(e,r))return  true;return  false}function dt(t,n,e,r){if(t==="proto")return mn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return gn(n,e)?true:pt(n,e);for(let o of lt(n))for(let s of e.strings)if(s&&(t==="sql"&&z(o,s)||t==="shell"&&bn(o,s)||t==="path"&&kn(o,s,r)||t==="ssrf"&&xn(o,s)))return  true;return  false}function An(t,n,e,r){return dt(t,n,e,r)?{block:true,ruleId:jn[t]}:{block:false}}function Pn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var En=new Map,Z=new Map,ht={block:2,honey:5,anomaly:1},gt=900*1e3,X=false,Cn=gt;function In(t={}){X=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(Cn=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(En.get(t)??0)+ht[n];return En.set(t,r),X&&r>=10&&Z.set(t,e+Cn),r}function vn(t,n=Date.now()){if(!X)return  false;let e=Z.get(t);return e===void 0?false:n>=e?(Z.delete(t),false):true}var yt=["/admin.php","/.git/config","/wp-login.php"],kt=new Set,mt=6e4,Ln=new Map;function qn(t){let n=t.split("?")[0]??t;return yt.includes(n)}function On(t){if(!t)return  false;for(let n of kt)if(n&&t.includes(n))return  true;return  false}function Tn(t,n=Date.now()){let e=Ln.get(t);return e===void 0||n-e.start>mt?(Ln.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function _n(){return function(n,e,r){let o=B(n);try{let s=o.strings.some(c=>On(c));if(qn(o.path)&&!s){let c=Tn(o.ip);P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),vn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=M("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}D(o,()=>{r();});}}var R=createRequire(import.meta.url),q=[],l=new WeakSet,Un=false,Mn=false;function Rt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function St(t){let n=w();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function H(t,n,e){try{let r=w();if(r){let o=M(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Rt(n)}),P(r.ip,"block"),L(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=w();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function m(t,n,e,r){return H(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,q.push(()=>{r[n]=o;});}function xt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return m("sql",xt(r),void 0,()=>e.call(this,r,...o))});}function Fn(t,n){b(t,n,e=>function(r,...o){return m("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return m("shell",u,void 0,()=>r.call(this,...o))});}function Hn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return m("path",s,St(s),()=>e.call(this,r,...o))});}function $n(t){let n=Kn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Pn(e,n)){let r=w();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var Wn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Y(t,n){b(t,n,e=>function(r,...o){return m("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function G(t,n){b(t,n,e=>function(r,...o){return m("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function jt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Bn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,jt);}function J(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return _(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return _(n)}function At(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Dn(t){try{let n=At(t);n&&H("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return $n(s),m("ssrf",s,void 0,()=>r.call(this,...o))});}var Pt=Symbol.for("fullshield.rasp.wrapSqlite"),nn=Symbol.for("fullshield.rasp.sqliteWrapped"),W;function tn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Et(t){let n=tn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=tn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(W)try{return tn(W("node:sqlite",void 0,!1))}catch{}}function Ct(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function F(t){try{let n=Et(t);if(!n||n[nn])return;Object.defineProperty(n,nn,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),q.push(()=>{delete n[nn];});}catch{}}function It(){globalThis[Pt]=F;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Hn(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Hn(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",v),S(s,"get",v),S(i,"request",v),S(i,"get",v),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=_(p);return $n(h),(d?.redirect??"follow")!=="follow"?m("ssrf",h,void 0,()=>f.call(this,p,d)):(H("ssrf",h),(async()=>{let C=h,on=p;for(let sn=0;sn<8;sn+=1){let I=await f.call(this,on,{...d,redirect:"manual"});if(I.status<300||I.status>=400)return I;let un=I.headers.get("location");if(!un)return I;C=new URL(un,C).href,H("ssrf",C),on=C;}return f.call(this,C,d)})())},q.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return m("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");W=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Lt(String(f),h)}catch{return g({ruleId:A,path:w()?.path??"/",ip:w()?.ip??"unknown",sample:"hook-error"}),h}},q.push(()=>{c._load=y,W=void 0;});let rn=c.registerHooks;typeof rn=="function"&&!Mn&&(Mn=true,rn({load(f,p,d){let h=d(f,p);return Un&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&F(),h}})),Ct()&&F();}function vt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(_n()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Lt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return F(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Wn)Y(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Wn)Y(o,u);Fn(o,"$where");}let s=n.Model;s&&Y(s,"aggregate");let i=s?.prototype;return i&&Fn(i,"$where"),l.add(e),n}if(r==="axios")return Bn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Bn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",J);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",J),o.Agent?.prototype&&S(o.Agent.prototype,"request",J),l.add(e),n}if(r==="ejs"||r==="pug")return G(e,"render"),G(e,"compile"),l.add(e),n;if(r==="nunjucks")return G(e,"renderString"),l.add(e),n;if(r==="express"){vt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return m("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Nn(){Un=true,It();let t=bt.channel("undici:request:create");t.subscribe(Dn),q.push(()=>{t.unsubscribe(Dn);});}function zn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Qn=false,x={};function Ot(){return x.mode??"monitor"}function L(t,n){return zn(x.virtualPatches??[],t,n)?"block":Ot()}function Kn(){return x.egress?.allow}function M(t,n,e,r){return x.decide?x.decide(t,n,e):An(t,n,e,r)}function g(t){x.onEvent?.(t);}function Tt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},pn(t.dnsPinTtlMs),In({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Qn||(Nn(),Qn=true));}function Vn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Tt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Vn();try{register("./rasp/loader.js",import.meta.url);}catch{}
-export{k as RaspBlockedError,B as contextFromRequest,D as enterRaspContext};
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function lt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function G(t,n){if(!n)return  false;let e=at(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(lt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function J(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function dt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function In(t){let n=J(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(dt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ht(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function gt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function X(t){let n=J(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=In(n);return e?ht(e):n.includes(":")?gt(n):false}function yt(t){let n=J(t);if(In(n)||n.includes(":"))return [n];try{let e=pt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function kt(t){try{return yt(t)}catch{return []}}function Pn(t){if(X(t))return  true;let n=kt(t);for(let e of n)if(X(e))return  true;return mn(t,n,X)}function Cn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Pn(r)||Pn(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function F(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var W={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function bt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function mt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&G(e,r))return  true;return  false}function wt(t,n,e,r){if(t==="proto")return jn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return Rn(n,e)?true:mt(n,e);for(let o of bt(n))for(let s of e.strings)if(s&&(t==="sql"&&G(o,s)||t==="shell"&&An(o,s)||t==="path"&&xn(o,s,r)||t==="ssrf"&&Cn(o,s)))return  true;return  false}function vn(t,n,e,r){return wt(t,n,e,r)?{block:true,ruleId:W[t]}:{block:false}}function Ln(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var Mn=new Map,Z=new Map,Rt={block:2,honey:5,anomaly:1},St=900*1e3,Y=false,_n=St;function On(t={}){Y=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(_n=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=(Mn.get(t)??0)+Rt[n];return Mn.set(t,r),Y&&r>=10&&Z.set(t,e+_n),r}function qn(t,n=Date.now()){if(!Y)return  false;let e=Z.get(t);return e===void 0?false:n>=e?(Z.delete(t),false):true}var xt=["/admin.php","/.git/config","/wp-login.php"],jt=new Set,At=6e4,Tn=new Map;function Fn(t){let n=t.split("?")[0]??t;return xt.includes(n)}function Wn(t){if(!t)return  false;for(let n of jt)if(n&&t.includes(n))return  true;return  false}function Hn(t,n=Date.now()){let e=Tn.get(t);return e===void 0||n-e.start>At?(Tn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Dn(){return function(n,e,r){let o=U(n);try{let s=o.strings.some(c=>Wn(c));if(Fn(o.path)&&!s){let c=Hn(o.ip);E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),qn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=H("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}$(o,()=>{r();});}}var R=createRequire(import.meta.url),M=[],l=new WeakSet,Qn=false,Bn=false;function It(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Ct(t){let n=w();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function B(t,n,e){try{let r=w();if(r){let o=H(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:It(n)}),E(r.ip,"block"),L(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=w();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return B(t,n,e),r()}function m(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,M.push(()=>{r[n]=o;});}function vt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){m(t,n,e=>function(r,...o){return b("sql",vt(r),void 0,()=>e.call(this,r,...o))});}function Nn(t,n){m(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function P(t,n,e){m(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function Un(t,n){m(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,Ct(s),()=>e.call(this,r,...o))});}function Vn(t){let n=Xn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Ln(e,n)){let r=w();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var $n=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function nn(t,n){m(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function tn(t,n){m(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Lt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Kn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Lt);}function en(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return F(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return F(n)}function Mt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function zn(t){try{let n=Mt(t);n&&B("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){m(t,n,r=>function(...o){let s=e(o);return Vn(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var _t=Symbol.for("fullshield.rasp.wrapSqlite"),rn=Symbol.for("fullshield.rasp.sqliteWrapped"),N;function on(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Ot(t){let n=on(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=on(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(N)try{return on(N("node:sqlite",void 0,!1))}catch{}}function qt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function D(t){try{let n=Ot(t);if(!n||n[rn])return;Object.defineProperty(n,rn,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),M.push(()=>{delete n[rn];});}catch{}}function Tt(){globalThis[_t]=D;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))P(f,"exec",true),P(f,"execSync",true),P(f,"spawn",false),P(f,"spawnSync",false),P(f,"execFile",false),P(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Un(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Un(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",v),S(s,"get",v),S(i,"request",v),S(i,"get",v),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=F(p);return Vn(h),(d?.redirect??"follow")!=="follow"?b("ssrf",h,void 0,()=>f.call(this,p,d)):(B("ssrf",h),(async()=>{let I=h,cn=p;for(let fn=0;fn<8;fn+=1){let C=await f.call(this,cn,{...d,redirect:"manual"});if(C.status<300||C.status>=400)return C;let an=C.headers.get("location");if(!an)return C;I=new URL(an,I).href,B("ssrf",I),cn=I;}return f.call(this,I,d)})())},M.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])m(u,f,p=>function(d,...h){return b("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");N=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Wt(String(f),h)}catch{return g({ruleId:A,path:w()?.path??"/",ip:w()?.ip??"unknown",sample:"hook-error"}),h}},M.push(()=>{c._load=y,N=void 0;});let un=c.registerHooks;typeof un=="function"&&!Bn&&(Bn=true,un({load(f,p,d){let h=d(f,p);return Qn&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&D(),h}})),qt()&&D();}function Ft(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Dn()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Wt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return D(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of $n)nn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of $n)nn(o,u);Nn(o,"$where");}let s=n.Model;s&&nn(s,"aggregate");let i=s?.prototype;return i&&Nn(i,"$where"),l.add(e),n}if(r==="axios")return Kn(e),m(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Kn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",en);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",en),o.Agent?.prototype&&S(o.Agent.prototype,"request",en),l.add(e),n}if(r==="ejs"||r==="pug")return tn(e,"render"),tn(e,"compile"),l.add(e),n;if(r==="nunjucks")return tn(e,"renderString"),l.add(e),n;if(r==="express"){Ft(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&m(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Gn(){Qn=true,Tt();let t=Et.channel("undici:request:create");t.subscribe(zn),M.push(()=>{t.unsubscribe(zn);});}function Jn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Zn=false,x={},_=[],Ht=1e3,sn=false;function Dt(t,n){if(!sn)return;sn=false;let e=_[_.length-1];if(!e||e.ruleId!==W[t])return;let r=dn(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);}function Bt(){return x.mode??"monitor"}function L(t,n){let e=Jn(x.virtualPatches??[],t,n)?"block":Bt(),r=pn(e,n);return Dt(n,r),r}function Xn(){return x.egress?.allow}function H(t,n,e,r){return x.decide?x.decide(t,n,e):vn(t,n,e,r)}function g(t){_.length>=Ht&&_.shift(),_.push(t),sn=true,x.onEvent?.(t);}function Nt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},bn(t.dnsPinTtlMs),On({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Zn||(Gn(),Zn=true));}function Yn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Nt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Yn();try{register("./rasp/loader.js",import.meta.url);}catch{}
+export{k as RaspBlockedError,U as contextFromRequest,$ as enterRaspContext};

package/models/index.json

@@ -1,5 +1,5 @@
 {
-  "fullshieldVersion": "3.2.2",
+  "fullshieldVersion": "3.3.1",
   "entries": [
     {
       "package": "express",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "3.2.2",
+  "version": "3.3.1",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",

package/templates/action/action.yml

@@ -45,7 +45,7 @@ runs:
       uses: actions/setup-node@v7
       with:
         node-version: '22'
-    - name: Install fullshield@3.2.2
+    - name: Install fullshield@3.3.1
       shell: bash
       run: npm install --global fullshield@${{ inputs.version }}
     - name: Cache FullShield baseline

package/templates/fullshield-bumps.yml

@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
-      - run: npx fullshield@3.2.2 bumps plan --from .fullshield/last-scan.json
+      - run: npx fullshield@3.3.1 bumps plan --from .fullshield/last-scan.json
         env:
           FULLSHIELD_EXPERIMENTAL_BUMP_PR: '1'
-      - run: npx fullshield@3.2.2 bumps open --from .fullshield/last-scan.json
+      - run: npx fullshield@3.3.1 bumps open --from .fullshield/last-scan.json
         env:
           FULLSHIELD_EXPERIMENTAL_BUMP_PR: '1'

package/templates/github-workflow-action.yml

@@ -15,7 +15,7 @@ jobs:
       # Example Marketplace ref once published: kathanp/fullshield-action@<sha>
       - uses: ./templates/action
         with:
-          version: '3.2.2'
+          version: '3.3.1'
           fail-on: high
           cache-baseline: 'true'
           upload-sarif: 'true'

package/templates/github-workflow-diff.yml

@@ -10,6 +10,6 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - run: npx fullshield@3.2.2 scan --diff
+      - run: npx fullshield@3.3.1 scan --diff
         env:
           FULLSHIELD_EXPERIMENTAL_DIFFSCAN: '1'