fullshield 3.2.2 → 3.3.2

package/dist/runtime/auto.js

@@ -1,5 +1,6 @@
-import {AsyncLocalStorage}from'async_hooks';import st from'dns';import mt from'diagnostics_channel';import {createRequire}from'module';var Xn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),sn=new AsyncLocalStorage;function O(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)O(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))O(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function un(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])O(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))Xn.has(r.toLowerCase())||O(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function cn(t,n){return sn.run(t,n)}function m(){return sn.getStore()}var an=6e4,Yn=1e3,j=new Map,ln=an,Gn=()=>Date.now();function pn(t){ln=t!==void 0&&Number.isFinite(t)&&t>=0?t:an;}function fn(t,n){for(j.delete(t),j.set(t,n);j.size>Yn;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function dn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Gn(),i=j.get(o);return !i||s-i.at>ln?(fn(o,{addresses:new Set(n),at:s}),false):(fn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function hn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function B(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>B(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>B(t[o],n[o]))}function D(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)D(r,n,e+1);return}for(let r of Object.values(t))D(r,n,e+1);}}function gn(t,n){let e=[];for(let i of n.objects)D(i,e,0);let r=e.filter(hn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),hn(i)&&r.some(c=>c===i||B(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function U(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function Jn(t,n){let e=U(t).replace(/\/+$/,""),r=U(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function nt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function yn(t){let n=U(t).split("/").filter(Boolean);return n[n.length-1]}function kn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:nt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!Jn(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=yn(n),o=yn(t);if(r&&r===o)return  true}return  false}var tt=new Set(["__proto__","constructor","prototype"]);function $(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(tt.has(r))return  true;return Array.isArray(t)?t.some(r=>$(r,n+1,e)):Object.values(t).some(r=>$(r,n+1,e))}function bn(t){let n=new Set;return t.objects.some(e=>$(e,0,n))}function et(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {AsyncLocalStorage}from'async_hooks';import wt from'dns';import qt from'diagnostics_channel';import {createRequire}from'module';var st="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var it=new Set(["sql","shell"]),q=[];function an(){return process.env[st]==="1"}function ln(t,n){return an()?t!=="block"?"monitor":it.has(n)?"block":"monitor":t}function pn(t,n,e,r){if(an()&&(q=q.filter(o=>r-o<6e4),!(q.length>=5)))return q.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var ut="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";function O(){return process.env[ut]==="1"}function ct(t){let n="",e="";for(let r of t){if(e!==""){r===e&&(n+=e+e,e="");continue}if(r==="'"||r==='"'){e=r;continue}if(r>="0"&&r<="9"){n.endsWith("0")||(n+="0");continue}n+=r;}return n}function ft(t){let n=5381;for(let e=0;e<t.length;e+=1)n=Math.imul(n,33)^t.charCodeAt(e);return (n>>>0).toString(16).padStart(8,"0").slice(0,8)}function dn(t){if(O())return ft(ct(t))}function hn(t,n){if(!O()||n==="")return [];let e=[],r=t.split(`
+`);for(let o=0;o<r.length;o+=1){let s=r[o]??"";(s.includes(".query(")||s.includes("$queryRaw"))&&e.push(o+1);}return e}function gn(t){return O()?!(t>4096):true}function yn(t){return O()?t==="block-experimental"?"block":"monitor":t==="block"?"block":"monitor"}var lt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),kn=new AsyncLocalStorage;function T(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)T(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))T(r,n,e+1);}}function F(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)F(r,n,e+1);return}for(let r of Object.values(t))F(r,n,e+1);}}function bn(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])T(r,n,0),F(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))lt.has(r.toLowerCase())||T(o,n,0);F(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function mn(t,n){return kn.run(t,n)}function m(){return kn.getStore()}var Sn=6e4,pt=1e3,A=new Map,Rn=Sn,dt=()=>Date.now();function xn(t){Rn=t!==void 0&&Number.isFinite(t)&&t>=0?t:Sn;}function wn(t,n){for(A.delete(t),A.set(t,n);A.size>pt;){let e=A.keys().next().value;if(e===void 0)break;A.delete(e);}}function An(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=dt(),i=A.get(o);return !i||s-i.at>Rn?(wn(o,{addresses:new Set(n),at:s}),false):(wn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function jn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function $(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>$(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>$(t[o],n[o]))}function K(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)K(r,n,e+1);return}for(let r of Object.values(t))K(r,n,e+1);}}function En(t,n){let e=[];for(let i of n.objects)K(i,e,0);let r=e.filter(jn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),jn(i)&&r.some(c=>c===i||$(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function z(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function ht(t,n){let e=z(t).replace(/\/+$/,""),r=z(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function gt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Pn(t){let n=z(t).split("/").filter(Boolean);return n[n.length-1]}function In(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:gt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!ht(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Pn(n),o=Pn(t);if(r&&r===o)return  true}return  false}var yt=new Set(["__proto__","constructor","prototype"]);function Q(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(yt.has(r))return  true;return Array.isArray(t)?t.some(r=>Q(r,n+1,e)):Object.values(t).some(r=>Q(r,n+1,e))}function Ln(t){let n=new Set;return t.objects.some(e=>Q(e,0,n))}function kt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function mn(t,n){if(!n)return  false;let e=et(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function rt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Cn(t,n){if(!n)return  false;let e=kt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function bt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function ot(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function N(t,n){if(!n)return  false;let e=rt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(ot(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function z(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function it(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Sn(t){let n=z(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(it);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ut(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function ct(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function K(t){let n=z(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Sn(n);return e?ut(e):n.includes(":")?ct(n):false}function ft(t){let n=z(t);if(Sn(n)||n.includes(":"))return [n];try{let e=st.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function at(t){try{return ft(t)}catch{return []}}function Rn(t){if(K(t))return  true;let n=at(t);for(let e of n)if(K(e))return  true;return dn(t,n,K)}function xn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Rn(r)||Rn(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function _(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var jn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function lt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&N(e,r))return  true;return  false}function dt(t,n,e,r){if(t==="proto")return bn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return gn(n,e)?true:pt(n,e);for(let o of lt(n))for(let s of e.strings)if(s&&(t==="sql"&&N(o,s)||t==="shell"&&mn(o,s)||t==="path"&&kn(o,s,r)||t==="ssrf"&&xn(o,s)))return  true;return  false}function An(t,n,e,r){return dt(t,n,e,r)?{block:true,ruleId:jn[t]}:{block:false}}function Pn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var En=new Map,Q=new Map,ht={block:2,honey:5,anomaly:1},gt=900*1e3,V=false,In=gt;function Cn(t={}){V=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(In=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(En.get(t)??0)+ht[n];return En.set(t,r),V&&r>=10&&Q.set(t,e+In),r}function vn(t,n=Date.now()){if(!V)return  false;let e=Q.get(t);return e===void 0?false:n>=e?(Q.delete(t),false):true}var yt=["/admin.php","/.git/config","/wp-login.php"],kt=new Set,bt=6e4,Ln=new Map;function qn(t){let n=t.split("?")[0]??t;return yt.includes(n)}function On(t){if(!t)return  false;for(let n of kt)if(n&&t.includes(n))return  true;return  false}function Tn(t,n=Date.now()){let e=Ln.get(t);return e===void 0||n-e.start>bt?(Ln.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function _n(){return function(n,e,r){let o=un(n);try{let s=o.strings.some(c=>On(c));if(qn(o.path)&&!s){let c=Tn(o.ip);P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),vn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=M("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}cn(o,()=>{r();});}}var R=createRequire(import.meta.url),q=[],l=new WeakSet,Un=false,Mn=false;function Rt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function St(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function H(t,n,e){try{let r=m();if(r){let o=M(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Rt(n)}),P(r.ip,"block"),L(r.path,t)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=m();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function k(t,n,e,r){return H(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,q.push(()=>{r[n]=o;});}function xt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return k("sql",xt(r),void 0,()=>e.call(this,r,...o))});}function Fn(t,n){b(t,n,e=>function(r,...o){return k("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return k("shell",u,void 0,()=>r.call(this,...o))});}function Hn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return k("path",s,St(s),()=>e.call(this,r,...o))});}function $n(t){let n=Kn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Pn(e,n)){let r=m();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}var Wn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Z(t,n){b(t,n,e=>function(r,...o){return k("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function X(t,n){b(t,n,e=>function(r,...o){return k("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function jt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Bn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,jt);}function Y(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return _(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return _(n)}function At(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Dn(t){try{let n=At(t);n&&H("ssrf",n);}catch(n){if(n instanceof w)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return $n(s),k("ssrf",s,void 0,()=>r.call(this,...o))});}var Pt=Symbol.for("fullshield.rasp.wrapSqlite"),G=Symbol.for("fullshield.rasp.sqliteWrapped"),W;function J(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Et(t){let n=J(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=J(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(W)try{return J(W("node:sqlite",void 0,!1))}catch{}}function It(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function F(t){try{let n=Et(t);if(!n||n[G])return;Object.defineProperty(n,G,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),q.push(()=>{delete n[G];});}catch{}}function Ct(){globalThis[Pt]=F;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Hn(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Hn(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",v),S(s,"get",v),S(i,"request",v),S(i,"get",v),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=_(p);return $n(h),(d?.redirect??"follow")!=="follow"?k("ssrf",h,void 0,()=>f.call(this,p,d)):(H("ssrf",h),(async()=>{let I=h,en=p;for(let rn=0;rn<8;rn+=1){let C=await f.call(this,en,{...d,redirect:"manual"});if(C.status<300||C.status>=400)return C;let on=C.headers.get("location");if(!on)return C;I=new URL(on,I).href,H("ssrf",I),en=I;}return f.call(this,I,d)})())},q.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return k("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");W=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Lt(String(f),h)}catch{return g({ruleId:A,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),h}},q.push(()=>{c._load=y,W=void 0;});let tn=c.registerHooks;typeof tn=="function"&&!Mn&&(Mn=true,tn({load(f,p,d){let h=d(f,p);return Un&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&F(),h}})),It()&&F();}function vt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(_n()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Lt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return F(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Wn)Z(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Wn)Z(o,u);Fn(o,"$where");}let s=n.Model;s&&Z(s,"aggregate");let i=s?.prototype;return i&&Fn(i,"$where"),l.add(e),n}if(r==="axios")return Bn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Bn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",Y);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",Y),o.Agent?.prototype&&S(o.Agent.prototype,"request",Y),l.add(e),n}if(r==="ejs"||r==="pug")return X(e,"render"),X(e,"compile"),l.add(e),n;if(r==="nunjucks")return X(e,"renderString"),l.add(e),n;if(r==="express"){vt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return k("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Nn(){Un=true,Ct();let t=mt.channel("undici:request:create");t.subscribe(Dn),q.push(()=>{t.unsubscribe(Dn);});}function zn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Qn=false,x={};function Ot(){return x.mode??"monitor"}function L(t,n){return zn(x.virtualPatches??[],t,n)?"block":Ot()}function Kn(){return x.egress?.allow}function M(t,n,e,r){return x.decide?x.decide(t,n,e):An(t,n,e,r)}function g(t){x.onEvent?.(t);}function Tt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},pn(t.dnsPinTtlMs),Cn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Qn||(Nn(),Qn=true));}function Vn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Tt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Vn();
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function mt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function G(t,n){if(!n)return  false;let e=bt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(mt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function X(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function St(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function _n(t){let n=X(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(St);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Rt(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function xt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function V(t){let n=X(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=_n(n);return e?Rt(e):n.includes(":")?xt(n):false}function At(t){let n=X(t);if(_n(n)||n.includes(":"))return [n];try{let e=wt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function jt(t){try{return At(t)}catch{return []}}function Mn(t){if(V(t))return  true;let n=jt(t);for(let e of n)if(V(e))return  true;return An(t,n,V)}function qn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Mn(r)||Mn(s):false}function C(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function W(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var H={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},j="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function Et(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function Pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&G(e,r))return  true;return  false}function It(t,n,e,r){if(t==="proto")return Ln(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return En(n,e)?true:Pt(n,e);for(let o of Et(n))for(let s of e.strings)if(s&&(t==="sql"&&G(o,s)||t==="shell"&&Cn(o,s)||t==="path"&&In(o,s,r)||t==="ssrf"&&qn(o,s)))return  true;return  false}function On(t,n,e,r){return It(t,n,e,r)?{block:true,ruleId:H[t]}:{block:false}}function Tn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var Fn=new Map,Y=new Map,Lt={block:2,honey:5,anomaly:1},Ct=900*1e3,J=false,Wn=Ct;function Hn(t={}){J=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(Wn=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=(Fn.get(t)??0)+Lt[n];return Fn.set(t,r),J&&r>=10&&Y.set(t,e+Wn),r}function Dn(t,n=Date.now()){if(!J)return  false;let e=Y.get(t);return e===void 0?false:n>=e?(Y.delete(t),false):true}var vt=["/admin.php","/.git/config","/wp-login.php"],Mt=new Set,_t=6e4,Bn=new Map;function Un(t){let n=t.split("?")[0]??t;return vt.includes(n)}function Nn(t){if(!t)return  false;for(let n of Mt)if(n&&t.includes(n))return  true;return  false}function $n(t,n=Date.now()){let e=Bn.get(t);return e===void 0||n-e.start>_t?(Bn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Kn(){return function(n,e,r){let o=bn(n);try{let s=o.strings.some(c=>Nn(c));if(Un(o.path)&&!s){let c=$n(o.ip);E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),Dn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=D("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),v(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}mn(o,()=>{r();});}}var S=createRequire(import.meta.url),M=[],l=new WeakSet,Jn=false,zn=false;function Tt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Ft(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function U(t,n,e){try{let r=m();if(r){let o=D(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Tt(n)}),E(r.ip,"block"),v(r.path,t)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=m();g({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function k(t,n,e,r){return U(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,M.push(()=>{r[n]=o;});}function Wt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return k("sql",Wt(r),void 0,()=>e.call(this,r,...o))});}function Qn(t,n){b(t,n,e=>function(r,...o){return k("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function P(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return k("shell",u,void 0,()=>r.call(this,...o))});}function Gn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return k("path",s,Ft(s),()=>e.call(this,r,...o))});}function Zn(t){let n=tt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Tn(e,n)){let r=m();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),v(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}var Vn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Z(t,n){b(t,n,e=>function(r,...o){return k("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function nn(t,n){b(t,n,e=>function(r,...o){return k("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Ht(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Xn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])R(t,n,Ht);}function tn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return W(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return W(n)}function Dt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Yn(t){try{let n=Dt(t);n&&U("ssrf",n);}catch(n){if(n instanceof w)return;throw n}}function R(t,n,e){b(t,n,r=>function(...o){let s=e(o);return Zn(s),k("ssrf",s,void 0,()=>r.call(this,...o))});}var Bt=Symbol.for("fullshield.rasp.wrapSqlite"),en=Symbol.for("fullshield.rasp.sqliteWrapped"),N;function rn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Ut(t){let n=rn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=rn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(N)try{return rn(N("node:sqlite",void 0,!1))}catch{}}function Nt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function B(t){try{let n=Ut(t);if(!n||n[en])return;Object.defineProperty(n,en,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),M.push(()=>{delete n[en];});}catch{}}function $t(){globalThis[Bt]=B;let t=S("node:child_process"),n=S("child_process");for(let f of new Set([t,n]))P(f,"exec",true),P(f,"execSync",true),P(f,"spawn",false),P(f,"spawnSync",false),P(f,"execFile",false),P(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=S("node:fs"),o=S("fs");for(let f of new Set([r,o]))for(let p of e)Gn(f,p);try{let f=S("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Gn(f,p);}catch{}let s=S("node:http"),i=S("node:https");if(R(s,"request",C),R(s,"get",C),R(i,"request",C),R(i,"get",C),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=W(p);return Zn(h),(d?.redirect??"follow")!=="follow"?k("ssrf",h,void 0,()=>f.call(this,p,d)):(U("ssrf",h),(async()=>{let I=h,un=p;for(let cn=0;cn<8;cn+=1){let L=await f.call(this,un,{...d,redirect:"manual"});if(L.status<300||L.status>=400)return L;let fn=L.headers.get("location");if(!fn)return L;I=new URL(fn,I).href,U("ssrf",I),un=I;}return f.call(this,I,d)})())},M.push(()=>{globalThis.fetch=f;});}let u=S("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return k("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=S("node:module");N=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return zt(String(f),h)}catch{return g({ruleId:j,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),h}},M.push(()=>{c._load=y,N=void 0;});let sn=c.registerHooks;typeof sn=="function"&&!zn&&(zn=true,sn({load(f,p,d){let h=d(f,p);return Jn&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&B(),h}})),Nt()&&B();}function Kt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Kn()),o.__fullshieldRasp=!0);}catch{g({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function zt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return B(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Vn)Z(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Vn)Z(o,u);Qn(o,"$where");}let s=n.Model;s&&Z(s,"aggregate");let i=s?.prototype;return i&&Qn(i,"$where"),l.add(e),n}if(r==="axios")return Xn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Xn(i),i}),l.add(e),n;if(r==="undici"){R(e,"request",tn);let o=n;return o.Dispatcher?.prototype&&R(o.Dispatcher.prototype,"request",tn),o.Agent?.prototype&&R(o.Agent.prototype,"request",tn),l.add(e),n}if(r==="ejs"||r==="pug")return nn(e,"render"),nn(e,"compile"),l.add(e),n;if(r==="nunjucks")return nn(e,"renderString"),l.add(e),n;if(r==="express"){Kt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return k("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function nt(){Jn=true,$t();let t=qt.channel("undici:request:create");t.subscribe(Yn),M.push(()=>{t.unsubscribe(Yn);});}function et(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var rt=false,x={},_=[],Qt=1e3,on=false;function Gt(t,n){if(!on)return;on=false;let e=_[_.length-1];if(!e||e.ruleId!==H[t])return;let r=pn(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);let o=t==="sql"?dn(e.sample):void 0;o!==void 0&&(e.fingerprint=o);let s=hn(e.sample,o??"");s.length>0&&(e.sinkLines=s),gn(Buffer.byteLength(e.sample))||(e.overCap=true);}function Vt(){return x.mode??"monitor"}function v(t,n){let e=et(x.virtualPatches??[],t,n)?"block":Vt(),r=ln(e,n);return Gt(n,r),r}function tt(){return x.egress?.allow}function D(t,n,e,r){return x.decide?x.decide(t,n,e):On(t,n,e,r)}function g(t){_.length>=Qt&&_.shift(),_.push(t),on=true,x.onEvent?.(t);}function Xt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},xn(t.dnsPinTtlMs),Hn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),rt||(nt(),rt=true));}function ot(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Xt({experimental:true,mode:yn(process.env.FULLSHIELD_RASP_MODE)});}ot();

package/dist/runtime/rasp.js

@@ -1,14 +1,15 @@
-import {AsyncLocalStorage}from'async_hooks';import xt from'dns';import Ht from'diagnostics_channel';import {createRequire}from'module';import {mkdirSync,writeFileSync,readFileSync,existsSync}from'fs';import {dirname,join}from'path';var ht=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),_n=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function F(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)F(r,n,e+1);return}for(let r of Object.values(t))F(r,n,e+1);}}function Q(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),F(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))ht.has(r.toLowerCase())||q(o,n,0);F(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function Y(t,n){return _n.run(t,n)}function m(){return _n.getStore()}function Tn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function J(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>J(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>J(t[o],n[o]))}function Z(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)Z(r,n,e+1);return}for(let r of Object.values(t))Z(r,n,e+1);}}function qn(t,n){let e=[];for(let i of n.objects)Z(i,e,0);let r=e.filter(Tn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),Tn(i)&&r.some(c=>c===i||J(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function G(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function gt(t,n){let e=G(t).replace(/\/+$/,""),r=G(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function yt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Fn(t){let n=G(t).split("/").filter(Boolean);return n[n.length-1]}function Hn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:yt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!gt(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Fn(n),o=Fn(t);if(r&&r===o)return  true}return  false}var mt=new Set(["__proto__","constructor","prototype"]);function X(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(mt.has(r))return  true;return Array.isArray(t)?t.some(r=>X(r,n+1,e)):Object.values(t).some(r=>X(r,n+1,e))}function Mn(t){let n=new Set;return t.objects.some(e=>X(e,0,n))}function kt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {AsyncLocalStorage}from'async_hooks';import Mt from'dns';import Zt from'diagnostics_channel';import {createRequire}from'module';import {mkdirSync,writeFileSync,readFileSync,existsSync}from'fs';import {dirname,join}from'path';var jt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),Fn=new AsyncLocalStorage;function T(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)T(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))T(r,n,e+1);}}function H(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)H(r,n,e+1);return}for(let r of Object.values(t))H(r,n,e+1);}}function X(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])T(r,n,0),H(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))jt.has(r.toLowerCase())||T(o,n,0);H(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function Z(t,n){return Fn.run(t,n)}function m(){return Fn.getStore()}function Tn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function nn(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>nn(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>nn(t[o],n[o]))}function tn(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)tn(r,n,e+1);return}for(let r of Object.values(t))tn(r,n,e+1);}}function Hn(t,n){let e=[];for(let i of n.objects)tn(i,e,0);let r=e.filter(Tn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),Tn(i)&&r.some(c=>c===i||nn(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function en(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function Et(t,n){let e=en(t).replace(/\/+$/,""),r=en(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function Pt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Wn(t){let n=en(t).split("/").filter(Boolean);return n[n.length-1]}function Dn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:Pt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!Et(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Wn(n),o=Wn(t);if(r&&r===o)return  true}return  false}var Ct=new Set(["__proto__","constructor","prototype"]);function rn(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(Ct.has(r))return  true;return Array.isArray(t)?t.some(r=>rn(r,n+1,e)):Object.values(t).some(r=>rn(r,n+1,e))}function Bn(t){let n=new Set;return t.objects.some(e=>rn(e,0,n))}function It(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let p=1;for(;e<r&&p>0;)t[e]===i?p+=1:t[e]===u&&(p-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Wn(t,n){if(!n)return  false;let e=kt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function bt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let p=1;for(;e<r&&p>0;)t[e]===i?p+=1:t[e]===u&&(p-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Un(t,n){if(!n)return  false;let e=It(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function Lt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function wt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function nn(t,n){if(!n)return  false;let e=bt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(wt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}var Dn=6e4,Rt=1e3,j=new Map,Un=Dn,St=()=>Date.now();function tn(t){Un=t!==void 0&&Number.isFinite(t)&&t>=0?t:Dn;}function Nn(){j.clear();}function Bn(t,n){for(j.delete(t),j.set(t,n);j.size>Rt;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function $n(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=St(),i=j.get(o);return !i||s-i.at>Un?(Bn(o,{addresses:new Set(n),at:s}),false):(Bn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}var en;function on(t){en=t;}function M(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function jt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Kn(t){let n=M(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(jt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],p=r[2];return o>255||c>255||p>65535?void 0:[o,c,p>>>8&255,p&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function At(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function Pt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function H(t){let n=M(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Kn(n);return e?At(e):n.includes(":")?Pt(n):false}function Et(t){let n=M(t);if(Kn(n)||n.includes(":"))return [n];if(en)return en(n);try{let e=xt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function Ct(t){try{return Et(t)}catch{return []}}function rn(t){if(H(t))return  true;let n=Ct(t);for(let e of n)if(H(e))return  true;return $n(t,n,H)}function sn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?rn(r)||rn(s):false}function O(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function W(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var un={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function vt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function It(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&nn(e,r))return  true;return  false}function Vn(t,n,e,r){if(t==="proto")return Mn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return qn(n,e)?true:It(n,e);for(let o of vt(n))for(let s of e.strings)if(s&&(t==="sql"&&nn(o,s)||t==="shell"&&Wn(o,s)||t==="path"&&Hn(o,s,r)||t==="ssrf"&&sn(o,s)))return  true;return  false}function B(t,n,e,r){return Vn(t,n,e,r)?{block:true,ruleId:un[t]}:{block:false}}function Lt(t){let n=t.kind,e=t.input;if(n==="proto"||e!==null&&typeof e=="object")return {path:"/",ip:"test",strings:[],objects:e!==null&&typeof e=="object"?[e]:[]};let r=typeof e=="string"||typeof e=="number"||typeof e=="boolean"?String(e):"";return {path:"/",ip:"test",strings:r?[r]:[],objects:[]}}function zn(t){let n={},e=0;for(let r of t){let o=typeof r.kind=="string"?r.kind:"unknown",s=Lt(r),i=o==="proto"?null:r.sink??r.input,u=typeof r.base=="string"?r.base:void 0,c=B(o,i,s,u).block,p=n[o]??{blocked:0,total:0};p.total+=1,c&&(p.blocked+=1,e+=1),n[o]=p;}return {blocked:e,total:t.length,byKind:n}}function Ot(t){let{blocked:n,total:e}=zn(t);return {blocked:n,total:e}}function cn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var D=new Map,U=new Map,_t={block:2,honey:5,anomaly:1},Qn=900*1e3,N=false,an=Qn;function Yn(t={}){N=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(an=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(D.get(t)??0)+_t[n];return D.set(t,r),N&&r>=10&&U.set(t,e+an),r}function Tt(t){return D.get(t)??0}function fn(){D.clear(),U.clear(),N=false,an=Qn;}function qt(t){return t>=10?"block":t>=5?"challenge":"log"}function ln(t,n=Date.now()){if(!N)return  false;let e=U.get(t);return e===void 0?false:n>=e?(U.delete(t),false):true}var dn=["/admin.php","/.git/config","/wp-login.php"],hn=new Set,Ft=6e4,pn=new Map;function Jn(t){for(let n of t)hn.add(n);}function Zn(){hn.clear(),pn.clear();}function gn(t){let n=t.split("?")[0]??t;return dn.includes(n)}function yn(t){if(!t)return  false;for(let n of hn)if(n&&t.includes(n))return  true;return  false}function mn(t,n=Date.now()){let e=pn.get(t);return e===void 0||n-e.start>Ft?(pn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function kn(){return function(n,e,r){let o=Q(n);try{let s=o.strings.some(c=>yn(c));if(gn(o.path)&&!s){let c=mn(o.ip);P(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),ln(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=$("proto",null,o);if(u.block&&u.ruleId&&(y({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),C(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}y({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}Y(o,()=>{r();});}}var R=createRequire(import.meta.url),E=[],l=new WeakSet,jn=false,Gn=false;function Wt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Bt(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function V(t,n,e){try{let r=m();if(r){let o=$(t,n,r,e);if(o.block&&o.ruleId&&(y({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Wt(n)}),P(r.ip,"block"),C(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=m();y({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return V(t,n,e),r()}function w(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,E.push(()=>{r[n]=o;});}function Dt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function f(t,n){w(t,n,e=>function(r,...o){return b("sql",Dt(r),void 0,()=>e.call(this,r,...o))});}function Xn(t,n){w(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function v(t,n,e){w(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function nt(t,n){w(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,Bt(s),()=>e.call(this,r,...o))});}function ot(t){let n=at();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!cn(e,n)){let r=m();if(y({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),C(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var tt=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function bn(t,n){w(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function wn(t,n){w(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Ut(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function et(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Ut);}function Rn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return W(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return W(n)}function Nt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function rt(t){try{let n=Nt(t);n&&V("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){w(t,n,r=>function(...o){let s=e(o);return ot(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var st=Symbol.for("fullshield.rasp.wrapSqlite"),Sn=Symbol.for("fullshield.rasp.sqliteWrapped"),z;function xn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function $t(t){let n=xn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=xn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(z)try{return xn(z("node:sqlite",void 0,!1))}catch{}}function Kt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function K(t){try{let n=$t(t);if(!n||n[Sn])return;Object.defineProperty(n,Sn,{value:!0,configurable:!0}),f(n,"exec"),f(n,"prepare"),E.push(()=>{delete n[Sn];});}catch{}}function Vt(){globalThis[st]=K;let t=R("node:child_process"),n=R("child_process");for(let a of new Set([t,n]))v(a,"exec",true),v(a,"execSync",true),v(a,"spawn",false),v(a,"spawnSync",false),v(a,"execFile",false),v(a,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let a of new Set([r,o]))for(let d of e)nt(a,d);try{let a=R("node:fs/promises");for(let d of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])nt(a,d);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",O),S(s,"get",O),S(i,"request",O),S(i,"get",O),typeof globalThis.fetch=="function"){let a=globalThis.fetch;globalThis.fetch=function(d,h){let g=W(d);return ot(g),(h?.redirect??"follow")!=="follow"?b("ssrf",g,void 0,()=>a.call(this,d,h)):(V("ssrf",g),(async()=>{let I=g,In=d;for(let Ln=0;Ln<8;Ln+=1){let L=await a.call(this,In,{...h,redirect:"manual"});if(L.status<300||L.status>=400)return L;let On=L.headers.get("location");if(!On)return L;I=new URL(On,I).href,V("ssrf",I),In=I;}return a.call(this,I,h)})())},E.push(()=>{globalThis.fetch=a;});}let u=R("node:vm");for(let a of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,a,d=>function(h,...g){return b("sql",typeof h=="string"?h:"",void 0,()=>d.call(this,h,...g))});let c=R("node:module");z=c._load.bind(c);let p=c._load;c._load=function(a,d,h){let g=p.call(this,a,d,h);try{return it(String(a),g)}catch{return y({ruleId:A,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),g}},E.push(()=>{c._load=p,z=void 0;});let vn=c.registerHooks;typeof vn=="function"&&!Gn&&(Gn=true,vn({load(a,d,h){let g=h(a,d);return jn&&typeof a=="string"&&(a==="node:sqlite"||a.startsWith("node:sqlite"))&&K(),g}})),Kt()&&K();}function zt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(kn()),o.__fullshieldRasp=!0);}catch{y({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function it(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return K(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&f(o.Client.prototype,"query"),o.Pool?.prototype&&f(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(f(s,"query"),f(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(f(o,"exec"),f(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(f(o,"$queryRawUnsafe"),f(o,"$executeRawUnsafe"),f(o,"$queryRaw"),f(o,"$executeRaw"));let s=n.Prisma;return s&&f(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&f(s,"query"),typeof o.literal=="function"&&f(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&f(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&f(e,"raw");let o=n.Client?.prototype;return o&&(f(o,"raw"),f(o,"whereRaw"),f(o,"orderByRaw"),f(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&f(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&f(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&f(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of tt)bn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of tt)bn(o,u);Xn(o,"$where");}let s=n.Model;s&&bn(s,"aggregate");let i=s?.prototype;return i&&Xn(i,"$where"),l.add(e),n}if(r==="axios")return et(e),w(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&et(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",Rn);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",Rn),o.Agent?.prototype&&S(o.Agent.prototype,"request",Rn),l.add(e),n}if(r==="ejs"||r==="pug")return wn(e,"render"),wn(e,"compile"),l.add(e),n;if(r==="nunjucks")return wn(e,"renderString"),l.add(e),n;if(r==="express"){zt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function ut(){jn=true,Vt();let t=Ht.channel("undici:request:create");t.subscribe(rt),E.push(()=>{t.unsubscribe(rt);});}function ct(){for(jn=false,delete globalThis[st];E.length>0;)E.pop()?.();}function ft(t){let n=t.toUpperCase();if(n.includes("SQLI")||n.includes("SQL-"))return "sql";if(n.includes("CMDI")||n.includes("SHELL"))return "shell";if(n.includes("PATH"))return "path";if(n.includes("NOSQL"))return "nosql";if(n.includes("SSRF"))return "ssrf";if(n.includes("PROTO"))return "proto"}function lt(t){if(typeof t.route=="string"&&t.route.startsWith("/"))return t.route;let n=(t.message??"").match(/\/[A-Za-z0-9._/-]+/);if(n)return n[0];if(t.file){let e=Math.max(t.file.lastIndexOf("/"),t.file.lastIndexOf("\\")),r=e>=0?t.file.slice(e+1):t.file,o=r.lastIndexOf("."),s=o>0?r.slice(0,o):r;if(s&&s!=="index")return `/${s}`}}function An(t){return t.map(n=>({ruleId:n.ruleId,file:n.file,line:n.line,sink:ft(n.ruleId),route:lt(n)}))}function Pn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var T=false,x={},_=[],Qt=1e3;function Yt(){return T}function Jt(){return x.mode??"monitor"}function C(t,n){return Pn(x.virtualPatches??[],t,n)?"block":Jt()}function at(){return x.egress?.allow}function $(t,n,e,r){return x.decide?x.decide(t,n,e):B(t,n,e,r)}function y(t){_.length>=Qt&&_.shift(),_.push(t),x.onEvent?.(t);}function Zt(){return _}function Gt(){_.length=0;}function pt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},tn(t.dnsPinTtlMs),Yn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),T||(ut(),T=true));}function Xt(){T&&(ct(),T=false,x={},on(void 0),Nn(),tn(void 0),Zn(),fn());}function ne(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&pt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}function se(t,n){let e=An(t);return mkdirSync(dirname(n),{recursive:true}),writeFileSync(n,`${JSON.stringify({patches:e},null,2)}
-`,"utf8"),e}function ie(t){let n=JSON.parse(readFileSync(t,"utf8"));return Array.isArray(n)?n:n.patches??[]}function fe(t,n){let e=join(t,".gitignore"),r=existsSync(e)?readFileSync(e,"utf8"):"",o=new Set(r.split(`
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function vt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function on(t,n){if(!n)return  false;let e=Lt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(vt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}var $n=6e4,_t=1e3,A=new Map,Kn=$n,Ot=()=>Date.now();function sn(t){Kn=t!==void 0&&Number.isFinite(t)&&t>=0?t:$n;}function Vn(){A.clear();}function Nn(t,n){for(A.delete(t),A.set(t,n);A.size>_t;){let e=A.keys().next().value;if(e===void 0)break;A.delete(e);}}function zn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Ot(),i=A.get(o);return !i||s-i.at>Kn?(Nn(o,{addresses:new Set(n),at:s}),false):(Nn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}var un;function an(t){un=t;}function D(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function qt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Gn(t){let n=D(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(qt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],p=r[2];return o>255||c>255||p>65535?void 0:[o,c,p>>>8&255,p&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Ft(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function Tt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function W(t){let n=D(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Gn(n);return e?Ft(e):n.includes(":")?Tt(n):false}function Ht(t){let n=D(t);if(Gn(n)||n.includes(":"))return [n];if(un)return un(n);try{let e=Mt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function Wt(t){try{return Ht(t)}catch{return []}}function cn(t){if(W(t))return  true;let n=Wt(t);for(let e of n)if(W(e))return  true;return zn(t,n,W)}function fn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?cn(r)||cn(s):false}function O(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function B(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var M={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},j="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function Dt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function Bt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&on(e,r))return  true;return  false}function Qn(t,n,e,r){if(t==="proto")return Bn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return Hn(n,e)?true:Bt(n,e);for(let o of Dt(n))for(let s of e.strings)if(s&&(t==="sql"&&on(o,s)||t==="shell"&&Un(o,s)||t==="path"&&Dn(o,s,r)||t==="ssrf"&&fn(o,s)))return  true;return  false}function U(t,n,e,r){return Qn(t,n,e,r)?{block:true,ruleId:M[t]}:{block:false}}function Ut(t){let n=t.kind,e=t.input;if(n==="proto"||e!==null&&typeof e=="object")return {path:"/",ip:"test",strings:[],objects:e!==null&&typeof e=="object"?[e]:[]};let r=typeof e=="string"||typeof e=="number"||typeof e=="boolean"?String(e):"";return {path:"/",ip:"test",strings:r?[r]:[],objects:[]}}function Yn(t){let n={},e=0;for(let r of t){let o=typeof r.kind=="string"?r.kind:"unknown",s=Ut(r),i=o==="proto"?null:r.sink??r.input,u=typeof r.base=="string"?r.base:void 0,c=U(o,i,s,u).block,p=n[o]??{blocked:0,total:0};p.total+=1,c&&(p.blocked+=1,e+=1),n[o]=p;}return {blocked:e,total:t.length,byKind:n}}function Nt(t){let{blocked:n,total:e}=Yn(t);return {blocked:n,total:e}}var $t="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var Kt=new Set(["sql","shell"]),q=[];function Jn(){return process.env[$t]==="1"}function Xn(t,n){return Jn()?t!=="block"?"monitor":Kt.has(n)?"block":"monitor":t}function Zn(){q=[];}function nt(t,n,e,r){if(Jn()&&(q=q.filter(o=>r-o<6e4),!(q.length>=5)))return q.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var Vt="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";function N(){return process.env[Vt]==="1"}function zt(t){let n="",e="";for(let r of t){if(e!==""){r===e&&(n+=e+e,e="");continue}if(r==="'"||r==='"'){e=r;continue}if(r>="0"&&r<="9"){n.endsWith("0")||(n+="0");continue}n+=r;}return n}function Gt(t){let n=5381;for(let e=0;e<t.length;e+=1)n=Math.imul(n,33)^t.charCodeAt(e);return (n>>>0).toString(16).padStart(8,"0").slice(0,8)}function tt(t){if(N())return Gt(zt(t))}function et(t,n){if(!N()||n==="")return [];let e=[],r=t.split(`
+`);for(let o=0;o<r.length;o+=1){let s=r[o]??"";(s.includes(".query(")||s.includes("$queryRaw"))&&e.push(o+1);}return e}function rt(t){return N()?!(t>4096):true}function ot(t){return N()?t==="block-experimental"?"block":"monitor":t==="block"?"block":"monitor"}function ln(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var $=new Map,K=new Map,Qt={block:2,honey:5,anomaly:1},st=900*1e3,V=false,pn=st;function it(t={}){V=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(pn=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=($.get(t)??0)+Qt[n];return $.set(t,r),V&&r>=10&&K.set(t,e+pn),r}function Yt(t){return $.get(t)??0}function dn(){$.clear(),K.clear(),V=false,pn=st;}function Jt(t){return t>=10?"block":t>=5?"challenge":"log"}function hn(t,n=Date.now()){if(!V)return  false;let e=K.get(t);return e===void 0?false:n>=e?(K.delete(t),false):true}var yn=["/admin.php","/.git/config","/wp-login.php"],mn=new Set,Xt=6e4,gn=new Map;function ut(t){for(let n of t)mn.add(n);}function ct(){mn.clear(),gn.clear();}function kn(t){let n=t.split("?")[0]??t;return yn.includes(n)}function bn(t){if(!t)return  false;for(let n of mn)if(n&&t.includes(n))return  true;return  false}function wn(t,n=Date.now()){let e=gn.get(t);return e===void 0||n-e.start>Xt?(gn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Sn(){return function(n,e,r){let o=X(n);try{let s=o.strings.some(c=>bn(c));if(kn(o.path)&&!s){let c=wn(o.ip);E(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),hn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=z("proto",null,o);if(u.block&&u.ruleId&&(y({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),I(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}y({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}Z(o,()=>{r();});}}var S=createRequire(import.meta.url),P=[],l=new WeakSet,Pn=false,at=false;function te(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function ee(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function Q(t,n,e){try{let r=m();if(r){let o=z(t,n,r,e);if(o.block&&o.ruleId&&(y({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:te(n)}),E(r.ip,"block"),I(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=m();y({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return Q(t,n,e),r()}function w(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,P.push(()=>{r[n]=o;});}function re(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function f(t,n){w(t,n,e=>function(r,...o){return b("sql",re(r),void 0,()=>e.call(this,r,...o))});}function ft(t,n){w(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function L(t,n,e){w(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function lt(t,n){w(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,ee(s),()=>e.call(this,r,...o))});}function gt(t){let n=wt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!ln(e,n)){let r=m();if(y({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),I(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var pt=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Rn(t,n){w(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function xn(t,n){w(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function oe(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function dt(t){for(let n of ["request","get","post","put","patch","delete","head","options"])R(t,n,oe);}function An(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return B(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return B(n)}function se(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function ht(t){try{let n=se(t);n&&Q("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function R(t,n,e){w(t,n,r=>function(...o){let s=e(o);return gt(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var yt=Symbol.for("fullshield.rasp.wrapSqlite"),jn=Symbol.for("fullshield.rasp.sqliteWrapped"),Y;function En(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function ie(t){let n=En(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=En(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(Y)try{return En(Y("node:sqlite",void 0,!1))}catch{}}function ue(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function G(t){try{let n=ie(t);if(!n||n[jn])return;Object.defineProperty(n,jn,{value:!0,configurable:!0}),f(n,"exec"),f(n,"prepare"),P.push(()=>{delete n[jn];});}catch{}}function ce(){globalThis[yt]=G;let t=S("node:child_process"),n=S("child_process");for(let a of new Set([t,n]))L(a,"exec",true),L(a,"execSync",true),L(a,"spawn",false),L(a,"spawnSync",false),L(a,"execFile",false),L(a,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=S("node:fs"),o=S("fs");for(let a of new Set([r,o]))for(let d of e)lt(a,d);try{let a=S("node:fs/promises");for(let d of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])lt(a,d);}catch{}let s=S("node:http"),i=S("node:https");if(R(s,"request",O),R(s,"get",O),R(i,"request",O),R(i,"get",O),typeof globalThis.fetch=="function"){let a=globalThis.fetch;globalThis.fetch=function(d,h){let g=B(d);return gt(g),(h?.redirect??"follow")!=="follow"?b("ssrf",g,void 0,()=>a.call(this,d,h)):(Q("ssrf",g),(async()=>{let v=g,On=d;for(let Mn=0;Mn<8;Mn+=1){let _=await a.call(this,On,{...h,redirect:"manual"});if(_.status<300||_.status>=400)return _;let qn=_.headers.get("location");if(!qn)return _;v=new URL(qn,v).href,Q("ssrf",v),On=v;}return a.call(this,v,h)})())},P.push(()=>{globalThis.fetch=a;});}let u=S("node:vm");for(let a of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,a,d=>function(h,...g){return b("sql",typeof h=="string"?h:"",void 0,()=>d.call(this,h,...g))});let c=S("node:module");Y=c._load.bind(c);let p=c._load;c._load=function(a,d,h){let g=p.call(this,a,d,h);try{return mt(String(a),g)}catch{return y({ruleId:j,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),g}},P.push(()=>{c._load=p,Y=void 0;});let _n=c.registerHooks;typeof _n=="function"&&!at&&(at=true,_n({load(a,d,h){let g=h(a,d);return Pn&&typeof a=="string"&&(a==="node:sqlite"||a.startsWith("node:sqlite"))&&G(),g}})),ue()&&G();}function ae(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Sn()),o.__fullshieldRasp=!0);}catch{y({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function mt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return G(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&f(o.Client.prototype,"query"),o.Pool?.prototype&&f(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(f(s,"query"),f(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(f(o,"exec"),f(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(f(o,"$queryRawUnsafe"),f(o,"$executeRawUnsafe"),f(o,"$queryRaw"),f(o,"$executeRaw"));let s=n.Prisma;return s&&f(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&f(s,"query"),typeof o.literal=="function"&&f(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&f(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&f(e,"raw");let o=n.Client?.prototype;return o&&(f(o,"raw"),f(o,"whereRaw"),f(o,"orderByRaw"),f(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&f(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&f(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&f(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of pt)Rn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of pt)Rn(o,u);ft(o,"$where");}let s=n.Model;s&&Rn(s,"aggregate");let i=s?.prototype;return i&&ft(i,"$where"),l.add(e),n}if(r==="axios")return dt(e),w(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&dt(i),i}),l.add(e),n;if(r==="undici"){R(e,"request",An);let o=n;return o.Dispatcher?.prototype&&R(o.Dispatcher.prototype,"request",An),o.Agent?.prototype&&R(o.Agent.prototype,"request",An),l.add(e),n}if(r==="ejs"||r==="pug")return xn(e,"render"),xn(e,"compile"),l.add(e),n;if(r==="nunjucks")return xn(e,"renderString"),l.add(e),n;if(r==="express"){ae(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function kt(){Pn=true,ce();let t=Zt.channel("undici:request:create");t.subscribe(ht),P.push(()=>{t.unsubscribe(ht);});}function bt(){for(Pn=false,delete globalThis[yt];P.length>0;)P.pop()?.();}function St(t){let n=t.toUpperCase();if(n.includes("SQLI")||n.includes("SQL-"))return "sql";if(n.includes("CMDI")||n.includes("SHELL"))return "shell";if(n.includes("PATH"))return "path";if(n.includes("NOSQL"))return "nosql";if(n.includes("SSRF"))return "ssrf";if(n.includes("PROTO"))return "proto"}function Rt(t){if(typeof t.route=="string"&&t.route.startsWith("/"))return t.route;let n=(t.message??"").match(/\/[A-Za-z0-9._/-]+/);if(n)return n[0];if(t.file){let e=Math.max(t.file.lastIndexOf("/"),t.file.lastIndexOf("\\")),r=e>=0?t.file.slice(e+1):t.file,o=r.lastIndexOf("."),s=o>0?r.slice(0,o):r;if(s&&s!=="index")return `/${s}`}}function Cn(t){return t.map(n=>({ruleId:n.ruleId,file:n.file,line:n.line,sink:St(n.ruleId),route:Rt(n)}))}function In(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var F=false,x={},C=[],fe=1e3,J=false;function le(t,n){if(!J)return;J=false;let e=C[C.length-1];if(!e||e.ruleId!==M[t])return;let r=nt(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);let o=t==="sql"?tt(e.sample):void 0;o!==void 0&&(e.fingerprint=o);let s=et(e.sample,o??"");s.length>0&&(e.sinkLines=s),rt(Buffer.byteLength(e.sample))||(e.overCap=true);}function pe(){return F}function de(){return x.mode??"monitor"}function I(t,n){let e=In(x.virtualPatches??[],t,n)?"block":de(),r=Xn(e,n);return le(n,r),r}function wt(){return x.egress?.allow}function z(t,n,e,r){return x.decide?x.decide(t,n,e):U(t,n,e,r)}function y(t){C.length>=fe&&C.shift(),C.push(t),J=true,x.onEvent?.(t);}function he(){return C}function ge(){C.length=0,J=false,Zn();}function xt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},sn(t.dnsPinTtlMs),it({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),F||(kt(),F=true));}function ye(){F&&(bt(),F=false,x={},an(void 0),Vn(),sn(void 0),ct(),dn());}function me(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&xt({experimental:true,mode:ot(process.env.FULLSHIELD_RASP_MODE)});}function Re(t,n){let e=Cn(t);return mkdirSync(dirname(n),{recursive:true}),writeFileSync(n,`${JSON.stringify({patches:e},null,2)}
+`,"utf8"),e}function xe(t){let n=JSON.parse(readFileSync(t,"utf8"));return Array.isArray(n)?n:n.patches??[]}function Pe(t,n){let e=join(t,".gitignore"),r=existsSync(e)?readFileSync(e,"utf8"):"",o=new Set(r.split(`
 `).map(s=>s.trim()));for(let s of n)o.has(s)||(r.length>0&&!r.endsWith(`
 `)&&(r+=`
 `),r+=`${s}
-`,o.add(s));writeFileSync(e,r,"utf8");}function le(t){let n="FULLSHIELD-HONEY-CANARY-NOT-A-CLOUD-KEY",e="fullshield-honey-db-canary://local";return mkdirSync(t,{recursive:true}),writeFileSync(join(t,".env.backup"),`# fullshield honeytoken decoy \u2014 not real credentials
+`,o.add(s));writeFileSync(e,r,"utf8");}function Ce(t){let n="FULLSHIELD-HONEY-CANARY-NOT-A-CLOUD-KEY",e="fullshield-honey-db-canary://local";return mkdirSync(t,{recursive:true}),writeFileSync(join(t,".env.backup"),`# fullshield honeytoken decoy \u2014 not real credentials
 AWS_ACCESS_KEY_ID=${n}
 DATABASE_URL=${e}
-`,"utf8"),writeFileSync(join(t,".fullshield-honey.json"),`${JSON.stringify({decoys:dn,canaries:{awsKey:n,dbUrl:e}},null,2)}
-`,"utf8"),fe(t,[".env.backup",".fullshield-honey.json"]),Jn([n,e]),{awsKey:n,dbUrl:e}}export{A as RASP_FAIL_OPEN,un as RASP_RULE,k as RaspBlockedError,P as addThreat,Gt as clearRaspEvents,fn as clearThreats,Q as contextFromRequest,m as currentRaspContext,qt as decideResponse,B as decideSink,Vn as detectStructureChange,Xt as disableRasp,cn as egressAllowed,se as emitVirtualPatches,pt as enableRasp,ne as enableRaspFromEnv,Y as enterRaspContext,An as findingsToVpatches,Zt as getRaspEvents,le as honeyInit,rn as hostIsBlocked,yn as isHoneyCanary,gn as isHoneyRoute,ln as isIpBlocked,H as isPrivateOrMetadata,Yt as isRaspEnabled,ie as loadVirtualPatches,M as normalizeHost,mn as noteHoneyRouteHit,Pn as patchForcesBlock,kn as raspContext,C as raspModeFor,lt as routeFromFinding,Ot as scoreCorpus,zn as scoreCorpusByKind,on as setSsrfLookup,ft as sinkFromRule,sn as ssrfHostFromUser,Tt as threatScore,it as wrapKnownPackage};
+`,"utf8"),writeFileSync(join(t,".fullshield-honey.json"),`${JSON.stringify({decoys:yn,canaries:{awsKey:n,dbUrl:e}},null,2)}
+`,"utf8"),Pe(t,[".env.backup",".fullshield-honey.json"]),ut([n,e]),{awsKey:n,dbUrl:e}}export{j as RASP_FAIL_OPEN,M as RASP_RULE,k as RaspBlockedError,E as addThreat,ge as clearRaspEvents,dn as clearThreats,X as contextFromRequest,m as currentRaspContext,Jt as decideResponse,U as decideSink,Qn as detectStructureChange,ye as disableRasp,ln as egressAllowed,Re as emitVirtualPatches,xt as enableRasp,me as enableRaspFromEnv,Z as enterRaspContext,Cn as findingsToVpatches,he as getRaspEvents,Ce as honeyInit,cn as hostIsBlocked,bn as isHoneyCanary,kn as isHoneyRoute,hn as isIpBlocked,W as isPrivateOrMetadata,pe as isRaspEnabled,xe as loadVirtualPatches,D as normalizeHost,wn as noteHoneyRouteHit,In as patchForcesBlock,Sn as raspContext,I as raspModeFor,Rt as routeFromFinding,Nt as scoreCorpus,Yn as scoreCorpusByKind,an as setSsrfLookup,St as sinkFromRule,fn as ssrfHostFromUser,Yt as threatScore,mt as wrapKnownPackage};

package/dist/runtime/register.js

@@ -1,6 +1,7 @@
-import {createRequire,register}from'module';import {AsyncLocalStorage}from'async_hooks';import st from'dns';import bt from'diagnostics_channel';var Xn=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),cn=new AsyncLocalStorage;function O(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)O(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))O(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function B(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])O(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))Xn.has(r.toLowerCase())||O(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function D(t,n){return cn.run(t,n)}function w(){return cn.getStore()}var an=6e4,Yn=1e3,j=new Map,ln=an,Gn=()=>Date.now();function pn(t){ln=t!==void 0&&Number.isFinite(t)&&t>=0?t:an;}function fn(t,n){for(j.delete(t),j.set(t,n);j.size>Yn;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function dn(t,n,e){let r=w();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Gn(),i=j.get(o);return !i||s-i.at>ln?(fn(o,{addresses:new Set(n),at:s}),false):(fn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function hn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function U(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>U(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>U(t[o],n[o]))}function $(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)$(r,n,e+1);return}for(let r of Object.values(t))$(r,n,e+1);}}function gn(t,n){let e=[];for(let i of n.objects)$(i,e,0);let r=e.filter(hn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),hn(i)&&r.some(c=>c===i||U(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function N(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function Jn(t,n){let e=N(t).replace(/\/+$/,""),r=N(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function nt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function yn(t){let n=N(t).split("/").filter(Boolean);return n[n.length-1]}function kn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:nt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!Jn(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=yn(n),o=yn(t);if(r&&r===o)return  true}return  false}var tt=new Set(["__proto__","constructor","prototype"]);function K(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(tt.has(r))return  true;return Array.isArray(t)?t.some(r=>K(r,n+1,e)):Object.values(t).some(r=>K(r,n+1,e))}function mn(t){let n=new Set;return t.objects.some(e=>K(e,0,n))}function et(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {createRequire,register}from'module';import {AsyncLocalStorage}from'async_hooks';import wt from'dns';import qt from'diagnostics_channel';var st="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var it=new Set(["sql","shell"]),q=[];function pn(){return process.env[st]==="1"}function dn(t,n){return pn()?t!=="block"?"monitor":it.has(n)?"block":"monitor":t}function hn(t,n,e,r){if(pn()&&(q=q.filter(o=>r-o<6e4),!(q.length>=5)))return q.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var ut="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";function O(){return process.env[ut]==="1"}function ct(t){let n="",e="";for(let r of t){if(e!==""){r===e&&(n+=e+e,e="");continue}if(r==="'"||r==='"'){e=r;continue}if(r>="0"&&r<="9"){n.endsWith("0")||(n+="0");continue}n+=r;}return n}function ft(t){let n=5381;for(let e=0;e<t.length;e+=1)n=Math.imul(n,33)^t.charCodeAt(e);return (n>>>0).toString(16).padStart(8,"0").slice(0,8)}function gn(t){if(O())return ft(ct(t))}function yn(t,n){if(!O()||n==="")return [];let e=[],r=t.split(`
+`);for(let o=0;o<r.length;o+=1){let s=r[o]??"";(s.includes(".query(")||s.includes("$queryRaw"))&&e.push(o+1);}return e}function kn(t){return O()?!(t>4096):true}function mn(t){return O()?t==="block-experimental"?"block":"monitor":t==="block"?"block":"monitor"}var lt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),bn=new AsyncLocalStorage;function T(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)T(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))T(r,n,e+1);}}function F(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)F(r,n,e+1);return}for(let r of Object.values(t))F(r,n,e+1);}}function $(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])T(r,n,0),F(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))lt.has(r.toLowerCase())||T(o,n,0);F(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function K(t,n){return bn.run(t,n)}function w(){return bn.getStore()}var Rn=6e4,pt=1e3,A=new Map,Sn=Rn,dt=()=>Date.now();function xn(t){Sn=t!==void 0&&Number.isFinite(t)&&t>=0?t:Rn;}function wn(t,n){for(A.delete(t),A.set(t,n);A.size>pt;){let e=A.keys().next().value;if(e===void 0)break;A.delete(e);}}function An(t,n,e){let r=w();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=dt(),i=A.get(o);return !i||s-i.at>Sn?(wn(o,{addresses:new Set(n),at:s}),false):(wn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function jn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function z(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>z(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>z(t[o],n[o]))}function Q(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)Q(r,n,e+1);return}for(let r of Object.values(t))Q(r,n,e+1);}}function En(t,n){let e=[];for(let i of n.objects)Q(i,e,0);let r=e.filter(jn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),jn(i)&&r.some(c=>c===i||z(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function G(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function ht(t,n){let e=G(t).replace(/\/+$/,""),r=G(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function gt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Pn(t){let n=G(t).split("/").filter(Boolean);return n[n.length-1]}function In(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:gt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!ht(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Pn(n),o=Pn(t);if(r&&r===o)return  true}return  false}var yt=new Set(["__proto__","constructor","prototype"]);function V(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(yt.has(r))return  true;return Array.isArray(t)?t.some(r=>V(r,n+1,e)):Object.values(t).some(r=>V(r,n+1,e))}function Ln(t){let n=new Set;return t.objects.some(e=>V(e,0,n))}function kt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function bn(t,n){if(!n)return  false;let e=et(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function rt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Cn(t,n){if(!n)return  false;let e=kt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function mt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function ot(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function z(t,n){if(!n)return  false;let e=rt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(ot(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function V(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function it(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Sn(t){let n=V(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(it);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ut(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function ct(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function Q(t){let n=V(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Sn(n);return e?ut(e):n.includes(":")?ct(n):false}function ft(t){let n=V(t);if(Sn(n)||n.includes(":"))return [n];try{let e=st.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function at(t){try{return ft(t)}catch{return []}}function Rn(t){if(Q(t))return  true;let n=at(t);for(let e of n)if(Q(e))return  true;return dn(t,n,Q)}function xn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Rn(r)||Rn(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function _(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var jn={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function lt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&z(e,r))return  true;return  false}function dt(t,n,e,r){if(t==="proto")return mn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return gn(n,e)?true:pt(n,e);for(let o of lt(n))for(let s of e.strings)if(s&&(t==="sql"&&z(o,s)||t==="shell"&&bn(o,s)||t==="path"&&kn(o,s,r)||t==="ssrf"&&xn(o,s)))return  true;return  false}function An(t,n,e,r){return dt(t,n,e,r)?{block:true,ruleId:jn[t]}:{block:false}}function Pn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var En=new Map,Z=new Map,ht={block:2,honey:5,anomaly:1},gt=900*1e3,X=false,Cn=gt;function In(t={}){X=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(Cn=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(En.get(t)??0)+ht[n];return En.set(t,r),X&&r>=10&&Z.set(t,e+Cn),r}function vn(t,n=Date.now()){if(!X)return  false;let e=Z.get(t);return e===void 0?false:n>=e?(Z.delete(t),false):true}var yt=["/admin.php","/.git/config","/wp-login.php"],kt=new Set,mt=6e4,Ln=new Map;function qn(t){let n=t.split("?")[0]??t;return yt.includes(n)}function On(t){if(!t)return  false;for(let n of kt)if(n&&t.includes(n))return  true;return  false}function Tn(t,n=Date.now()){let e=Ln.get(t);return e===void 0||n-e.start>mt?(Ln.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function _n(){return function(n,e,r){let o=B(n);try{let s=o.strings.some(c=>On(c));if(qn(o.path)&&!s){let c=Tn(o.ip);P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),vn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=M("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}D(o,()=>{r();});}}var R=createRequire(import.meta.url),q=[],l=new WeakSet,Un=false,Mn=false;function Rt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function St(t){let n=w();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function H(t,n,e){try{let r=w();if(r){let o=M(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Rt(n)}),P(r.ip,"block"),L(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=w();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function m(t,n,e,r){return H(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,q.push(()=>{r[n]=o;});}function xt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return m("sql",xt(r),void 0,()=>e.call(this,r,...o))});}function Fn(t,n){b(t,n,e=>function(r,...o){return m("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return m("shell",u,void 0,()=>r.call(this,...o))});}function Hn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return m("path",s,St(s),()=>e.call(this,r,...o))});}function $n(t){let n=Kn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Pn(e,n)){let r=w();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var Wn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Y(t,n){b(t,n,e=>function(r,...o){return m("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function G(t,n){b(t,n,e=>function(r,...o){return m("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function jt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Bn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,jt);}function J(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return _(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return _(n)}function At(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Dn(t){try{let n=At(t);n&&H("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return $n(s),m("ssrf",s,void 0,()=>r.call(this,...o))});}var Pt=Symbol.for("fullshield.rasp.wrapSqlite"),nn=Symbol.for("fullshield.rasp.sqliteWrapped"),W;function tn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Et(t){let n=tn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=tn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(W)try{return tn(W("node:sqlite",void 0,!1))}catch{}}function Ct(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function F(t){try{let n=Et(t);if(!n||n[nn])return;Object.defineProperty(n,nn,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),q.push(()=>{delete n[nn];});}catch{}}function It(){globalThis[Pt]=F;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Hn(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Hn(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",v),S(s,"get",v),S(i,"request",v),S(i,"get",v),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=_(p);return $n(h),(d?.redirect??"follow")!=="follow"?m("ssrf",h,void 0,()=>f.call(this,p,d)):(H("ssrf",h),(async()=>{let C=h,on=p;for(let sn=0;sn<8;sn+=1){let I=await f.call(this,on,{...d,redirect:"manual"});if(I.status<300||I.status>=400)return I;let un=I.headers.get("location");if(!un)return I;C=new URL(un,C).href,H("ssrf",C),on=C;}return f.call(this,C,d)})())},q.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return m("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");W=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Lt(String(f),h)}catch{return g({ruleId:A,path:w()?.path??"/",ip:w()?.ip??"unknown",sample:"hook-error"}),h}},q.push(()=>{c._load=y,W=void 0;});let rn=c.registerHooks;typeof rn=="function"&&!Mn&&(Mn=true,rn({load(f,p,d){let h=d(f,p);return Un&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&F(),h}})),Ct()&&F();}function vt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(_n()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Lt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return F(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Wn)Y(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Wn)Y(o,u);Fn(o,"$where");}let s=n.Model;s&&Y(s,"aggregate");let i=s?.prototype;return i&&Fn(i,"$where"),l.add(e),n}if(r==="axios")return Bn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Bn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",J);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",J),o.Agent?.prototype&&S(o.Agent.prototype,"request",J),l.add(e),n}if(r==="ejs"||r==="pug")return G(e,"render"),G(e,"compile"),l.add(e),n;if(r==="nunjucks")return G(e,"renderString"),l.add(e),n;if(r==="express"){vt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return m("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Nn(){Un=true,It();let t=bt.channel("undici:request:create");t.subscribe(Dn),q.push(()=>{t.unsubscribe(Dn);});}function zn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Qn=false,x={};function Ot(){return x.mode??"monitor"}function L(t,n){return zn(x.virtualPatches??[],t,n)?"block":Ot()}function Kn(){return x.egress?.allow}function M(t,n,e,r){return x.decide?x.decide(t,n,e):An(t,n,e,r)}function g(t){x.onEvent?.(t);}function Tt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},pn(t.dnsPinTtlMs),In({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Qn||(Nn(),Qn=true));}function Vn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Tt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Vn();try{register("./rasp/loader.js",import.meta.url);}catch{}
-export{k as RaspBlockedError,B as contextFromRequest,D as enterRaspContext};
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function bt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function X(t,n){if(!n)return  false;let e=mt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(bt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function J(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function Rt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function _n(t){let n=J(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(Rt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function St(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function xt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function Y(t){let n=J(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=_n(n);return e?St(e):n.includes(":")?xt(n):false}function At(t){let n=J(t);if(_n(n)||n.includes(":"))return [n];try{let e=wt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function jt(t){try{return At(t)}catch{return []}}function Mn(t){if(Y(t))return  true;let n=jt(t);for(let e of n)if(Y(e))return  true;return An(t,n,Y)}function qn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Mn(r)||Mn(s):false}function C(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function W(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var H={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},j="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function Et(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function Pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&X(e,r))return  true;return  false}function It(t,n,e,r){if(t==="proto")return Ln(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return En(n,e)?true:Pt(n,e);for(let o of Et(n))for(let s of e.strings)if(s&&(t==="sql"&&X(o,s)||t==="shell"&&Cn(o,s)||t==="path"&&In(o,s,r)||t==="ssrf"&&qn(o,s)))return  true;return  false}function On(t,n,e,r){return It(t,n,e,r)?{block:true,ruleId:H[t]}:{block:false}}function Tn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var Fn=new Map,Z=new Map,Lt={block:2,honey:5,anomaly:1},Ct=900*1e3,nn=false,Wn=Ct;function Hn(t={}){nn=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(Wn=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=(Fn.get(t)??0)+Lt[n];return Fn.set(t,r),nn&&r>=10&&Z.set(t,e+Wn),r}function Dn(t,n=Date.now()){if(!nn)return  false;let e=Z.get(t);return e===void 0?false:n>=e?(Z.delete(t),false):true}var vt=["/admin.php","/.git/config","/wp-login.php"],Mt=new Set,_t=6e4,Bn=new Map;function Un(t){let n=t.split("?")[0]??t;return vt.includes(n)}function Nn(t){if(!t)return  false;for(let n of Mt)if(n&&t.includes(n))return  true;return  false}function $n(t,n=Date.now()){let e=Bn.get(t);return e===void 0||n-e.start>_t?(Bn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Kn(){return function(n,e,r){let o=$(n);try{let s=o.strings.some(c=>Nn(c));if(Un(o.path)&&!s){let c=$n(o.ip);E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),Dn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=D("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),v(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}K(o,()=>{r();});}}var R=createRequire(import.meta.url),M=[],l=new WeakSet,Jn=false,zn=false;function Tt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Ft(t){let n=w();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function U(t,n,e){try{let r=w();if(r){let o=D(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Tt(n)}),E(r.ip,"block"),v(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=w();g({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function m(t,n,e,r){return U(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,M.push(()=>{r[n]=o;});}function Wt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return m("sql",Wt(r),void 0,()=>e.call(this,r,...o))});}function Qn(t,n){b(t,n,e=>function(r,...o){return m("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function P(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return m("shell",u,void 0,()=>r.call(this,...o))});}function Gn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return m("path",s,Ft(s),()=>e.call(this,r,...o))});}function Zn(t){let n=tt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Tn(e,n)){let r=w();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),v(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var Vn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function tn(t,n){b(t,n,e=>function(r,...o){return m("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function en(t,n){b(t,n,e=>function(r,...o){return m("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Ht(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Xn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Ht);}function rn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return W(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return W(n)}function Dt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Yn(t){try{let n=Dt(t);n&&U("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return Zn(s),m("ssrf",s,void 0,()=>r.call(this,...o))});}var Bt=Symbol.for("fullshield.rasp.wrapSqlite"),on=Symbol.for("fullshield.rasp.sqliteWrapped"),N;function sn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Ut(t){let n=sn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=sn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(N)try{return sn(N("node:sqlite",void 0,!1))}catch{}}function Nt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function B(t){try{let n=Ut(t);if(!n||n[on])return;Object.defineProperty(n,on,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),M.push(()=>{delete n[on];});}catch{}}function $t(){globalThis[Bt]=B;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))P(f,"exec",true),P(f,"execSync",true),P(f,"spawn",false),P(f,"spawnSync",false),P(f,"execFile",false),P(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Gn(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Gn(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",C),S(s,"get",C),S(i,"request",C),S(i,"get",C),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=W(p);return Zn(h),(d?.redirect??"follow")!=="follow"?m("ssrf",h,void 0,()=>f.call(this,p,d)):(U("ssrf",h),(async()=>{let I=h,fn=p;for(let an=0;an<8;an+=1){let L=await f.call(this,fn,{...d,redirect:"manual"});if(L.status<300||L.status>=400)return L;let ln=L.headers.get("location");if(!ln)return L;I=new URL(ln,I).href,U("ssrf",I),fn=I;}return f.call(this,I,d)})())},M.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return m("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");N=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return zt(String(f),h)}catch{return g({ruleId:j,path:w()?.path??"/",ip:w()?.ip??"unknown",sample:"hook-error"}),h}},M.push(()=>{c._load=y,N=void 0;});let cn=c.registerHooks;typeof cn=="function"&&!zn&&(zn=true,cn({load(f,p,d){let h=d(f,p);return Jn&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&B(),h}})),Nt()&&B();}function Kt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Kn()),o.__fullshieldRasp=!0);}catch{g({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function zt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return B(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Vn)tn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Vn)tn(o,u);Qn(o,"$where");}let s=n.Model;s&&tn(s,"aggregate");let i=s?.prototype;return i&&Qn(i,"$where"),l.add(e),n}if(r==="axios")return Xn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Xn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",rn);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",rn),o.Agent?.prototype&&S(o.Agent.prototype,"request",rn),l.add(e),n}if(r==="ejs"||r==="pug")return en(e,"render"),en(e,"compile"),l.add(e),n;if(r==="nunjucks")return en(e,"renderString"),l.add(e),n;if(r==="express"){Kt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return m("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function nt(){Jn=true,$t();let t=qt.channel("undici:request:create");t.subscribe(Yn),M.push(()=>{t.unsubscribe(Yn);});}function et(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var rt=false,x={},_=[],Qt=1e3,un=false;function Gt(t,n){if(!un)return;un=false;let e=_[_.length-1];if(!e||e.ruleId!==H[t])return;let r=hn(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);let o=t==="sql"?gn(e.sample):void 0;o!==void 0&&(e.fingerprint=o);let s=yn(e.sample,o??"");s.length>0&&(e.sinkLines=s),kn(Buffer.byteLength(e.sample))||(e.overCap=true);}function Vt(){return x.mode??"monitor"}function v(t,n){let e=et(x.virtualPatches??[],t,n)?"block":Vt(),r=dn(e,n);return Gt(n,r),r}function tt(){return x.egress?.allow}function D(t,n,e,r){return x.decide?x.decide(t,n,e):On(t,n,e,r)}function g(t){_.length>=Qt&&_.shift(),_.push(t),un=true,x.onEvent?.(t);}function Xt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},xn(t.dnsPinTtlMs),Hn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),rt||(nt(),rt=true));}function ot(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Xt({experimental:true,mode:mn(process.env.FULLSHIELD_RASP_MODE)});}ot();try{register("./rasp/loader.js",import.meta.url);}catch{}
+export{k as RaspBlockedError,$ as contextFromRequest,K as enterRaspContext};

package/models/index.json

@@ -1,5 +1,5 @@
 {
-  "fullshieldVersion": "3.2.2",
+  "fullshieldVersion": "3.3.2",
   "entries": [
     {
       "package": "express",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "3.2.2",
+  "version": "3.3.2",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",

package/templates/action/action.yml

@@ -45,7 +45,7 @@ runs:
       uses: actions/setup-node@v7
       with:
         node-version: '22'
-    - name: Install fullshield@3.2.2
+    - name: Install fullshield@3.3.2
       shell: bash
       run: npm install --global fullshield@${{ inputs.version }}
     - name: Cache FullShield baseline

package/templates/fullshield-bumps.yml

@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
-      - run: npx fullshield@3.2.2 bumps plan --from .fullshield/last-scan.json
+      - run: npx fullshield@3.3.2 bumps plan --from .fullshield/last-scan.json
         env:
           FULLSHIELD_EXPERIMENTAL_BUMP_PR: '1'
-      - run: npx fullshield@3.2.2 bumps open --from .fullshield/last-scan.json
+      - run: npx fullshield@3.3.2 bumps open --from .fullshield/last-scan.json
         env:
           FULLSHIELD_EXPERIMENTAL_BUMP_PR: '1'

package/templates/github-workflow-action.yml

@@ -15,7 +15,7 @@ jobs:
       # Example Marketplace ref once published: kathanp/fullshield-action@<sha>
       - uses: ./templates/action
         with:
-          version: '3.2.2'
+          version: '3.3.2'
           fail-on: high
           cache-baseline: 'true'
           upload-sarif: 'true'

package/templates/github-workflow-diff.yml

@@ -10,6 +10,6 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - run: npx fullshield@3.2.2 scan --diff
+      - run: npx fullshield@3.3.2 scan --diff
         env:
           FULLSHIELD_EXPERIMENTAL_DIFFSCAN: '1'