fullshield 3.3.1 → 3.3.2

package/dist/runtime/auto.js

@@ -1,5 +1,6 @@
-import {AsyncLocalStorage}from'async_hooks';import pt from'dns';import Pt from'diagnostics_channel';import {createRequire}from'module';var nt="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var tt=new Set(["sql","shell"]),O=[];function fn(){return process.env[nt]==="1"}function an(t,n){return fn()?t!=="block"?"monitor":tt.has(n)?"block":"monitor":t}function ln(t,n,e,r){if(fn()&&(O=O.filter(o=>r-o<6e4),!(O.length>=5)))return O.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var rt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),pn=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function dn(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))rt.has(r.toLowerCase())||q(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function hn(t,n){return pn.run(t,n)}function m(){return pn.getStore()}var yn=6e4,ot=1e3,j=new Map,kn=yn,st=()=>Date.now();function bn(t){kn=t!==void 0&&Number.isFinite(t)&&t>=0?t:yn;}function gn(t,n){for(j.delete(t),j.set(t,n);j.size>ot;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function mn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=st(),i=j.get(o);return !i||s-i.at>kn?(gn(o,{addresses:new Set(n),at:s}),false):(gn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function wn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function U(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>U(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>U(t[o],n[o]))}function $(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)$(r,n,e+1);return}for(let r of Object.values(t))$(r,n,e+1);}}function Rn(t,n){let e=[];for(let i of n.objects)$(i,e,0);let r=e.filter(wn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),wn(i)&&r.some(c=>c===i||U(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function K(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function it(t,n){let e=K(t).replace(/\/+$/,""),r=K(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function ut(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Sn(t){let n=K(t).split("/").filter(Boolean);return n[n.length-1]}function xn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:ut(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!it(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Sn(n),o=Sn(t);if(r&&r===o)return  true}return  false}var ct=new Set(["__proto__","constructor","prototype"]);function z(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(ct.has(r))return  true;return Array.isArray(t)?t.some(r=>z(r,n+1,e)):Object.values(t).some(r=>z(r,n+1,e))}function jn(t){let n=new Set;return t.objects.some(e=>z(e,0,n))}function ft(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {AsyncLocalStorage}from'async_hooks';import wt from'dns';import qt from'diagnostics_channel';import {createRequire}from'module';var st="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var it=new Set(["sql","shell"]),q=[];function an(){return process.env[st]==="1"}function ln(t,n){return an()?t!=="block"?"monitor":it.has(n)?"block":"monitor":t}function pn(t,n,e,r){if(an()&&(q=q.filter(o=>r-o<6e4),!(q.length>=5)))return q.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var ut="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";function O(){return process.env[ut]==="1"}function ct(t){let n="",e="";for(let r of t){if(e!==""){r===e&&(n+=e+e,e="");continue}if(r==="'"||r==='"'){e=r;continue}if(r>="0"&&r<="9"){n.endsWith("0")||(n+="0");continue}n+=r;}return n}function ft(t){let n=5381;for(let e=0;e<t.length;e+=1)n=Math.imul(n,33)^t.charCodeAt(e);return (n>>>0).toString(16).padStart(8,"0").slice(0,8)}function dn(t){if(O())return ft(ct(t))}function hn(t,n){if(!O()||n==="")return [];let e=[],r=t.split(`
+`);for(let o=0;o<r.length;o+=1){let s=r[o]??"";(s.includes(".query(")||s.includes("$queryRaw"))&&e.push(o+1);}return e}function gn(t){return O()?!(t>4096):true}function yn(t){return O()?t==="block-experimental"?"block":"monitor":t==="block"?"block":"monitor"}var lt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),kn=new AsyncLocalStorage;function T(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)T(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))T(r,n,e+1);}}function F(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)F(r,n,e+1);return}for(let r of Object.values(t))F(r,n,e+1);}}function bn(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])T(r,n,0),F(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))lt.has(r.toLowerCase())||T(o,n,0);F(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function mn(t,n){return kn.run(t,n)}function m(){return kn.getStore()}var Sn=6e4,pt=1e3,A=new Map,Rn=Sn,dt=()=>Date.now();function xn(t){Rn=t!==void 0&&Number.isFinite(t)&&t>=0?t:Sn;}function wn(t,n){for(A.delete(t),A.set(t,n);A.size>pt;){let e=A.keys().next().value;if(e===void 0)break;A.delete(e);}}function An(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=dt(),i=A.get(o);return !i||s-i.at>Rn?(wn(o,{addresses:new Set(n),at:s}),false):(wn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function jn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function $(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>$(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>$(t[o],n[o]))}function K(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)K(r,n,e+1);return}for(let r of Object.values(t))K(r,n,e+1);}}function En(t,n){let e=[];for(let i of n.objects)K(i,e,0);let r=e.filter(jn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),jn(i)&&r.some(c=>c===i||$(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function z(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function ht(t,n){let e=z(t).replace(/\/+$/,""),r=z(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function gt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Pn(t){let n=z(t).split("/").filter(Boolean);return n[n.length-1]}function In(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:gt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!ht(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Pn(n),o=Pn(t);if(r&&r===o)return  true}return  false}var yt=new Set(["__proto__","constructor","prototype"]);function Q(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(yt.has(r))return  true;return Array.isArray(t)?t.some(r=>Q(r,n+1,e)):Object.values(t).some(r=>Q(r,n+1,e))}function Ln(t){let n=new Set;return t.objects.some(e=>Q(e,0,n))}function kt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function An(t,n){if(!n)return  false;let e=ft(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function at(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Cn(t,n){if(!n)return  false;let e=kt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function bt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function lt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function Q(t,n){if(!n)return  false;let e=at(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(lt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function G(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function dt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function In(t){let n=G(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(dt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ht(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function gt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function V(t){let n=G(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=In(n);return e?ht(e):n.includes(":")?gt(n):false}function yt(t){let n=G(t);if(In(n)||n.includes(":"))return [n];try{let e=pt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function kt(t){try{return yt(t)}catch{return []}}function En(t){if(V(t))return  true;let n=kt(t);for(let e of n)if(V(e))return  true;return mn(t,n,V)}function vn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?En(r)||En(s):false}function C(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function F(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var W={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function bt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function mt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&Q(e,r))return  true;return  false}function wt(t,n,e,r){if(t==="proto")return jn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return Rn(n,e)?true:mt(n,e);for(let o of bt(n))for(let s of e.strings)if(s&&(t==="sql"&&Q(o,s)||t==="shell"&&An(o,s)||t==="path"&&xn(o,s,r)||t==="ssrf"&&vn(o,s)))return  true;return  false}function Cn(t,n,e,r){return wt(t,n,e,r)?{block:true,ruleId:W[t]}:{block:false}}function Ln(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var Mn=new Map,X=new Map,Rt={block:2,honey:5,anomaly:1},St=900*1e3,J=false,_n=St;function On(t={}){J=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(_n=t.maxBlockMs);}function P(t,n,e=Date.now()){let r=(Mn.get(t)??0)+Rt[n];return Mn.set(t,r),J&&r>=10&&X.set(t,e+_n),r}function qn(t,n=Date.now()){if(!J)return  false;let e=X.get(t);return e===void 0?false:n>=e?(X.delete(t),false):true}var xt=["/admin.php","/.git/config","/wp-login.php"],jt=new Set,At=6e4,Tn=new Map;function Fn(t){let n=t.split("?")[0]??t;return xt.includes(n)}function Wn(t){if(!t)return  false;for(let n of jt)if(n&&t.includes(n))return  true;return  false}function Hn(t,n=Date.now()){let e=Tn.get(t);return e===void 0||n-e.start>At?(Tn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Dn(){return function(n,e,r){let o=dn(n);try{let s=o.strings.some(c=>Wn(c));if(Fn(o.path)&&!s){let c=Hn(o.ip);P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(P(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),qn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=H("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}hn(o,()=>{r();});}}var R=createRequire(import.meta.url),M=[],l=new WeakSet,Qn=false,Bn=false;function It(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function vt(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function B(t,n,e){try{let r=m();if(r){let o=H(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:It(n)}),P(r.ip,"block"),L(r.path,t)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=m();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function k(t,n,e,r){return B(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,M.push(()=>{r[n]=o;});}function Ct(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return k("sql",Ct(r),void 0,()=>e.call(this,r,...o))});}function Nn(t,n){b(t,n,e=>function(r,...o){return k("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function E(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return k("shell",u,void 0,()=>r.call(this,...o))});}function Un(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return k("path",s,vt(s),()=>e.call(this,r,...o))});}function Vn(t){let n=Xn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Ln(e,n)){let r=m();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&P(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}var $n=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Z(t,n){b(t,n,e=>function(r,...o){return k("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function Y(t,n){b(t,n,e=>function(r,...o){return k("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Lt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Kn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Lt);}function nn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return F(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return F(n)}function Mt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function zn(t){try{let n=Mt(t);n&&B("ssrf",n);}catch(n){if(n instanceof w)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return Vn(s),k("ssrf",s,void 0,()=>r.call(this,...o))});}var _t=Symbol.for("fullshield.rasp.wrapSqlite"),tn=Symbol.for("fullshield.rasp.sqliteWrapped"),N;function en(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Ot(t){let n=en(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=en(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(N)try{return en(N("node:sqlite",void 0,!1))}catch{}}function qt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function D(t){try{let n=Ot(t);if(!n||n[tn])return;Object.defineProperty(n,tn,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),M.push(()=>{delete n[tn];});}catch{}}function Tt(){globalThis[_t]=D;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))E(f,"exec",true),E(f,"execSync",true),E(f,"spawn",false),E(f,"spawnSync",false),E(f,"execFile",false),E(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Un(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Un(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",C),S(s,"get",C),S(i,"request",C),S(i,"get",C),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=F(p);return Vn(h),(d?.redirect??"follow")!=="follow"?k("ssrf",h,void 0,()=>f.call(this,p,d)):(B("ssrf",h),(async()=>{let I=h,sn=p;for(let un=0;un<8;un+=1){let v=await f.call(this,sn,{...d,redirect:"manual"});if(v.status<300||v.status>=400)return v;let cn=v.headers.get("location");if(!cn)return v;I=new URL(cn,I).href,B("ssrf",I),sn=I;}return f.call(this,I,d)})())},M.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return k("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");N=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Wt(String(f),h)}catch{return g({ruleId:A,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),h}},M.push(()=>{c._load=y,N=void 0;});let on=c.registerHooks;typeof on=="function"&&!Bn&&(Bn=true,on({load(f,p,d){let h=d(f,p);return Qn&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&D(),h}})),qt()&&D();}function Ft(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Dn()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Wt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return D(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of $n)Z(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of $n)Z(o,u);Nn(o,"$where");}let s=n.Model;s&&Z(s,"aggregate");let i=s?.prototype;return i&&Nn(i,"$where"),l.add(e),n}if(r==="axios")return Kn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Kn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",nn);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",nn),o.Agent?.prototype&&S(o.Agent.prototype,"request",nn),l.add(e),n}if(r==="ejs"||r==="pug")return Y(e,"render"),Y(e,"compile"),l.add(e),n;if(r==="nunjucks")return Y(e,"renderString"),l.add(e),n;if(r==="express"){Ft(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return k("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Gn(){Qn=true,Tt();let t=Pt.channel("undici:request:create");t.subscribe(zn),M.push(()=>{t.unsubscribe(zn);});}function Jn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Zn=false,x={},_=[],Ht=1e3,rn=false;function Dt(t,n){if(!rn)return;rn=false;let e=_[_.length-1];if(!e||e.ruleId!==W[t])return;let r=ln(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);}function Bt(){return x.mode??"monitor"}function L(t,n){let e=Jn(x.virtualPatches??[],t,n)?"block":Bt(),r=an(e,n);return Dt(n,r),r}function Xn(){return x.egress?.allow}function H(t,n,e,r){return x.decide?x.decide(t,n,e):Cn(t,n,e,r)}function g(t){_.length>=Ht&&_.shift(),_.push(t),rn=true,x.onEvent?.(t);}function Nt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},bn(t.dnsPinTtlMs),On({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Zn||(Gn(),Zn=true));}function Yn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Nt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Yn();
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function mt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function G(t,n){if(!n)return  false;let e=bt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(mt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function X(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function St(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function _n(t){let n=X(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(St);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Rt(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function xt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function V(t){let n=X(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=_n(n);return e?Rt(e):n.includes(":")?xt(n):false}function At(t){let n=X(t);if(_n(n)||n.includes(":"))return [n];try{let e=wt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function jt(t){try{return At(t)}catch{return []}}function Mn(t){if(V(t))return  true;let n=jt(t);for(let e of n)if(V(e))return  true;return An(t,n,V)}function qn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Mn(r)||Mn(s):false}function C(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function W(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var H={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},j="RASP-FAIL-OPEN-001",w=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function Et(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function Pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&G(e,r))return  true;return  false}function It(t,n,e,r){if(t==="proto")return Ln(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return En(n,e)?true:Pt(n,e);for(let o of Et(n))for(let s of e.strings)if(s&&(t==="sql"&&G(o,s)||t==="shell"&&Cn(o,s)||t==="path"&&In(o,s,r)||t==="ssrf"&&qn(o,s)))return  true;return  false}function On(t,n,e,r){return It(t,n,e,r)?{block:true,ruleId:H[t]}:{block:false}}function Tn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var Fn=new Map,Y=new Map,Lt={block:2,honey:5,anomaly:1},Ct=900*1e3,J=false,Wn=Ct;function Hn(t={}){J=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(Wn=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=(Fn.get(t)??0)+Lt[n];return Fn.set(t,r),J&&r>=10&&Y.set(t,e+Wn),r}function Dn(t,n=Date.now()){if(!J)return  false;let e=Y.get(t);return e===void 0?false:n>=e?(Y.delete(t),false):true}var vt=["/admin.php","/.git/config","/wp-login.php"],Mt=new Set,_t=6e4,Bn=new Map;function Un(t){let n=t.split("?")[0]??t;return vt.includes(n)}function Nn(t){if(!t)return  false;for(let n of Mt)if(n&&t.includes(n))return  true;return  false}function $n(t,n=Date.now()){let e=Bn.get(t);return e===void 0||n-e.start>_t?(Bn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Kn(){return function(n,e,r){let o=bn(n);try{let s=o.strings.some(c=>Nn(c));if(Un(o.path)&&!s){let c=$n(o.ip);E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),Dn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=D("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),v(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof w){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}mn(o,()=>{r();});}}var S=createRequire(import.meta.url),M=[],l=new WeakSet,Jn=false,zn=false;function Tt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Ft(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function U(t,n,e){try{let r=m();if(r){let o=D(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Tt(n)}),E(r.ip,"block"),v(r.path,t)==="block"))throw new w(o.ruleId)}}catch(r){if(r instanceof w)throw r;let o=m();g({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function k(t,n,e,r){return U(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,M.push(()=>{r[n]=o;});}function Wt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return k("sql",Wt(r),void 0,()=>e.call(this,r,...o))});}function Qn(t,n){b(t,n,e=>function(r,...o){return k("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function P(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return k("shell",u,void 0,()=>r.call(this,...o))});}function Gn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return k("path",s,Ft(s),()=>e.call(this,r,...o))});}function Zn(t){let n=tt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Tn(e,n)){let r=m();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),v(r?.path??"/","ssrf")==="block")throw new w("RASP-EGRESS-001")}}var Vn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Z(t,n){b(t,n,e=>function(r,...o){return k("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function nn(t,n){b(t,n,e=>function(r,...o){return k("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Ht(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Xn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])R(t,n,Ht);}function tn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return W(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return W(n)}function Dt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Yn(t){try{let n=Dt(t);n&&U("ssrf",n);}catch(n){if(n instanceof w)return;throw n}}function R(t,n,e){b(t,n,r=>function(...o){let s=e(o);return Zn(s),k("ssrf",s,void 0,()=>r.call(this,...o))});}var Bt=Symbol.for("fullshield.rasp.wrapSqlite"),en=Symbol.for("fullshield.rasp.sqliteWrapped"),N;function rn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Ut(t){let n=rn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=rn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(N)try{return rn(N("node:sqlite",void 0,!1))}catch{}}function Nt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function B(t){try{let n=Ut(t);if(!n||n[en])return;Object.defineProperty(n,en,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),M.push(()=>{delete n[en];});}catch{}}function $t(){globalThis[Bt]=B;let t=S("node:child_process"),n=S("child_process");for(let f of new Set([t,n]))P(f,"exec",true),P(f,"execSync",true),P(f,"spawn",false),P(f,"spawnSync",false),P(f,"execFile",false),P(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=S("node:fs"),o=S("fs");for(let f of new Set([r,o]))for(let p of e)Gn(f,p);try{let f=S("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Gn(f,p);}catch{}let s=S("node:http"),i=S("node:https");if(R(s,"request",C),R(s,"get",C),R(i,"request",C),R(i,"get",C),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=W(p);return Zn(h),(d?.redirect??"follow")!=="follow"?k("ssrf",h,void 0,()=>f.call(this,p,d)):(U("ssrf",h),(async()=>{let I=h,un=p;for(let cn=0;cn<8;cn+=1){let L=await f.call(this,un,{...d,redirect:"manual"});if(L.status<300||L.status>=400)return L;let fn=L.headers.get("location");if(!fn)return L;I=new URL(fn,I).href,U("ssrf",I),un=I;}return f.call(this,I,d)})())},M.push(()=>{globalThis.fetch=f;});}let u=S("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return k("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=S("node:module");N=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return zt(String(f),h)}catch{return g({ruleId:j,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),h}},M.push(()=>{c._load=y,N=void 0;});let sn=c.registerHooks;typeof sn=="function"&&!zn&&(zn=true,sn({load(f,p,d){let h=d(f,p);return Jn&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&B(),h}})),Nt()&&B();}function Kt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Kn()),o.__fullshieldRasp=!0);}catch{g({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function zt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return B(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Vn)Z(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Vn)Z(o,u);Qn(o,"$where");}let s=n.Model;s&&Z(s,"aggregate");let i=s?.prototype;return i&&Qn(i,"$where"),l.add(e),n}if(r==="axios")return Xn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Xn(i),i}),l.add(e),n;if(r==="undici"){R(e,"request",tn);let o=n;return o.Dispatcher?.prototype&&R(o.Dispatcher.prototype,"request",tn),o.Agent?.prototype&&R(o.Agent.prototype,"request",tn),l.add(e),n}if(r==="ejs"||r==="pug")return nn(e,"render"),nn(e,"compile"),l.add(e),n;if(r==="nunjucks")return nn(e,"renderString"),l.add(e),n;if(r==="express"){Kt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return k("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function nt(){Jn=true,$t();let t=qt.channel("undici:request:create");t.subscribe(Yn),M.push(()=>{t.unsubscribe(Yn);});}function et(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var rt=false,x={},_=[],Qt=1e3,on=false;function Gt(t,n){if(!on)return;on=false;let e=_[_.length-1];if(!e||e.ruleId!==H[t])return;let r=pn(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);let o=t==="sql"?dn(e.sample):void 0;o!==void 0&&(e.fingerprint=o);let s=hn(e.sample,o??"");s.length>0&&(e.sinkLines=s),gn(Buffer.byteLength(e.sample))||(e.overCap=true);}function Vt(){return x.mode??"monitor"}function v(t,n){let e=et(x.virtualPatches??[],t,n)?"block":Vt(),r=ln(e,n);return Gt(n,r),r}function tt(){return x.egress?.allow}function D(t,n,e,r){return x.decide?x.decide(t,n,e):On(t,n,e,r)}function g(t){_.length>=Qt&&_.shift(),_.push(t),on=true,x.onEvent?.(t);}function Xt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},xn(t.dnsPinTtlMs),Hn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),rt||(nt(),rt=true));}function ot(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Xt({experimental:true,mode:yn(process.env.FULLSHIELD_RASP_MODE)});}ot();

package/dist/runtime/rasp.js

@@ -1,14 +1,15 @@
-import {AsyncLocalStorage}from'async_hooks';import It from'dns';import Kt from'diagnostics_channel';import {createRequire}from'module';import {mkdirSync,writeFileSync,readFileSync,existsSync}from'fs';import {dirname,join}from'path';var wt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),Fn=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function H(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)H(r,n,e+1);return}for(let r of Object.values(t))H(r,n,e+1);}}function J(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),H(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))wt.has(r.toLowerCase())||q(o,n,0);H(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function X(t,n){return Fn.run(t,n)}function m(){return Fn.getStore()}function Tn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function Z(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>Z(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>Z(t[o],n[o]))}function nn(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)nn(r,n,e+1);return}for(let r of Object.values(t))nn(r,n,e+1);}}function qn(t,n){let e=[];for(let i of n.objects)nn(i,e,0);let r=e.filter(Tn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),Tn(i)&&r.some(c=>c===i||Z(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function tn(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function St(t,n){let e=tn(t).replace(/\/+$/,""),r=tn(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function Rt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Hn(t){let n=tn(t).split("/").filter(Boolean);return n[n.length-1]}function Wn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:Rt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!St(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Hn(n),o=Hn(t);if(r&&r===o)return  true}return  false}var xt=new Set(["__proto__","constructor","prototype"]);function en(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(xt.has(r))return  true;return Array.isArray(t)?t.some(r=>en(r,n+1,e)):Object.values(t).some(r=>en(r,n+1,e))}function Dn(t){let n=new Set;return t.objects.some(e=>en(e,0,n))}function At(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {AsyncLocalStorage}from'async_hooks';import Mt from'dns';import Zt from'diagnostics_channel';import {createRequire}from'module';import {mkdirSync,writeFileSync,readFileSync,existsSync}from'fs';import {dirname,join}from'path';var jt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),Fn=new AsyncLocalStorage;function T(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)T(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))T(r,n,e+1);}}function H(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)H(r,n,e+1);return}for(let r of Object.values(t))H(r,n,e+1);}}function X(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])T(r,n,0),H(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))jt.has(r.toLowerCase())||T(o,n,0);H(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function Z(t,n){return Fn.run(t,n)}function m(){return Fn.getStore()}function Tn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function nn(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>nn(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>nn(t[o],n[o]))}function tn(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)tn(r,n,e+1);return}for(let r of Object.values(t))tn(r,n,e+1);}}function Hn(t,n){let e=[];for(let i of n.objects)tn(i,e,0);let r=e.filter(Tn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),Tn(i)&&r.some(c=>c===i||nn(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function en(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function Et(t,n){let e=en(t).replace(/\/+$/,""),r=en(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function Pt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Wn(t){let n=en(t).split("/").filter(Boolean);return n[n.length-1]}function Dn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:Pt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!Et(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Wn(n),o=Wn(t);if(r&&r===o)return  true}return  false}var Ct=new Set(["__proto__","constructor","prototype"]);function rn(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(Ct.has(r))return  true;return Array.isArray(t)?t.some(r=>rn(r,n+1,e)):Object.values(t).some(r=>rn(r,n+1,e))}function Bn(t){let n=new Set;return t.objects.some(e=>rn(e,0,n))}function It(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let p=1;for(;e<r&&p>0;)t[e]===i?p+=1:t[e]===u&&(p-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Bn(t,n){if(!n)return  false;let e=At(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function jt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let p=1;for(;e<r&&p>0;)t[e]===i?p+=1:t[e]===u&&(p-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Un(t,n){if(!n)return  false;let e=It(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function Lt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function Et(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function rn(t,n){if(!n)return  false;let e=jt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(Et(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}var Un=6e4,Pt=1e3,A=new Map,$n=Un,Ct=()=>Date.now();function on(t){$n=t!==void 0&&Number.isFinite(t)&&t>=0?t:Un;}function Kn(){A.clear();}function Nn(t,n){for(A.delete(t),A.set(t,n);A.size>Pt;){let e=A.keys().next().value;if(e===void 0)break;A.delete(e);}}function Vn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Ct(),i=A.get(o);return !i||s-i.at>$n?(Nn(o,{addresses:new Set(n),at:s}),false):(Nn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}var sn;function cn(t){sn=t;}function D(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function vt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function zn(t){let n=D(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(vt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],p=r[2];return o>255||c>255||p>65535?void 0:[o,c,p>>>8&255,p&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Lt(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function Ot(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function W(t){let n=D(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=zn(n);return e?Lt(e):n.includes(":")?Ot(n):false}function _t(t){let n=D(t);if(zn(n)||n.includes(":"))return [n];if(sn)return sn(n);try{let e=It.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function Mt(t){try{return _t(t)}catch{return []}}function un(t){if(W(t))return  true;let n=Mt(t);for(let e of n)if(W(e))return  true;return Vn(t,n,W)}function an(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?un(r)||un(s):false}function _(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function B(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var M={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},j="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function Ft(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function Tt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&rn(e,r))return  true;return  false}function Qn(t,n,e,r){if(t==="proto")return Dn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return qn(n,e)?true:Tt(n,e);for(let o of Ft(n))for(let s of e.strings)if(s&&(t==="sql"&&rn(o,s)||t==="shell"&&Bn(o,s)||t==="path"&&Wn(o,s,r)||t==="ssrf"&&an(o,s)))return  true;return  false}function N(t,n,e,r){return Qn(t,n,e,r)?{block:true,ruleId:M[t]}:{block:false}}function qt(t){let n=t.kind,e=t.input;if(n==="proto"||e!==null&&typeof e=="object")return {path:"/",ip:"test",strings:[],objects:e!==null&&typeof e=="object"?[e]:[]};let r=typeof e=="string"||typeof e=="number"||typeof e=="boolean"?String(e):"";return {path:"/",ip:"test",strings:r?[r]:[],objects:[]}}function Gn(t){let n={},e=0;for(let r of t){let o=typeof r.kind=="string"?r.kind:"unknown",s=qt(r),i=o==="proto"?null:r.sink??r.input,u=typeof r.base=="string"?r.base:void 0,c=N(o,i,s,u).block,p=n[o]??{blocked:0,total:0};p.total+=1,c&&(p.blocked+=1,e+=1),n[o]=p;}return {blocked:e,total:t.length,byKind:n}}function Ht(t){let{blocked:n,total:e}=Gn(t);return {blocked:n,total:e}}var Wt="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var Dt=new Set(["sql","shell"]),F=[];function Yn(){return process.env[Wt]==="1"}function Jn(t,n){return Yn()?t!=="block"?"monitor":Dt.has(n)?"block":"monitor":t}function Xn(){F=[];}function Zn(t,n,e,r){if(Yn()&&(F=F.filter(o=>r-o<6e4),!(F.length>=5)))return F.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}function fn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var U=new Map,$=new Map,Bt={block:2,honey:5,anomaly:1},nt=900*1e3,K=false,ln=nt;function tt(t={}){K=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(ln=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=(U.get(t)??0)+Bt[n];return U.set(t,r),K&&r>=10&&$.set(t,e+ln),r}function Nt(t){return U.get(t)??0}function pn(){U.clear(),$.clear(),K=false,ln=nt;}function Ut(t){return t>=10?"block":t>=5?"challenge":"log"}function dn(t,n=Date.now()){if(!K)return  false;let e=$.get(t);return e===void 0?false:n>=e?($.delete(t),false):true}var gn=["/admin.php","/.git/config","/wp-login.php"],yn=new Set,$t=6e4,hn=new Map;function et(t){for(let n of t)yn.add(n);}function rt(){yn.clear(),hn.clear();}function mn(t){let n=t.split("?")[0]??t;return gn.includes(n)}function kn(t){if(!t)return  false;for(let n of yn)if(n&&t.includes(n))return  true;return  false}function bn(t,n=Date.now()){let e=hn.get(t);return e===void 0||n-e.start>$t?(hn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function wn(){return function(n,e,r){let o=J(n);try{let s=o.strings.some(c=>kn(c));if(mn(o.path)&&!s){let c=bn(o.ip);E(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),dn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=V("proto",null,o);if(u.block&&u.ruleId&&(y({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),I(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}y({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}X(o,()=>{r();});}}var S=createRequire(import.meta.url),P=[],l=new WeakSet,En=false,ot=false;function zt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Qt(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function Q(t,n,e){try{let r=m();if(r){let o=V(t,n,r,e);if(o.block&&o.ruleId&&(y({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:zt(n)}),E(r.ip,"block"),I(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=m();y({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return Q(t,n,e),r()}function w(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,P.push(()=>{r[n]=o;});}function Gt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function f(t,n){w(t,n,e=>function(r,...o){return b("sql",Gt(r),void 0,()=>e.call(this,r,...o))});}function st(t,n){w(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function v(t,n,e){w(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function it(t,n){w(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,Qt(s),()=>e.call(this,r,...o))});}function ft(t){let n=gt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!fn(e,n)){let r=m();if(y({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),I(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var ut=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Sn(t,n){w(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function Rn(t,n){w(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Yt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function ct(t){for(let n of ["request","get","post","put","patch","delete","head","options"])R(t,n,Yt);}function xn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return B(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return B(n)}function Jt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function at(t){try{let n=Jt(t);n&&Q("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function R(t,n,e){w(t,n,r=>function(...o){let s=e(o);return ft(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var lt=Symbol.for("fullshield.rasp.wrapSqlite"),An=Symbol.for("fullshield.rasp.sqliteWrapped"),G;function jn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Xt(t){let n=jn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=jn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(G)try{return jn(G("node:sqlite",void 0,!1))}catch{}}function Zt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function z(t){try{let n=Xt(t);if(!n||n[An])return;Object.defineProperty(n,An,{value:!0,configurable:!0}),f(n,"exec"),f(n,"prepare"),P.push(()=>{delete n[An];});}catch{}}function ne(){globalThis[lt]=z;let t=S("node:child_process"),n=S("child_process");for(let a of new Set([t,n]))v(a,"exec",true),v(a,"execSync",true),v(a,"spawn",false),v(a,"spawnSync",false),v(a,"execFile",false),v(a,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=S("node:fs"),o=S("fs");for(let a of new Set([r,o]))for(let d of e)it(a,d);try{let a=S("node:fs/promises");for(let d of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])it(a,d);}catch{}let s=S("node:http"),i=S("node:https");if(R(s,"request",_),R(s,"get",_),R(i,"request",_),R(i,"get",_),typeof globalThis.fetch=="function"){let a=globalThis.fetch;globalThis.fetch=function(d,h){let g=B(d);return ft(g),(h?.redirect??"follow")!=="follow"?b("ssrf",g,void 0,()=>a.call(this,d,h)):(Q("ssrf",g),(async()=>{let L=g,On=d;for(let _n=0;_n<8;_n+=1){let O=await a.call(this,On,{...h,redirect:"manual"});if(O.status<300||O.status>=400)return O;let Mn=O.headers.get("location");if(!Mn)return O;L=new URL(Mn,L).href,Q("ssrf",L),On=L;}return a.call(this,L,h)})())},P.push(()=>{globalThis.fetch=a;});}let u=S("node:vm");for(let a of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,a,d=>function(h,...g){return b("sql",typeof h=="string"?h:"",void 0,()=>d.call(this,h,...g))});let c=S("node:module");G=c._load.bind(c);let p=c._load;c._load=function(a,d,h){let g=p.call(this,a,d,h);try{return pt(String(a),g)}catch{return y({ruleId:j,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),g}},P.push(()=>{c._load=p,G=void 0;});let Ln=c.registerHooks;typeof Ln=="function"&&!ot&&(ot=true,Ln({load(a,d,h){let g=h(a,d);return En&&typeof a=="string"&&(a==="node:sqlite"||a.startsWith("node:sqlite"))&&z(),g}})),Zt()&&z();}function te(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(wn()),o.__fullshieldRasp=!0);}catch{y({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function pt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return z(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&f(o.Client.prototype,"query"),o.Pool?.prototype&&f(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(f(s,"query"),f(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(f(o,"exec"),f(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(f(o,"$queryRawUnsafe"),f(o,"$executeRawUnsafe"),f(o,"$queryRaw"),f(o,"$executeRaw"));let s=n.Prisma;return s&&f(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&f(s,"query"),typeof o.literal=="function"&&f(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&f(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&f(e,"raw");let o=n.Client?.prototype;return o&&(f(o,"raw"),f(o,"whereRaw"),f(o,"orderByRaw"),f(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&f(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&f(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&f(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of ut)Sn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of ut)Sn(o,u);st(o,"$where");}let s=n.Model;s&&Sn(s,"aggregate");let i=s?.prototype;return i&&st(i,"$where"),l.add(e),n}if(r==="axios")return ct(e),w(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&ct(i),i}),l.add(e),n;if(r==="undici"){R(e,"request",xn);let o=n;return o.Dispatcher?.prototype&&R(o.Dispatcher.prototype,"request",xn),o.Agent?.prototype&&R(o.Agent.prototype,"request",xn),l.add(e),n}if(r==="ejs"||r==="pug")return Rn(e,"render"),Rn(e,"compile"),l.add(e),n;if(r==="nunjucks")return Rn(e,"renderString"),l.add(e),n;if(r==="express"){te(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function dt(){En=true,ne();let t=Kt.channel("undici:request:create");t.subscribe(at),P.push(()=>{t.unsubscribe(at);});}function ht(){for(En=false,delete globalThis[lt];P.length>0;)P.pop()?.();}function yt(t){let n=t.toUpperCase();if(n.includes("SQLI")||n.includes("SQL-"))return "sql";if(n.includes("CMDI")||n.includes("SHELL"))return "shell";if(n.includes("PATH"))return "path";if(n.includes("NOSQL"))return "nosql";if(n.includes("SSRF"))return "ssrf";if(n.includes("PROTO"))return "proto"}function mt(t){if(typeof t.route=="string"&&t.route.startsWith("/"))return t.route;let n=(t.message??"").match(/\/[A-Za-z0-9._/-]+/);if(n)return n[0];if(t.file){let e=Math.max(t.file.lastIndexOf("/"),t.file.lastIndexOf("\\")),r=e>=0?t.file.slice(e+1):t.file,o=r.lastIndexOf("."),s=o>0?r.slice(0,o):r;if(s&&s!=="index")return `/${s}`}}function Pn(t){return t.map(n=>({ruleId:n.ruleId,file:n.file,line:n.line,sink:yt(n.ruleId),route:mt(n)}))}function Cn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var T=false,x={},C=[],ee=1e3,Y=false;function re(t,n){if(!Y)return;Y=false;let e=C[C.length-1];if(!e||e.ruleId!==M[t])return;let r=Zn(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);}function oe(){return T}function se(){return x.mode??"monitor"}function I(t,n){let e=Cn(x.virtualPatches??[],t,n)?"block":se(),r=Jn(e,n);return re(n,r),r}function gt(){return x.egress?.allow}function V(t,n,e,r){return x.decide?x.decide(t,n,e):N(t,n,e,r)}function y(t){C.length>=ee&&C.shift(),C.push(t),Y=true,x.onEvent?.(t);}function ie(){return C}function ue(){C.length=0,Y=false,Xn();}function kt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},on(t.dnsPinTtlMs),tt({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),T||(dt(),T=true));}function ce(){T&&(ht(),T=false,x={},cn(void 0),Kn(),on(void 0),rt(),pn());}function ae(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&kt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}function he(t,n){let e=Pn(t);return mkdirSync(dirname(n),{recursive:true}),writeFileSync(n,`${JSON.stringify({patches:e},null,2)}
-`,"utf8"),e}function ge(t){let n=JSON.parse(readFileSync(t,"utf8"));return Array.isArray(n)?n:n.patches??[]}function be(t,n){let e=join(t,".gitignore"),r=existsSync(e)?readFileSync(e,"utf8"):"",o=new Set(r.split(`
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function vt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function on(t,n){if(!n)return  false;let e=Lt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(vt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}var $n=6e4,_t=1e3,A=new Map,Kn=$n,Ot=()=>Date.now();function sn(t){Kn=t!==void 0&&Number.isFinite(t)&&t>=0?t:$n;}function Vn(){A.clear();}function Nn(t,n){for(A.delete(t),A.set(t,n);A.size>_t;){let e=A.keys().next().value;if(e===void 0)break;A.delete(e);}}function zn(t,n,e){let r=m();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=Ot(),i=A.get(o);return !i||s-i.at>Kn?(Nn(o,{addresses:new Set(n),at:s}),false):(Nn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}var un;function an(t){un=t;}function D(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function qt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function Gn(t){let n=D(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(qt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],p=r[2];return o>255||c>255||p>65535?void 0:[o,c,p>>>8&255,p&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function Ft(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function Tt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function W(t){let n=D(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=Gn(n);return e?Ft(e):n.includes(":")?Tt(n):false}function Ht(t){let n=D(t);if(Gn(n)||n.includes(":"))return [n];if(un)return un(n);try{let e=Mt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function Wt(t){try{return Ht(t)}catch{return []}}function cn(t){if(W(t))return  true;let n=Wt(t);for(let e of n)if(W(e))return  true;return zn(t,n,W)}function fn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?cn(r)||cn(s):false}function O(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function B(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var M={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},j="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function Dt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function Bt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&on(e,r))return  true;return  false}function Qn(t,n,e,r){if(t==="proto")return Bn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return Hn(n,e)?true:Bt(n,e);for(let o of Dt(n))for(let s of e.strings)if(s&&(t==="sql"&&on(o,s)||t==="shell"&&Un(o,s)||t==="path"&&Dn(o,s,r)||t==="ssrf"&&fn(o,s)))return  true;return  false}function U(t,n,e,r){return Qn(t,n,e,r)?{block:true,ruleId:M[t]}:{block:false}}function Ut(t){let n=t.kind,e=t.input;if(n==="proto"||e!==null&&typeof e=="object")return {path:"/",ip:"test",strings:[],objects:e!==null&&typeof e=="object"?[e]:[]};let r=typeof e=="string"||typeof e=="number"||typeof e=="boolean"?String(e):"";return {path:"/",ip:"test",strings:r?[r]:[],objects:[]}}function Yn(t){let n={},e=0;for(let r of t){let o=typeof r.kind=="string"?r.kind:"unknown",s=Ut(r),i=o==="proto"?null:r.sink??r.input,u=typeof r.base=="string"?r.base:void 0,c=U(o,i,s,u).block,p=n[o]??{blocked:0,total:0};p.total+=1,c&&(p.blocked+=1,e+=1),n[o]=p;}return {blocked:e,total:t.length,byKind:n}}function Nt(t){let{blocked:n,total:e}=Yn(t);return {blocked:n,total:e}}var $t="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var Kt=new Set(["sql","shell"]),q=[];function Jn(){return process.env[$t]==="1"}function Xn(t,n){return Jn()?t!=="block"?"monitor":Kt.has(n)?"block":"monitor":t}function Zn(){q=[];}function nt(t,n,e,r){if(Jn()&&(q=q.filter(o=>r-o<6e4),!(q.length>=5)))return q.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var Vt="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";function N(){return process.env[Vt]==="1"}function zt(t){let n="",e="";for(let r of t){if(e!==""){r===e&&(n+=e+e,e="");continue}if(r==="'"||r==='"'){e=r;continue}if(r>="0"&&r<="9"){n.endsWith("0")||(n+="0");continue}n+=r;}return n}function Gt(t){let n=5381;for(let e=0;e<t.length;e+=1)n=Math.imul(n,33)^t.charCodeAt(e);return (n>>>0).toString(16).padStart(8,"0").slice(0,8)}function tt(t){if(N())return Gt(zt(t))}function et(t,n){if(!N()||n==="")return [];let e=[],r=t.split(`
+`);for(let o=0;o<r.length;o+=1){let s=r[o]??"";(s.includes(".query(")||s.includes("$queryRaw"))&&e.push(o+1);}return e}function rt(t){return N()?!(t>4096):true}function ot(t){return N()?t==="block-experimental"?"block":"monitor":t==="block"?"block":"monitor"}function ln(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var $=new Map,K=new Map,Qt={block:2,honey:5,anomaly:1},st=900*1e3,V=false,pn=st;function it(t={}){V=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(pn=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=($.get(t)??0)+Qt[n];return $.set(t,r),V&&r>=10&&K.set(t,e+pn),r}function Yt(t){return $.get(t)??0}function dn(){$.clear(),K.clear(),V=false,pn=st;}function Jt(t){return t>=10?"block":t>=5?"challenge":"log"}function hn(t,n=Date.now()){if(!V)return  false;let e=K.get(t);return e===void 0?false:n>=e?(K.delete(t),false):true}var yn=["/admin.php","/.git/config","/wp-login.php"],mn=new Set,Xt=6e4,gn=new Map;function ut(t){for(let n of t)mn.add(n);}function ct(){mn.clear(),gn.clear();}function kn(t){let n=t.split("?")[0]??t;return yn.includes(n)}function bn(t){if(!t)return  false;for(let n of mn)if(n&&t.includes(n))return  true;return  false}function wn(t,n=Date.now()){let e=gn.get(t);return e===void 0||n-e.start>Xt?(gn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Sn(){return function(n,e,r){let o=X(n);try{let s=o.strings.some(c=>bn(c));if(kn(o.path)&&!s){let c=wn(o.ip);E(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),y({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),hn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=z("proto",null,o);if(u.block&&u.ruleId&&(y({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),I(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}y({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}Z(o,()=>{r();});}}var S=createRequire(import.meta.url),P=[],l=new WeakSet,Pn=false,at=false;function te(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function ee(t){let n=m();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function Q(t,n,e){try{let r=m();if(r){let o=z(t,n,r,e);if(o.block&&o.ruleId&&(y({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:te(n)}),E(r.ip,"block"),I(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=m();y({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return Q(t,n,e),r()}function w(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,P.push(()=>{r[n]=o;});}function re(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function f(t,n){w(t,n,e=>function(r,...o){return b("sql",re(r),void 0,()=>e.call(this,r,...o))});}function ft(t,n){w(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function L(t,n,e){w(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function lt(t,n){w(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,ee(s),()=>e.call(this,r,...o))});}function gt(t){let n=wt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!ln(e,n)){let r=m();if(y({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),I(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var pt=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function Rn(t,n){w(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function xn(t,n){w(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function oe(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function dt(t){for(let n of ["request","get","post","put","patch","delete","head","options"])R(t,n,oe);}function An(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return B(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return B(n)}function se(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function ht(t){try{let n=se(t);n&&Q("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function R(t,n,e){w(t,n,r=>function(...o){let s=e(o);return gt(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var yt=Symbol.for("fullshield.rasp.wrapSqlite"),jn=Symbol.for("fullshield.rasp.sqliteWrapped"),Y;function En(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function ie(t){let n=En(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=En(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(Y)try{return En(Y("node:sqlite",void 0,!1))}catch{}}function ue(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function G(t){try{let n=ie(t);if(!n||n[jn])return;Object.defineProperty(n,jn,{value:!0,configurable:!0}),f(n,"exec"),f(n,"prepare"),P.push(()=>{delete n[jn];});}catch{}}function ce(){globalThis[yt]=G;let t=S("node:child_process"),n=S("child_process");for(let a of new Set([t,n]))L(a,"exec",true),L(a,"execSync",true),L(a,"spawn",false),L(a,"spawnSync",false),L(a,"execFile",false),L(a,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=S("node:fs"),o=S("fs");for(let a of new Set([r,o]))for(let d of e)lt(a,d);try{let a=S("node:fs/promises");for(let d of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])lt(a,d);}catch{}let s=S("node:http"),i=S("node:https");if(R(s,"request",O),R(s,"get",O),R(i,"request",O),R(i,"get",O),typeof globalThis.fetch=="function"){let a=globalThis.fetch;globalThis.fetch=function(d,h){let g=B(d);return gt(g),(h?.redirect??"follow")!=="follow"?b("ssrf",g,void 0,()=>a.call(this,d,h)):(Q("ssrf",g),(async()=>{let v=g,On=d;for(let Mn=0;Mn<8;Mn+=1){let _=await a.call(this,On,{...h,redirect:"manual"});if(_.status<300||_.status>=400)return _;let qn=_.headers.get("location");if(!qn)return _;v=new URL(qn,v).href,Q("ssrf",v),On=v;}return a.call(this,v,h)})())},P.push(()=>{globalThis.fetch=a;});}let u=S("node:vm");for(let a of ["runInNewContext","runInThisContext","runInContext","compileFunction"])w(u,a,d=>function(h,...g){return b("sql",typeof h=="string"?h:"",void 0,()=>d.call(this,h,...g))});let c=S("node:module");Y=c._load.bind(c);let p=c._load;c._load=function(a,d,h){let g=p.call(this,a,d,h);try{return mt(String(a),g)}catch{return y({ruleId:j,path:m()?.path??"/",ip:m()?.ip??"unknown",sample:"hook-error"}),g}},P.push(()=>{c._load=p,Y=void 0;});let _n=c.registerHooks;typeof _n=="function"&&!at&&(at=true,_n({load(a,d,h){let g=h(a,d);return Pn&&typeof a=="string"&&(a==="node:sqlite"||a.startsWith("node:sqlite"))&&G(),g}})),ue()&&G();}function ae(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Sn()),o.__fullshieldRasp=!0);}catch{y({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function mt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return G(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&f(o.Client.prototype,"query"),o.Pool?.prototype&&f(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(f(s,"query"),f(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(f(o,"exec"),f(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(f(o,"$queryRawUnsafe"),f(o,"$executeRawUnsafe"),f(o,"$queryRaw"),f(o,"$executeRaw"));let s=n.Prisma;return s&&f(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&f(s,"query"),typeof o.literal=="function"&&f(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&f(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&f(e,"raw");let o=n.Client?.prototype;return o&&(f(o,"raw"),f(o,"whereRaw"),f(o,"orderByRaw"),f(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&f(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&f(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&f(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of pt)Rn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of pt)Rn(o,u);ft(o,"$where");}let s=n.Model;s&&Rn(s,"aggregate");let i=s?.prototype;return i&&ft(i,"$where"),l.add(e),n}if(r==="axios")return dt(e),w(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&dt(i),i}),l.add(e),n;if(r==="undici"){R(e,"request",An);let o=n;return o.Dispatcher?.prototype&&R(o.Dispatcher.prototype,"request",An),o.Agent?.prototype&&R(o.Agent.prototype,"request",An),l.add(e),n}if(r==="ejs"||r==="pug")return xn(e,"render"),xn(e,"compile"),l.add(e),n;if(r==="nunjucks")return xn(e,"renderString"),l.add(e),n;if(r==="express"){ae(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&w(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function kt(){Pn=true,ce();let t=Zt.channel("undici:request:create");t.subscribe(ht),P.push(()=>{t.unsubscribe(ht);});}function bt(){for(Pn=false,delete globalThis[yt];P.length>0;)P.pop()?.();}function St(t){let n=t.toUpperCase();if(n.includes("SQLI")||n.includes("SQL-"))return "sql";if(n.includes("CMDI")||n.includes("SHELL"))return "shell";if(n.includes("PATH"))return "path";if(n.includes("NOSQL"))return "nosql";if(n.includes("SSRF"))return "ssrf";if(n.includes("PROTO"))return "proto"}function Rt(t){if(typeof t.route=="string"&&t.route.startsWith("/"))return t.route;let n=(t.message??"").match(/\/[A-Za-z0-9._/-]+/);if(n)return n[0];if(t.file){let e=Math.max(t.file.lastIndexOf("/"),t.file.lastIndexOf("\\")),r=e>=0?t.file.slice(e+1):t.file,o=r.lastIndexOf("."),s=o>0?r.slice(0,o):r;if(s&&s!=="index")return `/${s}`}}function Cn(t){return t.map(n=>({ruleId:n.ruleId,file:n.file,line:n.line,sink:St(n.ruleId),route:Rt(n)}))}function In(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var F=false,x={},C=[],fe=1e3,J=false;function le(t,n){if(!J)return;J=false;let e=C[C.length-1];if(!e||e.ruleId!==M[t])return;let r=nt(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);let o=t==="sql"?tt(e.sample):void 0;o!==void 0&&(e.fingerprint=o);let s=et(e.sample,o??"");s.length>0&&(e.sinkLines=s),rt(Buffer.byteLength(e.sample))||(e.overCap=true);}function pe(){return F}function de(){return x.mode??"monitor"}function I(t,n){let e=In(x.virtualPatches??[],t,n)?"block":de(),r=Xn(e,n);return le(n,r),r}function wt(){return x.egress?.allow}function z(t,n,e,r){return x.decide?x.decide(t,n,e):U(t,n,e,r)}function y(t){C.length>=fe&&C.shift(),C.push(t),J=true,x.onEvent?.(t);}function he(){return C}function ge(){C.length=0,J=false,Zn();}function xt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},sn(t.dnsPinTtlMs),it({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),F||(kt(),F=true));}function ye(){F&&(bt(),F=false,x={},an(void 0),Vn(),sn(void 0),ct(),dn());}function me(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&xt({experimental:true,mode:ot(process.env.FULLSHIELD_RASP_MODE)});}function Re(t,n){let e=Cn(t);return mkdirSync(dirname(n),{recursive:true}),writeFileSync(n,`${JSON.stringify({patches:e},null,2)}
+`,"utf8"),e}function xe(t){let n=JSON.parse(readFileSync(t,"utf8"));return Array.isArray(n)?n:n.patches??[]}function Pe(t,n){let e=join(t,".gitignore"),r=existsSync(e)?readFileSync(e,"utf8"):"",o=new Set(r.split(`
 `).map(s=>s.trim()));for(let s of n)o.has(s)||(r.length>0&&!r.endsWith(`
 `)&&(r+=`
 `),r+=`${s}
-`,o.add(s));writeFileSync(e,r,"utf8");}function we(t){let n="FULLSHIELD-HONEY-CANARY-NOT-A-CLOUD-KEY",e="fullshield-honey-db-canary://local";return mkdirSync(t,{recursive:true}),writeFileSync(join(t,".env.backup"),`# fullshield honeytoken decoy \u2014 not real credentials
+`,o.add(s));writeFileSync(e,r,"utf8");}function Ce(t){let n="FULLSHIELD-HONEY-CANARY-NOT-A-CLOUD-KEY",e="fullshield-honey-db-canary://local";return mkdirSync(t,{recursive:true}),writeFileSync(join(t,".env.backup"),`# fullshield honeytoken decoy \u2014 not real credentials
 AWS_ACCESS_KEY_ID=${n}
 DATABASE_URL=${e}
-`,"utf8"),writeFileSync(join(t,".fullshield-honey.json"),`${JSON.stringify({decoys:gn,canaries:{awsKey:n,dbUrl:e}},null,2)}
-`,"utf8"),be(t,[".env.backup",".fullshield-honey.json"]),et([n,e]),{awsKey:n,dbUrl:e}}export{j as RASP_FAIL_OPEN,M as RASP_RULE,k as RaspBlockedError,E as addThreat,ue as clearRaspEvents,pn as clearThreats,J as contextFromRequest,m as currentRaspContext,Ut as decideResponse,N as decideSink,Qn as detectStructureChange,ce as disableRasp,fn as egressAllowed,he as emitVirtualPatches,kt as enableRasp,ae as enableRaspFromEnv,X as enterRaspContext,Pn as findingsToVpatches,ie as getRaspEvents,we as honeyInit,un as hostIsBlocked,kn as isHoneyCanary,mn as isHoneyRoute,dn as isIpBlocked,W as isPrivateOrMetadata,oe as isRaspEnabled,ge as loadVirtualPatches,D as normalizeHost,bn as noteHoneyRouteHit,Cn as patchForcesBlock,wn as raspContext,I as raspModeFor,mt as routeFromFinding,Ht as scoreCorpus,Gn as scoreCorpusByKind,cn as setSsrfLookup,yt as sinkFromRule,an as ssrfHostFromUser,Nt as threatScore,pt as wrapKnownPackage};
+`,"utf8"),writeFileSync(join(t,".fullshield-honey.json"),`${JSON.stringify({decoys:yn,canaries:{awsKey:n,dbUrl:e}},null,2)}
+`,"utf8"),Pe(t,[".env.backup",".fullshield-honey.json"]),ut([n,e]),{awsKey:n,dbUrl:e}}export{j as RASP_FAIL_OPEN,M as RASP_RULE,k as RaspBlockedError,E as addThreat,ge as clearRaspEvents,dn as clearThreats,X as contextFromRequest,m as currentRaspContext,Jt as decideResponse,U as decideSink,Qn as detectStructureChange,ye as disableRasp,ln as egressAllowed,Re as emitVirtualPatches,xt as enableRasp,me as enableRaspFromEnv,Z as enterRaspContext,Cn as findingsToVpatches,he as getRaspEvents,Ce as honeyInit,cn as hostIsBlocked,bn as isHoneyCanary,kn as isHoneyRoute,hn as isIpBlocked,W as isPrivateOrMetadata,pe as isRaspEnabled,xe as loadVirtualPatches,D as normalizeHost,wn as noteHoneyRouteHit,In as patchForcesBlock,Sn as raspContext,I as raspModeFor,Rt as routeFromFinding,Nt as scoreCorpus,Yn as scoreCorpusByKind,an as setSsrfLookup,St as sinkFromRule,fn as ssrfHostFromUser,Yt as threatScore,mt as wrapKnownPackage};

package/dist/runtime/register.js

@@ -1,6 +1,7 @@
-import {createRequire,register}from'module';import {AsyncLocalStorage}from'async_hooks';import pt from'dns';import Et from'diagnostics_channel';var nt="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var tt=new Set(["sql","shell"]),O=[];function ln(){return process.env[nt]==="1"}function pn(t,n){return ln()?t!=="block"?"monitor":tt.has(n)?"block":"monitor":t}function dn(t,n,e,r){if(ln()&&(O=O.filter(o=>r-o<6e4),!(O.length>=5)))return O.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var rt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),hn=new AsyncLocalStorage;function q(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)q(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))q(r,n,e+1);}}function T(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)T(r,n,e+1);return}for(let r of Object.values(t))T(r,n,e+1);}}function U(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])q(r,n,0),T(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))rt.has(r.toLowerCase())||q(o,n,0);T(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function $(t,n){return hn.run(t,n)}function w(){return hn.getStore()}var yn=6e4,ot=1e3,j=new Map,kn=yn,st=()=>Date.now();function bn(t){kn=t!==void 0&&Number.isFinite(t)&&t>=0?t:yn;}function gn(t,n){for(j.delete(t),j.set(t,n);j.size>ot;){let e=j.keys().next().value;if(e===void 0)break;j.delete(e);}}function mn(t,n,e){let r=w();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=st(),i=j.get(o);return !i||s-i.at>kn?(gn(o,{addresses:new Set(n),at:s}),false):(gn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function wn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function K(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>K(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>K(t[o],n[o]))}function z(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)z(r,n,e+1);return}for(let r of Object.values(t))z(r,n,e+1);}}function Rn(t,n){let e=[];for(let i of n.objects)z(i,e,0);let r=e.filter(wn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),wn(i)&&r.some(c=>c===i||K(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function Q(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function it(t,n){let e=Q(t).replace(/\/+$/,""),r=Q(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function ut(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Sn(t){let n=Q(t).split("/").filter(Boolean);return n[n.length-1]}function xn(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:ut(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!it(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Sn(n),o=Sn(t);if(r&&r===o)return  true}return  false}var ct=new Set(["__proto__","constructor","prototype"]);function V(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(ct.has(r))return  true;return Array.isArray(t)?t.some(r=>V(r,n+1,e)):Object.values(t).some(r=>V(r,n+1,e))}function jn(t){let n=new Set;return t.objects.some(e=>V(e,0,n))}function ft(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
+import {createRequire,register}from'module';import {AsyncLocalStorage}from'async_hooks';import wt from'dns';import qt from'diagnostics_channel';var st="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";var it=new Set(["sql","shell"]),q=[];function pn(){return process.env[st]==="1"}function dn(t,n){return pn()?t!=="block"?"monitor":it.has(n)?"block":"monitor":t}function hn(t,n,e,r){if(pn()&&(q=q.filter(o=>r-o<6e4),!(q.length>=5)))return q.push(r),JSON.stringify({schema:1,kind:t,action:n,ruleId:e})}var ut="FULLSHIELD_EXPERIMENTAL_RUNTIME_GUARD";function O(){return process.env[ut]==="1"}function ct(t){let n="",e="";for(let r of t){if(e!==""){r===e&&(n+=e+e,e="");continue}if(r==="'"||r==='"'){e=r;continue}if(r>="0"&&r<="9"){n.endsWith("0")||(n+="0");continue}n+=r;}return n}function ft(t){let n=5381;for(let e=0;e<t.length;e+=1)n=Math.imul(n,33)^t.charCodeAt(e);return (n>>>0).toString(16).padStart(8,"0").slice(0,8)}function gn(t){if(O())return ft(ct(t))}function yn(t,n){if(!O()||n==="")return [];let e=[],r=t.split(`
+`);for(let o=0;o<r.length;o+=1){let s=r[o]??"";(s.includes(".query(")||s.includes("$queryRaw"))&&e.push(o+1);}return e}function kn(t){return O()?!(t>4096):true}function mn(t){return O()?t==="block-experimental"?"block":"monitor":t==="block"?"block":"monitor"}var lt=new Set(["host","connection","user-agent","accept","accept-encoding","accept-language","content-type","content-length","transfer-encoding","cookie"]),bn=new AsyncLocalStorage;function T(t,n,e){if(!(e>8||n.length>200)){if(typeof t=="string"){n.push(t);return}if(typeof t=="number"||typeof t=="boolean"){n.push(String(t));return}if(Array.isArray(t)){for(let r of t)T(r,n,e+1);return}if(t!==null&&typeof t=="object")for(let r of Object.values(t))T(r,n,e+1);}}function F(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)F(r,n,e+1);return}for(let r of Object.values(t))F(r,n,e+1);}}function $(t){let n=[],e=[];for(let r of [t.query,t.body,t.params,t.cookies])T(r,n,0),F(r,e,0);if(t.headers&&typeof t.headers=="object"){for(let[r,o]of Object.entries(t.headers))lt.has(r.toLowerCase())||T(o,n,0);F(t.headers,e,0);}return {path:t.path??t.url?.split("?")[0]??"/",ip:t.ip??"unknown",strings:n,objects:e}}function K(t,n){return bn.run(t,n)}function w(){return bn.getStore()}var Rn=6e4,pt=1e3,A=new Map,Sn=Rn,dt=()=>Date.now();function xn(t){Sn=t!==void 0&&Number.isFinite(t)&&t>=0?t:Rn;}function wn(t,n){for(A.delete(t),A.set(t,n);A.size>pt;){let e=A.keys().next().value;if(e===void 0)break;A.delete(e);}}function An(t,n,e){let r=w();if(!r||n.length===0)return  false;let o=`${r.ip}\0${r.path}\0${t}`,s=dt(),i=A.get(o);return !i||s-i.at>Sn?(wn(o,{addresses:new Set(n),at:s}),false):(wn(o,i),n.some(u=>e(u)&&!i.addresses.has(u)))}function jn(t){return t===null||typeof t!="object"||Array.isArray(t)?false:Object.keys(t).some(n=>n.startsWith("$"))}function z(t,n){if(t===n)return  true;if(t===null||n===null||typeof t!="object"||typeof n!="object")return  false;if(Array.isArray(t)||Array.isArray(n))return !Array.isArray(t)||!Array.isArray(n)||t.length!==n.length?false:t.every((o,s)=>z(o,n[s]));let e=Object.keys(t),r=Object.keys(n);return e.length!==r.length?false:e.every(o=>z(t[o],n[o]))}function Q(t,n,e){if(!(e>8||t===null||typeof t!="object")){if(n.push(t),Array.isArray(t)){for(let r of t)Q(r,n,e+1);return}for(let r of Object.values(t))Q(r,n,e+1);}}function En(t,n){let e=[];for(let i of n.objects)Q(i,e,0);let r=e.filter(jn);if(r.length===0)return  false;let o=new Set,s=(i,u)=>u>8||i===null||typeof i!="object"||o.has(i)?false:(o.add(i),jn(i)&&r.some(c=>c===i||z(c,i))?true:Array.isArray(i)?i.some(c=>s(c,u+1)):Object.values(i).some(c=>s(c,u+1)));return s(t,0)}function G(t){let n=t.startsWith("/")||/^[A-Za-z]:[\\/]/.test(t),e=[];for(let r of t.split(/[\\/]+/))if(!(r===""||r===".")){if(r===".."){e.pop();continue}e.push(r);}return (n?"/":"")+e.join("/")}function ht(t,n){let e=G(t).replace(/\/+$/,""),r=G(n);return e===""?!r.startsWith("/")&&!r.split("/").includes(".."):r===e||r.startsWith(`${e}/`)}function gt(t,n){let e=t.indexOf(n);return e<=0?"":t.slice(0,e)}function Pn(t){let n=G(t).split("/").filter(Boolean);return n[n.length-1]}function In(t,n,e){if(!n)return  false;if(n.includes("\0")||t.includes("\0"))return  true;if(t.includes(n)){if(n.includes(".."))return  true;let r=e!==void 0&&e.length>0?e:gt(t,n);return r===""?n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)||n.includes(".."):!ht(r,t)}if(n.includes("..")||n.startsWith("/")||/^[A-Za-z]:[\\/]/.test(n)){let r=Pn(n),o=Pn(t);if(r&&r===o)return  true}return  false}var yt=new Set(["__proto__","constructor","prototype"]);function V(t,n,e){if(n>8||t===null||typeof t!="object"||e.has(t))return  false;e.add(t);for(let r of Object.getOwnPropertyNames(t))if(yt.has(r))return  true;return Array.isArray(t)?t.some(r=>V(r,n+1,e)):Object.values(t).some(r=>V(r,n+1,e))}function Ln(t){let n=new Set;return t.objects.some(e=>V(e,0,n))}function kt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o===" "||o==="	"||o===`
 `){let i=e;for(;e<r&&(t[e]===" "||t[e]==="	"||t[e]===`
-`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function An(t,n){if(!n)return  false;let e=ft(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function at(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
+`);)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'){let i=o,u=e;for(e+=1;e<r&&t[e]!==i;)i==='"'&&t[e]==="\\"&&(e+=1),e+=1;e<r&&(e+=1),n.push({kind:"word",start:u,end:e});continue}if(o==="`"){let i=e;for(e+=1;e<r&&t[e]!=="`";)e+=1;e<r&&(e+=1),n.push({kind:"op",start:i,end:e});continue}if(o==="$"&&(t[e+1]==="("||t[e+1]==="{")){let i=t[e+1],u=i==="("?")":"}",c=e;e+=2;let y=1;for(;e<r&&y>0;)t[e]===i?y+=1:t[e]===u&&(y-=1),e+=1;n.push({kind:"op",start:c,end:e});continue}if(t.startsWith("||",e)||t.startsWith("&&",e)||t.startsWith(">>",e)||t.startsWith("<<",e)){n.push({kind:"op",start:e,end:e+2}),e+=2;continue}if(";|&<>()".includes(o)){n.push({kind:"op",start:e,end:e+1}),e+=1;continue}let s=e;for(;e<r&&!/[\s;|&$`<>()]/.test(t[e]);)e+=1;n.push({kind:"word",start:s,end:e});}return n}function Cn(t,n){if(!n)return  false;let e=kt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;let s=o+n.length,i=e.filter(u=>u.kind!=="space"&&u.start<s&&u.end>o);if(!(i.length===1&&i[0].kind==="word"&&i[0].start<=o&&i[0].end>=s))return  true;r=o+Math.max(n.length,1);}return  false}function mt(t){let n=[],e=0,r=t.length;for(;e<r;){let o=t[e];if(o<=" "){let i=e;for(;e<r&&t[e]<=" ";)e+=1;n.push({kind:"space",start:i,end:e});continue}if(o==="'"||o==='"'||o==="`"){let i=o,u=e;for(e+=1;e<r;){if(t[e]===i){if(t[e+1]===i){e+=2;continue}e+=1;break}e+=1;}n.push({kind:"string",start:u,end:e});continue}if(o==="-"&&t[e+1]==="-"){let i=e;for(e+=2;e<r&&t[e]!==`
 `;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o==="/"&&t[e+1]==="*"){let i=e;for(e+=2;e<r&&!(t[e]==="*"&&t[e+1]==="/");)e+=1;e+1<r&&(e+=2),n.push({kind:"comment",start:i,end:e});continue}if(o==="#"){let i=e;for(;e<r&&t[e]!==`
-`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function lt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function G(t,n){if(!n)return  false;let e=at(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(lt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function J(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function dt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function In(t){let n=J(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(dt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function ht(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function gt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function X(t){let n=J(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=In(n);return e?ht(e):n.includes(":")?gt(n):false}function yt(t){let n=J(t);if(In(n)||n.includes(":"))return [n];try{let e=pt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function kt(t){try{return yt(t)}catch{return []}}function Pn(t){if(X(t))return  true;let n=kt(t);for(let e of n)if(X(e))return  true;return mn(t,n,X)}function Cn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Pn(r)||Pn(s):false}function v(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function F(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var W={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},A="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function bt(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function mt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&G(e,r))return  true;return  false}function wt(t,n,e,r){if(t==="proto")return jn(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return Rn(n,e)?true:mt(n,e);for(let o of bt(n))for(let s of e.strings)if(s&&(t==="sql"&&G(o,s)||t==="shell"&&An(o,s)||t==="path"&&xn(o,s,r)||t==="ssrf"&&Cn(o,s)))return  true;return  false}function vn(t,n,e,r){return wt(t,n,e,r)?{block:true,ruleId:W[t]}:{block:false}}function Ln(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var Mn=new Map,Z=new Map,Rt={block:2,honey:5,anomaly:1},St=900*1e3,Y=false,_n=St;function On(t={}){Y=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(_n=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=(Mn.get(t)??0)+Rt[n];return Mn.set(t,r),Y&&r>=10&&Z.set(t,e+_n),r}function qn(t,n=Date.now()){if(!Y)return  false;let e=Z.get(t);return e===void 0?false:n>=e?(Z.delete(t),false):true}var xt=["/admin.php","/.git/config","/wp-login.php"],jt=new Set,At=6e4,Tn=new Map;function Fn(t){let n=t.split("?")[0]??t;return xt.includes(n)}function Wn(t){if(!t)return  false;for(let n of jt)if(n&&t.includes(n))return  true;return  false}function Hn(t,n=Date.now()){let e=Tn.get(t);return e===void 0||n-e.start>At?(Tn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Dn(){return function(n,e,r){let o=U(n);try{let s=o.strings.some(c=>Wn(c));if(Fn(o.path)&&!s){let c=Hn(o.ip);E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),qn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=H("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),L(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:A,path:o.path,ip:o.ip,sample:"hook-error"});}$(o,()=>{r();});}}var R=createRequire(import.meta.url),M=[],l=new WeakSet,Qn=false,Bn=false;function It(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Ct(t){let n=w();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function B(t,n,e){try{let r=w();if(r){let o=H(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:It(n)}),E(r.ip,"block"),L(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=w();g({ruleId:A,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function b(t,n,e,r){return B(t,n,e),r()}function m(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,M.push(()=>{r[n]=o;});}function vt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){m(t,n,e=>function(r,...o){return b("sql",vt(r),void 0,()=>e.call(this,r,...o))});}function Nn(t,n){m(t,n,e=>function(r,...o){return b("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function P(t,n,e){m(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return b("shell",u,void 0,()=>r.call(this,...o))});}function Un(t,n){m(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return b("path",s,Ct(s),()=>e.call(this,r,...o))});}function Vn(t){let n=Xn();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Ln(e,n)){let r=w();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),L(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var $n=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function nn(t,n){m(t,n,e=>function(r,...o){return b("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function tn(t,n){m(t,n,e=>function(r,...o){return b("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Lt(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Kn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Lt);}function en(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return F(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return F(n)}function Mt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function zn(t){try{let n=Mt(t);n&&B("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){m(t,n,r=>function(...o){let s=e(o);return Vn(s),b("ssrf",s,void 0,()=>r.call(this,...o))});}var _t=Symbol.for("fullshield.rasp.wrapSqlite"),rn=Symbol.for("fullshield.rasp.sqliteWrapped"),N;function on(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Ot(t){let n=on(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=on(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(N)try{return on(N("node:sqlite",void 0,!1))}catch{}}function qt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function D(t){try{let n=Ot(t);if(!n||n[rn])return;Object.defineProperty(n,rn,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),M.push(()=>{delete n[rn];});}catch{}}function Tt(){globalThis[_t]=D;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))P(f,"exec",true),P(f,"execSync",true),P(f,"spawn",false),P(f,"spawnSync",false),P(f,"execFile",false),P(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Un(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Un(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",v),S(s,"get",v),S(i,"request",v),S(i,"get",v),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=F(p);return Vn(h),(d?.redirect??"follow")!=="follow"?b("ssrf",h,void 0,()=>f.call(this,p,d)):(B("ssrf",h),(async()=>{let I=h,cn=p;for(let fn=0;fn<8;fn+=1){let C=await f.call(this,cn,{...d,redirect:"manual"});if(C.status<300||C.status>=400)return C;let an=C.headers.get("location");if(!an)return C;I=new URL(an,I).href,B("ssrf",I),cn=I;}return f.call(this,I,d)})())},M.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])m(u,f,p=>function(d,...h){return b("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");N=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return Wt(String(f),h)}catch{return g({ruleId:A,path:w()?.path??"/",ip:w()?.ip??"unknown",sample:"hook-error"}),h}},M.push(()=>{c._load=y,N=void 0;});let un=c.registerHooks;typeof un=="function"&&!Bn&&(Bn=true,un({load(f,p,d){let h=d(f,p);return Qn&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&D(),h}})),qt()&&D();}function Ft(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Dn()),o.__fullshieldRasp=!0);}catch{g({ruleId:A,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function Wt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return D(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of $n)nn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of $n)nn(o,u);Nn(o,"$where");}let s=n.Model;s&&nn(s,"aggregate");let i=s?.prototype;return i&&Nn(i,"$where"),l.add(e),n}if(r==="axios")return Kn(e),m(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Kn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",en);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",en),o.Agent?.prototype&&S(o.Agent.prototype,"request",en),l.add(e),n}if(r==="ejs"||r==="pug")return tn(e,"render"),tn(e,"compile"),l.add(e),n;if(r==="nunjucks")return tn(e,"renderString"),l.add(e),n;if(r==="express"){Ft(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&m(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return b("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function Gn(){Qn=true,Tt();let t=Et.channel("undici:request:create");t.subscribe(zn),M.push(()=>{t.unsubscribe(zn);});}function Jn(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var Zn=false,x={},_=[],Ht=1e3,sn=false;function Dt(t,n){if(!sn)return;sn=false;let e=_[_.length-1];if(!e||e.ruleId!==W[t])return;let r=dn(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);}function Bt(){return x.mode??"monitor"}function L(t,n){let e=Jn(x.virtualPatches??[],t,n)?"block":Bt(),r=pn(e,n);return Dt(n,r),r}function Xn(){return x.egress?.allow}function H(t,n,e,r){return x.decide?x.decide(t,n,e):vn(t,n,e,r)}function g(t){_.length>=Ht&&_.shift(),_.push(t),sn=true,x.onEvent?.(t);}function Nt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},bn(t.dnsPinTtlMs),On({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),Zn||(Gn(),Zn=true));}function Yn(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Nt({experimental:true,mode:process.env.FULLSHIELD_RASP_MODE==="block"?"block":"monitor"});}Yn();try{register("./rasp/loader.js",import.meta.url);}catch{}
-export{k as RaspBlockedError,U as contextFromRequest,$ as enterRaspContext};
+`;)e+=1;n.push({kind:"comment",start:i,end:e});continue}if(o>="0"&&o<="9"||o==="."&&e+1<r&&t[e+1]>="0"&&t[e+1]<="9"){let i=e;for(;e<r&&/[0-9.eE+-]/.test(t[e]);)e+=1;n.push({kind:"number",start:i,end:e});continue}if(/[A-Za-z_]/.test(o)){let i=e;for(;e<r&&/[A-Za-z0-9_$]/.test(t[e]);)e+=1;n.push({kind:"ident",start:i,end:e});continue}let s=e;t.startsWith("<=",e)||t.startsWith(">=",e)||t.startsWith("<>",e)||t.startsWith("!=",e)||t.startsWith("||",e)||t.startsWith("&&",e)?e+=2:e+=1,n.push({kind:"op",start:s,end:e});}return n}function bt(t,n,e){let r=t.filter(o=>o.kind!=="space"&&o.start<e&&o.end>n);if(r.length===1){let o=r[0];return !(o.kind==="string"||o.kind==="number"||o.kind==="comment")||o.start>n||o.end<e}return r.length>0}function X(t,n){if(!n)return  false;let e=mt(t),r=0;for(;r<=t.length;){let o=t.indexOf(n,r);if(o===-1)return  false;if(bt(e,o,o+n.length))return  true;r=o+Math.max(n.length,1);}return  false}function J(t){let n=t.trim().toLowerCase();return n=n.replace(/\.+$/,""),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n.startsWith("::ffff:")&&(n=n.slice(7)),n.startsWith("[")&&n.endsWith("]")&&(n=n.slice(1,-1)),n}function Rt(t){if(/^0x[0-9a-f]+$/i.test(t)){let n=Number.parseInt(t,16);return Number.isFinite(n)?n:void 0}if(/^0[0-7]+$/.test(t)){let n=Number.parseInt(t,8);return Number.isFinite(n)?n:void 0}if(/^\d+$/.test(t)){let n=Number(t);return Number.isFinite(n)?n:void 0}}function _n(t){let n=J(t);if(!n||n.includes(":"))return;let e=n.split(".");if(e.length===0||e.length>4)return;let r=e.map(Rt);if(r.some(c=>c===void 0))return;let o=r[0];if(e.length===1)return o>4294967295?void 0:[o>>>24&255,o>>>16&255,o>>>8&255,o&255];if(e.length===2){let c=r[1];return o>255||c>16777215?void 0:[o,c>>>16&255,c>>>8&255,c&255]}if(e.length===3){let c=r[1],y=r[2];return o>255||c>255||y>65535?void 0:[o,c,y>>>8&255,y&255]}let s=r[1],i=r[2],u=r[3];if(![o,s,i,u].some(c=>c>255))return [o,s,i,u]}function St(t){let[n,e]=t;return n===127||n===0||n===10||n===169&&e===254||n===192&&e===168||n===172&&e>=16&&e<=31}function xt(t){return !!(t==="::1"||t==="::"||t==="0:0:0:0:0:0:0:1"||t.startsWith("fc")||t.startsWith("fd")||t.startsWith("fe80:"))}function Y(t){let n=J(t);if(n==="localhost"||n.endsWith(".localhost")||n==="metadata.google.internal")return  true;let e=_n(n);return e?St(e):n.includes(":")?xt(n):false}function At(t){let n=J(t);if(_n(n)||n.includes(":"))return [n];try{let e=wt.lookupSync;if(typeof e=="function")return e(n,{all:!0}).map(r=>r.address)}catch{}return []}function jt(t){try{return At(t)}catch{return []}}function Mn(t){if(Y(t))return  true;let n=jt(t);for(let e of n)if(Y(e))return  true;return An(t,n,Y)}function qn(t,n){if(!n||!t.includes(n))return  false;let e;try{e=new URL(t);}catch{return  false}let r=e.hostname;if(!r)return  false;let s=(/^https?:\/\/([^/?#]+)/i.exec(t)?.[1]??r).replace(/:\d+$/,"");return n===t||n.includes(r)||n.includes(s)||s.includes(n)&&n.length>=3?Mn(r)||Mn(s):false}function C(t){let n=t[0];if(typeof n=="string")return n;if(n instanceof URL)return n.href;if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=e.protocol??"http:",o=e.hostname??e.host??"",s=e.path??"/";return `${r}//${o}${s}`}return ""}function W(t){return typeof t=="string"?t:t instanceof URL?t.href:t&&typeof t=="object"&&"url"in t&&typeof t.url=="string"?t.url:""}var H={sql:"RASP-SQL-001",shell:"RASP-SHELL-001",path:"RASP-PATH-001",nosql:"RASP-NOSQL-001",ssrf:"RASP-SSRF-001",proto:"RASP-PROTO-001",ssti:"RASP-SSTI-001"},j="RASP-FAIL-OPEN-001",k=class extends Error{ruleId;constructor(n){super(`fullshield rasp blocked ${n}`),this.name="RaspBlockedError",this.ruleId=n;}};function Et(t){return typeof t=="string"?[t]:typeof t=="number"||typeof t=="boolean"?[String(t)]:[]}function Pt(t,n){let e="";if(typeof t=="string")e=t;else if(t!==null&&typeof t=="object"&&!Array.isArray(t)&&"$where"in t){let r=t.$where;typeof r=="string"&&(e=r);}if(!e)return  false;for(let r of n.strings)if(r&&X(e,r))return  true;return  false}function It(t,n,e,r){if(t==="proto")return Ln(e);if(t==="ssti")return typeof n!="string"||n.length===0?false:e.strings.some(o=>o.length>=3&&n.includes(o));if(t==="nosql")return En(n,e)?true:Pt(n,e);for(let o of Et(n))for(let s of e.strings)if(s&&(t==="sql"&&X(o,s)||t==="shell"&&Cn(o,s)||t==="path"&&In(o,s,r)||t==="ssrf"&&qn(o,s)))return  true;return  false}function On(t,n,e,r){return It(t,n,e,r)?{block:true,ruleId:H[t]}:{block:false}}function Tn(t,n){let e=t.toLowerCase().replace(/\.+$/,"");for(let r of n){let o=r.toLowerCase();if(o.startsWith("*.")){let s=o.slice(1);if(e.endsWith(s)&&e!==o.slice(2))return  true}else if(e===o)return  true}return  false}var Fn=new Map,Z=new Map,Lt={block:2,honey:5,anomaly:1},Ct=900*1e3,nn=false,Wn=Ct;function Hn(t={}){nn=t.autoBlock===true,typeof t.maxBlockMs=="number"&&t.maxBlockMs>0&&(Wn=t.maxBlockMs);}function E(t,n,e=Date.now()){let r=(Fn.get(t)??0)+Lt[n];return Fn.set(t,r),nn&&r>=10&&Z.set(t,e+Wn),r}function Dn(t,n=Date.now()){if(!nn)return  false;let e=Z.get(t);return e===void 0?false:n>=e?(Z.delete(t),false):true}var vt=["/admin.php","/.git/config","/wp-login.php"],Mt=new Set,_t=6e4,Bn=new Map;function Un(t){let n=t.split("?")[0]??t;return vt.includes(n)}function Nn(t){if(!t)return  false;for(let n of Mt)if(n&&t.includes(n))return  true;return  false}function $n(t,n=Date.now()){let e=Bn.get(t);return e===void 0||n-e.start>_t?(Bn.set(t,{count:1,start:n}),1):(e.count+=1,e.count)}function Kn(){return function(n,e,r){let o=$(n);try{let s=o.strings.some(c=>Nn(c));if(Un(o.path)&&!s){let c=$n(o.ip);E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"honeytoken",severity:"low",count:c});}else if(s&&(E(o.ip,"honey"),g({ruleId:"RASP-HONEY-001",path:o.path,ip:o.ip,sample:"canary-credential",severity:"critical"}),Dn(o.ip))){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:"RASP-HONEY-001"});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:"RASP-HONEY-001"}));return}let u=D("proto",null,o);if(u.block&&u.ruleId&&(g({ruleId:u.ruleId,path:o.path,ip:o.ip,sample:"prototype-key"}),v(o.path,"proto")==="block")){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:u.ruleId});return}e.statusCode=403,e.end?.(JSON.stringify({error:"blocked",ruleId:u.ruleId}));return}}catch(s){if(s instanceof k){if(typeof e.status=="function"){e.status(403).json({error:"blocked",ruleId:s.ruleId});return}throw s}g({ruleId:j,path:o.path,ip:o.ip,sample:"hook-error"});}K(o,()=>{r();});}}var R=createRequire(import.meta.url),M=[],l=new WeakSet,Jn=false,zn=false;function Tt(t){return typeof t=="string"?t.slice(0,40):t==null?"":"[object]"}function Ft(t){let n=w();if(n)for(let e of n.strings){if(!e)continue;let r=t.indexOf(e);if(r>0)return t.slice(0,r)}}function U(t,n,e){try{let r=w();if(r){let o=D(t,n,r,e);if(o.block&&o.ruleId&&(g({ruleId:o.ruleId,path:r.path,ip:r.ip,sample:Tt(n)}),E(r.ip,"block"),v(r.path,t)==="block"))throw new k(o.ruleId)}}catch(r){if(r instanceof k)throw r;let o=w();g({ruleId:j,path:o?.path??"/",ip:o?.ip??"unknown",sample:"hook-error"});}}function m(t,n,e,r){return U(t,n,e),r()}function b(t,n,e){let r=t,o=r[n];if(typeof o!="function")return;let s=e(o);try{Object.defineProperty(s,"name",{value:o.name});}catch{}r[n]=s,M.push(()=>{r[n]=o;});}function Wt(t){if(typeof t=="string")return t;if(Array.isArray(t))return t.filter(n=>typeof n=="string").join(" ");if(t!==null&&typeof t=="object"){let n=t;if(typeof n.text=="string")return n.text;if(typeof n.sql=="string")return n.sql;if(Array.isArray(n.strings))return n.strings.filter(e=>typeof e=="string").join(" ")}return ""}function a(t,n){b(t,n,e=>function(r,...o){return m("sql",Wt(r),void 0,()=>e.call(this,r,...o))});}function Qn(t,n){b(t,n,e=>function(r,...o){return m("nosql",typeof r=="string"?{$where:r}:r??{},void 0,()=>e.call(this,r,...o))});}function P(t,n,e){b(t,n,r=>function(...o){let s=o[1]&&typeof o[1]=="object"?o[1]:o[2]&&typeof o[2]=="object"?o[2]:void 0;if(!(e||s?.shell===true))return r.call(this,...o);let u=typeof o[0]=="string"?o[0]:"";return m("shell",u,void 0,()=>r.call(this,...o))});}function Gn(t,n){b(t,n,e=>function(r,...o){let s=typeof r=="string"?r:Buffer.isBuffer(r)?r.toString():r instanceof URL?r.pathname:typeof r=="number"||typeof r=="boolean"?String(r):"";return m("path",s,Ft(s),()=>e.call(this,r,...o))});}function Zn(t){let n=tt();if(!n||n.length===0)return;let e="";try{e=new URL(t).hostname;}catch{return}if(e&&!Tn(e,n)){let r=w();if(g({ruleId:"RASP-EGRESS-001",path:r?.path??"/",ip:r?.ip??"unknown",sample:e.slice(0,40)}),r&&E(r.ip,"block"),v(r?.path??"/","ssrf")==="block")throw new k("RASP-EGRESS-001")}}var Vn=["find","findOne","aggregate","updateOne","updateMany","deleteOne","deleteMany","countDocuments"];function tn(t,n){b(t,n,e=>function(r,...o){return m("nosql",r??{},void 0,()=>e.call(this,r,...o))});}function en(t,n){b(t,n,e=>function(r,...o){return m("ssti",typeof r=="string"?r:"",void 0,()=>e.call(this,r,...o))});}function Ht(t){let n=t[0];return typeof n=="string"?n:n&&typeof n=="object"&&"url"in n&&typeof n.url=="string"?n.url:""}function Xn(t){for(let n of ["request","get","post","put","patch","delete","head","options"])S(t,n,Ht);}function rn(t){let n=t[0];if(typeof n=="string"||n instanceof URL)return W(n);if(n&&typeof n=="object"){let e=n;if(typeof e.href=="string")return e.href;let r=typeof e.origin=="string"?e.origin:"",o=typeof e.path=="string"?e.path:"";if(r||o)return `${r}${o}`}return W(n)}function Dt(t){if(!t||typeof t!="object")return "";let n=t;if(typeof n.url=="string")return n.url;let e=typeof n.request?.origin=="string"?n.request.origin:"",r=typeof n.request?.path=="string"?n.request.path:"";return e||r?`${e}${r}`:""}function Yn(t){try{let n=Dt(t);n&&U("ssrf",n);}catch(n){if(n instanceof k)return;throw n}}function S(t,n,e){b(t,n,r=>function(...o){let s=e(o);return Zn(s),m("ssrf",s,void 0,()=>r.call(this,...o))});}var Bt=Symbol.for("fullshield.rasp.wrapSqlite"),on=Symbol.for("fullshield.rasp.sqliteWrapped"),N;function sn(t){if(!t||typeof t!="object")return;let n=t.DatabaseSync?.prototype;if(n&&typeof n=="object")return n}function Ut(t){let n=sn(t);if(n)return n;let e=process.getBuiltinModule;if(typeof e=="function")try{let r=sn(e.call(process,"node:sqlite")??e.call(process,"sqlite"));if(r)return r}catch{}if(N)try{return sn(N("node:sqlite",void 0,!1))}catch{}}function Nt(){let t=process.moduleLoadList;return Array.isArray(t)&&t.some(n=>/(?:^| )sqlite$/i.test(n))}function B(t){try{let n=Ut(t);if(!n||n[on])return;Object.defineProperty(n,on,{value:!0,configurable:!0}),a(n,"exec"),a(n,"prepare"),M.push(()=>{delete n[on];});}catch{}}function $t(){globalThis[Bt]=B;let t=R("node:child_process"),n=R("child_process");for(let f of new Set([t,n]))P(f,"exec",true),P(f,"execSync",true),P(f,"spawn",false),P(f,"spawnSync",false),P(f,"execFile",false),P(f,"execFileSync",false);let e=["readFile","readFileSync","writeFile","writeFileSync","appendFile","appendFileSync","open","openSync","createReadStream","createWriteStream","stat","statSync","lstat","lstatSync","access","accessSync","readdir","readdirSync","unlink","unlinkSync","rm","rmSync"],r=R("node:fs"),o=R("fs");for(let f of new Set([r,o]))for(let p of e)Gn(f,p);try{let f=R("node:fs/promises");for(let p of ["readFile","writeFile","appendFile","open","stat","lstat","access","readdir","unlink","rm"])Gn(f,p);}catch{}let s=R("node:http"),i=R("node:https");if(S(s,"request",C),S(s,"get",C),S(i,"request",C),S(i,"get",C),typeof globalThis.fetch=="function"){let f=globalThis.fetch;globalThis.fetch=function(p,d){let h=W(p);return Zn(h),(d?.redirect??"follow")!=="follow"?m("ssrf",h,void 0,()=>f.call(this,p,d)):(U("ssrf",h),(async()=>{let I=h,fn=p;for(let an=0;an<8;an+=1){let L=await f.call(this,fn,{...d,redirect:"manual"});if(L.status<300||L.status>=400)return L;let ln=L.headers.get("location");if(!ln)return L;I=new URL(ln,I).href,U("ssrf",I),fn=I;}return f.call(this,I,d)})())},M.push(()=>{globalThis.fetch=f;});}let u=R("node:vm");for(let f of ["runInNewContext","runInThisContext","runInContext","compileFunction"])b(u,f,p=>function(d,...h){return m("sql",typeof d=="string"?d:"",void 0,()=>p.call(this,d,...h))});let c=R("node:module");N=c._load.bind(c);let y=c._load;c._load=function(f,p,d){let h=y.call(this,f,p,d);try{return zt(String(f),h)}catch{return g({ruleId:j,path:w()?.path??"/",ip:w()?.ip??"unknown",sample:"hook-error"}),h}},M.push(()=>{c._load=y,N=void 0;});let cn=c.registerHooks;typeof cn=="function"&&!zn&&(zn=true,cn({load(f,p,d){let h=d(f,p);return Jn&&typeof f=="string"&&(f==="node:sqlite"||f.startsWith("node:sqlite"))&&B(),h}})),Nt()&&B();}function Kt(t){if(typeof t!="function")return;let n=t;if(l.has(n))return;function e(...r){let o=n.apply(this,r);try{o&&typeof o.use=="function"&&!o.__fullshieldRasp&&(o.use(Kn()),o.__fullshieldRasp=!0);}catch{g({ruleId:j,path:"/",ip:"unknown",sample:"hook-error"});}return o}Object.assign(e,n),Object.setPrototypeOf(e,n),l.add(n),t.__fullshieldExpressPatch=e;}function zt(t,n){if(n===null||typeof n!="object"&&typeof n!="function")return n;let e=n;if(l.has(e))return n;let r=t.replace(/^node:/,"");if(r==="sqlite")return B(n),n;if(r==="pg"||r.endsWith("/pg")){let o=n;return o.Client?.prototype&&a(o.Client.prototype,"query"),o.Pool?.prototype&&a(o.Pool.prototype,"query"),l.add(e),n}if(r==="mysql2"||r.endsWith("/mysql2")||r.includes("mysql2/")){let o=n,s=o.Connection?.prototype??o.prototype;return s&&(a(s,"query"),a(s,"execute")),l.add(e),n}if(r==="better-sqlite3"||r.endsWith("/better-sqlite3")){let o=n.prototype;return o&&(a(o,"exec"),a(o,"prepare")),l.add(e),n}if(r==="@prisma/client"||r==="prisma"||r.endsWith("/@prisma/client")){let o=n.PrismaClient?.prototype;o&&(a(o,"$queryRawUnsafe"),a(o,"$executeRawUnsafe"),a(o,"$queryRaw"),a(o,"$executeRaw"));let s=n.Prisma;return s&&a(s,"raw"),l.add(e),n}if(r==="sequelize"||r.endsWith("/sequelize")){let o=n,s=o.Sequelize?.prototype??o.prototype;return s&&a(s,"query"),typeof o.literal=="function"&&a(o,"literal"),o.Sequelize&&typeof o.Sequelize.literal=="function"&&a(o.Sequelize,"literal"),l.add(e),n}if(r==="knex"||r.endsWith("/knex")){typeof n.raw=="function"&&a(e,"raw");let o=n.Client?.prototype;return o&&(a(o,"raw"),a(o,"whereRaw"),a(o,"orderByRaw"),a(o,"query")),l.add(e),n}if(r==="typeorm"||r.endsWith("/typeorm")){let o=n;for(let i of ["DataSource","EntityManager","QueryRunner","Connection"]){let u=o[i]?.prototype;u&&a(u,"query");}let s=o.SelectQueryBuilder?.prototype??o.QueryBuilder?.prototype;return s&&a(s,"where"),l.add(e),n}if(r==="drizzle-orm"||r.endsWith("/drizzle-orm")){let o=n.sql;return o&&a(o,"raw"),l.add(e),n}if(r==="mongodb"||r.includes("mongodb")){let o=n.Collection?.prototype;if(o)for(let s of Vn)tn(o,s);return l.add(e),n}if(r==="mongoose"||r.includes("mongoose")){let o=n.Query?.prototype;if(o){for(let u of Vn)tn(o,u);Qn(o,"$where");}let s=n.Model;s&&tn(s,"aggregate");let i=s?.prototype;return i&&Qn(i,"$where"),l.add(e),n}if(r==="axios")return Xn(e),b(e,"create",o=>function(...s){let i=o.call(this,...s);return i!==null&&typeof i=="object"&&Xn(i),i}),l.add(e),n;if(r==="undici"){S(e,"request",rn);let o=n;return o.Dispatcher?.prototype&&S(o.Dispatcher.prototype,"request",rn),o.Agent?.prototype&&S(o.Agent.prototype,"request",rn),l.add(e),n}if(r==="ejs"||r==="pug")return en(e,"render"),en(e,"compile"),l.add(e),n;if(r==="nunjucks")return en(e,"renderString"),l.add(e),n;if(r==="express"){Kt(n);let o=n.__fullshieldExpressPatch;if(typeof o=="function"){let s=n.response;return s&&typeof s.redirect=="function"&&b(s,"redirect",i=>function(...u){let c=typeof u[0]=="string"?u[0]:typeof u[1]=="string"?u[1]:"";return m("ssrf",c,void 0,()=>i.call(this,...u))}),l.add(e),o}}return n}function nt(){Jn=true,$t();let t=qt.channel("undici:request:create");t.subscribe(Yn),M.push(()=>{t.unsubscribe(Yn);});}function et(t,n,e){return t.some(r=>{let o=r.route===void 0||r.route===n,s=r.sink===void 0||r.sink===e;return o&&s})}var rt=false,x={},_=[],Qt=1e3,un=false;function Gt(t,n){if(!un)return;un=false;let e=_[_.length-1];if(!e||e.ruleId!==H[t])return;let r=hn(t,n,e.ruleId,Date.now());r!==void 0&&(e.webhookJson=r);let o=t==="sql"?gn(e.sample):void 0;o!==void 0&&(e.fingerprint=o);let s=yn(e.sample,o??"");s.length>0&&(e.sinkLines=s),kn(Buffer.byteLength(e.sample))||(e.overCap=true);}function Vt(){return x.mode??"monitor"}function v(t,n){let e=et(x.virtualPatches??[],t,n)?"block":Vt(),r=dn(e,n);return Gt(n,r),r}function tt(){return x.egress?.allow}function D(t,n,e,r){return x.decide?x.decide(t,n,e):On(t,n,e,r)}function g(t){_.length>=Qt&&_.shift(),_.push(t),un=true,x.onEvent?.(t);}function Xt(t={}){!t.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_RASP!=="1"||(x={...t,experimental:true},xn(t.dnsPinTtlMs),Hn({autoBlock:t.threatAutoBlock===true,maxBlockMs:t.threatMaxBlockMs}),rt||(nt(),rt=true));}function ot(){process.env.FULLSHIELD_EXPERIMENTAL_RASP==="1"&&Xt({experimental:true,mode:mn(process.env.FULLSHIELD_RASP_MODE)});}ot();try{register("./rasp/loader.js",import.meta.url);}catch{}
+export{k as RaspBlockedError,$ as contextFromRequest,K as enterRaspContext};

package/models/index.json

@@ -1,5 +1,5 @@
 {
-  "fullshieldVersion": "3.3.1",
+  "fullshieldVersion": "3.3.2",
   "entries": [
     {
       "package": "express",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullshield",
-  "version": "3.3.1",
+  "version": "3.3.2",
   "description": "Full-cycle security scanner for Node.js/TypeScript backends: detect, classify, report, notify, fix, prevent.",
   "license": "MIT",
   "type": "module",

package/templates/action/action.yml

@@ -45,7 +45,7 @@ runs:
       uses: actions/setup-node@v7
       with:
         node-version: '22'
-    - name: Install fullshield@3.3.1
+    - name: Install fullshield@3.3.2
       shell: bash
       run: npm install --global fullshield@${{ inputs.version }}
     - name: Cache FullShield baseline

package/templates/fullshield-bumps.yml

@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v7
-      - run: npx fullshield@3.3.1 bumps plan --from .fullshield/last-scan.json
+      - run: npx fullshield@3.3.2 bumps plan --from .fullshield/last-scan.json
         env:
           FULLSHIELD_EXPERIMENTAL_BUMP_PR: '1'
-      - run: npx fullshield@3.3.1 bumps open --from .fullshield/last-scan.json
+      - run: npx fullshield@3.3.2 bumps open --from .fullshield/last-scan.json
         env:
           FULLSHIELD_EXPERIMENTAL_BUMP_PR: '1'

package/templates/github-workflow-action.yml

@@ -15,7 +15,7 @@ jobs:
       # Example Marketplace ref once published: kathanp/fullshield-action@<sha>
       - uses: ./templates/action
         with:
-          version: '3.3.1'
+          version: '3.3.2'
           fail-on: high
           cache-baseline: 'true'
           upload-sarif: 'true'

package/templates/github-workflow-diff.yml

@@ -10,6 +10,6 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - run: npx fullshield@3.3.1 scan --diff
+      - run: npx fullshield@3.3.2 scan --diff
         env:
           FULLSHIELD_EXPERIMENTAL_DIFFSCAN: '1'