http-attack 0.0.0-stage → 1.0.1-rc.0

package/skills/http-attack/scripts/lib/probes/persist.mjs

@@ -0,0 +1,69 @@
+import { readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { UsageError } from '../errors.mjs';
+import { granted, is2xx } from '../http.mjs';
+import { wire } from '../body.mjs';
+import { itemLabel, itemUrlOf } from './auth.mjs';
+
+const real = (p) => { try { return realpathSync(p); } catch { return p; } };
+
+// The state file is read and written by the tool: keep it inside the working directory, the temp directory or the config's persistDir.
+export const checkPersistPath = (file, config, cwd) => {
+  const abs = resolve(cwd, file);
+  const target = join(real(dirname(abs)), basename(abs));
+  const roots = [cwd, tmpdir(), config.persistDir].filter(Boolean).map(real);
+  const inside = roots.some((root) => { const rel = relative(root, target); return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel); });
+  if (!inside) throw new UsageError(`${file} is outside the working directory and the temp directory: set "persistDir" in the config file to allow it.`);
+};
+
+const canonical = (value, ignore) => {
+  if (Array.isArray(value)) return value.map((v) => canonical(v, ignore));
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.keys(value).filter((k) => !ignore.includes(k)).sort().map((k) => [k, canonical(value[k], ignore)]));
+  }
+  return value;
+};
+
+// Compares two bodies; JSON bodies ignore the named fields (timestamps, request ids) at any depth.
+export const sameBody = (a, b, ignore = []) => {
+  try { return JSON.stringify(canonical(JSON.parse(a), ignore)) === JSON.stringify(canonical(JSON.parse(b), ignore)); } catch { return a === b; }
+};
+
+// Persistence is a two-step run around a restart. Returns { ok, message, data } for the CLI to print.
+// A file that is not a previous persist state is never overwritten (it could be a package.json).
+const refuseToOverwrite = (file) => {
+  let existing;
+  try { existing = readFileSync(file, 'utf8'); } catch (e) { if (e.code === 'ENOENT') return; throw new UsageError(`--persist-save: cannot read ${file}: ${e.code ?? e.message}`); }
+  let state;
+  try { state = JSON.parse(existing); } catch { /* not JSON */ }
+  if (typeof state?.item !== 'string' || !('status' in state) || !('body' in state)) throw new UsageError(`--persist-save: ${file} exists and is not a state file written by --persist-save: it is not overwritten.`);
+};
+
+export async function persistSave(run, file) {
+  const w = run.opts.writes[0];
+  if (!w) throw new UsageError('--persist-save needs a --write.');
+  refuseToOverwrite(file);
+  const p = wire(w, run.settings(w.method, w.path));
+  const res = await run.client.send(w.method, w.path, { body: p.text, type: p.type, common: false });
+  if (res.s === null) throw new Error(`the create did not answer: ${res.err}`);
+  if (!granted(res)) throw new UsageError(res.s >= 300 ? `The create was redirected to login (${res.headers.location}): the credentials do not work.` : `The create answered ${res.s}: nothing was saved.`);
+  const item = itemUrlOf(res,{ base: run.client.base, itemPath: run.itemPath });
+  if (!item) throw new UsageError(`The create answered ${res.s} without a readable location (give --item-path).`);
+  const read = await run.client.send('GET', item, { common: false });
+  try { writeFileSync(file, JSON.stringify({ item, status: read.s, body: read.text }, null, 2)); } catch (e) { throw new Error(`cannot write ${file}: ${e.code ?? e.message}`); }
+  return { ok: is2xx(read.s), message: `saved ${item} (${read.s}) to ${file}. Restart the app, then run --persist-verify ${file}.`, data: { mode: 'persist-save', item, status: read.s } };
+}
+
+export async function persistVerify(run, file) {
+  let saved;
+  try { saved = JSON.parse(readFileSync(file, 'utf8')); } catch (e) { throw new UsageError(`--persist-verify: cannot read ${file}: ${e.code ?? e.message}`); }
+  if (typeof saved?.item !== 'string') throw new UsageError(`--persist-verify: ${file} is not a file written by --persist-save.`);
+  const now = await run.client.send('GET', saved.item, { common: false });
+  const same = now.s === saved.status && sameBody(now.text, saved.body, run.config.persistIgnore);
+  return {
+    ok: same,
+    message: `${same ? 'PASS' : 'FAIL critical'}  GET ${saved.item} after restart: ${now.s} (before: ${saved.status})${same ? '' : ' - expected the same status and body: the data is not durable'}`,
+    data: { mode: 'persist-verify', ...(same ? {} : { id: `not-durable:persist-verify:GET ${itemLabel(saved.item)}`, rule: 'not-durable', severity: 'critical' }), item: saved.item, status: now.s, savedStatus: saved.status },
+  };
+}

package/skills/http-attack/scripts/lib/probes/race.mjs

@@ -0,0 +1,124 @@
+import { connect } from 'node:net';
+import { wire } from '../body.mjs';
+
+// Identical creates at once: check-then-insert lets more than one through, or turns the constraint violation into a 500.
+// Last-byte synchronization over raw sockets: every connection gets its request minus the final byte, then the final bytes go
+// out in one synchronous loop. Three details keep the racers inside one server read batch:
+// - Nagle is off: a 1-byte write behind unacknowledged data otherwise waits for the peer's delayed ACK (~200 ms on Windows).
+// - A pacer request (same endpoint, different key) is released a few ms first. An event loop wakes on the first byte that
+//   arrives and handles that request alone; if the handler then blocks the loop (a synchronous fsync takes ~100 ms on
+//   Windows), its timers fire before the next read, and requests that arrived a microsecond apart are served one by one.
+//   The pacer takes that first wake-up, and the racers arrive while the loop is busy with it.
+// - Every dropped connection is reported with its error code (ECONNRESET, EMPTY_RESPONSE, TIMEOUT...).
+const PACER_LEAD_MS = 5;
+const SETTLE_MS = 50;
+const SOCKET_TIMEOUT_MS = 10_000;
+
+const decodeChunked = (text) => {
+  let out = '', rest = text;
+  for (;;) {
+    const nl = rest.indexOf('\r\n');
+    const size = parseInt(rest.slice(0, nl), 16);
+    if (nl < 0 || !Number.isInteger(size) || size === 0) return out;
+    out += rest.slice(nl + 2, nl + 2 + size);
+    rest = rest.slice(nl + 2 + size + 2);
+  }
+};
+
+// The response parsed from the bytes read until the server closed the socket. A response whose body is shorter than its
+// Content-Length, or whose chunked body has no terminating chunk, was cut: `complete` is false.
+const parseResponse = (buf) => {
+  const end = buf.indexOf('\r\n\r\n');
+  const head = buf.subarray(0, end < 0 ? buf.length : end).toString('latin1');
+  const m = head.match(/^HTTP\/1\.[01] (\d{3})/);
+  if (!m) return null;
+  const headers = Object.fromEntries(head.split('\r\n').slice(1).filter((l) => l.includes(':'))
+    .map((l) => [l.slice(0, l.indexOf(':')).trim().toLowerCase(), l.slice(l.indexOf(':') + 1).trim()]));
+  const body = end < 0 ? Buffer.alloc(0) : buf.subarray(end + 4);
+  const chunked = headers['transfer-encoding'] === 'chunked';
+  const length = headers['content-length'] === undefined ? null : Number(headers['content-length']);
+  const complete = end >= 0 && (chunked ? /(^|\r\n)0\r\n\r\n$/.test(body.toString('latin1')) : length === null || body.length >= length);
+  const text = body.toString('utf8');
+  return { s: Number(m[1]), headers, text: chunked ? decodeChunked(text) : text, complete };
+};
+
+// The identity of the item a success created: its Location, else the id in the JSON body.
+const identityOf = (r) => {
+  if (r.headers.location) return r.headers.location;
+  try { const j = JSON.parse(r.text); const id = j?.id ?? j?.data?.id ?? j?.item?.id; return id === undefined ? null : `id:${id}`; } catch { return null; }
+};
+
+export async function raceProbe(run, u) {
+  const { client, opts } = run;
+  const target = `${u.method} ${u.path}`;
+  const spec = { group: 'concurrency', probe: 'race-identical-creates', target, name: `${target} x${opts.raceCount} identical requests at once` };
+  const st = run.settings(u.method, u.path);
+  const expected = `exactly one 201, the other ${opts.raceCount - 1} 409`;
+  const bytesOf = (p) => {
+    const data = Buffer.from(p.text);
+    const head = Object.entries({ host: client.base.host, ...opts.headers, 'content-type': p.type, 'content-length': data.length, connection: 'close' })
+      .map(([k, v]) => `${k}: ${v}`).join('\r\n');
+    return Buffer.concat([Buffer.from(`${u.method} ${u.path} HTTP/1.1\r\n${head}\r\n\r\n`), data]);
+  };
+  const open = (bytes) => new Promise((ready) => {
+    const sock = connect({ host: client.host, port: client.port, noDelay: true });
+    const chunks = [];
+    let err = null, settle;
+    const settled = new Promise((r) => { settle = r; });
+    sock.setTimeout(SOCKET_TIMEOUT_MS, () => { err ??= 'TIMEOUT'; sock.destroy(); });
+    sock.on('data', (d) => chunks.push(d));
+    sock.on('error', (e) => { err ??= e.code ?? e.message; ready({ sock: null, settled }); });
+    sock.on('close', () => {
+      const bytes = Buffer.concat(chunks);
+      const parsed = parseResponse(bytes);
+      if (!parsed) return settle({ s: null, err: err ?? (bytes.length ? 'BAD_RESPONSE' : 'EMPTY_RESPONSE') });
+      if (!parsed.complete) return settle({ s: null, err: err ?? 'TRUNCATED_RESPONSE' });
+      client.noteHeaders(u.method, u.path, parsed.s, parsed.headers);
+      settle(parsed);
+    });
+    sock.on('connect', () => sock.write(bytes.subarray(0, -1), () => ready({ sock, settled, last: bytes.subarray(-1) })));
+  });
+
+  let last = null;
+  for (let attempt = 1; attempt <= opts.raceAttempts; attempt++) {
+    const racerBytes = bytesOf(wire(u, st));
+    const [pacer, ...racers] = await Promise.all([open(bytesOf(wire(u, st))), ...Array.from({ length: opts.raceCount }, () => open(racerBytes))]);
+    await new Promise((r) => setTimeout(r, SETTLE_MS));
+    if (pacer.sock && !pacer.sock.destroyed) pacer.sock.write(pacer.last);
+    await new Promise((r) => setTimeout(r, PACER_LEAD_MS));
+    for (const c of racers) if (c.sock && !c.sock.destroyed) c.sock.write(c.last);
+    const [, ...all] = await Promise.all([pacer.settled, ...racers.map((c) => c.settled)]);
+    const verdict = judge(all);
+    last = { ...verdict, attempt };
+    if (verdict.kind !== 'pass') break;
+  }
+
+  function judge(all) {
+    const codes = all.map((x) => x.s ?? `drop:${x.err}`);
+    const created = all.filter((x) => x.s >= 200 && x.s < 300);
+    const five = all.filter((x) => x.s >= 500).length;
+    const drop = all.filter((x) => x.s === null).length;
+    const joined = codes.join(' ');
+    if (drop === all.length) return { kind: 'not-run', codes: joined, why: `no response at all (${joined})` };
+    if (!created.length && !five && !drop) return { kind: 'not-run', codes: joined, why: `none succeeded (${joined}): the legitimate body is refused, so the race was not tried` };
+    if (created.length > 1 && !st.idempotentCreate) {
+      const ids = created.map(identityOf);
+      const distinct = new Set(ids.filter(Boolean));
+      if (ids.some((x) => x === null) || distinct.size > 1) {
+        return { kind: 'duplicates', codes: joined, why: `${created.length} succeeded${distinct.size > 1 ? ` with ${distinct.size} distinct items` : ''}: duplicates stored; the unique key is not enforced by the database (a create that is idempotent by design: idempotentCreate in the config)` };
+      }
+      return { kind: 'pass', codes: joined, why: 'several successes returned the same item: the create is idempotent' };
+    }
+    if (five) return { kind: 'five', codes: joined, why: 'the constraint violation escapes as a 5xx: map the unique-violation error to 409', sample: all.find((x) => x.s >= 500) };
+    if (drop) return { kind: 'drop', codes: joined, why: 'the constraint violation closes the connection: map the unique-violation error to 409' };
+    if (codes.some((s) => s !== 409 && s >= 400)) return { kind: 'pass', codes: joined, why: 'refusals are 4xx but not 409; fine if the contract says so' };
+    return { kind: 'pass', codes: joined };
+  }
+
+  const at = last.attempt > 1 || opts.raceAttempts > 1 ? ` (attempt ${last.attempt} of ${opts.raceAttempts})` : '';
+  if (last.kind === 'not-run') run.notRun(spec, last.why);
+  else if (last.kind === 'duplicates') run.fail('duplicates-stored', spec, last.codes, expected, last.why + at);
+  else if (last.kind === 'five') await run.transportFault(last.sample, { ...spec, hint: last.why }, expected);
+  else if (last.kind === 'drop') run.fail('connection-dropped', spec, last.codes, expected, last.why + at);
+  else run.pass(spec, last.codes, expected, last.why);
+}

package/skills/http-attack/scripts/lib/probes/resources.mjs

@@ -0,0 +1,44 @@
+import { is4xx } from '../http.mjs';
+import { isJsonBody, wire } from '../body.mjs';
+
+const MIB = 1 << 20;
+const BIG = 50 * MIB;
+const DEFAULT_LIMIT = 2 * MIB;
+const MAX_STREAM = 64 * MIB;
+const TEXT_PLAIN_WAIT_MS = 3000;
+const FAST_REJECT_MS = 2000;
+
+const mb = (n) => (n / MIB).toFixed(1);
+
+// Bodies that cost the server something: a big one with the wrong media type, and one that never ends.
+export async function resourceProbes(run, w) {
+  const { client, opts } = run;
+  const target = `${w.method} ${w.path}`;
+  const st = run.settings(w.method, w.path);
+  const spec = (probe, name) => ({ group: 'resources', probe, target, name: `${target} ${name}` });
+  const json = isJsonBody(w);
+  const p = wire(w, st);
+
+  const big = spec('text-plain-50mb', '50 MB text/plain body');
+  if (!json) run.notRun(big, 'the write body is not JSON: the wrong-media-type probe sends text/plain to a JSON route');
+  else {
+    const expected = '415 (or 413) at the first bytes, before reading the body';
+    const v = await client.stream(w.method, w.path, { 'content-type': 'text/plain', 'content-length': BIG }, BIG, 64 << 10, { stopAfterMs: TEXT_PLAIN_WAIT_MS });
+    if (!(await client.alive())) run.fail('process-died', big, v.s ?? v.code, expected, 'the app stopped answering');
+    else if (v.kind === 'status' && is4xx(v.s) && (v.sent < BIG || v.ms < FAST_REJECT_MS)) run.pass(big, v.s, expected);
+    else if (v.kind === 'status' && is4xx(v.s)) run.fail('read-before-reject', big, v.s, expected, `answered only after reading all 50 MB (${v.ms} ms)`);
+    else if (v.kind === 'closed' && v.sent < BIG) run.pass(big, 'closed', expected);
+    else run.fail('no-body-limit', big, v.s ?? v.kind, expected, `${mb(v.sent)} MB sent`);
+  }
+
+  const endless = spec('body-never-ends', 'body that never ends (chunked)');
+  const limit = st.bodyLimit ?? DEFAULT_LIMIT;
+  if (limit + 1 > MAX_STREAM) { run.notRun(endless, `bodyLimit ${limit} is above the ${mb(MAX_STREAM)} MB this probe will send`); return; }
+  const expected = '413 once over the limit, or 408 / connection closed within the request timeout';
+  const v = await client.stream(w.method, w.path, { 'content-type': p.type, 'transfer-encoding': 'chunked' }, limit + 1, 64 << 10,
+    { stopAfterMs: opts.hangMs, prefix: json ? '{"x":"' : 'x=' });
+  if (!(await client.alive())) run.fail('process-died', endless, v.s ?? v.code, expected, 'the app stopped answering');
+  else if (v.kind === 'silent') run.fail('no-body-limit', endless, 'no answer', expected, `still reading after ${mb(v.sent)} MB (the limit is ${st.bodyLimit ? `${limit} bytes` : 'unknown: 2 MB assumed'}) and ${opts.hangMs} ms: no body limit, no timeout`);
+  else if (v.kind === 'status' && !is4xx(v.s)) run.fail('no-body-limit', endless, v.s, expected);
+  else run.pass(endless, v.s ?? 'closed', expected);
+}

package/skills/http-attack/scripts/lib/probes/search.mjs

@@ -0,0 +1,74 @@
+import { is2xx } from '../http.mjs';
+import { nextCounter } from '../body.mjs';
+
+const ENVELOPE_KEYS = ['data', 'items', 'results', 'rows', 'records', 'content', 'edges', 'hits'];
+
+// The rows of a list response: a JSON array, or the array inside an envelope. null when the body is not a list.
+export function rowsOf(text) {
+  let v;
+  try { v = JSON.parse(text); } catch { return null; }
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === 'object') {
+    const key = ENVELOPE_KEYS.find((k) => Array.isArray(v[k])) ?? Object.keys(v).find((k) => Array.isArray(v[k]));
+    if (key) return v[key];
+  }
+  return null;
+}
+const VALUES = [
+  ['percent', '%'], ['underscore', '_'], ['quote-single', "'"], ['quote-double', '"'], ['backslash', '\\'],
+  ['injection-or-number', "' OR 1=1 --"], ['injection-or-string', "%' OR '1'='1"],
+];
+
+// The text values of the bodies the run created, as search terms: a row the run created is a row known to exist.
+const termsOf = (bodies) => {
+  const terms = [];
+  const walk = (v) => {
+    if (typeof v === 'string') { if (v.length >= 2 && v.length <= 80) terms.push(v); } else if (v && typeof v === 'object') Object.values(v).forEach(walk);
+  };
+  for (const body of bodies) { try { walk(JSON.parse(body)); } catch { /* not JSON: no terms */ } }
+  return [...new Set(terms)];
+};
+
+// Free text taken literally: % and _ are LIKE wildcards; a quote that breaks the SQL is an injection.
+// Rows are compared as parsed rows against a control search that matches nothing. `created` holds the bodies of the
+// writes that succeeded.
+export async function searchProbes(run, { path: route, param }, created = []) {
+  const { client } = run;
+  const [p, q] = route.split('?');
+  const target = `GET ${p}`;
+  const spec = (probe, name) => ({ group: 'search', probe, target, name });
+  const at = (v) => { const sp = new URLSearchParams(q ?? ''); if (v === null) sp.delete(param); else sp.set(param, v); const s = sp.toString(); return s ? `${p}?${s}` : p; };
+
+  const all = await client.send('GET', at(null));
+  const control = await client.send('GET', at(`zz-no-match-${nextCounter()}`));
+  const allRows = is2xx(all.s) ? rowsOf(all.text) : null;
+  const controlRows = is2xx(control.s) ? rowsOf(control.text) : null;
+  // The unfiltered list is optional (some endpoints require the parameter): the control search is the reference.
+  // Without it, a row must be known to exist: one the run created, found again by an exact-match search.
+  let blocked = null;
+  if (allRows && allRows.length === 0) blocked = 'the unfiltered list is empty: create a row first, or the wildcard and injection checks prove nothing';
+  else if (!controlRows) blocked = `a search that matches nothing did not answer a list of rows (${control.s ?? control.err})`;
+  else if (controlRows.length > 0) blocked = `the ${param} parameter does not filter: a search that matches nothing returned ${controlRows.length} rows`;
+  else if (!allRows) {
+    let found = false;
+    for (const term of termsOf(created)) {
+      const hit = await client.send('GET', at(term));
+      if (is2xx(hit.s) && (rowsOf(hit.text) ?? []).some((row) => JSON.stringify(row).includes(term))) { found = true; break; }
+    }
+    if (!found) blocked = 'the unfiltered list needs the parameter and no row created by --write was found by an exact search: without a row known to exist, a pass proves nothing';
+  }
+
+  for (const [tag, v] of VALUES) {
+    const s = spec(tag, `GET ${at(v)}`);
+    const expected = '200 with only the rows that contain that literal text (usually none)';
+    const res = await client.send('GET', at(v));
+    if (await run.transportFault({ ...res }, { ...s, hint: /'/.test(v) ? 'a quote breaks the query: SQL built by concatenation, or a driver that rejects the literal (to_tsquery): confirm' : undefined }, expected)) continue;
+    if (blocked) { run.notRun(s, blocked); continue; }
+    const rows = is2xx(res.s) ? rowsOf(res.text) : null;
+    if (rows && (tag === 'percent' || tag === 'underscore') && rows.length > controlRows.length) {
+      run.fail('wildcard-unescaped', s, res.s, expected, `${v} matched ${rows.length} rows while a search that matches nothing matched none: it reached LIKE unescaped`);
+    } else if (rows && tag.startsWith('injection') && rows.length > controlRows.length) {
+      run.fail('sql-injection', s, res.s, expected, 'the injected OR returned rows, a search that matches nothing returned none');
+    } else run.pass(s, res.s, expected);
+  }
+}

package/skills/http-attack/scripts/lib/registry.mjs

@@ -0,0 +1,39 @@
+// The single registry of finding rules. SKILL.md's severity table is checked against it by the test suite.
+// A finding id is `<rule>:<probe>:<target>`; the probe and the target never contain generated values (row ids, run tags).
+
+export const SEVERITIES = ['critical', 'high', 'medium', 'low'];
+
+export const RULES = {
+  'process-died': { severity: 'critical', meaning: 'the app stopped answering during a probe' },
+  'unauthenticated-access': { severity: 'critical', meaning: 'a write or read is granted (2xx) without credentials' },
+  idor: { severity: 'critical', meaning: "another user's credentials reach this user's object (2xx)" },
+  'sql-injection': { severity: 'critical', meaning: 'an injected OR returns rows that a no-match control does not' },
+  'duplicates-stored': { severity: 'critical', meaning: 'concurrent identical creates stored more than one distinct item' },
+  'file-served': { severity: 'critical', meaning: 'a repo, secret or OS file came back over HTTP' },
+  csrf: { severity: 'critical', meaning: 'a cookie-authenticated write from a foreign Origin was accepted' },
+  'not-durable': { severity: 'critical', meaning: 'a saved item is gone or different after a restart' },
+  'connection-dropped': { severity: 'high', meaning: 'the connection was closed without a response while the app stayed up' },
+  'server-error': { severity: 'high', meaning: 'a 5xx on client input (including path params, quotes and unique violations)' },
+  'accepted-invalid': { severity: 'high', meaning: 'input that must be refused got a 2xx/3xx (bad JSON, invalid UTF-8, wrong type, other methods)' },
+  'no-body-limit': { severity: 'high', meaning: 'a body over the limit is accepted, or a body that never ends is read forever' },
+  'double-slash-mismatch': { severity: 'high', meaning: '`//x` answers 2xx with something other than `/x`' },
+  'wildcard-unescaped': { severity: 'high', meaning: '`%` or `_` in a search reach LIKE as wildcards' },
+  'parser-accepted': { severity: 'high', meaning: 'the HTTP parser let a malformed raw request through' },
+  'fault-not-reported': { severity: 'high', meaning: 'a write during a database fault was not answered with a 5xx' },
+  'limit-counts-characters': { severity: 'medium', meaning: 'the body limit counts characters, not bytes' },
+  'read-before-reject': { severity: 'medium', meaning: 'a 50 MB body was read in full before the 415' },
+  'media-type-strict': { severity: 'medium', meaning: 'a case or parameter variant of the media type is refused (RFC 9110 8.3.1)' },
+  'stack-leak': { severity: 'medium', meaning: 'a 5xx body leaks a stack trace, driver error or SQLSTATE' },
+  'parser-no-common-headers': { severity: 'medium', meaning: "a parser-level error lacks the app's common headers" },
+  'headers-missing': { severity: 'medium', meaning: 'a response lacks a header every response must carry' },
+  'missing-allow': { severity: 'low', meaning: '405 without an `Allow` header' },
+  'head-unsupported': { severity: 'low', meaning: 'HEAD on a readable route answers 405 (RFC 9110 9.1)' },
+  'not-run': { severity: null, meaning: 'a probe could not reach a verdict; never a pass' },
+};
+
+export const severityOf = (rule) => {
+  if (!(rule in RULES)) throw new Error(`unknown rule ${rule}`);
+  return RULES[rule].severity;
+};
+
+export const EXIT = { OK: 0, FINDINGS: 1, ERROR: 2 };

package/skills/http-attack/scripts/lib/report.mjs

@@ -0,0 +1,63 @@
+import { EXIT, SEVERITIES } from './registry.mjs';
+
+export const SCHEMA_VERSION = 1;
+
+export function summarize(rows) {
+  const count = (fn) => rows.filter(fn).length;
+  const bySeverity = Object.fromEntries(SEVERITIES.map((s) => [s, count((r) => r.verdict === 'fail' && r.severity === s)]));
+  const passed = count((r) => r.verdict === 'pass');
+  const failed = count((r) => r.verdict === 'fail');
+  const suppressed = count((r) => r.verdict === 'suppressed');
+  return {
+    run: passed + failed + count((r) => r.verdict === 'suppressed' && r.was === 'fail'),
+    passed, failed, suppressed,
+    notRun: count((r) => r.verdict === 'not-run'),
+    skipped: count((r) => r.verdict === 'skipped'),
+    bySeverity,
+  };
+}
+
+// 0 clean, 1 findings, 2 nothing could be concluded: no probe ran, or some probe could not run.
+export function exitCode(summary) {
+  if (summary.failed > 0) return EXIT.FINDINGS;
+  if (summary.run === 0 || summary.notRun > 0) return EXIT.ERROR;
+  return EXIT.OK;
+}
+
+const ORDER = Object.fromEntries(SEVERITIES.map((s, i) => [s, i]));
+
+export function renderJson({ base, rows, summary, unusedIgnores, unusedRoutes = [] }) {
+  const findings = rows.filter((r) => r.verdict === 'fail').sort((a, b) => ORDER[a.severity] - ORDER[b.severity]);
+  return JSON.stringify({
+    schemaVersion: SCHEMA_VERSION,
+    base,
+    summary: { ...summary, exitCode: exitCode(summary) },
+    findings: findings.map((r) => r.id),
+    unusedIgnores: unusedIgnores.map((i) => i.id),
+    unusedRoutes,
+    rows: rows.map(({ id, rule, group, probe, target, name, verdict, severity, got, expected, evidence, was, suppressedBy }) =>
+      ({ id, rule: rule ?? null, group, probe, target, name, verdict, severity: severity ?? null, got: got ?? '', expected: expected ?? '', evidence: evidence ?? null, was: was ?? null, suppressedBy: suppressedBy ?? null })),
+  }, null, 2);
+}
+
+const MARK = { fail: (r) => `FAIL ${r.severity.padEnd(8)}`, 'not-run': () => 'NOT RUN      ', pass: () => 'pass         ', skipped: () => 'skipped      ', suppressed: () => 'suppressed   ' };
+
+export function renderText({ rows, summary, unusedIgnores, unusedRoutes = [] }) {
+  const out = [];
+  const pad = ' '.repeat(20);
+  for (const r of rows) {
+    out.push(`${MARK[r.verdict](r)} ${(r.got || '-').padEnd(5)} [${r.group}] ${r.name}`);
+    if (r.verdict === 'pass') continue;
+    if (r.verdict === 'suppressed') { out.push(`${pad}${r.was === 'fail' ? 'finding' : 'not run'} suppressed: ${r.suppressedBy}`, `${pad}id: ${r.id}`); continue; }
+    if (r.verdict === 'skipped') { out.push(`${pad}${r.evidence}`); continue; }
+    out.push(`${pad}expected: ${r.expected || '-'}`);
+    if (r.evidence) out.push(`${pad}evidence: ${r.evidence}`);
+    out.push(`${pad}id: ${r.id}`);
+  }
+  for (const i of unusedIgnores) out.push(`warning: the ignore "${i.id}" matched nothing`);
+  for (const k of unusedRoutes) out.push(`warning: the route settings "${k}" matched no request`);
+  const s = summary;
+  out.push('', `${s.run} probes run - ${s.failed} findings (critical ${s.bySeverity.critical}, high ${s.bySeverity.high}, medium ${s.bySeverity.medium}, low ${s.bySeverity.low})`
+    + ` - ${s.suppressed} suppressed - ${s.notRun} not run${s.skipped ? ` - ${s.skipped} skipped by configuration` : ''}`);
+  return out.join('\n');
+}

package/skills/http-attack/scripts/lib/run.mjs

@@ -0,0 +1,58 @@
+import { routeSettings } from './config.mjs';
+import { severityOf } from './registry.mjs';
+import { is5xx } from './http.mjs';
+
+// Stack traces and driver errors from Node, Python, Go, Java, Rails and SQL drivers.
+const LEAK = new RegExp([
+  String.raw`\bat \S+ \(`, String.raw`\bat [\w$.<>]+\([\w$]+\.(?:java|kt|scala):\d+\)`, 'node:internal', String.raw`Traceback \(most recent`,
+  String.raw`File "[^"]+", line \d+`, 'panic: ', String.raw`goroutine \d+ \[`, String.raw`ActiveRecord::`, String.raw`ActionController::`,
+  'SQLSTATE', 'SQLITE_', String.raw`sqlite3\.`, String.raw`\bPG::`, 'psycopg', String.raw`org\.postgresql`, String.raw`com\.mysql`,
+  String.raw`java\.lang\.\w+Exception`, String.raw`\.rb:\d+:in `,
+].join('|'), 'i');
+export const leaksInternals = (text) => LEAK.test(text);
+
+const snippet = (text) => text.replace(/\s+/g, ' ').slice(0, 120);
+
+// Collects the rows of one run. `spec` is { group, probe, target, name }: probe and target form the stable id.
+export class Run {
+  constructor({ client, opts, config }) {
+    Object.assign(this, { client, opts, config, rows: [] });
+  }
+
+  settings(method, path) { return routeSettings(this.config, this.opts, method, path); }
+
+  add(row) { this.rows.push({ ...row }); }
+
+  pass(spec, got, expected, evidence) {
+    this.add({ ...spec, id: `ok:${spec.probe}:${spec.target}`, verdict: 'pass', got: String(got ?? ''), expected, evidence });
+  }
+
+  fail(rule, spec, got, expected, evidence) {
+    this.add({ ...spec, id: `${rule}:${spec.probe}:${spec.target}`, rule, verdict: 'fail', severity: severityOf(rule), got: String(got ?? ''), expected, evidence });
+  }
+
+  notRun(spec, why) {
+    this.add({ ...spec, id: `not-run:${spec.probe}:${spec.target}`, rule: 'not-run', verdict: 'not-run', got: '', expected: '', evidence: why });
+  }
+
+  // Not applicable because the configuration says so (not a gap, not a pass).
+  skipped(spec, why) {
+    this.add({ ...spec, id: `skipped:${spec.probe}:${spec.target}`, verdict: 'skipped', got: '', expected: '', evidence: why });
+  }
+
+  // A response that is a failure whatever the probe was: no answer, a dead app, a 5xx (with its leak check).
+  // Returns true when it recorded the outcome.
+  async transportFault(res, spec, expected) {
+    if (res.s === null || res.truncated) {
+      if (await this.client.alive()) this.fail('connection-dropped', spec, res.err, expected, 'the connection was closed without a complete response');
+      else this.fail('process-died', spec, res.err, expected, 'the app stopped answering');
+      return true;
+    }
+    if (is5xx(res.s)) {
+      this.fail('server-error', spec, res.s, expected, spec.hint);
+      if (leaksInternals(res.text ?? '')) this.fail('stack-leak', spec, res.s, 'a fixed error body without internals', `the body shows: ${snippet(res.text)}`);
+      return true;
+    }
+    return false;
+  }
+}