shield360 1.0.1 → 1.2.0

package/dist/rasp/__tests__/auto-http.test.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * The zero-code request capture (`shield360/register` with RASP on): every
+ * `http` server request runs in a RASP context without middleware. A block
+ * raised after an `await` in an async handler answers 403 (it must not become
+ * an unhandled rejection), and middleware added on top does not run the head
+ * virtual patches a second time.
+ */
+const http_1 = require("http");
+const auto_http_1 = require("../auto-http");
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const middleware_1 = require("../middleware");
+const types_1 = require("../types");
+const vpatch_1 = require("../vpatch");
+const corpus_1 = require("./corpus");
+const exampleRule = vpatch_1.BUILT_IN_RULES.find((r) => r.example);
+const exampleHeaders = (0, corpus_1.requestFor)(exampleRule).headers;
+const events = [];
+beforeAll(() => {
+    (0, engine_1.configureEngine)({ enabled: true, applicationName: 'orders-api', attacks: { virtual_patch: 'monitor' }, env: {} });
+    (0, engine_1.setEventSink)({ add: (e) => events.push(e) });
+    (0, auto_http_1.installAutoHttpCapture)();
+});
+beforeEach(() => {
+    events.length = 0;
+});
+afterAll(() => {
+    (0, auto_http_1.uninstallAutoHttpCapture)();
+    (0, engine_1.setEventSink)(undefined);
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+});
+async function serve(handler, once = false) {
+    const server = (0, http_1.createServer)();
+    if (once)
+        server.once('request', handler);
+    else
+        server.on('request', handler);
+    await new Promise((r) => server.listen(0, '127.0.0.1', () => r()));
+    const { port } = server.address();
+    return { url: `http://127.0.0.1:${port}`, close: () => new Promise((r) => { server.closeAllConnections(); server.close(() => r()); }) };
+}
+function get(url, headers = {}) {
+    return new Promise((ok, fail) => {
+        (0, http_1.request)(url, { headers, timeout: 3000 }, (res) => {
+            let body = '';
+            res.on('data', (c) => (body += c));
+            res.on('end', () => ok({ status: res.statusCode || 0, body }));
+        })
+            .on('timeout', function () {
+            this.destroy(new Error('no response'));
+        })
+            .on('error', fail)
+            .end();
+    });
+}
+const vpFindings = () => events.filter((e) => JSON.stringify(e).includes(exampleRule.id));
+describe('zero-code http capture', () => {
+    it('runs a plain handler inside a request context', async () => {
+        let inRequest;
+        const s = await serve((_req, res) => {
+            inRequest = (0, context_1.currentContext)()?.inRequest;
+            res.end('ok');
+        });
+        try {
+            expect(await get(`${s.url}/?q=1`)).toEqual({ status: 200, body: 'ok' });
+            expect(inRequest).toBe(true);
+        }
+        finally {
+            await s.close();
+        }
+    });
+    it('answers 403 when an async handler is blocked after an await, and keeps serving', async () => {
+        const onUnhandled = jest.fn();
+        process.on('unhandledRejection', onUnhandled);
+        const s = await serve(async (req, res) => {
+            await new Promise((r) => setTimeout(r, 5));
+            if (req.url?.includes('attack'))
+                throw new types_1.RaspBlockedError('command_injection', 'cmdi.userinput', 'e'.repeat(32));
+            res.end('ok');
+        });
+        try {
+            const blocked = await get(`${s.url}/attack`);
+            expect(blocked.status).toBe(403);
+            expect(JSON.parse(blocked.body).attack).toBe('command_injection');
+            expect(await get(`${s.url}/fine`)).toEqual({ status: 200, body: 'ok' });
+            await new Promise((r) => setImmediate(r));
+            expect(onUnhandled).not.toHaveBeenCalled();
+        }
+        finally {
+            process.off('unhandledRejection', onUnhandled);
+            await s.close();
+        }
+    });
+    it('serves once listeners', async () => {
+        const s = await serve((_req, res) => res.end('once'), true);
+        try {
+            expect(await get(s.url)).toEqual({ status: 200, body: 'once' });
+        }
+        finally {
+            await s.close();
+        }
+    });
+    it('with raspExpress() on top, a virtual patch is reported once', async () => {
+        const mw = (0, middleware_1.raspExpress)();
+        const s = await serve((req, res) => mw(req, res, () => res.end('ok')));
+        try {
+            await get(s.url, exampleHeaders);
+            expect(vpFindings()).toHaveLength(1);
+        }
+        finally {
+            await s.close();
+        }
+    });
+    it('with withRasp() on top (Next.js route handlers), a virtual patch is reported once', async () => {
+        const route = (0, middleware_1.withRasp)(async () => new Response('ok'));
+        const s = await serve(async (req, res) => {
+            const headers = new Headers();
+            for (const [k, v] of Object.entries(req.headers))
+                if (typeof v === 'string')
+                    headers.set(k, v);
+            const out = await route(new Request(`http://localhost${req.url}`, { headers }), {});
+            res.statusCode = out.status;
+            res.end(await out.text());
+        });
+        try {
+            expect((await get(s.url, exampleHeaders)).status).toBe(200);
+            expect(vpFindings()).toHaveLength(1);
+        }
+        finally {
+            await s.close();
+        }
+    });
+});
+//# sourceMappingURL=auto-http.test.js.map

package/dist/rasp/__tests__/auto-http.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-http.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/auto-http.test.ts"],"names":[],"mappings":";;AAAA;;;;;;GAMG;AACH,+BAAoH;AAEpH,4CAAgF;AAChF,wCAA4C;AAC5C,sCAA0D;AAC1D,8CAAsD;AACtD,oCAA4C;AAC5C,sCAA2C;AAC3C,qCAAsC;AAEtC,MAAM,WAAW,GAAG,uBAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAE,CAAC;AAC3D,MAAM,cAAc,GAAG,IAAA,mBAAU,EAAC,WAAW,CAAC,CAAC,OAAiC,CAAC;AAEjF,MAAM,MAAM,GAAU,EAAE,CAAC;AAEzB,SAAS,CAAC,GAAG,EAAE;IACb,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAClH,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAA,kCAAsB,GAAE,CAAC;AAC3B,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,GAAG,EAAE;IACd,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC;AACH,QAAQ,CAAC,GAAG,EAAE;IACZ,IAAA,oCAAwB,GAAE,CAAC;IAC3B,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,KAAK,CAAC,OAA+D,EAAE,IAAI,GAAG,KAAK;IAChG,MAAM,MAAM,GAAW,IAAA,mBAAY,GAAE,CAAC;IACtC,IAAI,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAc,CAAC,CAAC;;QAC5C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAc,CAAC,CAAC;IAC1C,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,oBAAoB,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1I,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,UAAkC,EAAE;IAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAA,cAAW,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACnD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC;aACC,EAAE,CAAC,SAAS,EAAE;YACb,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC;aACD,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC;aACjB,GAAG,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAE1F,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,IAAI,SAA8B,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAClC,SAAS,GAAG,IAAA,wBAAc,GAAE,EAAE,SAAS,CAAC;YACxC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,wBAAgB,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACnH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YAC7C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,GAAG,IAAA,wBAAW,GAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACjC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,KAAK,GAAG,IAAA,qBAAQ,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/F,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,mBAAmB,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAW,CAAC,CAAC;YAC7F,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/baseline.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/baseline.test.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Security baseline: each rule from what it reads (pure), nothing for a
+ * sound set-up, monitor only even in block mode, once per process, and no
+ * setting's value in an event.
+ */
+const baseline_1 = require("../baseline");
+const engine_1 = require("../engine");
+const sound = {
+    env: { NODE_ENV: 'production' },
+    environment: 'production',
+    remoteWanted: true,
+    pinned: true,
+    execArgv: [],
+    nodeVersion: '22.11.0',
+    uid: 1000,
+    inspectorOpen: false,
+    now: new Date('2026-10-29T00:00:00Z'),
+};
+const rules = (over) => (0, baseline_1.baselineFindings)({ ...sound, ...over }).map((f) => f.rule);
+describe('baselineFindings', () => {
+    it('finds nothing for a sound production set-up', () => {
+        expect(rules({})).toEqual([]);
+    });
+    it.each([
+        ['TLS checks off', { env: { NODE_ENV: 'production', NODE_TLS_REJECT_UNAUTHORIZED: '0' } }, 'baseline.tls_verify_off'],
+        ['an inspector flag in production', { execArgv: ['--inspect=0.0.0.0:9229'] }, 'baseline.inspector_in_production'],
+        ['an inspector in NODE_OPTIONS in production', { env: { NODE_ENV: 'production', NODE_OPTIONS: '--max-old-space-size=512 --inspect' } }, 'baseline.inspector_in_production'],
+        ['an open inspector in production', { inspectorOpen: true }, 'baseline.inspector_in_production'],
+        ['development mode under a production environment', { env: { NODE_ENV: 'development' } }, 'baseline.development_mode_in_production'],
+        ['running as root', { uid: 0 }, 'baseline.running_as_root'],
+        ['an unpinned config key in production', { pinned: false }, 'baseline.config_key_unpinned'],
+        ['an end-of-life Node line', { nodeVersion: '18.20.4' }, 'baseline.runtime_end_of_life'],
+        ['an odd (short-lived) Node line', { nodeVersion: '23.1.0' }, 'baseline.runtime_end_of_life'],
+    ])('reports %s', (_label, over, rule) => {
+        expect(rules(over)).toContain(rule);
+    });
+    it('leaves development set-ups alone where the rule is about production', () => {
+        const dev = { env: { NODE_ENV: 'development' }, environment: 'development', inspectorOpen: true, pinned: false };
+        expect(rules(dev)).toEqual([]);
+    });
+    it('a release line still in support passes; one past its date does not', () => {
+        expect(rules({ nodeVersion: '20.18.0', now: new Date('2026-04-30T12:00:00Z') })).toEqual([]);
+        expect(rules({ nodeVersion: '20.18.0', now: new Date('2026-05-01T00:00:00Z') })).toEqual(['baseline.runtime_end_of_life']);
+    });
+    it('reads production from NODE_ENV, ENVIRONMENT or the SDK option', () => {
+        expect((0, baseline_1.isProduction)({ NODE_ENV: 'production' })).toBe(true);
+        expect((0, baseline_1.isProduction)({ ENVIRONMENT: 'Prod' })).toBe(true);
+        expect((0, baseline_1.isProduction)({}, 'production')).toBe(true);
+        expect((0, baseline_1.isProduction)({ NODE_ENV: 'staging' }, 'qa')).toBe(false);
+    });
+});
+describe('runBaseline', () => {
+    const events = [];
+    beforeEach(() => {
+        events.length = 0;
+        (0, baseline_1.resetBaseline)();
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'orders-api', mode: 'block', env: {} });
+        (0, engine_1.setEventSink)({ add: (e) => events.push(e) });
+    });
+    afterAll(() => {
+        (0, engine_1.setEventSink)(undefined);
+        (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+    });
+    it('reports each finding once per process, monitored even in block mode, without the setting values', () => {
+        const env = { NODE_ENV: 'production', NODE_TLS_REJECT_UNAUTHORIZED: '0', NODE_OPTIONS: '--inspect' };
+        expect(() => (0, baseline_1.runBaseline)({ environment: 'production', remoteWanted: true, pinned: false, env })).not.toThrow();
+        (0, baseline_1.runBaseline)({ environment: 'production', remoteWanted: true, pinned: false, env });
+        const got = events.map((e) => e.attrs['shield360.rasp.rule']);
+        expect(got).toEqual(expect.arrayContaining(['baseline.tls_verify_off', 'baseline.inspector_in_production', 'baseline.config_key_unpinned']));
+        expect(new Set(got).size).toBe(got.length);
+        for (const e of events) {
+            expect(e.attrs['shield360.rasp.attack']).toBe('baseline');
+            expect(e.attrs['shield360.rasp.decision']).toBe('monitored');
+            expect(e.attrs['shield360.rasp.sink']).toBe('startup');
+            expect(JSON.stringify(e.attrs)).not.toContain('--inspect');
+        }
+    });
+    it('does nothing while RASP is off', () => {
+        (0, engine_1.configureEngine)({ enabled: false, applicationName: 'orders-api', env: {} });
+        (0, baseline_1.runBaseline)({ remoteWanted: false, pinned: false, env: { NODE_TLS_REJECT_UNAUTHORIZED: '0' } });
+        expect(events).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=baseline.test.js.map

package/dist/rasp/__tests__/baseline.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/baseline.test.ts"],"names":[],"mappings":";;AAAA;;;;GAIG;AACH,0CAA6G;AAC7G,sCAA0D;AAE1D,MAAM,KAAK,GAAkB;IAC3B,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;IAC/B,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,IAAI;IAClB,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,SAAS;IACtB,GAAG,EAAE,IAAI;IACT,aAAa,EAAE,KAAK;IACpB,GAAG,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;CACtC,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,IAAA,2BAAgB,EAAC,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE3G,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,4BAA4B,EAAE,GAAG,EAAE,EAAE,EAAE,yBAAyB,CAAC;QACrH,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,kCAAkC,CAAC;QACjH,CAAC,4CAA4C,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,oCAAoC,EAAE,EAAE,EAAE,kCAAkC,CAAC;QAC3K,CAAC,iCAAiC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,kCAAkC,CAAC;QAChG,CAAC,iDAAiD,EAAE,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,yCAAyC,CAAC;QACpI,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,0BAA0B,CAAC;QAC3D,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,8BAA8B,CAAC;QAC3F,CAAC,0BAA0B,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,8BAA8B,CAAC;QACxF,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,8BAA8B,CAAC;KAC9F,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACtC,MAAM,CAAC,KAAK,CAAC,IAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACjH,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,IAAA,uBAAY,EAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAA,uBAAY,EAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,IAAA,uBAAY,EAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,IAAA,uBAAY,EAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAClB,IAAA,wBAAa,GAAE,CAAC;QAChB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,EAAE;QACZ,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;QACxB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QACzG,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,4BAA4B,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QACrG,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,sBAAW,EAAC,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/G,IAAA,sBAAW,EAAC,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,yBAAyB,EAAE,kCAAkC,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC;QAC7I,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1D,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7D,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAA,sBAAW,EAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,4BAA4B,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/benign-corpus.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/benign-corpus.test.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * The shared RASP corpus (sdk/rasp/testdata): every benign case must fire
+ * nothing (false-positive rate per section, must be 0), every entry of
+ * attack-examples.json must be detected as it says, and the embedded data
+ * files must stay byte-identical to the contract's copies.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const lexers_1 = require("../lexers");
+const template_1 = require("../template");
+const corpus_1 = require("./corpus");
+const benign = (0, corpus_1.loadJson)('testdata/benign.json');
+const attacks = { cases: [...(0, corpus_1.loadJson)('testdata/attack-examples.json').cases, ...(0, corpus_1.loadJson)('testdata/template-attack-examples.json').cases] };
+const lexer = (0, corpus_1.loadJson)('testdata/sql-lexer.json');
+describe('RASP benign corpus', () => {
+    const rates = {};
+    afterAll(() => {
+        // The report the contract asks each SDK for: false positives per section.
+        console.log(`RASP false-positive rates (TypeScript):\n${Object.entries(rates).map(([s, r]) => `  ${s}: ${r}`).join('\n')}`);
+    });
+    it('is the generated corpus, version 1, with every section', () => {
+        expect(benign.version).toBe(1);
+        for (const s of corpus_1.SECTIONS)
+            expect(Array.isArray(benign[s]) && benign[s].length > 0).toBe(true);
+    });
+    it.each(corpus_1.SECTIONS.map((s) => [s]))('%s: no false positives', (section) => {
+        const cases = benign[section];
+        const fired = cases.map((c) => ({ name: c.name, f: (0, corpus_1.runCase)(section, c) })).filter((x) => x.f);
+        rates[section] = `${fired.length}/${cases.length} (${((100 * fired.length) / cases.length).toFixed(2)}%)`;
+        expect(fired.map((x) => `${x.name}: ${x.f?.rule}`)).toEqual([]);
+    });
+});
+describe('RASP attack examples', () => {
+    it('is the reviewed file (empty until the owner adds cases)', () => {
+        expect(Array.isArray(attacks.cases)).toBe(true);
+    });
+    const cases = Array.isArray(attacks.cases) ? attacks.cases : [];
+    const named = cases.map((c) => [String(c.name ?? c.check), c]);
+    if (named.length) {
+        it.each(named)('detects %s', (_name, c) => {
+            const f = (0, corpus_1.runCase)(c.check, c);
+            expect(f?.attack).toBe(c.expect.attack);
+            if (c.expect.rule)
+                expect(f?.rule).toBe(c.expect.rule);
+        });
+    }
+});
+describe('SQL lexer conformance', () => {
+    const cases = lexer.cases;
+    it.each(cases.map((c) => [c.name, c]))('%s', (_name, c) => {
+        expect((0, lexers_1.sqlTokens)(c.query, c.dialect).map((t) => [t.kind, t.text])).toEqual(c.tokens);
+    });
+});
+describe('embedded RASP data', () => {
+    const embedded = (f) => (0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', 'data', f));
+    it('default-rules.json is byte-identical to sdk/rasp/rules', () => {
+        expect(embedded('default-rules.json').equals((0, fs_1.readFileSync)((0, path_1.join)(corpus_1.RASP_DIR, 'rules', 'default-rules.json')))).toBe(true);
+    });
+    it('the template engine table matches sdk/rasp/rules/template-engines.json', () => {
+        expect(template_1.TEMPLATE_ENGINES).toEqual((0, corpus_1.loadJson)('rules/template-engines.json').engines);
+    });
+    it('dnslog-domains.json is byte-identical to sdk/rasp/testdata', () => {
+        expect(embedded('dnslog-domains.json').equals((0, fs_1.readFileSync)((0, path_1.join)(corpus_1.RASP_DIR, 'testdata', 'dnslog-domains.json')))).toBe(true);
+    });
+});
+//# sourceMappingURL=benign-corpus.test.js.map

package/dist/rasp/__tests__/benign-corpus.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"benign-corpus.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/benign-corpus.test.ts"],"names":[],"mappings":";;AAAA;;;;;GAKG;AACH,2BAAkC;AAClC,+BAA4B;AAC5B,sCAAuD;AACvD,0CAA+C;AAC/C,qCAA+E;AAE/E,MAAM,MAAM,GAAG,IAAA,iBAAQ,EAAC,sBAAsB,CAAC,CAAC;AAChD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,IAAA,iBAAQ,EAAC,+BAA+B,CAAC,CAAC,KAAK,EAAE,GAAG,IAAA,iBAAQ,EAAC,wCAAwC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7I,MAAM,KAAK,GAAG,IAAA,iBAAQ,EAAC,yBAAyB,CAAC,CAAC;AAElD,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,KAAK,GAA2B,EAAE,CAAC;IAEzC,QAAQ,CAAC,GAAG,EAAE;QACZ,0EAA0E;QAC1E,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,iBAAQ;YAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,iBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,OAAO,EAAE,EAAE;QACtE,MAAM,KAAK,GAAU,MAAM,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAA,gBAAO,EAAC,OAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,KAAK,CAAC,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1G,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAU,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAkB,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACxC,MAAM,CAAC,GAAG,IAAA,gBAAO,EAAC,CAAC,CAAC,KAAgB,EAAE,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,KAAK,GAAU,KAAK,CAAC,KAAK,CAAC;IACjC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,CAAC,IAAA,kBAAS,EAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/E,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,iBAAQ,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,2BAAgB,CAAC,CAAC,OAAO,CAAC,IAAA,iBAAQ,EAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,iBAAQ,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/capture-context.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/capture-context.test.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Capture runs inside the request's context (README "Custom rules: when rules
+ * run"): a custom finding rule that reads request fields must see the request
+ * when a virtual patch or an upload check fires during capture, whichever
+ * entry point captured it (raspHttp, raspExpress, raspFastify, raspKoa,
+ * withRasp, the zero-code http capture, late body capture).
+ */
+const http_1 = require("http");
+const auto_http_1 = require("../auto-http");
+const capture_1 = require("../capture");
+const context_1 = require("../context");
+const custom_rules_1 = require("../custom-rules");
+const engine_1 = require("../engine");
+const middleware_1 = require("../middleware");
+const types_1 = require("../types");
+const vpatch_1 = require("../vpatch");
+const corpus_1 = require("./corpus");
+const exampleRule = vpatch_1.BUILT_IN_RULES.find((r) => r.example);
+const shape = (0, corpus_1.requestFor)(exampleRule);
+const headers = shape.headers;
+const path = shape.path;
+let events = [];
+/** Virtual patches and uploads monitor; a finding rule on the request path blocks. */
+function config() {
+    return {
+        version: 'v1',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+        killSwitch: false,
+        snippets: false,
+        mode: 'monitor',
+        attacks: { custom_rule: 'block' },
+        rules: null,
+        customRules: [
+            { id: 'vp-on-path', expression: `attack.type == "virtual_patch" && request.path == ${JSON.stringify(path)}`, action: 'block', enabled: true },
+            { id: 'upload-on-path', expression: 'attack.type == "file_write" && request.path == "/upload"', action: 'block', enabled: true },
+        ],
+    };
+}
+beforeEach(() => {
+    (0, custom_rules_1.resetCustomRuleWarnings)();
+    events = [];
+    (0, engine_1.configureEngine)({ enabled: true, applicationName: 'orders-api', env: {} });
+    (0, engine_1.setEventSink)({ add: (e) => events.push(e) });
+    (0, engine_1.setRemoteConfig)(config());
+});
+afterEach(() => {
+    (0, engine_1.setEventSink)(undefined);
+    (0, engine_1.setRemoteConfig)(undefined);
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+});
+const customRule = () => events.filter((e) => e.attrs['shield360.rasp.attack'] === 'custom_rule').map((e) => e.attrs['shield360.rasp.rule']);
+function res() {
+    const r = { statusCode: 0, headersSent: false, writableEnded: false, body: '', setHeader: () => undefined };
+    r.end = (b) => ((r.body = b), (r.writableEnded = true));
+    return r;
+}
+describe('a finding rule sees the request during capture', () => {
+    it('raspHttp', () => {
+        const handler = jest.fn();
+        const r = res();
+        (0, middleware_1.raspHttp)(handler)({ method: 'GET', url: path, headers, socket: { remoteAddress: '127.0.0.1' } }, r);
+        expect(handler).not.toHaveBeenCalled();
+        expect(r.statusCode).toBe(403);
+        expect(JSON.parse(r.body)).toMatchObject({ attack: 'custom_rule', rule: 'custom.vp-on-path' });
+    });
+    it('raspExpress', () => {
+        const next = jest.fn();
+        const r = res();
+        (0, middleware_1.raspExpress)()({ method: 'GET', url: path, originalUrl: path, headers, query: {}, params: {} }, r, next);
+        expect(next).not.toHaveBeenCalled();
+        expect(r.statusCode).toBe(403);
+        expect(customRule()).toEqual(['custom.vp-on-path']);
+    });
+    it('raspFastify', () => {
+        const hooks = {};
+        (0, middleware_1.raspFastify)({ addHook: (name, fn) => (hooks[name] = fn) }, {}, () => undefined);
+        const reply = { status: 0, code: (n) => ((reply.status = n), reply), header: () => reply, send: (b) => (reply.sent = b) };
+        const next = jest.fn();
+        hooks.onRequest({ method: 'GET', url: path, headers }, reply, next);
+        expect(next).not.toHaveBeenCalled();
+        expect(reply.status).toBe(403);
+        expect(customRule()).toEqual(['custom.vp-on-path']);
+    });
+    it('raspKoa', async () => {
+        const k = { method: 'GET', url: path, originalUrl: path, path, headers, query: {}, request: {}, set: jest.fn() };
+        const next = jest.fn(async () => undefined);
+        await (0, middleware_1.raspKoa)()(k, next);
+        expect(next).not.toHaveBeenCalled();
+        expect(k.status).toBe(403);
+        expect(customRule()).toEqual(['custom.vp-on-path']);
+    });
+    it('withRasp (Next.js route handlers)', async () => {
+        const res = await (0, middleware_1.withRasp)(async () => new Response('ran'))(new Request(`http://localhost${path}`, { headers }), {});
+        expect(res.status).toBe(403);
+        expect((await res.json()).rule).toBe('custom.vp-on-path');
+    });
+    it('the zero-code http capture', async () => {
+        (0, auto_http_1.installAutoHttpCapture)();
+        const server = (0, http_1.createServer)((_req, r) => r.end('ran'));
+        await new Promise((ok) => server.listen(0, '127.0.0.1', () => ok()));
+        try {
+            const { port } = server.address();
+            const status = await new Promise((ok, fail) => {
+                (0, http_1.request)(`http://127.0.0.1:${port}${path}`, { headers }, (r) => {
+                    r.resume();
+                    r.on('end', () => ok(r.statusCode || 0));
+                })
+                    .on('error', fail)
+                    .end();
+            });
+            expect(status).toBe(403);
+            expect(customRule()).toEqual(['custom.vp-on-path']);
+        }
+        finally {
+            server.closeAllConnections();
+            await new Promise((ok) => server.close(ok));
+            (0, auto_http_1.uninstallAutoHttpCapture)();
+        }
+    });
+    it('an upload checked when the body is captured', () => {
+        const ctx = (0, capture_1.captureRequest)({ framework: 'test', method: 'POST', url: '/upload', headers: {} });
+        expect(() => (0, capture_1.captureBody)(ctx, { body: {}, files: [{ fieldname: 'f', originalname: 'shell.php' }] })).toThrow(types_1.RaspBlockedError);
+        expect(customRule()).toEqual(['custom.upload-on-path']);
+    });
+    it('late body capture, from inside another context', () => {
+        const ctx = (0, capture_1.captureRequest)({ framework: 'test', method: 'POST', url: '/upload', headers: {} });
+        (0, capture_1.captureLater)(ctx, () => ({ body: {}, files: [{ fieldname: 'f', originalname: 'shell.php' }] }));
+        const other = (0, capture_1.captureRequest)({ framework: 'test', method: 'GET', url: '/elsewhere', headers: {} });
+        expect(() => context_1.storage.run(other, () => ctx.late?.())).toThrow(types_1.RaspBlockedError);
+        expect(customRule()).toEqual(['custom.upload-on-path']);
+    });
+});
+//# sourceMappingURL=capture-context.test.js.map

package/dist/rasp/__tests__/capture-context.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-context.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/capture-context.test.ts"],"names":[],"mappings":";;AAAA;;;;;;GAMG;AACH,+BAAyE;AAEzE,4CAAgF;AAChF,wCAAuE;AACvE,wCAAqC;AACrC,kDAA0D;AAC1D,sCAA8F;AAC9F,8CAAsF;AACtF,oCAA4C;AAC5C,sCAA2C;AAC3C,qCAAsC;AAEtC,MAAM,WAAW,GAAG,uBAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAE,CAAC;AAC3D,MAAM,KAAK,GAAG,IAAA,mBAAU,EAAC,WAAW,CAAC,CAAC;AACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAiC,CAAC;AACxD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAGxB,IAAI,MAAM,GAAY,EAAE,CAAC;AAEzB,sFAAsF;AACtF,SAAS,MAAM;IACb,OAAO;QACL,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;QACzC,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;QACjC,KAAK,EAAE,IAAI;QACX,WAAW,EAAE;YACX,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,qDAAqD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7I,EAAE,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,0DAA0D,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;SACjI;KACF,CAAC;AACJ,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,IAAA,sCAAuB,GAAE,CAAC;IAC1B,MAAM,GAAG,EAAE,CAAC;IACZ,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAA,wBAAe,EAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,GAAG,EAAE;IACb,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC;IAC3B,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAE7I,SAAS,GAAG;IACV,MAAM,CAAC,GAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IACjH,CAAC,CAAC,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,IAAA,qBAAQ,EAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,EAAS,EAAE,CAAC,CAAC,CAAC;QAC3G,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,IAAA,wBAAW,GAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/G,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,aAAa,EAAE,GAAG,EAAE;QACrB,MAAM,KAAK,GAAwB,EAAE,CAAC;QACtC,IAAA,wBAAW,EAAC,EAAE,OAAO,EAAE,CAAC,IAAY,EAAE,EAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpG,MAAM,KAAK,GAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAChJ,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACvB,MAAM,CAAC,GAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;QACtH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,IAAA,oBAAO,GAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,IAAA,qBAAQ,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,mBAAmB,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,IAAA,kCAAsB,GAAE,CAAC;QACzB,MAAM,MAAM,GAAW,IAAA,mBAAY,EAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,OAAO,CAAO,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE;gBACpD,IAAA,cAAW,EAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;oBAChE,CAAC,CAAC,MAAM,EAAE,CAAC;oBACX,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC3C,CAAC,CAAC;qBACC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC;qBACjB,GAAG,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACtD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,IAAA,oCAAwB,GAAE,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;QAC/H,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,IAAA,sBAAY,EAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;QAC/E,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/code-hook.test.d.ts

@@ -0,0 +1 @@
+export {};