shield360 1.0.1 → 1.2.0

package/dist/rasp/__tests__/hook-contracts.test.js

@@ -0,0 +1,201 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Every sink hook through the shared hook contract (hook-kit.ts). Triggers
+ * are the harmless ones the hooks' own tests use.
+ */
+const cp = require("child_process");
+const fs = require("fs");
+const http = require("http");
+const vm = require("vm");
+const os_1 = require("os");
+const path_1 = require("path");
+const detect = __importStar(require("../detect"));
+const code_1 = require("../hooks/code");
+const db_1 = require("../hooks/db");
+const fs_1 = require("../hooks/fs");
+const http_1 = require("../hooks/http");
+const process_1 = require("../hooks/process");
+const template_1 = require("../hooks/template");
+const template = __importStar(require("../template"));
+const hook_kit_1 = require("./hook-kit");
+const req = (value) => ({ value, key: 'query.q', source: 'request' });
+(0, hook_kit_1.describeHookContract)({
+    name: 'child_process',
+    install: process_1.installProcessHooks,
+    uninstall: process_1.uninstallProcessHooks,
+    replaced: process_1.PROCESS_APIS.map((key) => ({ owner: cp, key })),
+    outer: { owner: cp, key: 'execSync' },
+    trigger: () => cp.execSync('echo ok; echo rasp-test'),
+    inputs: [req('ok; echo rasp-test')],
+    detector: { module: detect, name: 'detectCommand' },
+    attack: 'command_injection',
+});
+let dir = '';
+(0, hook_kit_1.describeHookContract)({
+    name: 'fs',
+    install: fs_1.installFsHooks,
+    uninstall: fs_1.uninstallFsHooks,
+    replaced: ['readFile', 'readFileSync', 'writeFile', 'writeFileSync', 'openSync', 'rename'].map((key) => ({ owner: fs, key })),
+    outer: { owner: fs, key: 'readFileSync' },
+    trigger: () => fs.readFileSync(`${dir}/child/../escape.txt`, 'utf8'),
+    inputs: [req('../escape.txt')],
+    detector: { module: detect, name: 'detectPath' },
+    attack: 'path_traversal',
+    beforeEach: () => {
+        dir = fs.mkdtempSync((0, path_1.join)((0, os_1.tmpdir)(), 'rasp-kit-'));
+        fs.mkdirSync((0, path_1.join)(dir, 'child'));
+        fs.writeFileSync((0, path_1.join)(dir, 'escape.txt'), 'fixture');
+    },
+    afterEach: () => fs.rmSync(dir, { recursive: true, force: true }),
+});
+// Nothing listens on the discard port, and the request is destroyed at once.
+const local = 'http://127.0.0.1:9/fixture';
+(0, hook_kit_1.describeHookContract)({
+    name: 'outbound http',
+    install: () => (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] }),
+    uninstall: http_1.uninstallHttpHooks,
+    replaced: [
+        { owner: http, key: 'request' },
+        { owner: http, key: 'get' },
+    ],
+    trigger: () => {
+        const r = http.request(local);
+        r.on('error', () => undefined);
+        r.destroy();
+    },
+    inputs: [req(local)],
+    detector: { module: detect, name: 'detectSsrf' },
+    attack: 'ssrf',
+});
+const input = "' OR '1'='1";
+class FakeClient {
+    query(...values) {
+        return values.length;
+    }
+}
+const pg = { Client: FakeClient };
+(0, hook_kit_1.describeHookContract)({
+    name: 'database (pg)',
+    install: () => {
+        (0, db_1.patchPg)(pg);
+        return true;
+    },
+    uninstall: () => (0, db_1.unpatchPg)(pg),
+    replaced: [{ owner: FakeClient.prototype, key: 'query' }],
+    trigger: () => new FakeClient().query(`SELECT * FROM products WHERE name = '${input}'`),
+    inputs: [req(input)],
+    detector: { module: detect, name: 'detectSql' },
+    attack: 'sql_injection',
+});
+(0, hook_kit_1.describeHookContract)({
+    name: 'code',
+    install: code_1.installCodeHooks,
+    uninstall: code_1.uninstallCodeHooks,
+    replaced: [
+        ...['runInThisContext', 'runInNewContext', 'runInContext', 'compileFunction', 'Script'].map((key) => ({ owner: vm, key })),
+        { owner: globalThis, key: 'Function' },
+    ],
+    added: ['write', 'end'].map((key) => ({ owner: http.ServerResponse.prototype, key })),
+    outer: { owner: vm, key: 'runInNewContext' },
+    trigger: () => vm.runInNewContext('1 + 2'),
+    inputs: [req('1 + 2')],
+    detector: { module: detect, name: 'detectCode' },
+    attack: 'code_injection',
+});
+// Template engines: stand-ins shaped like each engine's exports (the engines are optional dependencies).
+const templateEngines = [
+    ['handlebars', ['compile', 'precompile'], '{{name}}'],
+    ['ejs', ['render', 'compile'], '<%= 1 + 2 %>'],
+    ['pug', ['compile', 'render', 'compileClient'], '#{1 + 2}'],
+    ['nunjucks', ['renderString'], '{{ 1 + 2 }}'],
+    ['lodash', ['template'], '<%= 1 + 2 %>'],
+];
+for (const [engine, keys, source] of templateEngines) {
+    const exports = {};
+    for (const key of keys) {
+        // Named, with an arity, so the kit can see both survive.
+        exports[key] = { [key]: function (text, data) { return [text, data]; } }[key];
+    }
+    (0, hook_kit_1.describeHookContract)({
+        name: `template (${engine})`,
+        install: () => {
+            (0, template_1.patchTemplate)(engine, exports);
+            return true;
+        },
+        uninstall: () => (0, template_1.unpatchTemplate)(exports),
+        replaced: keys.map((key) => ({ owner: exports, key })),
+        trigger: () => exports[keys[0]](`Hello ${source}`, { name: 'data' }),
+        inputs: [req(source)],
+        detector: { module: template, name: 'detectTemplate' },
+        attack: 'code_injection',
+    });
+}
+// The real Handlebars, when present: the singleton and the compiler module its create() instances call.
+let handlebars;
+let compiler;
+try {
+    handlebars = require('handlebars');
+    compiler = require('handlebars/dist/cjs/handlebars/compiler/compiler');
+}
+catch {
+    handlebars = undefined;
+}
+if (handlebars && compiler) {
+    const hb = handlebars;
+    const internal = compiler;
+    (0, hook_kit_1.describeHookContract)({
+        name: 'template (real handlebars)',
+        install: () => {
+            (0, template_1.patchTemplate)('handlebars', hb);
+            (0, template_1.patchHandlebarsCompiler)(internal);
+            return true;
+        },
+        uninstall: () => {
+            (0, template_1.unpatchTemplate)(hb);
+            (0, template_1.unpatchTemplate)(internal);
+        },
+        replaced: [
+            ...['compile', 'precompile'].map((key) => ({ owner: hb, key })),
+            ...['compile', 'precompile'].map((key) => ({ owner: internal, key })),
+        ],
+        trigger: () => hb.compile('Hello {{name}}'),
+        inputs: [req('{{name}}')],
+        detector: { module: template, name: 'detectTemplate' },
+        attack: 'code_injection',
+    });
+}
+//# sourceMappingURL=hook-contracts.test.js.map

package/dist/rasp/__tests__/hook-contracts.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-contracts.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/hook-contracts.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;GAGG;AACH,oCAAqC;AACrC,yBAA0B;AAC1B,6BAA8B;AAC9B,yBAA0B;AAC1B,2BAA4B;AAC5B,+BAA4B;AAC5B,kDAAoC;AACpC,wCAAqE;AACrE,oCAAiD;AACjD,oCAA+D;AAC/D,wCAAqE;AACrE,8CAA4F;AAC5F,gDAA4F;AAC5F,sDAAwC;AAGxC,yCAAkD;AAElD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAa,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAEzF,IAAA,+BAAoB,EAAC;IACnB,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,6BAAmB;IAC5B,SAAS,EAAE,+BAAqB;IAChC,QAAQ,EAAE,sBAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;IACrC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACrD,MAAM,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE;IACnD,MAAM,EAAE,mBAAmB;CAC5B,CAAC,CAAC;AAEH,IAAI,GAAG,GAAG,EAAE,CAAC;AACb,IAAA,+BAAoB,EAAC;IACnB,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,mBAAc;IACvB,SAAS,EAAE,qBAAgB;IAC3B,QAAQ,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7H,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE;IACzC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,GAAG,sBAAsB,EAAE,MAAM,CAAC;IACpE,MAAM,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9B,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE;IAChD,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,GAAG,EAAE;QACf,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAClD,EAAE,CAAC,SAAS,CAAC,IAAA,WAAI,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACjC,EAAE,CAAC,aAAa,CAAC,IAAA,WAAI,EAAC,GAAG,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IACD,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;CAClE,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAC3C,IAAA,+BAAoB,EAAC;IACnB,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,uBAAgB,EAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;IAC3D,SAAS,EAAE,yBAAkB;IAC7B,QAAQ,EAAE;QACR,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE;QAC/B,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;KAC5B;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC,CAAC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE;IAChD,MAAM,EAAE,MAAM;CACf,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,aAAa,CAAC;AAC5B,MAAM,UAAU;IACd,KAAK,CAAC,GAAG,MAAiB;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;CACF;AACD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAClC,IAAA,+BAAoB,EAAC;IACnB,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,GAAG,EAAE;QACZ,IAAA,YAAO,EAAC,EAAE,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,cAAS,EAAC,EAAE,CAAC;IAC9B,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACzD,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,wCAAwC,KAAK,GAAG,CAAC;IACvF,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;IAC/C,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,IAAA,+BAAoB,EAAC;IACnB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,uBAAgB;IACzB,SAAS,EAAE,yBAAkB;IAC7B,QAAQ,EAAE;QACR,GAAG,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1H,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE;KACvC;IACD,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IACrF,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;IAC5C,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC;IAC1C,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE;IAChD,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,eAAe,GAAyC;IAC5D,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC;IACrD,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC9C,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,UAAU,CAAC;IAC3D,CAAC,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IAC7C,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;CACzC,CAAC;AACF,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;IACrD,MAAM,OAAO,GAAiD,EAAE,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,yDAAyD;QACzD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,IAAa,EAAE,IAAc,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,IAAA,+BAAoB,EAAC;QACnB,IAAI,EAAE,aAAa,MAAM,GAAG;QAC5B,OAAO,EAAE,GAAG,EAAE;YACZ,IAAA,wBAAa,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,0BAAe,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACpE,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACtD,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC;AAED,wGAAwG;AACxG,IAAI,UAA2D,CAAC;AAChE,IAAI,QAA4B,CAAC;AACjC,IAAI,CAAC;IACH,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnC,QAAQ,GAAG,OAAO,CAAC,kDAAkD,CAAC,CAAC;AACzE,CAAC;AAAC,MAAM,CAAC;IACP,UAAU,GAAG,SAAS,CAAC;AACzB,CAAC;AACD,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,UAAU,CAAC;IACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,IAAA,+BAAoB,EAAC;QACnB,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,GAAG,EAAE;YACZ,IAAA,wBAAa,EAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAChC,IAAA,kCAAuB,EAAC,QAAQ,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,IAAA,0BAAe,EAAC,EAAE,CAAC,CAAC;YACpB,IAAA,0BAAe,EAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,QAAQ,EAAE;YACR,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;SACtE;QACD,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC3C,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzB,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACtD,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC"}

package/dist/rasp/__tests__/hook-kit.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The checks every RASP sink hook must pass, whoever wrote it. The hooks'
+ * own tests cover what each sink detects; this kit covers how a hook sits
+ * in the process: install once, restore exactly, keep the replaced
+ * functions' shape, check a call once, fail open, stay quiet when RASP is
+ * off, and live alongside another wrapper (OpenTelemetry tracing wraps the
+ * same functions) in either order.
+ *
+ * Each hook supplies a harmless trigger: a call its detector flags under
+ * the given inputs, safe to run when RASP only reports.
+ */
+import { type RaspContext } from '../context';
+import { type AttackType, type RaspInput } from '../types';
+export type Target = {
+    owner: object;
+    key: string;
+};
+export type HookSpec = {
+    name: string;
+    install: () => boolean;
+    uninstall: () => void;
+    /** Properties the hook replaces. */
+    replaced: Target[];
+    /** Properties the hook adds (absent before install, removed by uninstall). */
+    added?: Target[];
+    /** The property the "wrapper on top" check wraps after install (default: the first replaced). */
+    outer?: Target;
+    /** A harmless call the hook flags under `inputs`. May return, throw or return a promise. */
+    trigger: () => unknown;
+    inputs: RaspInput[];
+    context?: Partial<RaspContext>;
+    /** The detector the trigger goes through, to make it fail. */
+    detector: {
+        module: object;
+        name: string;
+    };
+    attack: AttackType;
+    /** Per-test setup and teardown the trigger needs (temp files, a server). */
+    beforeEach?: () => unknown;
+    afterEach?: () => unknown;
+};
+export declare function describeHookContract(spec: HookSpec): void;

package/dist/rasp/__tests__/hook-kit.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeHookContract = describeHookContract;
+/**
+ * The checks every RASP sink hook must pass, whoever wrote it. The hooks'
+ * own tests cover what each sink detects; this kit covers how a hook sits
+ * in the process: install once, restore exactly, keep the replaced
+ * functions' shape, check a call once, fail open, stay quiet when RASP is
+ * off, and live alongside another wrapper (OpenTelemetry tracing wraps the
+ * same functions) in either order.
+ *
+ * Each hook supplies a harmless trigger: a call its detector flags under
+ * the given inputs, safe to run when RASP only reports.
+ */
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const types_1 = require("../types");
+function describeHookContract(spec) {
+    describe(`${spec.name}: hook contract`, () => {
+        const events = [];
+        const setMode = (mode) => {
+            if (mode === 'disabled')
+                (0, engine_1.configureEngine)({ enabled: false, applicationName: 'kit', env: {} });
+            else
+                (0, engine_1.configureEngine)({ enabled: true, applicationName: 'kit', mode, env: {} });
+            (0, engine_1.setEventSink)({ add: (e) => events.push(e) });
+        };
+        const ours = () => events.filter((e) => e.attrs['shield360.rasp.attack'] === spec.attack);
+        async function fire() {
+            try {
+                await (0, context_1.runWithInputs)(spec.inputs, spec.trigger, { inRequest: true, ...spec.context });
+                return { blocked: false };
+            }
+            catch (error) {
+                return { blocked: error instanceof types_1.RaspBlockedError, error };
+            }
+        }
+        const snapshot = (targets) => targets.map((t) => ({ ...t, descriptor: Object.getOwnPropertyDescriptor(t.owner, t.key) }));
+        beforeEach(async () => {
+            events.length = 0;
+            setMode('block');
+            await spec.beforeEach?.();
+        });
+        afterEach(async () => {
+            spec.uninstall();
+            jest.restoreAllMocks();
+            (0, engine_1.setEventSink)(undefined);
+            (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+            await spec.afterEach?.();
+        });
+        it('installs, and installing again changes nothing', () => {
+            expect(spec.install()).toBe(true);
+            const first = spec.replaced.map((t) => Reflect.get(t.owner, t.key));
+            expect(spec.install()).toBe(true);
+            expect(spec.replaced.map((t) => Reflect.get(t.owner, t.key))).toEqual(first);
+        });
+        it('keeps the name and length of what it replaces', () => {
+            const before = snapshot(spec.replaced);
+            spec.install();
+            for (const { owner, key, descriptor } of before) {
+                const now = Reflect.get(owner, key);
+                expect(now).not.toBe(descriptor?.value);
+                expect(now.name).toBe(descriptor?.value.name);
+                expect(now.length).toBe(descriptor?.value.length);
+            }
+        });
+        it('uninstall restores exactly, and twice is harmless', () => {
+            const before = snapshot(spec.replaced);
+            for (const t of spec.added ?? [])
+                expect(Object.prototype.hasOwnProperty.call(t.owner, t.key)).toBe(false);
+            spec.install();
+            for (const t of spec.added ?? [])
+                expect(Object.prototype.hasOwnProperty.call(t.owner, t.key)).toBe(true);
+            spec.uninstall();
+            spec.uninstall();
+            for (const { owner, key, descriptor } of before)
+                expect(Object.getOwnPropertyDescriptor(owner, key)).toEqual(descriptor);
+            for (const t of spec.added ?? [])
+                expect(Object.prototype.hasOwnProperty.call(t.owner, t.key)).toBe(false);
+        });
+        it('block: the trigger is refused and reported once', async () => {
+            spec.install();
+            const out = await fire();
+            expect(out.blocked).toBe(true);
+            expect(ours()).toHaveLength(1);
+            expect(ours()[0].attrs['shield360.rasp.decision']).toBe('blocked');
+        });
+        it('monitor: the trigger goes through and is reported exactly once', async () => {
+            setMode('monitor');
+            spec.install();
+            const out = await fire();
+            expect(out.blocked).toBe(false);
+            expect(ours()).toHaveLength(1);
+            expect(ours()[0].attrs['shield360.rasp.decision']).toBe('monitored');
+        });
+        it('RASP off: nothing is checked or reported', async () => {
+            setMode('disabled');
+            const detector = jest.spyOn(spec.detector.module, spec.detector.name);
+            spec.install();
+            const out = await fire();
+            expect(out.blocked).toBe(false);
+            expect(detector).not.toHaveBeenCalled();
+            expect(events).toHaveLength(0);
+        });
+        it('fails open when the detector fails', async () => {
+            jest.spyOn(spec.detector.module, spec.detector.name).mockImplementation(() => {
+                throw new Error('detector unavailable');
+            });
+            spec.install();
+            const out = await fire();
+            expect(out.blocked).toBe(false);
+            expect(events).toHaveLength(0);
+        });
+        it('lives alongside a wrapper put on top of it', async () => {
+            const target = spec.outer ?? spec.replaced[0];
+            spec.install();
+            const inner = Reflect.get(target.owner, target.key);
+            const descriptor = Object.getOwnPropertyDescriptor(target.owner, target.key);
+            // Shaped like a tracing wrapper: a plain function calling what it found.
+            const outer = function (...values) {
+                return Reflect.apply(inner, this, values);
+            };
+            Object.defineProperty(target.owner, target.key, { ...descriptor, value: outer });
+            try {
+                expect((await fire()).blocked).toBe(true);
+                spec.uninstall();
+                // Uninstall must not tear the outer wrapper off, and what is left must not check.
+                expect(Reflect.get(target.owner, target.key)).toBe(outer);
+                events.length = 0;
+                expect((await fire()).blocked).toBe(false);
+                expect(events).toHaveLength(0);
+            }
+            finally {
+                Object.defineProperty(target.owner, target.key, descriptor);
+            }
+        });
+    });
+}
+//# sourceMappingURL=hook-kit.js.map

package/dist/rasp/__tests__/hook-kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook-kit.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/hook-kit.ts"],"names":[],"mappings":";;AAyCA,oDA2HC;AApKD;;;;;;;;;;GAUG;AACH,wCAA6D;AAC7D,sCAA0D;AAC1D,oCAA4F;AA4B5F,SAAgB,oBAAoB,CAAC,IAAc;IACjD,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,iBAAiB,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAwC,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,CAAC,IAA2B,EAAE,EAAE;YAC9C,IAAI,IAAI,KAAK,UAAU;gBAAE,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;;gBACzF,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;QAE1F,KAAK,UAAU,IAAI;YACjB,IAAI,CAAC;gBACH,MAAM,IAAA,uBAAa,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,YAAY,wBAAgB,EAAE,KAAK,EAAE,CAAC;YAC/D,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,OAAiB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpI,UAAU,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAClB,OAAO,CAAC,OAAO,CAAC,CAAC;YACjB,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;YACxB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,MAAM,EAAE,CAAC;gBAChD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAqC,CAAC;gBACxE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACxC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;gBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3G,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;gBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1G,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,MAAM;gBAAE,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;gBAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7G,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;YAC9E,OAAO,CAAC,SAAS,CAAC,CAAC;YACnB,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,OAAO,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAsD,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtH,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAsD,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;gBAC3H,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAiC,CAAC;YACpF,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAE,CAAC;YAC9E,yEAAyE;YACzE,MAAM,KAAK,GAAG,UAAyB,GAAG,MAAiB;gBACzD,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,CAAC,CAAC;YACF,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjB,kFAAkF;gBAClF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClB,MAAM,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/rasp/__tests__/http-hook.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/http-hook.test.js

@@ -0,0 +1,250 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const http = require("http");
+const https = require("https");
+const dns = require("dns");
+const detect = __importStar(require("../detect"));
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const types_1 = require("../types");
+const http_1 = require("../hooks/http");
+const index_1 = require("../index");
+let server;
+let url;
+let port;
+let arrivals;
+const tainted = (value, fn) => (0, context_1.runWithInputs)([{ value, key: 'query.q', source: 'request' }], fn, { inRequest: true });
+function configure(mode = 'block', outboundHosts = []) {
+    (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode, allow: { outboundHosts }, env: {} });
+}
+function receive(request) {
+    return new Promise((resolve, reject) => {
+        request.on('error', reject);
+        request.on('response', response => {
+            response.resume();
+            response.on('end', resolve);
+            response.on('error', reject);
+        });
+    });
+}
+beforeEach(async () => {
+    configure();
+    (0, engine_1.setEventSink)({ add: () => undefined });
+    arrivals = jest.fn();
+    server = http.createServer((_req, res) => { arrivals(); res.end('fixture'); });
+    await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+    port = server.address().port;
+    url = `http://127.0.0.1:${port}/x`;
+});
+afterEach(async () => {
+    (0, http_1.uninstallHttpHooks)();
+    jest.restoreAllMocks();
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'a', env: {} });
+    (0, engine_1.setEventSink)(undefined);
+    server.closeAllConnections();
+    await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
+});
+for (const [owner, scheme] of [[http, 'http:'], [https, 'https:']]) {
+    describe(scheme, () => {
+        test.each(['request', 'get'])('%s normalizes every call form', api => {
+            const original = jest.spyOn(owner, api).mockImplementation((() => ({})));
+            const outbound = jest.spyOn(detect, 'detectOutbound').mockReturnValue(null);
+            jest.spyOn(detect, 'detectSsrf').mockReturnValue(null);
+            (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+            const endpoint = `${scheme}//127.0.0.1:${port}/x`;
+            const callback = () => undefined;
+            const forms = [
+                [endpoint], [new URL(endpoint)], [endpoint, callback],
+                [endpoint, {}, callback], [new URL(endpoint), {}, callback],
+                [{ protocol: scheme, hostname: '127.0.0.1', port, path: '/x' }, callback],
+                [{ host: '127.0.0.1', port, path: '/x' }],
+            ];
+            for (const values of forms) {
+                Reflect.apply(owner[api], owner, values);
+                expect(outbound).toHaveBeenLastCalledWith(endpoint, [], []);
+            }
+            expect(original).toHaveBeenCalledTimes(forms.length);
+            expect(outbound).toHaveBeenCalledTimes(forms.length);
+        });
+    });
+}
+test('tainted literal blocks synchronously before original or server', () => {
+    const original = jest.spyOn(http, 'request');
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    expect(() => tainted(url, () => http.request(url))).toThrow(types_1.RaspBlockedError);
+    expect(original).not.toHaveBeenCalled();
+    expect(arrivals).not.toHaveBeenCalled();
+});
+test('untainted loopback passes and get is checked once', async () => {
+    const detector = jest.spyOn(detect, 'detectSsrf');
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    await receive(http.get(url));
+    expect(arrivals).toHaveBeenCalledTimes(1);
+    expect(detector).toHaveBeenCalledTimes(1);
+});
+test('monitor reports and permits the request', async () => {
+    configure('monitor');
+    const events = jest.fn();
+    (0, engine_1.setEventSink)({ add: events });
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    await receive(tainted(url, () => http.get(url)));
+    expect(arrivals).toHaveBeenCalledTimes(1);
+    expect(events).toHaveBeenCalledWith(expect.objectContaining({ attrs: expect.objectContaining({
+            'shield360.rasp.decision': 'monitored',
+        }) }), expect.any(String));
+});
+test('outbound list applies without taint and alwaysAllowedHosts is honored', async () => {
+    configure('block', ['allowed.invalid']);
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    expect(() => http.get(url)).toThrow(types_1.RaspBlockedError);
+    (0, http_1.uninstallHttpHooks)();
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: ['127.0.0.1'] });
+    await receive(http.get(url));
+    expect(arrivals).toHaveBeenCalledTimes(1);
+});
+test.each([false, true])('actual lookup blocks private resolution, all=%s', all => {
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    const hostname = 'fixture.example';
+    const endpoint = `http://${hostname}:${port}/x`;
+    const lookup = jest.fn((_host, _options, callback) => {
+        process.nextTick(() => all ? callback(null, [{ address: '127.0.0.1', family: 4 }]) : callback(null, '127.0.0.1', 4));
+    });
+    const options = { lookup: lookup, all };
+    const request = tainted(endpoint, () => http.get(endpoint, options));
+    expect(options.lookup).toBe(lookup);
+    return new Promise((resolve, reject) => {
+        request.on('response', () => reject(new Error('Unexpected connection')));
+        request.on('error', error => {
+            try {
+                expect(error).toBeInstanceOf(types_1.RaspBlockedError);
+                expect(arrivals).not.toHaveBeenCalled();
+                resolve();
+            }
+            catch (failure) {
+                reject(failure);
+            }
+        });
+    });
+});
+test('fetch block rejects without calling original', async () => {
+    const original = jest.spyOn(globalThis, 'fetch');
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    await expect(tainted(url, () => fetch(url))).rejects.toBeInstanceOf(types_1.RaspBlockedError);
+    expect(original).not.toHaveBeenCalled();
+    expect(arrivals).not.toHaveBeenCalled();
+});
+describe('an outbound finding in monitor does not hide an SSRF block', () => {
+    const settings = () => (0, engine_1.configureEngine)({
+        enabled: true, applicationName: 'a', mode: 'block', attacks: { outbound: 'monitor', ssrf: 'block' },
+        allow: { outboundHosts: ['api.example.com'] }, env: {},
+    });
+    test('http.get', () => {
+        settings();
+        const original = jest.spyOn(http, 'get');
+        (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+        expect(() => tainted(url, () => http.get(url))).toThrow(expect.objectContaining({ attack: 'ssrf', rule: 'ssrf.internal' }));
+        expect(original).not.toHaveBeenCalled();
+        expect(arrivals).not.toHaveBeenCalled();
+    });
+    test('fetch', async () => {
+        settings();
+        const original = jest.spyOn(globalThis, 'fetch');
+        (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+        await expect(tainted(url, () => fetch(url))).rejects.toMatchObject({ attack: 'ssrf', rule: 'ssrf.internal' });
+        expect(original).not.toHaveBeenCalled();
+        expect(arrivals).not.toHaveBeenCalled();
+    });
+});
+test('fetch checks DNS addresses before calling original', async () => {
+    const original = jest.spyOn(globalThis, 'fetch');
+    jest.spyOn(dns.promises, 'lookup').mockImplementation((async () => [{ address: '127.0.0.1', family: 4 }]));
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    const endpoint = `http://fixture.example:${port}/x`;
+    await expect(tainted(endpoint, () => fetch(endpoint))).rejects.toBeInstanceOf(types_1.RaspBlockedError);
+    expect(original).not.toHaveBeenCalled();
+});
+test('off does not run detection', async () => {
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'a', env: {} });
+    const detector = jest.spyOn(detect, 'detectSsrf');
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    await receive(tainted(url, () => http.get(url)));
+    expect(detector).not.toHaveBeenCalled();
+});
+test('detector errors fail open', async () => {
+    jest.spyOn(detect, 'detectOutbound').mockImplementation(() => { throw new Error('unavailable'); });
+    (0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] });
+    await receive(http.get(url));
+    expect(arrivals).toHaveBeenCalledTimes(1);
+});
+test('a fetch that cannot be wrapped leaves the http hooks in place', () => {
+    const descriptor = Object.getOwnPropertyDescriptor(globalThis, 'fetch');
+    const fetchValue = descriptor.value;
+    Object.defineProperty(globalThis, 'fetch', { configurable: true, enumerable: descriptor.enumerable, get: () => fetchValue });
+    try {
+        const original = jest.spyOn(http, 'request');
+        expect((0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] })).toBe(true);
+        expect(() => tainted(url, () => http.request(url))).toThrow(types_1.RaspBlockedError);
+        expect(original).not.toHaveBeenCalled();
+        expect(Object.getOwnPropertyDescriptor(globalThis, 'fetch').get).toBeDefined();
+    }
+    finally {
+        (0, http_1.uninstallHttpHooks)();
+        Object.defineProperty(globalThis, 'fetch', descriptor);
+    }
+});
+test('alwaysAllowedHosts takes the hosts of the Shield360 URL and the OTLP endpoint', () => {
+    expect((0, index_1.alwaysAllowedHosts)(['https://App.Shield360.ai/api', 'http://[::1]:4318/v1/traces', undefined, 'not a url'])).toEqual(['app.shield360.ai', '::1']);
+});
+test('install is idempotent and restores exact descriptors', () => {
+    const entries = [http, https].flatMap(owner => ['request', 'get'].map(key => ({ owner, key })));
+    const saved = [...entries, { owner: globalThis, key: 'fetch' }].map(entry => ({
+        ...entry, descriptor: Object.getOwnPropertyDescriptor(entry.owner, entry.key),
+    }));
+    expect((0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] })).toBe(true);
+    const wrapper = http.request;
+    expect((0, http_1.installHttpHooks)({ alwaysAllowedHosts: [] })).toBe(true);
+    expect(http.request).toBe(wrapper);
+    for (const { owner, key, descriptor } of saved) {
+        const fn = Reflect.get(owner, key);
+        expect(fn.name).toBe(descriptor.value.name);
+        expect(fn.length).toBe(descriptor.value.length);
+    }
+    (0, http_1.uninstallHttpHooks)();
+    (0, http_1.uninstallHttpHooks)();
+    for (const { owner, key, descriptor } of saved)
+        expect(Object.getOwnPropertyDescriptor(owner, key)).toEqual(descriptor);
+});
+//# sourceMappingURL=http-hook.test.js.map