shield360 1.0.1 → 1.2.0

package/dist/rasp/__tests__/template-hook.test.js

@@ -0,0 +1,254 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const detector = __importStar(require("../template"));
+const template_1 = require("../template");
+const template_2 = require("../hooks/template");
+const code_1 = require("../hooks/code");
+const engine_1 = require("../engine");
+const context_1 = require("../context");
+const types_1 = require("../types");
+const input = (value) => [{ value, key: 'query.q', source: 'request' }];
+const taint = (value, fn) => (0, context_1.runWithInputs)(input(value), fn, { inRequest: true });
+const mode = (value = 'block') => (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode: 'block', attacks: { code_injection: value }, env: {} });
+const engines = [
+    ['handlebars', 'compile', '{{name}}'], ['ejs', 'render', '<%= 1 + 2 %>'], ['pug', 'compile', '#{1 + 2}'],
+    ['nunjucks', 'renderString', '{{ 1 + 2 }}'], ['lodash', 'template', '<%= 1 + 2 %>'],
+];
+beforeEach(() => { mode(); (0, engine_1.setEventSink)({ add: () => undefined }); });
+afterEach(() => { (0, code_1.uninstallCodeHooks)(); (0, template_2.uninstallTemplateHooks)(); jest.restoreAllMocks(); (0, engine_1.setEventSink)(undefined); (0, engine_1.configureEngine)({ enabled: false, applicationName: 'a', env: {} }); });
+test.each(engines)('%s blocks source before original; monitor and off preserve arguments and receiver', (engine, method, source) => {
+    const original = jest.fn(function (...args) { return { receiver: this, args }; });
+    const module = { [method]: original };
+    (0, template_2.patchTemplate)(engine, module);
+    const wrapper = module[method];
+    (0, template_2.patchTemplate)(engine, module);
+    expect(module[method]).toBe(wrapper);
+    expect(() => taint(source, () => module[method](source))).toThrow(types_1.RaspBlockedError);
+    expect(original).not.toHaveBeenCalled();
+    const events = jest.fn();
+    (0, engine_1.setEventSink)({ add: events });
+    mode('monitor');
+    const data = { name: source };
+    expect(taint(source, () => module[method](source, data))).toEqual({ receiver: module, args: [source, data] });
+    expect(events).toHaveBeenCalledTimes(1);
+    expect(events.mock.calls[0][0].attrs).toMatchObject({ 'shield360.rasp.rule': 'code.template_injection', 'shield360.rasp.attack': 'code_injection' });
+    mode('off');
+    events.mockClear();
+    const spy = jest.spyOn(detector, 'detectTemplate');
+    taint(source, () => module[method](source));
+    expect(spy).not.toHaveBeenCalled();
+    expect(events).not.toHaveBeenCalled();
+    mode();
+    spy.mockImplementation(() => { throw new Error('detector unavailable'); });
+    expect(() => taint(source, () => module[method](source))).not.toThrow();
+});
+test.each(engines)('%s allows fixed templates with expression-like input only as data', (engine, method, source) => {
+    const original = jest.fn((...args) => args);
+    const module = { [method]: original };
+    (0, template_2.patchTemplate)(engine, module);
+    expect(taint('{{ 7 * 7 }}', () => module[method](source, { name: '{{ 7 * 7 }}' }))).toEqual([source, { name: '{{ 7 * 7 }}' }]);
+    expect(taint('ordinary prose', () => module[method]('Hello ordinary prose'))).toEqual(['Hello ordinary prose']);
+});
+test('structure, overlap, minimum length and single expression tokens', () => {
+    expect((0, template_1.detectTemplate)('Hello {{ 7 * 7 }}', input('{{ 7 * 7 }}'), 'handlebars')?.rule).toBe('code.template_injection');
+    expect((0, template_1.detectTemplate)('<%= 7 * 7 %>', input('7 * 7'), 'ejs')?.rule).toBe('code.template_injection');
+    expect((0, template_1.detectTemplate)('p\n  - 7 + 7', input('- 7 + 7'), 'pug')?.rule).toBe('code.template_injection');
+    for (const [source, value] of [['Hello {{name}}', 'name'], ['<%= "ordinary prose" %>', 'ordinary prose'], ['Hello 7 + 7', '7 + 7'], ['{{name}}', 'absent'], ['{{x}}', 'x']]) {
+        expect((0, template_1.detectTemplate)(source, input(value), source.startsWith('Hello {{') ? 'handlebars' : 'ejs')).toBeNull();
+    }
+});
+test('one check for render delegating to compile and Function', () => {
+    (0, code_1.installCodeHooks)();
+    mode('monitor');
+    const module = { compile: (s) => new Function(`return ${s.length}`)(), render: (s) => module.compile(s) };
+    (0, template_2.patchTemplate)('ejs', module);
+    const events = jest.fn();
+    (0, engine_1.setEventSink)({ add: events });
+    const spy = jest.spyOn(detector, 'detectTemplate');
+    expect(taint('<%= 1 + 2 %>', () => module.render('<%= 1 + 2 %>'))).toBe(12);
+    expect(spy).toHaveBeenCalledTimes(1);
+    expect(events).toHaveBeenCalledTimes(1);
+});
+test('generations disable retained wrappers across reinstall; unpatch preserves later wrappers', () => {
+    (0, template_2.installTemplateHooks)();
+    const original = jest.fn((s) => s);
+    const module = { compile: original };
+    (0, template_2.patchTemplate)('handlebars', module);
+    const old = module.compile;
+    module.compile = s => old(s);
+    const later = module.compile;
+    (0, template_2.uninstallTemplateHooks)();
+    (0, template_2.installTemplateHooks)();
+    (0, template_2.patchTemplate)('handlebars', module);
+    const spy = jest.spyOn(detector, 'detectTemplate');
+    mode('monitor');
+    taint('{{name}}', () => module.compile('{{name}}'));
+    expect(spy).toHaveBeenCalledTimes(1);
+    (0, template_2.unpatchTemplate)(module);
+    expect(module.compile).toBe(later);
+    expect(taint('{{name}}', () => old('{{name}}'))).toBe('{{name}}');
+});
+test('nunjucks Environment and instrumentation register optional engines without loading them', () => {
+    class Environment {
+        renderString(s) { return s; }
+    }
+    const module = { Environment };
+    (0, template_2.patchTemplate)('nunjucks', module);
+    expect(() => taint('{{name}}', () => new Environment().renderString('{{name}}'))).toThrow(types_1.RaspBlockedError);
+    (0, template_2.unpatchTemplate)(module);
+    expect(taint('{{name}}', () => new Environment().renderString('{{name}}'))).toBe('{{name}}');
+    const instrumentation = new template_2.RaspTemplateInstrumentation();
+    expect(instrumentation).toBeDefined();
+    expect(() => (0, template_2.patchTemplate)('ejs', Object.freeze({ render: () => 'ok' }))).not.toThrow();
+});
+test('disabled engine, absent input and non-string sources bypass detection; original errors survive', () => {
+    const failure = new Error('engine failure');
+    const module = { render: jest.fn((..._args) => { throw failure; }) };
+    (0, template_2.patchTemplate)('ejs', module);
+    const spy = jest.spyOn(detector, 'detectTemplate');
+    expect(() => module.render('<%= 1 + 2 %>')).toThrow(failure);
+    expect(() => taint('input', () => module.render({ template: 'input' }))).toThrow(failure);
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'a', env: {} });
+    expect(() => taint('<%= 1 + 2 %>', () => module.render('<%= 1 + 2 %>'))).toThrow(failure);
+    expect(spy).not.toHaveBeenCalled();
+});
+// Review findings: each case below is harmless and never executes fixture source as an attack.
+const realHandlebars = (() => { try {
+    return require('handlebars');
+}
+catch {
+    return undefined;
+} })();
+const withHandlebars = realHandlebars ? test : test.skip;
+// Jest's module registry is not require.cache, so the real engine is patched the way the import hook patches it.
+const patchRealHandlebars = () => {
+    (0, template_2.patchTemplate)('handlebars', realHandlebars);
+    (0, template_2.patchHandlebarsCompiler)(require('handlebars/dist/cjs/handlebars/compiler/compiler'));
+};
+test('an independent template or Function call inside a render helper is still checked', () => {
+    (0, code_1.installCodeHooks)();
+    const inner = { compile: jest.fn((s) => s) };
+    (0, template_2.patchTemplate)('handlebars', inner);
+    const outer = { render: (s, data) => `${s}${String(data.helper())}` };
+    (0, template_2.patchTemplate)('ejs', outer);
+    const value = '{{name}}';
+    expect(() => taint(value, () => outer.render('Hello <%= name %>', { helper: () => inner.compile(`Hi ${value}`) }))).toThrow(types_1.RaspBlockedError);
+    expect(inner.compile).not.toHaveBeenCalled();
+    const code = 'name + 1';
+    expect(() => taint(code, () => outer.render('Hello <%= name %>', { helper: () => new Function(`return ${code}`) }))).toThrow(types_1.RaspBlockedError);
+});
+test('handlebars instances from create() share the patched compiler module', () => {
+    const compiler = { compile: jest.fn((s) => s), precompile: jest.fn((s) => s) };
+    const create = () => ({ compile: (s) => compiler.compile(s), precompile: (s) => compiler.precompile(s) });
+    (0, template_2.patchHandlebarsCompiler)(compiler);
+    const instance = create();
+    expect(() => taint('{{name}}', () => instance.compile('Hi {{name}}'))).toThrow(types_1.RaspBlockedError);
+    expect(() => taint('{{name}}', () => instance.precompile('Hi {{name}}'))).toThrow(types_1.RaspBlockedError);
+    expect(compiler.compile).not.toHaveBeenCalled();
+    (0, template_2.unpatchTemplate)(compiler);
+    expect(taint('{{name}}', () => instance.compile('Hi {{name}}'))).toBe('Hi {{name}}');
+});
+withHandlebars('real handlebars: create() instances are covered after install', () => {
+    patchRealHandlebars();
+    const instance = realHandlebars.create();
+    expect(() => taint('{{name}}', () => instance.compile('Hi {{name}}'))).toThrow(types_1.RaspBlockedError);
+    (0, template_2.uninstallTemplateHooks)();
+    expect(taint('{{name}}', () => instance.compile('Hi {{name}}')({ name: 'x' }))).toBe('Hi x');
+});
+test('pug attribute values are expression regions', () => {
+    expect((0, template_1.detectTemplate)('a(href=url + "x") Link', input('url + "x"'), 'pug')?.rule).toBe('code.template_injection');
+    expect((0, template_1.detectTemplate)('a(class="c" href=url)= label + 1', input('label + 1'), 'pug')?.rule).toBe('code.template_injection');
+    expect((0, template_1.detectTemplate)('a(href=url) Link', input('url'), 'pug')).toBeNull();
+    expect((0, template_1.detectTemplate)('a(title="O\'Brien here") Link', input("O'Brien here"), 'pug')).toBeNull();
+    expect((0, template_1.detectTemplate)('p Hello (see the notes) today', input('see the notes'), 'pug')).toBeNull();
+});
+test('a dotted path in a fixed template is one reference', () => {
+    expect((0, template_1.detectTemplate)('Hello {{user.name}}', input('user.name'), 'handlebars')).toBeNull();
+    expect((0, template_1.detectTemplate)('Hello <%= user.name %>', input('user.name'), 'ejs')).toBeNull();
+    expect((0, template_1.detectTemplate)('Hello {{ user.name }}', input('user.name }}'), 'nunjucks')?.rule).toBe('code.template_injection');
+});
+test('quoted closing delimiters stay inside their token where the engine lexes strings', () => {
+    expect((0, template_1.detectTemplate)('{{shout "a }} b"}} done', input('a }} b'), 'handlebars')).toBeNull();
+    expect((0, template_1.detectTemplate)('{{ "a }} b" | upper }} done', input('a }} b'), 'nunjucks')).toBeNull();
+    expect((0, template_1.detectTemplate)('p #{"a } b"} done', input('a } b'), 'pug')).toBeNull();
+});
+test('escaped handlebars mustaches and nunjucks comments are literal text', () => {
+    expect((0, template_1.detectTemplate)('Show \\{{name}} literally', input('{{name}}'), 'handlebars')).toBeNull();
+    expect((0, template_1.detectTemplate)('Show \\\\{{name}} live', input('{{name}}'), 'handlebars')?.rule).toBe('code.template_injection');
+    expect((0, template_1.detectTemplate)('Hi {# note {{ a + b }} #}', input('{{ a + b }}'), 'nunjucks')).toBeNull();
+});
+withHandlebars('real handlebars: fixed templates with matching data values render', () => {
+    patchRealHandlebars();
+    const hb = realHandlebars;
+    hb.registerHelper('shout', (s) => s.toUpperCase());
+    try {
+        expect(taint('user.name', () => hb.compile('Hello {{user.name}}')({ user: { name: 'user.name' } }))).toBe('Hello user.name');
+        expect(taint('a }} b', () => hb.compile('{{shout "a }} b"}}')({}))).toBe('A }} B');
+        expect(taint('{{name}}', () => hb.compile('Show \\{{name}}')({ name: '{{name}}' }))).toBe('Show {{name}}');
+    }
+    finally {
+        hb.unregisterHelper('shout');
+    }
+});
+test('shared engine table: tags, directives, line code, attributes and pairs are regions', () => {
+    const hit = (source, value, engine) => (0, template_1.detectTemplate)(source, input(value), engine)?.rule;
+    expect(hit('<#if x>${a}</#if>', 'x>${a}', 'freemarker')).toBe('code.template_injection');
+    expect(hit('<#assign x = 7 * 7>', '7 * 7', 'freemarker')).toBe('code.template_injection');
+    expect(hit('#set($x = 7 * 7)', '7 * 7', 'velocity')).toBe('code.template_injection');
+    expect(hit('Hi\n% if a + b:\nx', 'a + b', 'mako')).toBe('code.template_injection');
+    expect(hit('<%def name="x()">y</%def>', 'name="x()"', 'mako')).toBe('code.template_injection');
+    expect(hit('<p th:text="a + b">x</p>', 'a + b', 'thymeleaf')).toBe('code.template_injection');
+    expect(hit('@if($a + $b) y @endif', '$a + $b', 'blade')).toBe('code.template_injection');
+    expect(hit('{{ printf "%d" 7 }}', 'printf "%d"', 'gotemplate')).toBe('code.template_injection');
+    expect(hit('Hi {$a + $b}', '$a + $b', 'smarty')).toBe('code.template_injection');
+    expect(hit('{% raw %}x{% endraw %}{{ a }}', '{% endraw %}{{ a }}', 'jinja2')).toBe('code.template_injection');
+    expect((0, template_1.detectTemplate)('{{ a }}', input('{{ a }}'), 'unknown')).toBeNull();
+});
+test('review fixes: raw-block close variants, floor division, attribute spacing', () => {
+    const hit = (source, value, engine) => (0, template_1.detectTemplate)(source, input(value), engine)?.rule;
+    // A compact or trimming raw close ends the block; what follows is live.
+    expect(hit('{% raw %}x{%endraw%}{{ 7 * 7 }}', '{{ 7 * 7 }}', 'jinja2')).toBe('code.template_injection');
+    expect(hit('{% raw %}x{%- endraw -%}{{ 7 * 7 }}', '{{ 7 * 7 }}', 'nunjucks')).toBe('code.template_injection');
+    // Trimming raw openers make literal text.
+    expect((0, template_1.detectTemplate)('{%- raw -%}{{ a + b }}{% endraw %}', input('{{ a + b }}'), 'jinja2')).toBeNull();
+    // `//` is floor division, not a comment, inside template expressions.
+    expect(hit('{{ 10 // a + b }}', 'a + b', 'jinja2')).toBe('code.template_injection');
+    // Whitespace around `=` in an attribute.
+    expect(hit('<p th:text = "a + b">x</p>', 'a + b', 'thymeleaf')).toBe('code.template_injection');
+    // A Thymeleaf expression in plain HTML text is literal.
+    expect((0, template_1.detectTemplate)('<p>${a + b}</p>', input('${a + b}'), 'thymeleaf')).toBeNull();
+});
+//# sourceMappingURL=template-hook.test.js.map

package/dist/rasp/__tests__/template-hook.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-hook.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/template-hook.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,sDAAwC;AACxC,0CAAkE;AAClE,gDAAkM;AAClM,wCAAqE;AACrE,sCAA0D;AAC1D,wCAA2C;AAC3C,oCAA4C;AAC5C,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC;AACzF,MAAM,KAAK,GAAG,CAAI,KAAa,EAAE,EAAW,EAAK,EAAE,CAAC,IAAA,uBAAa,EAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACzG,MAAM,IAAI,GAAG,CAAC,QAAqC,OAAO,EAAE,EAAE,CAAC,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AACpL,MAAM,OAAO,GAA6C;IACxD,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC;IACxG,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC;CACpF,CAAC;AACF,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,SAAS,CAAC,GAAG,EAAE,GAAG,IAAA,yBAAkB,GAAE,CAAC,CAAC,IAAA,iCAAsB,GAAE,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC,CAAC,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1L,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,mFAAmF,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACjI,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,UAAyB,GAAG,IAAe,IAAI,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtC,IAAA,wBAAa,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAA,wBAAa,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACpF,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;IACzB,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACrJ,IAAI,CAAC,KAAK,CAAC,CAAC;IACZ,MAAM,CAAC,SAAS,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACnD,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACnC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACtC,IAAI,EAAE,CAAC;IACP,GAAG,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;AAC1E,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,mEAAmE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACjH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtC,IAAA,wBAAa,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAClH,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,CAAC,IAAA,yBAAc,EAAC,mBAAmB,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtH,MAAM,CAAC,IAAA,yBAAc,EAAC,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACpG,MAAM,CAAC,IAAA,yBAAc,EAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtG,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5K,MAAM,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChH,CAAC;AACH,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,IAAA,uBAAgB,GAAE,CAAC;IACnB,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1H,IAAA,wBAAa,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;IAAC,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,0FAA0F,EAAE,GAAG,EAAE;IACpG,IAAA,+BAAoB,GAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAuC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACzE,IAAA,wBAAa,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC;IAC7B,IAAA,iCAAsB,GAAE,CAAC;IACzB,IAAA,+BAAoB,GAAE,CAAC;IACvB,IAAA,wBAAa,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,CAAC;IAChB,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACrC,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACxB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,yFAAyF,EAAE,GAAG,EAAE;IACnG,MAAM,WAAW;QAAG,YAAY,CAAC,CAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;KAAE;IAC3D,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,CAAC;IAC/B,IAAA,wBAAa,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IAC5G,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7F,MAAM,eAAe,GAAG,IAAI,sCAA2B,EAAE,CAAC;IAC1D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,wBAAa,EAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;AAC1F,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,gGAAgG,EAAE,GAAG,EAAE;IAC1G,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAA,wBAAa,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;AACrC,CAAC,CAAC,CAAC;AACH,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,SAAS,CAAC;AAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvG,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACzD,iHAAiH;AACjH,MAAM,mBAAmB,GAAG,GAAG,EAAE;IAC/B,IAAA,wBAAa,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC5C,IAAA,kCAAuB,EAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,CAAC;AACvF,CAAC,CAAC;AACF,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,IAAA,uBAAgB,GAAE,CAAC;IACnB,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,IAAA,wBAAa,EAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,CAAC,CAAS,EAAE,IAA+B,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;IACzG,IAAA,wBAAa,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC;IACzB,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IAC9I,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC;IACxB,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;AACjJ,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1H,IAAA,kCAAuB,EAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACpG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAChD,IAAA,0BAAe,EAAC,QAAQ,CAAC,CAAC;IAC1B,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AACH,cAAc,CAAC,+DAA+D,EAAE,GAAG,EAAE;IACnF,mBAAmB,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;IACzC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IACjG,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;IACvD,MAAM,CAAC,IAAA,yBAAc,EAAC,wBAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAClH,MAAM,CAAC,IAAA,yBAAc,EAAC,kCAAkC,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC5H,MAAM,CAAC,IAAA,yBAAc,EAAC,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3E,MAAM,CAAC,IAAA,yBAAc,EAAC,+BAA+B,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjG,MAAM,CAAC,IAAA,yBAAc,EAAC,+BAA+B,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACpG,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,CAAC,IAAA,yBAAc,EAAC,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3F,MAAM,CAAC,IAAA,yBAAc,EAAC,wBAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvF,MAAM,CAAC,IAAA,yBAAc,EAAC,uBAAuB,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAC3H,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,CAAC,IAAA,yBAAc,EAAC,yBAAyB,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5F,MAAM,CAAC,IAAA,yBAAc,EAAC,6BAA6B,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9F,MAAM,CAAC,IAAA,yBAAc,EAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChF,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,CAAC,IAAA,yBAAc,EAAC,2BAA2B,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChG,MAAM,CAAC,IAAA,yBAAc,EAAC,wBAAwB,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxH,MAAM,CAAC,IAAA,yBAAc,EAAC,2BAA2B,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnG,CAAC,CAAC,CAAC;AACH,cAAc,CAAC,mEAAmE,EAAE,GAAG,EAAE;IACvF,mBAAmB,EAAE,CAAC;IACtB,MAAM,EAAE,GAAG,cAAc,CAAC;IAC1B,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC7H,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnF,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7G,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,oFAAoF,EAAE,GAAG,EAAE;IAC9F,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,MAAsB,EAAE,EAAE,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC;IAC1H,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzF,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACrF,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACnF,MAAM,CAAC,GAAG,CAAC,2BAA2B,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC/F,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9F,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzF,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAChG,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACjF,MAAM,CAAC,GAAG,CAAC,+BAA+B,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9G,MAAM,CAAC,IAAA,yBAAc,EAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,SAA2B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC9F,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,MAAsB,EAAE,EAAE,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC;IAC1H,wEAAwE;IACxE,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxG,MAAM,CAAC,GAAG,CAAC,qCAAqC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9G,0CAA0C;IAC1C,MAAM,CAAC,IAAA,yBAAc,EAAC,oCAAoC,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxG,sEAAsE;IACtE,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACpF,yCAAyC;IACzC,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAChG,wDAAwD;IACxD,MAAM,CAAC,IAAA,yBAAc,EAAC,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACvF,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/upload.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/upload.test.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Upload file names: read from raw multipart bodies and from a parser's file
+ * objects, recorded as request input, checked by file_write.upload, and then
+ * seen by file_write.script when the app writes a file named after them.
+ */
+const capture_1 = require("../capture");
+const detect_1 = require("../detect");
+const engine_1 = require("../engine");
+const types_1 = require("../types");
+const multipart = (parts) => {
+    const b = '----shield360test';
+    const text = parts
+        .map((p) => `--${b}\r\nContent-Disposition: form-data; name="${p.name}"${p.filename !== undefined ? `; filename="${p.filename}"` : ''}\r\n\r\n${p.body}\r\n`)
+        .join('');
+    return { body: `${text}--${b}--\r\n`, contentType: `multipart/form-data; boundary=${b}` };
+};
+const ctx = () => (0, capture_1.captureRequest)({ framework: 'test', method: 'POST', url: '/upload', headers: {} });
+const events = [];
+beforeEach(() => {
+    events.length = 0;
+    (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode: 'monitor', env: {} });
+    (0, engine_1.setEventSink)({ add: (e) => events.push(e) });
+});
+afterAll(() => {
+    (0, engine_1.setEventSink)(undefined);
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+});
+describe('uploadNames', () => {
+    it('reads file names from raw multipart part headers, not plain fields', () => {
+        const b = multipart([
+            { name: 'title', body: 'Quarterly report' },
+            { name: 'attachment', filename: 'report.pdf', body: 'fixture' },
+        ]);
+        expect((0, capture_1.uploadNames)(b, b.body)).toEqual([{ field: 'attachment', name: 'report.pdf' }]);
+    });
+    it("reads multer's req.file and req.files shapes", () => {
+        expect((0, capture_1.uploadNames)({ files: { fieldname: 'avatar', originalname: 'me.png' } }, '')).toEqual([{ field: 'avatar', name: 'me.png' }]);
+        expect((0, capture_1.uploadNames)({ files: [{ fieldname: 'docs', originalname: 'a.txt' }, { fieldname: 'docs', originalname: 'b.txt' }] }, '').map((u) => u.name)).toEqual(['a.txt', 'b.txt']);
+        expect((0, capture_1.uploadNames)({ files: { docs: [{ originalname: 'c.txt' }] } }, '')).toEqual([{ field: 'docs', name: 'c.txt' }]);
+    });
+    it('caps the number of names read', () => {
+        const parts = Array.from({ length: 40 }, (_, i) => ({ name: `f${i}`, filename: `x${i}.txt`, body: '1' }));
+        const b = multipart(parts);
+        expect((0, capture_1.uploadNames)(b, b.body)).toHaveLength(32);
+    });
+});
+describe('detectUpload', () => {
+    const input = (value) => ({ value, key: 'body.file.filename', source: 'request' });
+    it.each(['shell.php', 'run.sh', 'handler.JSP', 'x/../y.py', 'tool.exe'])('flags %s', (name) => {
+        expect((0, detect_1.detectUpload)(input(name))?.rule).toBe('file_write.upload');
+    });
+    it.each(['report.pdf', 'photo.jpeg', 'notes.txt', 'archive.tar.gz', 'php.txt'])('passes %s', (name) => {
+        expect((0, detect_1.detectUpload)(input(name))).toBeNull();
+    });
+});
+describe('captured uploads', () => {
+    it('records the file name as input and reports a script upload in monitor', () => {
+        const c = ctx();
+        const b = multipart([{ name: 'attachment', filename: 'shell.php', body: 'fixture' }]);
+        (0, capture_1.captureBody)(c, b);
+        expect(c.inputs).toContainEqual(expect.objectContaining({ key: 'body.attachment.filename', value: 'shell.php' }));
+        expect(events.map((e) => e.attrs['shield360.rasp.rule'])).toEqual(['file_write.upload']);
+        expect(events[0].attrs['shield360.rasp.sink']).toBe('request.upload');
+    });
+    it('blocks a script upload when file_write blocks', () => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode: 'monitor', attacks: { file_write: 'block' }, env: {} });
+        expect(() => (0, capture_1.captureBody)(ctx(), { body: {}, files: { fieldname: 'f', originalname: 'cmd.aspx' } })).toThrow(types_1.RaspBlockedError);
+    });
+    it('lets an ordinary upload through without a report', () => {
+        (0, capture_1.captureBody)(ctx(), multipart([{ name: 'attachment', filename: 'report.pdf', body: 'fixture' }]));
+        expect(events).toHaveLength(0);
+    });
+    it('a later write named after the upload is caught by file_write.script', () => {
+        const c = ctx();
+        (0, capture_1.captureBody)(c, { body: {}, files: { fieldname: 'f', originalname: 'page.php' } });
+        expect((0, detect_1.detectPath)('/srv/app/public/page.php', 'write', c.inputs, [], true)?.rule).toBe('file_write.script');
+    });
+});
+//# sourceMappingURL=upload.test.js.map

package/dist/rasp/__tests__/upload.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/upload.test.ts"],"names":[],"mappings":";;AAAA;;;;GAIG;AACH,wCAAsE;AACtE,sCAAqD;AACrD,sCAA0D;AAC1D,oCAA4D;AAE5D,MAAM,SAAS,GAAG,CAAC,KAA0D,EAAE,EAAE;IAC/E,MAAM,CAAC,GAAG,mBAAmB,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC;SAC5J,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,iCAAiC,CAAC,EAAE,EAAE,CAAC;AAC5F,CAAC,CAAC;AACF,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAErG,MAAM,MAAM,GAAwC,EAAE,CAAC;AACvD,UAAU,CAAC,GAAG,EAAE;IACd,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AACH,QAAQ,CAAC,GAAG,EAAE;IACZ,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,GAAG,SAAS,CAAC;YAClB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAC3C,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,IAAA,qBAAW,EAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,IAAA,qBAAW,EAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnI,MAAM,CAAC,IAAA,qBAAW,EAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChL,MAAM,CAAC,IAAA,qBAAW,EAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1G,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,IAAA,qBAAW,EAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,KAAK,GAAG,CAAC,KAAa,EAAa,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,oBAAoB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACtG,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QAC5F,MAAM,CAAC,IAAA,qBAAY,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;QACpG,MAAM,CAAC,IAAA,qBAAY,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACtF,IAAA,qBAAW,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClH,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrH,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IAChI,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,IAAA,qBAAW,EAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,IAAA,mBAAU,EAAC,0BAA0B,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC9G,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/vpatch-engine.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/vpatch-engine.test.js

@@ -0,0 +1,177 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Virtual patches: each built-in rule matches a request built from the shape
+ * its own rule file documents (no new payloads), and stops matching when one
+ * clause is missing. Then the engine: modes, caps, kill switches, events.
+ */
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const types_1 = require("../types");
+const vpatch_1 = require("../vpatch");
+const corpus_1 = require("./corpus");
+/** The same request without what one clause needs. */
+function without(rule, i) {
+    return (0, corpus_1.requestFor)({ ...rule, match: rule.match.filter((_, k) => k !== i) });
+}
+const versionIn = (rule) => rule.runtimeVersions?.node?.[0]?.[0] ?? process.versions.node;
+describe('virtual patches', () => {
+    it.each(vpatch_1.BUILT_IN_RULES.map((r) => [r.id, r]))('%s matches its documented request shape', (_id, rule) => {
+        const f = (0, vpatch_1.matchVirtualPatches)((0, corpus_1.requestFor)(rule), [rule], 'all', 'node', versionIn(rule));
+        expect(f).toMatchObject({ attack: 'virtual_patch', rule: rule.id, action: rule.action ?? 'block' });
+        if (rule.cves?.length)
+            expect(f?.cve).toBe(rule.cves[0]);
+    });
+    it.each(vpatch_1.BUILT_IN_RULES.map((r) => [r.id, r]))('%s needs every clause', (_id, rule) => {
+        rule.match.forEach((c, i) => {
+            const req = without(rule, i);
+            // A clause on a target the remaining clauses also fill can still be met; only check clauses that are not.
+            if ((0, vpatch_1.clauseMatches)(req, c))
+                return;
+            expect((0, vpatch_1.matchVirtualPatches)(req, [rule], 'all', 'node', versionIn(rule))).toBeNull();
+        });
+    });
+    it('runtimeVersions: [from, to) ranges; other runtimes skip node rules', () => {
+        const rule = vpatch_1.BUILT_IN_RULES.find((r) => r.runtimeVersions?.node);
+        const [from, to] = rule.runtimeVersions.node[0];
+        expect((0, vpatch_1.ruleApplies)(rule, 'node', from)).toBe(true);
+        expect((0, vpatch_1.ruleApplies)(rule, 'node', to)).toBe(false);
+        expect((0, vpatch_1.ruleApplies)(rule, 'python', from)).toBe(false);
+    });
+    it('phases: head rules never read the body; body rules wait for it', () => {
+        const bodyRule = vpatch_1.BUILT_IN_RULES.find(vpatch_1.needsBody);
+        const req = (0, corpus_1.requestFor)(bodyRule);
+        expect((0, vpatch_1.matchVirtualPatches)(req, [bodyRule], 'head')).toBeNull();
+        expect((0, vpatch_1.matchVirtualPatches)(req, [bodyRule], 'body', 'node', versionIn(bodyRule))?.rule).toBe(bodyRule.id);
+    });
+    it('refuses patterns with backreferences or lookaround', () => {
+        const req = { method: 'GET', path: '/aa', query: '', headers: {}, cookie: '', body: '' };
+        expect((0, vpatch_1.clauseMatches)(req, { target: 'path', op: 'regex', value: '^/a+$' })).toBe(true);
+        expect((0, vpatch_1.clauseMatches)(req, { target: 'path', op: 'regex', value: '(a)\\1' })).toBe(false);
+        expect((0, vpatch_1.clauseMatches)(req, { target: 'path', op: 'regex', value: 'a(?=a)' })).toBe(false);
+    });
+});
+describe('engine', () => {
+    const events = [];
+    const sink = { add: (e) => events.push(e) };
+    const finding = { attack: 'sql_injection', rule: 'sqli.userinput', input: { value: 'v', key: 'query.id', source: 'request' } };
+    const remote = (over = {}) => ({
+        version: 'v1',
+        exp: Date.now() / 1000 + 3600,
+        killSwitch: false,
+        snippets: false,
+        attacks: {},
+        rules: null,
+        ...over,
+    });
+    beforeEach(() => {
+        events.length = 0;
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'orders-api', env: {} });
+        (0, engine_1.setEventSink)(sink);
+    });
+    afterAll(() => {
+        (0, engine_1.setEventSink)(undefined);
+        (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+    });
+    it('monitor by default: reports, never throws', () => {
+        expect((0, engine_1.handleFinding)(finding, 'pg.query')).toBe('monitored');
+        expect(events).toHaveLength(1);
+        const a = events[0].attrs;
+        expect(a['shield360.rasp.event_id']).toMatch(/^[a-f0-9]{32}$/);
+        expect(a['shield360.rasp.input_key']).toBe('query.id');
+        expect(a['shield360.rasp.config_version']).toBe('local');
+        expect(JSON.stringify(events)).not.toContain('"v"');
+    });
+    it('block mode throws the typed error with the event id', () => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', attacks: { sql_injection: 'block' }, env: {} });
+        (0, engine_1.setEventSink)(sink);
+        let err;
+        try {
+            (0, engine_1.handleFinding)(finding, 'pg.query');
+        }
+        catch (e) {
+            err = e;
+        }
+        expect(err).toBeInstanceOf(types_1.RaspBlockedError);
+        expect(err.eventId).toBe(events[0].attrs['shield360.rasp.event_id']);
+        expect(err.statusCode).toBe(403);
+    });
+    it('xss never blocks', () => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode: 'block', env: {} });
+        expect((0, engine_1.modeFor)('xss')).toBe('monitor');
+        expect((0, engine_1.handleFinding)({ attack: 'xss', rule: 'xss.reflected' }, 'http.response')).toBe('monitored');
+    });
+    it('a virtual patch is capped by its own action and by the virtual_patch mode', () => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', attacks: { virtual_patch: 'block' }, env: {} });
+        expect((0, engine_1.handleFinding)({ attack: 'virtual_patch', rule: 'vp.x', action: 'monitor' }, 'server.request')).toBe('monitored');
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', env: {} });
+        expect((0, engine_1.handleFinding)({ attack: 'virtual_patch', rule: 'vp.x', action: 'block' }, 'server.request')).toBe('monitored');
+    });
+    it('the signed config overrides local modes, except a local off', () => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', attacks: { sql_injection: 'monitor', ssrf: 'off' }, env: {} });
+        (0, engine_1.setRemoteConfig)(remote({ attacks: { sql_injection: 'block', ssrf: 'block' } }));
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('block');
+        expect((0, engine_1.modeFor)('ssrf')).toBe('off');
+        expect((0, engine_1.modeFor)('xxe')).toBe('monitor');
+    });
+    it('monitor-only (no pinned key) caps block', () => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode: 'block', monitorOnly: true, env: {} });
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('monitor');
+    });
+    it('kill switch order: env off, signed killSwitch, runtime call', () => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', env: { SHIELD360_RASP: 'off' } });
+        expect((0, engine_1.isActive)()).toBe(false);
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', env: {} });
+        (0, engine_1.setRemoteConfig)(remote({ killSwitch: true }));
+        expect((0, engine_1.isActive)()).toBe(false);
+        expect((0, engine_1.modeFor)('sql_injection')).toBe('off');
+        (0, engine_1.setRemoteConfig)(remote());
+        (0, engine_1.setRuntimeDisabled)(true);
+        expect((0, engine_1.isActive)()).toBe(false);
+        (0, engine_1.setRuntimeDisabled)(false);
+        expect((0, engine_1.isActive)()).toBe(true);
+    });
+    it('SHIELD360_RASP=block sets the default mode', () => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', env: { SHIELD360_RASP: 'block' } });
+        expect((0, engine_1.modeFor)('command_injection')).toBe('block');
+    });
+    it('the signed config rules replace the built-in list; null keeps it', () => {
+        (0, engine_1.setRemoteConfig)(remote({ rules: [{ id: 'vp.only', match: [{ target: 'method', op: 'equals', values: ['GET'] }] }] }));
+        expect((0, engine_1.virtualPatches)().map((r) => r.id)).toEqual(['vp.only']);
+        (0, engine_1.setRemoteConfig)(remote({ rules: null }));
+        expect((0, engine_1.virtualPatches)()).toBe(vpatch_1.BUILT_IN_RULES);
+    });
+    it('snippets only with the signed snippets flag, masked and at most 64 characters', () => {
+        const secret = `token=${'s'.repeat(30)}`;
+        (0, engine_1.handleFinding)({ ...finding, input: { value: secret, key: 'body.t', source: 'request' } }, 'pg.query');
+        expect(events[0].attrs['shield360.rasp.snippet']).toBeUndefined();
+        (0, engine_1.setRemoteConfig)(remote({ snippets: true }));
+        (0, engine_1.handleFinding)({ ...finding, rule: 'sqli.stacked', input: { value: secret, key: 'body.t', source: 'request' } }, 'pg.query');
+        expect(events[1].attrs['shield360.rasp.snippet']).toBe('token=***');
+        expect((0, engine_1.maskSnippet)('a'.repeat(200)).length).toBeLessThanOrEqual(64);
+    });
+    it('events carry the route template or the path with ids replaced, and shaped keys', () => {
+        expect((0, context_1.routeOf)('/api/orders/12345/items/3f2a9c1e-0b1d-4e6f-8a7b-9c0d1e2f3a4b')).toBe('/api/orders/:id/items/:id');
+        context_1.storage.run((0, context_1.newContext)({ inRequest: true, method: 'get', path: '/api/orders/42', framework: 'express' }), () => {
+            expect((0, context_1.currentContext)()).toBeDefined();
+            (0, engine_1.handleFinding)({ ...finding, input: { value: 'v', key: 'query.a b', source: 'request' } }, 'pg.query');
+        });
+        const a = events[0].attrs;
+        expect(a['shield360.rasp.route']).toBe('/api/orders/:id');
+        expect(a['shield360.rasp.method']).toBe('GET');
+        expect(a['shield360.rasp.framework']).toBe('express');
+        expect(a['shield360.rasp.input_key']).toBe('query.a_b');
+    });
+    it('check() fails open on detector errors and rethrows only the block error', () => {
+        expect((0, engine_1.check)('pg.query', () => {
+            throw new Error('detector bug');
+        })).toBeNull();
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode: 'block', env: {} });
+        expect(() => (0, engine_1.check)('pg.query', () => finding)).toThrow(types_1.RaspBlockedError);
+    });
+    it('inactive: findings are dropped', () => {
+        (0, engine_1.configureEngine)({ enabled: false, applicationName: 'a', env: {} });
+        expect((0, engine_1.handleFinding)(finding, 'pg.query')).toBeNull();
+    });
+});
+//# sourceMappingURL=vpatch-engine.test.js.map

package/dist/rasp/__tests__/vpatch-engine.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpatch-engine.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/vpatch-engine.test.ts"],"names":[],"mappings":";;AAAA;;;;GAIG;AACH,wCAA0E;AAC1E,sCAYmB;AACnB,oCAA0D;AAC1D,sCAA4J;AAC5J,qCAAsC;AAEtC,sDAAsD;AACtD,SAAS,OAAO,CAAC,IAAkB,EAAE,CAAS;IAC5C,OAAO,IAAA,mBAAU,EAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,IAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;AAExG,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,IAAI,CAAC,uBAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,yCAAyC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACrG,MAAM,CAAC,GAAG,IAAA,4BAAmB,EAAC,IAAA,mBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM;YAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,uBAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACnF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAc,EAAE,CAAS,EAAE,EAAE;YAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7B,0GAA0G;YAC1G,IAAI,IAAA,sBAAa,EAAC,GAAG,EAAE,CAAC,CAAC;gBAAE,OAAO;YAClC,MAAM,CAAC,IAAA,4BAAmB,EAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,IAAI,GAAG,uBAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,IAAI,CAAE,CAAC;QAClE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,eAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAA,oBAAW,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,IAAA,oBAAW,EAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,IAAA,oBAAW,EAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,QAAQ,GAAG,uBAAc,CAAC,IAAI,CAAC,kBAAS,CAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,IAAA,4BAAmB,EAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,MAAM,CAAC,IAAA,4BAAmB,EAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAc,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpG,MAAM,CAAC,IAAA,sBAAa,EAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,CAAC,IAAA,sBAAa,EAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,MAAM,CAAC,IAAA,sBAAa,EAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;IACxI,MAAM,MAAM,GAAG,CAAC,OAA8B,EAAE,EAAgB,EAAE,CAAC,CAAC;QAClE,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;QAC7B,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,IAAI;QACX,GAAG,IAAI;KACR,CAAC,CAAC;IAEH,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAClB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAA,qBAAY,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,EAAE;QACZ,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;QACxB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,IAAA,sBAAa,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACvG,IAAA,qBAAY,EAAC,IAAI,CAAC,CAAC;QACnB,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAA,sBAAa,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,wBAAgB,CAAC,CAAC;QAC7C,MAAM,CAAE,GAAwB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC3F,MAAM,CAAE,GAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,IAAA,gBAAO,EAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,IAAA,sBAAa,EAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACvG,MAAM,CAAC,IAAA,sBAAa,EAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxH,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,IAAA,sBAAa,EAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACtH,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAA,gBAAO,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,IAAA,gBAAO,EAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,IAAA,iBAAQ,GAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAA,iBAAQ,GAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAA,wBAAe,EAAC,MAAM,EAAE,CAAC,CAAC;QAC1B,IAAA,2BAAkB,EAAC,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,IAAA,iBAAQ,GAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAA,2BAAkB,EAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,CAAC,IAAA,iBAAQ,GAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,CAAC,IAAA,gBAAO,EAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACtH,MAAM,CAAC,IAAA,uBAAc,GAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/D,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAA,uBAAc,GAAE,CAAC,CAAC,IAAI,CAAC,uBAAc,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,MAAM,GAAG,SAAS,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACzC,IAAA,sBAAa,EAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QACtG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClE,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAA,sBAAa,EAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAC5H,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,CAAC,IAAA,oBAAW,EAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,CAAC,IAAA,iBAAO,EAAC,8DAA8D,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAClH,iBAAO,CAAC,GAAG,CAAC,IAAA,oBAAU,EAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE;YAC7G,MAAM,CAAC,IAAA,wBAAc,GAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvC,IAAA,sBAAa,EAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QACxG,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC1D,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CACJ,IAAA,cAAK,EAAC,UAAU,EAAE,GAAG,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC,CAAC,CACH,CAAC,QAAQ,EAAE,CAAC;QACb,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,cAAK,EAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,IAAA,sBAAa,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/auto-http.d.ts

@@ -0,0 +1,6 @@
+/** Installs the capture on `http.Server` and `https.Server`. Idempotent; returns whether it is in place. */
+export declare function installAutoHttpCapture(): boolean;
+/** Removes the capture (tests). */
+export declare function uninstallAutoHttpCapture(): void;
+/** Whether the capture is installed. */
+export declare function autoHttpCaptureInstalled(): boolean;