shield360 1.0.1 → 1.2.0

package/dist/rasp/custom-rules.js

@@ -0,0 +1,222 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CUSTOM_RULE_ACTIONS = exports.CUSTOM_RULE_PREFIX = exports.CUSTOM_RULE_ID = exports.MAX_RULE_APPS = exports.MAX_CUSTOM_RULES = void 0;
+exports.resetCustomRuleWarnings = resetCustomRuleWarnings;
+exports.parseCustomRules = parseCustomRules;
+exports.actionMode = actionMode;
+exports.customFinding = customFinding;
+exports.requestSubject = requestSubject;
+exports.ruleState = ruleState;
+exports.matchRequestRules = matchRequestRules;
+exports.matchFindingRules = matchFindingRules;
+/**
+ * Custom rules (README "Custom rules"): the organization's own rules, written
+ * in the expression language of rule-expr.ts and delivered inside the signed
+ * config (`customRules`). They are data: each expression is parsed and
+ * type-checked when the config arrives and evaluated against the request (or
+ * a built-in finding) as a value. An invalid rule is skipped with one
+ * warning and never breaks the config; evaluation fails open.
+ *
+ * This file turns rules and the request context into the language's terms;
+ * the engine and capture decide what a match does.
+ */
+const context_1 = require("./context");
+const rule_expr_1 = require("./rule-expr");
+exports.MAX_CUSTOM_RULES = 64;
+exports.MAX_RULE_APPS = 32;
+/** Lower-case, so the event rule `custom.<id>` fits the platform's rule shape. */
+exports.CUSTOM_RULE_ID = /^[a-z0-9][a-z0-9_-]{0,47}$/;
+exports.CUSTOM_RULE_PREFIX = 'custom.';
+exports.CUSTOM_RULE_ACTIONS = ['block', 'monitor', 'alert'];
+const warned = new Set();
+function defaultWarn(s) {
+    console.warn(`Shield360 RASP: custom rule ${s.id ? `"${s.id}"` : `#${s.index + 1}`} was skipped (${s.reason}); the other rules apply.`);
+}
+/** Tests only: lets the once-per-rule warnings fire again. */
+function resetCustomRuleWarnings() {
+    warned.clear();
+}
+/**
+ * The rules of a signed config that apply to this app: invalid rules are
+ * skipped (one warning per rule and reason, per process), disabled rules and
+ * rules scoped to other apps are left out silently. At most 64.
+ */
+function parseCustomRules(raw, app, warn = defaultWarn) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    const ids = new Set();
+    const skip = (s, expression) => {
+        const key = `${s.id ?? s.index}\u0000${s.reason}\u0000${typeof expression === 'string' ? expression : ''}`;
+        if (warned.has(key))
+            return;
+        if (warned.size > 1024)
+            warned.clear();
+        warned.add(key);
+        try {
+            warn(s);
+        }
+        catch {
+            // never
+        }
+    };
+    for (let index = 0; index < raw.length; index++) {
+        try {
+            const r = raw[index];
+            if (!r || typeof r !== 'object' || Array.isArray(r)) {
+                skip({ index, reason: 'not an object' });
+                continue;
+            }
+            const id = typeof r.id === 'string' && exports.CUSTOM_RULE_ID.test(r.id) ? r.id : undefined;
+            if (!id) {
+                skip({ index, reason: 'invalid id' });
+                continue;
+            }
+            if (ids.has(id)) {
+                skip({ index, id, reason: 'duplicate id' });
+                continue;
+            }
+            ids.add(id);
+            if (typeof r.enabled !== 'boolean') {
+                skip({ index, id, reason: 'invalid enabled flag' });
+                continue;
+            }
+            if (!exports.CUSTOM_RULE_ACTIONS.includes(r.action)) {
+                skip({ index, id, reason: 'invalid action' });
+                continue;
+            }
+            if (r.name !== undefined && typeof r.name !== 'string') {
+                skip({ index, id, reason: 'invalid name' });
+                continue;
+            }
+            if (r.apps !== undefined && r.apps !== null && !(Array.isArray(r.apps) && r.apps.length <= exports.MAX_RULE_APPS && r.apps.every((a) => typeof a === 'string'))) {
+                skip({ index, id, reason: 'invalid apps' });
+                continue;
+            }
+            const compiled = (0, rule_expr_1.compileRuleExpr)(r.expression);
+            if (!compiled.ok) {
+                skip({ index, id, reason: `expression: ${compiled.error.code}` }, r.expression);
+                continue;
+            }
+            if (!r.enabled)
+                continue;
+            const apps = Array.isArray(r.apps) && r.apps.length ? r.apps : undefined;
+            if (apps && !apps.includes(app))
+                continue;
+            if (out.length >= exports.MAX_CUSTOM_RULES) {
+                skip({ index, id, reason: 'more than 64 rules' });
+                continue;
+            }
+            out.push({ id, name: typeof r.name === 'string' ? r.name : id, action: r.action, ...(apps ? { apps } : {}), expr: compiled.expr });
+        }
+        catch {
+            skip({ index, reason: 'unreadable' });
+        }
+    }
+    return out;
+}
+/** The most a rule does: `alert` reports like `monitor` (the platform raises the alert). */
+function actionMode(a) {
+    return a === 'block' ? 'block' : 'monitor';
+}
+/** The finding a matched rule reports (attack type `custom_rule`, rule `custom.<id>`). */
+function customFinding(rule, input) {
+    return { attack: 'custom_rule', rule: `${exports.CUSTOM_RULE_PREFIX}${rule.id}`, action: actionMode(rule.action), ...(input ? { input } : {}) };
+}
+const joined = (v) => (v === undefined ? undefined : Array.isArray(v) ? v.join(', ') : String(v));
+/** The request as the language sees it (README "Custom rules: fields"). */
+function requestSubject(ctx, app, inputs) {
+    if (!ctx)
+        return { app, inputs: [] };
+    const list = inputs ?? ctx.inputs;
+    const headers = {};
+    const raw = ctx.vp?.req.headers;
+    if (raw) {
+        for (const k of Object.keys(raw)) {
+            const v = joined(raw[k]);
+            if (v !== undefined)
+                headers[k.toLowerCase()] = v;
+        }
+    }
+    const query = {};
+    const body = {};
+    for (const i of list) {
+        if (i.source !== 'request')
+            continue;
+        if (i.key.startsWith('query.')) {
+            const k = i.key.slice(6);
+            if (!Object.prototype.hasOwnProperty.call(query, k))
+                query[k] = i.value;
+        }
+        else if (i.key.startsWith('body.')) {
+            const k = i.key.slice(5);
+            if (!Object.prototype.hasOwnProperty.call(body, k))
+                body[k] = i.value;
+        }
+    }
+    const path = ctx.path ?? null;
+    return {
+        app,
+        request: ctx.inRequest
+            ? {
+                method: ctx.method ? ctx.method.toUpperCase() : null,
+                path,
+                route: ctx.route ?? (path ? (0, context_1.routeOf)(path) : null),
+                ip: ctx.ip ?? null,
+                headers,
+                query,
+                body,
+            }
+            : null,
+        inputs: list.map((i) => ({ value: i.value, key: i.key, source: i.source })),
+    };
+}
+function ruleState(ctx) {
+    if (!ctx.rules)
+        ctx.rules = { matched: new Set(), budget: { steps: rule_expr_1.DEFAULT_RULE_BUDGET }, ranHead: false, ranBody: false };
+    return ctx.rules;
+}
+/**
+ * The request rules to judge in a phase, matched in order. `head`: every
+ * request rule that does not read the body. `body`: rules that read the body,
+ * and rules reading `input.*` that did not match at `head` (the body added
+ * inputs). A rule matches at most once per request.
+ */
+function matchRequestRules(rules, ctx, phase, subject) {
+    const st = ruleState(ctx);
+    const out = [];
+    for (const rule of rules) {
+        const e = rule.expr;
+        if (st.budget.steps < 0)
+            break;
+        if (e.phase !== 'request' || st.matched.has(rule.id))
+            continue;
+        if (phase === 'head' ? e.usesBody : !(e.usesBody || e.usesInput))
+            continue;
+        const r = (0, rule_expr_1.evaluateRuleExpr)(e, subject, st.budget);
+        if (r.exhausted)
+            break;
+        if (!r.matched)
+            continue;
+        st.matched.add(rule.id);
+        out.push({ rule, input: r.input });
+    }
+    return out;
+}
+/** The finding rules a built-in finding matches, in order. */
+function matchFindingRules(rules, subject, budget) {
+    const out = [];
+    for (const rule of rules) {
+        if (budget.steps < 0)
+            break;
+        if (rule.expr.phase !== 'finding')
+            continue;
+        const r = (0, rule_expr_1.evaluateRuleExpr)(rule.expr, subject, budget);
+        if (r.exhausted)
+            break;
+        if (r.matched)
+            out.push({ rule, input: r.input });
+    }
+    return out;
+}
+//# sourceMappingURL=custom-rules.js.map

package/dist/rasp/custom-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-rules.js","sourceRoot":"","sources":["../../src/rasp/custom-rules.ts"],"names":[],"mappings":";;;AAwCA,0DAEC;AAOD,4CAkEC;AAGD,gCAEC;AAGD,sCAEC;AAKD,wCAuCC;AAKD,8BAGC;AAUD,8CAeC;AAGD,8CAUC;AAvND;;;;;;;;;;GAUG;AACH,uCAAsD;AACtD,2CAA+I;AAGlI,QAAA,gBAAgB,GAAG,EAAE,CAAC;AACtB,QAAA,aAAa,GAAG,EAAE,CAAC;AAChC,kFAAkF;AACrE,QAAA,cAAc,GAAG,4BAA4B,CAAC;AAC9C,QAAA,kBAAkB,GAAG,SAAS,CAAC;AAC/B,QAAA,mBAAmB,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAa1E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjC,SAAS,WAAW,CAAC,CAAc;IACjC,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,2BAA2B,CAAC,CAAC;AAC1I,CAAC;AAED,8DAA8D;AAC9D,SAAgB,uBAAuB;IACrC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,GAAY,EAAE,GAAW,EAAE,OAAiC,WAAW;IACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAc,EAAE,UAAoB,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,SAAS,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3G,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC5B,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI;YAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,CAAC;QACV,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ;QACV,CAAC;IACH,CAAC,CAAC;IACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAmC,CAAC;YACvD,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,sBAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACZ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;gBACpD,SAAS;YACX,CAAC;YACD,IAAI,CAAE,2BAA0C,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAC9C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,qBAAa,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACxJ,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,SAAS;YACzB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,IAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1C,IAAI,GAAG,CAAC,MAAM,IAAI,wBAAgB,EAAE,CAAC;gBACnC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAClD,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAA0B,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACzJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4FAA4F;AAC5F,SAAgB,UAAU,CAAC,CAAmB;IAC5C,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,0FAA0F;AAC1F,SAAgB,aAAa,CAAC,IAAgB,EAAE,KAAiB;IAC/D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,0BAAkB,GAAG,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1I,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAgC,EAAsB,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAErJ,2EAA2E;AAC3E,SAAgB,cAAc,CAAC,GAA4B,EAAE,GAAW,EAAE,MAAoB;IAC5F,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;IAClC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAC1E,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACxE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;IAC9B,OAAO;QACL,GAAG;QACH,OAAO,EAAE,GAAG,CAAC,SAAS;YACpB,CAAC,CAAC;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;gBACpD,IAAI;gBACJ,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,iBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACjD,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,IAAI;gBAClB,OAAO;gBACP,KAAK;gBACL,IAAI;aACL;YACH,CAAC,CAAC,IAAI;QACR,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;KAC5E,CAAC;AACJ,CAAC;AAKD,SAAgB,SAAS,CAAC,GAAgB;IACxC,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,+BAAmB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3H,OAAO,GAAG,CAAC,KAAK,CAAC;AACnB,CAAC;AAID;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,KAAmB,EAAE,GAAgB,EAAE,KAAsB,EAAE,OAAoB;IACnH,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QACpB,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC;YAAE,MAAM;QAC/B,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/D,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS;QAC3E,MAAM,CAAC,GAAG,IAAA,4BAAgB,EAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,SAAS;YAAE,MAAM;QACvB,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QACzB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAA8B,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8DAA8D;AAC9D,SAAgB,iBAAiB,CAAC,KAAmB,EAAE,OAAoB,EAAE,MAAkB;IAC7F,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;YAAE,MAAM;QAC5B,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,IAAA,4BAAgB,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,SAAS;YAAE,MAAM;QACvB,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAA8B,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rasp/data/default-rules.json

@@ -0,0 +1,199 @@
+{
+    "version": "2026-10-29.1",
+    "rules": [
+        {
+            "id": "vp.react2shell",
+            "title": "React Server Components Flight deserialization RCE (React2Shell) in a Next.js server action",
+            "cves": [
+                "CVE-2025-55182",
+                "CVE-2025-66478"
+            ],
+            "references": [
+                "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components",
+                "https://vercel.com/changelog/cve-2025-55182",
+                "https://www.trendmicro.com/en_us/research/25/l/CVE-2025-55182-analysis-poc-itw.html"
+            ],
+            "severity": "critical",
+            "example": false,
+            "runtimes": [
+                "node"
+            ],
+            "action": "block",
+            "match": [
+                {
+                    "target": "method",
+                    "op": "equals",
+                    "values": [
+                        "POST"
+                    ]
+                },
+                {
+                    "target": "header:next-action",
+                    "op": "present"
+                },
+                {
+                    "target": "body",
+                    "op": "contains_any",
+                    "values": [
+                        "resolved_model",
+                        "constructor:constructor",
+                        "_formData.get",
+                        ":then:constructor",
+                        ":__proto__:"
+                    ]
+                }
+            ],
+            "note": "Body markers are the request shape Trend Micro documents for public exploits; CVE-2025-66478 is Next.js's identifier for the same flaw."
+        },
+        {
+            "id": "vp.react2shell-flight",
+            "title": "React Server Components Flight deserialization RCE (React2Shell) without a Next-Action header",
+            "cves": [
+                "CVE-2025-55182"
+            ],
+            "references": [
+                "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
+            ],
+            "severity": "critical",
+            "example": false,
+            "runtimes": [
+                "node"
+            ],
+            "action": "block",
+            "match": [
+                {
+                    "target": "method",
+                    "op": "equals",
+                    "values": [
+                        "POST"
+                    ]
+                },
+                {
+                    "target": "body",
+                    "op": "contains_any",
+                    "values": [
+                        "resolved_model"
+                    ]
+                },
+                {
+                    "target": "body",
+                    "op": "contains_any",
+                    "values": [
+                        "constructor:constructor",
+                        "_formData.get",
+                        ":then:constructor"
+                    ]
+                }
+            ]
+        },
+        {
+            "id": "vp.next-middleware-bypass",
+            "title": "Next.js middleware authorization bypass with x-middleware-subrequest",
+            "cves": [
+                "CVE-2025-29927"
+            ],
+            "references": [
+                "https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw"
+            ],
+            "severity": "critical",
+            "example": false,
+            "runtimes": [
+                "node"
+            ],
+            "action": "block",
+            "match": [
+                {
+                    "target": "header:x-middleware-subrequest",
+                    "op": "present"
+                }
+            ]
+        },
+        {
+            "id": "vp.node-serialize-iife",
+            "title": "node-serialize unserialize() code execution through an immediately invoked function",
+            "cves": [
+                "CVE-2017-5941"
+            ],
+            "references": [
+                "https://nvd.nist.gov/vuln/detail/CVE-2017-5941"
+            ],
+            "severity": "critical",
+            "example": false,
+            "runtimes": [
+                "node"
+            ],
+            "action": "block",
+            "match": [
+                {
+                    "target": "request",
+                    "op": "contains_any",
+                    "values": [
+                        "_$$ND_FUNC$$_"
+                    ]
+                }
+            ]
+        },
+        {
+            "id": "vp.node2shell-brotli",
+            "title": "Node2Shell: Brotli decoder out-of-bounds write; refuses Brotli-encoded request bodies on unpatched Node.js",
+            "cves": [
+                "CVE-2026-111497"
+            ],
+            "references": [
+                "https://www.ox.security/blog/node-js-brotli-decoder-out-of-bounds-write-rce-cve-2026-111497/",
+                "https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html"
+            ],
+            "severity": "high",
+            "example": false,
+            "runtimes": [
+                "node"
+            ],
+            "runtimeVersions": {
+                "node": [
+                    [
+                        "22.0.0",
+                        "22.23.4"
+                    ],
+                    [
+                        "24.0.0",
+                        "24.22.1"
+                    ],
+                    [
+                        "26.0.0",
+                        "26.12.1"
+                    ]
+                ]
+            },
+            "action": "block",
+            "match": [
+                {
+                    "target": "header:content-encoding",
+                    "op": "contains_any",
+                    "values": [
+                        "br"
+                    ],
+                    "ignoreCase": true
+                }
+            ],
+            "confirmation": "third-party: OX Security, The Hacker News and Rescana report CVE-2026-111497 and the fixed releases 22.23.4, 24.22.1, 26.12.1; the nodejs.org advisory was not read when this rule was written"
+        },
+        {
+            "id": "vp.example-test-header",
+            "title": "Example rule: matches the test header x-shield360-rasp-test: exploit (not a real advisory)",
+            "cves": [],
+            "references": [],
+            "severity": "info",
+            "example": true,
+            "action": "block",
+            "match": [
+                {
+                    "target": "header:x-shield360-rasp-test",
+                    "op": "equals",
+                    "values": [
+                        "exploit"
+                    ]
+                }
+            ]
+        }
+    ]
+}

package/dist/rasp/data/default-sinks.json

@@ -0,0 +1,4 @@
+{
+    "version": "2026-10-29.1",
+    "sinks": []
+}

package/dist/rasp/data/dnslog-domains.json

@@ -0,0 +1,11 @@
+{
+    "source": "Adapted from Baidu OpenRASP plugins/official/plugin.js dnsLogDomains (Apache-2.0); requestbin/interactsh entries added by Shield360.",
+    "domains": [
+        ".vuleye.pw", ".ceye.io", ".exeye.io", ".vcap.me", ".xip.name", ".xip.io", ".sslip.io", ".nip.io", ".oastify.com", ".eyes.sh",
+        ".burpcollaborator.net", ".tu4.org", ".2xss.cc", ".bxss.me", ".godns.vip", ".dnslog.cn", ".0kee.360.cn", ".r87.me", ".ngrok.io",
+        ".xn--9tr.com", ".pipedream.net", ".vxtrans.com", ".vxtrans.link", ".hopto.org", ".zapto.org", ".sytes.net", ".ddns.net",
+        ".canarytokens.com", ".interact.sh", ".oast.fun", ".oast.pro", ".oast.live", ".oast.site", ".oast.online", ".oast.me",
+        ".requestbin.net", ".requestcatcher.com", ".webhook.site"
+    ],
+    "hosts": ["requestb.in", "transfer.sh", "webhook.site"]
+}

package/dist/rasp/deception.d.ts

@@ -0,0 +1,70 @@
+import { RaspBlockedError } from './types';
+export type DeceptionConfig = {
+    paths: string[];
+    action: 'block' | 'monitor';
+    ttlSeconds: number;
+};
+export declare const MAX_DECOYS = 64;
+export declare const MAX_DECOY_LENGTH = 256;
+export declare const DEFAULT_TTL_S = 900;
+export declare const MAX_TTL_S = 86400;
+export declare const MAX_SUSPICIOUS = 10000;
+export declare const HIT_RULE = "deception.hit";
+export declare const SUSPICIOUS_RULE = "deception.suspicious";
+export declare const DECEPTION_SINK = "http.deception";
+/** Reads the signed config's `deception` value ("Deception", "Config"); null when deception is off. */
+export declare function parseDeception(v: unknown): DeceptionConfig | null;
+/**
+ * The decoy a request target hits, or null ("Deception", "Matching"). The
+ * path (before the first `?`) is percent-decoded once and compared byte for
+ * byte with each decoy's UTF-8. Both sides are kept as binary strings (one
+ * character per byte): Node's `req.url` already holds the target's bytes that
+ * way (it reads them as latin1); a character above U+00FF, which only a
+ * caller's own string can hold, counts as its UTF-8 bytes.
+ */
+export declare function matchDecoy(target: string, decoys: readonly string[]): string | null;
+/**
+ * Suspicious client addresses, at most `cap` entries, kept in expiry order
+ * (soonest first; equal expiries in marking order), so a TTL lowered by a new
+ * config never leaves an expired mark behind a live one. Marking a new
+ * address when full first drops every expired mark, then the mark closest to
+ * expiring. Single threaded, so no locking.
+ */
+export declare class SuspiciousTable {
+    private readonly cap;
+    private readonly now;
+    private readonly marks;
+    private head?;
+    private tail?;
+    constructor(cap?: number, now?: () => number);
+    private unlink;
+    /** Marks (or marks again, restarting the time) an address for `ttlSeconds`. */
+    mark(ip: string, ttlSeconds: number): void;
+    /** Whether an address is marked; an expired mark is dropped. Never extends a mark. */
+    isMarked(ip: string): boolean;
+    get size(): number;
+    /** The marked addresses, soonest to expire first (tests). */
+    keys(): string[];
+}
+/** The process's table (tests). */
+export declare function suspiciousTable(): SuspiciousTable;
+/** Replaces the process's table (tests: a small cap, a fake clock). */
+export declare function setSuspiciousTable(t: SuspiciousTable): void;
+/** A request as deception sees it: the raw target (path and query as received) and the client address `request.ip` uses. */
+export type DeceptionRequest = {
+    framework: string;
+    method: string;
+    url: string;
+    ip?: string;
+};
+/** What the adapter does: go on, answer its not-found, or answer the block response. */
+export type DeceptionOutcome = {
+    notFound?: true;
+    blocked?: RaspBlockedError;
+};
+/**
+ * Runs deception for a request ("Deception", "Decision"). Call it only while
+ * RASP is active, before anything else. Never throws: an error lets the
+ * request through as if deception were off.
+ */
+export declare function checkDeception(r: DeceptionRequest): DeceptionOutcome;