shield360 1.0.1 → 1.2.0

package/dist/rasp/deception.js

@@ -0,0 +1,220 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SuspiciousTable = exports.DECEPTION_SINK = exports.SUSPICIOUS_RULE = exports.HIT_RULE = exports.MAX_SUSPICIOUS = exports.MAX_TTL_S = exports.DEFAULT_TTL_S = exports.MAX_DECOY_LENGTH = exports.MAX_DECOYS = void 0;
+exports.parseDeception = parseDeception;
+exports.matchDecoy = matchDecoy;
+exports.suspiciousTable = suspiciousTable;
+exports.setSuspiciousTable = setSuspiciousTable;
+exports.checkDeception = checkDeception;
+/**
+ * Deception (README "Deception"): decoy paths from the signed config's
+ * `deception` block. A request for a decoy never reaches the app: it gets the
+ * not-found answer and its client address is marked suspicious for
+ * `ttlSeconds`; later requests from that address are reported, and blocked
+ * when the decision is `blocked`.
+ *
+ * The config reader and the matcher are pure; the suspicious-address table is
+ * in memory, per process. Every adapter calls `checkDeception` first, before
+ * capture, and it fails open: any error lets the request through.
+ */
+const context_1 = require("./context");
+const engine_1 = require("./engine");
+const types_1 = require("./types");
+exports.MAX_DECOYS = 64;
+exports.MAX_DECOY_LENGTH = 256;
+exports.DEFAULT_TTL_S = 900;
+exports.MAX_TTL_S = 86400;
+exports.MAX_SUSPICIOUS = 10000;
+exports.HIT_RULE = 'deception.hit';
+exports.SUSPICIOUS_RULE = 'deception.suspicious';
+exports.DECEPTION_SINK = 'http.deception';
+/** Reads the signed config's `deception` value ("Deception", "Config"); null when deception is off. */
+function parseDeception(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return null;
+    const o = v;
+    if (!Array.isArray(o.paths))
+        return null;
+    const paths = [];
+    for (const p of o.paths) {
+        if (paths.length >= exports.MAX_DECOYS)
+            break;
+        if (typeof p !== 'string' || p.length > exports.MAX_DECOY_LENGTH || !p.startsWith('/'))
+            continue;
+        const trimmed = p.endsWith('/') ? p.slice(0, -1) : p;
+        if (trimmed === '' || trimmed === '/')
+            continue;
+        paths.push(trimmed);
+    }
+    if (!paths.length)
+        return null;
+    const ttl = o.ttlSeconds;
+    return {
+        paths,
+        action: o.action === 'block' ? 'block' : 'monitor',
+        ttlSeconds: typeof ttl === 'number' && Number.isFinite(ttl) && ttl >= 1 ? Math.min(Math.floor(ttl), exports.MAX_TTL_S) : exports.DEFAULT_TTL_S,
+    };
+}
+const NON_ASCII = /[\u0080-\uffff]/;
+const hex = (c) => (c >= 48 && c <= 57 ? c - 48 : c >= 65 && c <= 70 ? c - 55 : c >= 97 && c <= 102 ? c - 87 : -1);
+/**
+ * The decoy a request target hits, or null ("Deception", "Matching"). The
+ * path (before the first `?`) is percent-decoded once and compared byte for
+ * byte with each decoy's UTF-8. Both sides are kept as binary strings (one
+ * character per byte): Node's `req.url` already holds the target's bytes that
+ * way (it reads them as latin1); a character above U+00FF, which only a
+ * caller's own string can hold, counts as its UTF-8 bytes.
+ */
+function matchDecoy(target, decoys) {
+    const q = target.indexOf('?');
+    const raw = q >= 0 ? target.slice(0, q) : target;
+    let path = raw;
+    if (raw.includes('%') || NON_ASCII.test(raw)) {
+        path = '';
+        for (let i = 0; i < raw.length; i++) {
+            const c = raw.charCodeAt(i);
+            if (c === 37) {
+                const h = hex(raw.charCodeAt(i + 1));
+                const l = hex(raw.charCodeAt(i + 2));
+                if (h < 0 || l < 0)
+                    return null;
+                path += String.fromCharCode(h * 16 + l);
+                i += 2;
+            }
+            else if (c <= 0xff) {
+                path += raw[i];
+            }
+            else {
+                const cp = raw.codePointAt(i);
+                path += Buffer.from(String.fromCodePoint(cp), 'utf8').toString('latin1');
+                if (cp > 0xffff)
+                    i++;
+            }
+        }
+    }
+    for (const d of decoys) {
+        const b = NON_ASCII.test(d) ? Buffer.from(d, 'utf8').toString('latin1') : d;
+        if (path === b || path.startsWith(`${b}/`))
+            return d;
+    }
+    return null;
+}
+/**
+ * Suspicious client addresses, at most `cap` entries, kept in expiry order
+ * (soonest first; equal expiries in marking order), so a TTL lowered by a new
+ * config never leaves an expired mark behind a live one. Marking a new
+ * address when full first drops every expired mark, then the mark closest to
+ * expiring. Single threaded, so no locking.
+ */
+class SuspiciousTable {
+    constructor(cap = exports.MAX_SUSPICIOUS, now = Date.now) {
+        this.cap = cap;
+        this.now = now;
+        this.marks = new Map();
+    }
+    unlink(m) {
+        if (m.prev)
+            m.prev.next = m.next;
+        else
+            this.head = m.next;
+        if (m.next)
+            m.next.prev = m.prev;
+        else
+            this.tail = m.prev;
+        m.prev = m.next = undefined;
+        this.marks.delete(m.ip);
+    }
+    /** Marks (or marks again, restarting the time) an address for `ttlSeconds`. */
+    mark(ip, ttlSeconds) {
+        const now = this.now();
+        const until = now + ttlSeconds * 1000;
+        const old = this.marks.get(ip);
+        if (old)
+            this.unlink(old);
+        else if (this.marks.size >= this.cap) {
+            while (this.head && this.head.until <= now)
+                this.unlink(this.head);
+            if (this.marks.size >= this.cap && this.head)
+                this.unlink(this.head);
+        }
+        // After the last mark that expires no later: an append while the TTL stays the same.
+        let after = this.tail;
+        while (after && after.until > until)
+            after = after.prev;
+        const m = { ip, until, prev: after, next: after ? after.next : this.head };
+        if (m.next)
+            m.next.prev = m;
+        else
+            this.tail = m;
+        if (after)
+            after.next = m;
+        else
+            this.head = m;
+        this.marks.set(ip, m);
+    }
+    /** Whether an address is marked; an expired mark is dropped. Never extends a mark. */
+    isMarked(ip) {
+        const m = this.marks.get(ip);
+        if (!m)
+            return false;
+        if (m.until <= this.now()) {
+            this.unlink(m);
+            return false;
+        }
+        return true;
+    }
+    get size() {
+        return this.marks.size;
+    }
+    /** The marked addresses, soonest to expire first (tests). */
+    keys() {
+        const out = [];
+        for (let m = this.head; m; m = m.next)
+            out.push(m.ip);
+        return out;
+    }
+}
+exports.SuspiciousTable = SuspiciousTable;
+let table = new SuspiciousTable();
+/** The process's table (tests). */
+function suspiciousTable() {
+    return table;
+}
+/** Replaces the process's table (tests: a small cap, a fake clock). */
+function setSuspiciousTable(t) {
+    table = t;
+}
+const PASS = {};
+/**
+ * Runs deception for a request ("Deception", "Decision"). Call it only while
+ * RASP is active, before anything else. Never throws: an error lets the
+ * request through as if deception were off.
+ */
+function checkDeception(r) {
+    try {
+        const cfg = (0, engine_1.deceptionConfig)();
+        if (!cfg)
+            return PASS;
+        const mode = (0, engine_1.deceptionMode)();
+        if (!mode)
+            return PASS;
+        const block = cfg.action === 'block' && mode === 'block';
+        const extra = { framework: r.framework, method: r.method };
+        const decoy = matchDecoy(r.url, cfg.paths);
+        if (decoy !== null) {
+            if (r.ip)
+                table.mark(r.ip, cfg.ttlSeconds);
+            (0, engine_1.reportDeception)(exports.HIT_RULE, block, { ...extra, route: decoy });
+            return { notFound: true };
+        }
+        if (!r.ip || !table.isMarked(r.ip))
+            return PASS;
+        const q = r.url.indexOf('?');
+        const eventId = (0, engine_1.reportDeception)(exports.SUSPICIOUS_RULE, block, { ...extra, route: (0, context_1.eventRouteOf)(q >= 0 ? r.url.slice(0, q) : r.url) });
+        return block ? { blocked: new types_1.RaspBlockedError('deception', exports.SUSPICIOUS_RULE, eventId) } : PASS;
+    }
+    catch {
+        return PASS;
+    }
+}
+//# sourceMappingURL=deception.js.map

package/dist/rasp/deception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deception.js","sourceRoot":"","sources":["../../src/rasp/deception.ts"],"names":[],"mappings":";;;AA2BA,wCAmBC;AAaD,gCA4BC;AA6ED,0CAEC;AAGD,gDAEC;AAeD,wCAqBC;AA/MD;;;;;;;;;;GAUG;AACH,uCAAyC;AACzC,qCAA2E;AAC3E,mCAA2C;AAI9B,QAAA,UAAU,GAAG,EAAE,CAAC;AAChB,QAAA,gBAAgB,GAAG,GAAG,CAAC;AACvB,QAAA,aAAa,GAAG,GAAG,CAAC;AACpB,QAAA,SAAS,GAAG,KAAM,CAAC;AACnB,QAAA,cAAc,GAAG,KAAM,CAAC;AACxB,QAAA,QAAQ,GAAG,eAAe,CAAC;AAC3B,QAAA,eAAe,GAAG,sBAAsB,CAAC;AACzC,QAAA,cAAc,GAAG,gBAAgB,CAAC;AAE/C,uGAAuG;AACvG,SAAgB,cAAc,CAAC,CAAU;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAU;YAAE,MAAM;QACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,wBAAgB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzF,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;YAAE,SAAS;QAChD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC;IACzB,OAAO;QACL,KAAK;QACL,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClD,UAAU,EAAE,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,iBAAS,CAAC,CAAC,CAAC,CAAC,qBAAa;KAC/H,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnI;;;;;;;GAOG;AACH,SAAgB,UAAU,CAAC,MAAc,EAAE,MAAyB;IAClE,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjD,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,GAAG,EAAE,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAChC,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxC,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;gBACxC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACzE,IAAI,EAAE,GAAG,MAAM;oBAAE,CAAC,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAID;;;;;;GAMG;AACH,MAAa,eAAe;IAK1B,YACmB,MAAM,sBAAc,EACpB,MAAoB,IAAI,CAAC,GAAG;QAD5B,QAAG,GAAH,GAAG,CAAiB;QACpB,QAAG,GAAH,GAAG,CAAyB;QAN9B,UAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IAO9C,CAAC;IAEI,MAAM,CAAC,CAAO;QACpB,IAAI,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;;YAC5B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;;YAC5B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACxB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC,EAAU,EAAE,UAAkB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,GAAG;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aACrB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,qFAAqF;QACrF,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,OAAO,KAAK,IAAI,KAAK,CAAC,KAAK,GAAG,KAAK;YAAE,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC;QACxD,MAAM,CAAC,GAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjF,IAAI,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;;YACvB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACnB,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;;YACrB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IAED,sFAAsF;IACtF,QAAQ,CAAC,EAAU;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,6DAA6D;IAC7D,IAAI;QACF,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AA7DD,0CA6DC;AAED,IAAI,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;AAElC,mCAAmC;AACnC,SAAgB,eAAe;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,SAAgB,kBAAkB,CAAC,CAAkB;IACnD,KAAK,GAAG,CAAC,CAAC;AACZ,CAAC;AAQD,MAAM,IAAI,GAAqB,EAAE,CAAC;AAElC;;;;GAIG;AACH,SAAgB,cAAc,CAAC,CAAmB;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,wBAAe,GAAE,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,IAAA,sBAAa,GAAE,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC;QACzD,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,CAAC,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAA,wBAAe,EAAC,gBAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAA,wBAAe,EAAC,uBAAe,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAA,sBAAY,EAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,wBAAgB,CAAC,WAAW,EAAE,uBAAe,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/rasp/detect.d.ts

@@ -0,0 +1,68 @@
+import { type SqlDialect } from './lexers';
+import type { Finding, RaspInput } from './types';
+export declare function detectSql(query: string, inputs: RaspInput[], dialect?: SqlDialect): Finding | null;
+export declare function detectNoSql(doc: unknown, trees: unknown[], inputs: RaspInput[]): Finding | null;
+export declare const SHELLS: Set<string>;
+export declare const DOWNLOADERS: Set<string>;
+export declare function exeName(p: string): string;
+export declare function detectCommand(command: string, inputs: RaspInput[]): Finding | null;
+/** argv spawns: the executable equals an input. */
+export declare function detectArgv(argv: string[], inputs: RaspInput[]): Finding | null;
+/** shell_spawn: a shell or downloader started during a request, or curl|sh at any time. */
+export declare function detectShellSpawn(opts: {
+    argv0?: string;
+    command?: string;
+    inRequest: boolean;
+    allow: string[];
+}): Finding | null;
+/** The script of `sh -c <script>` style argv, if any. */
+export declare function shellScriptOf(argv: string[]): string | null;
+export declare function normPath(p: string): string;
+export declare function resolvePath(p: string, cwd?: string): string;
+export declare const SCRIPT_FILE: RegExp;
+export declare function underRoot(resolved: string, root: string): boolean;
+/** The directory path.outside_root reports: the resolved path up to its last `/` (README "Allow-list targets"). */
+export declare function targetDirectory(resolved: string): string;
+export type FileOp = 'read' | 'write' | 'append' | 'delete' | 'rename' | 'list' | 'open';
+export declare function detectPath(path: string, op: FileOp, inputs: RaspInput[], fileRoots?: string[], inRequest?: boolean): Finding | null;
+export declare const METADATA_HOSTS: string[];
+/** Scheme and raw host as written (the WHATWG parser would rewrite numeric hosts). */
+export declare function rawUrl(url: string): {
+    scheme: string;
+    host: string;
+} | null;
+/** Private, loopback, link-local or unique-local, IPv4-mapped/compatible decoded. */
+export declare function isPrivateAddress(addr: string): boolean;
+export declare function isIpLiteral(host: string): boolean;
+export declare function hostMatches(host: string, pattern: string): boolean;
+/** Whether an input taints the URL's host. */
+export declare function taintOf(url: string, host: string, inputs: RaspInput[]): RaspInput | undefined;
+export declare function detectSsrf(url: string, inputs: RaspInput[], resolved?: string[]): Finding | null;
+/** outbound.not_allowed: host matches none of the allow-list (always-allowed hosts aside). */
+export declare function detectOutbound(url: string, allow: string[], alwaysAllowed?: string[]): Finding | null;
+/** Data is tainted when equal to an input, contained in one, or containing one of length >= 8. */
+export declare function taintedData(data: string, inputs: RaspInput[]): RaspInput | undefined;
+export type DeserFormat = 'pickle' | 'marshal' | 'yaml' | 'jsonpickle' | 'node_serialize' | 'funcster' | 'binaryformatter' | 'typename' | 'java' | 'snakeyaml';
+export declare function detectDeserialization(format: DeserFormat, data: string, inputs: RaspInput[]): Finding | null;
+export declare function detectCode(code: string, inputs: RaspInput[]): Finding | null;
+/** code.include: a module specifier that is, or carries a path from, an input. */
+export declare function detectInclude(specifier: string, inputs: RaspInput[]): Finding | null;
+/** file_write.upload: an uploaded file whose name is a script (README "Path"). */
+export declare function detectUpload(input: RaspInput): Finding | null;
+type EntityDecl = {
+    name: string;
+    external: boolean;
+    uri: string;
+    value: string;
+};
+/** Reads the DOCTYPE: external DTD id and entity declarations. */
+export declare function parseDoctype(xml: string): {
+    hasDoctype: boolean;
+    externalDtd: string | null;
+    entities: EntityDecl[];
+};
+export declare function detectXml(xml: string, inputs: RaspInput[], resolvesExternal: boolean): Finding | null;
+export declare const MAX_XSS_BODY: number;
+export declare function detectXss(contentType: string | undefined, body: string, inputs: RaspInput[]): Finding | null;
+export type { SqlDialect };
+export { detectTemplate, type TemplateEngine } from './template';