shield360 1.0.1 → 1.2.0

package/dist/rasp/detect.js

@@ -0,0 +1,671 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectTemplate = exports.MAX_XSS_BODY = exports.METADATA_HOSTS = exports.SCRIPT_FILE = exports.DOWNLOADERS = exports.SHELLS = void 0;
+exports.detectSql = detectSql;
+exports.detectNoSql = detectNoSql;
+exports.exeName = exeName;
+exports.detectCommand = detectCommand;
+exports.detectArgv = detectArgv;
+exports.detectShellSpawn = detectShellSpawn;
+exports.shellScriptOf = shellScriptOf;
+exports.normPath = normPath;
+exports.resolvePath = resolvePath;
+exports.underRoot = underRoot;
+exports.targetDirectory = targetDirectory;
+exports.detectPath = detectPath;
+exports.rawUrl = rawUrl;
+exports.isPrivateAddress = isPrivateAddress;
+exports.isIpLiteral = isIpLiteral;
+exports.hostMatches = hostMatches;
+exports.taintOf = taintOf;
+exports.detectSsrf = detectSsrf;
+exports.detectOutbound = detectOutbound;
+exports.taintedData = taintedData;
+exports.detectDeserialization = detectDeserialization;
+exports.detectCode = detectCode;
+exports.detectInclude = detectInclude;
+exports.detectUpload = detectUpload;
+exports.parseDoctype = parseDoctype;
+exports.detectXml = detectXml;
+exports.detectXss = detectXss;
+/**
+ * Pure structural detectors (README "Detection algorithms"). Each takes the
+ * sink's argument and the inputs in scope and returns a Finding or null. No
+ * I/O, no state: the engine decides what a finding does.
+ */
+const os_1 = require("os");
+const path_1 = require("path");
+const lexers_1 = require("./lexers");
+const iast_scope_1 = require("./iast-scope");
+const iast_rules_1 = require("./iast-rules");
+const dnslog_domains_json_1 = __importDefault(require("./data/dnslog-domains.json"));
+const reqInputs = (inputs, min) => inputs.filter((i) => i.source === 'request' && i.value.length >= min);
+const modelInputs = (inputs, min) => inputs.filter((i) => i.source === 'model_output' && i.value.length >= min);
+// ---- SQL ----------------------------------------------------------------
+const ANTI_DETECT = lexers_1.SQL_KEYWORDS;
+const COMMA_LIST = /^(, *)?(([a-zA-Z_]\w*|[0-9+\-x.]+) *, *)+([a-zA-Z_]\w*|[0-9+\-x.]+)$/;
+const WRITE_STATEMENTS = new Set('insert update delete drop alter create truncate grant revoke merge replace'.split(' '));
+const isComment = (t) => t.kind === 'comment' || t.kind === 'version_comment';
+function hasStackedAfter(tokens, from) {
+    for (const t of from) {
+        if (t.kind !== 'op' || t.text !== ';')
+            continue;
+        const at = tokens.indexOf(t);
+        if (tokens.slice(at + 1).some((x) => !isComment(x)))
+            return true;
+    }
+    return false;
+}
+function sqlWholeIsDangerous(tokens) {
+    const code = tokens.filter((t) => !isComment(t));
+    if (!code.length)
+        return false;
+    if (code[0].kind === 'word' && WRITE_STATEMENTS.has(code[0].text.toLowerCase()))
+        return true;
+    for (let i = 0; i < code.length - 1; i++)
+        if (code[i].kind === 'op' && code[i].text === ';')
+            return true;
+    return false;
+}
+function detectSql(query, inputs, dialect = 'generic') {
+    const f = detectSqlRules(query, inputs, dialect);
+    return f ? { ...f, dialect } : null;
+}
+function detectSqlRules(query, inputs, dialect) {
+    if (!query || !inputs.length)
+        return null;
+    let tokens = null;
+    const toks = () => (tokens ?? (tokens = (0, lexers_1.sqlTokens)(query, dialect)));
+    const trimmed = query.trim();
+    for (const inp of reqInputs(inputs, 3)) {
+        const v = inp.value;
+        if (v === query || v.trim() === trimmed)
+            continue; // allow_full: a SQL console
+        const occ = (0, lexers_1.occurrences)(query, v);
+        if (!occ.length)
+            continue;
+        const commaList = COMMA_LIST.test(v);
+        for (const idx of occ) {
+            const over = (0, lexers_1.overlapping)(toks(), idx, v.length);
+            if (!commaList && over.length >= 2) {
+                if (over.length >= 10)
+                    return { attack: 'sql_injection', rule: 'sqli.userinput', input: inp };
+                const plain = over.filter((t) => !(t.kind === 'word' && ANTI_DETECT.has(t.text.toLowerCase())));
+                if (plain.length >= 2)
+                    return { attack: 'sql_injection', rule: 'sqli.userinput', input: inp };
+            }
+            if (hasStackedAfter(toks(), over))
+                return { attack: 'sql_injection', rule: 'sqli.stacked', input: inp };
+        }
+    }
+    for (const inp of modelInputs(inputs, 3)) {
+        if (inp.value.trim() === trimmed) {
+            if (sqlWholeIsDangerous(toks()))
+                return { attack: 'sql_injection', rule: 'sqli.model_output', input: inp };
+            continue;
+        }
+        for (const idx of (0, lexers_1.occurrences)(query, inp.value)) {
+            if ((0, lexers_1.overlapping)(toks(), idx, inp.value.length).length >= 2)
+                return { attack: 'sql_injection', rule: 'sqli.model_output', input: inp };
+        }
+    }
+    (0, iast_scope_1.noteVulnerability)(() => (0, iast_rules_1.vulnSql)(query, inputs, toks)); // passive IAST (iast-rules.ts)
+    return null;
+}
+// ---- NoSQL ----------------------------------------------------------------
+function deepEqual(a, b, depth = 0) {
+    if (a === b)
+        return true;
+    if (depth > 32 || typeof a !== 'object' || typeof b !== 'object' || a === null || b === null)
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    const ka = Object.keys(a);
+    const kb = Object.keys(b);
+    if (ka.length !== kb.length)
+        return false;
+    return ka.every((k) => deepEqual(a[k], b[k], depth + 1));
+}
+function treeContains(tree, obj, depth = 0) {
+    if (tree === null || typeof tree !== 'object' || depth > 32)
+        return false;
+    if (tree === obj || deepEqual(tree, obj))
+        return true;
+    return Object.values(tree).some((v) => treeContains(v, obj, depth + 1));
+}
+function detectNoSql(doc, trees, inputs) {
+    let found = null;
+    const walk = (node, depth) => {
+        if (found || node === null || typeof node !== 'object' || depth > 32)
+            return;
+        const entries = Object.entries(node);
+        if (!Array.isArray(node) && entries.some(([k]) => k.startsWith('$')) && trees.some((t) => treeContains(t, node))) {
+            found = { attack: 'nosql_injection', rule: 'nosqli.operator' };
+            return;
+        }
+        for (const [k, v] of entries) {
+            if ((k === '$where' || k === '$function') && !found) {
+                const code = typeof v === 'string' ? v : v && typeof v === 'object' && typeof v.body === 'string' ? v.body : '';
+                const hit = code ? detectCode(code, inputs) : null;
+                if (hit)
+                    found = { attack: 'nosql_injection', rule: 'nosqli.where', input: hit.input };
+            }
+            walk(v, depth + 1);
+        }
+    };
+    walk(doc, 0);
+    return found;
+}
+// ---- Command ----------------------------------------------------------------
+exports.SHELLS = new Set('sh bash zsh dash ksh fish csh tcsh cmd powershell pwsh'.split(' '));
+exports.DOWNLOADERS = new Set(['curl', 'wget']);
+const MULTI_OPS = new Set([';', '&&', '||', '|', '`', '$(']);
+function exeName(p) {
+    const base = p.replace(/\\/g, '/').split('/').pop() || '';
+    return base.toLowerCase().replace(/\.exe$/, '');
+}
+function unquoteWord(w) {
+    return w.replace(/^['"]|['"]$/g, '');
+}
+function detectCommand(command, inputs) {
+    if (!command || !inputs.length)
+        return null;
+    const { tokens, inSingle } = (0, lexers_1.shellTokens)(command);
+    const trimmed = command.trim();
+    for (const inp of reqInputs(inputs, 3)) {
+        for (const idx of (0, lexers_1.occurrences)(command, inp.value)) {
+            if ((0, lexers_1.overlapping)(tokens, idx, inp.value.length).length >= 2)
+                return { attack: 'command_injection', rule: 'cmdi.userinput', input: inp };
+        }
+    }
+    for (const inp of reqInputs(inputs, 3)) {
+        const v = inp.value;
+        if (v.includes('${IFS}') || v.includes('$IFS')) {
+            if (command.includes(v))
+                return { attack: 'command_injection', rule: 'cmdi.substitution', input: inp };
+        }
+        if (v.includes('`') || v.includes('$(')) {
+            for (const idx of (0, lexers_1.occurrences)(command, v)) {
+                for (let k = idx; k < idx + v.length; k++) {
+                    const sub = command[k] === '`' || (command[k] === '$' && command[k + 1] === '(');
+                    if (sub && !inSingle[k])
+                        return { attack: 'command_injection', rule: 'cmdi.substitution', input: inp };
+                }
+            }
+        }
+    }
+    for (const inp of reqInputs(inputs, 1))
+        if (inp.value.trim() === trimmed)
+            return { attack: 'command_injection', rule: 'cmdi.full', input: inp };
+    for (const inp of modelInputs(inputs, 3)) {
+        if (inp.value.trim() === trimmed) {
+            if (tokens.some((t) => t.kind === 'op' && MULTI_OPS.has(t.text)))
+                return { attack: 'command_injection', rule: 'cmdi.model_output', input: inp };
+            continue;
+        }
+        for (const idx of (0, lexers_1.occurrences)(command, inp.value)) {
+            if ((0, lexers_1.overlapping)(tokens, idx, inp.value.length).length >= 2)
+                return { attack: 'command_injection', rule: 'cmdi.model_output', input: inp };
+        }
+    }
+    (0, iast_scope_1.noteVulnerability)(() => (0, iast_rules_1.vulnShell)(command, inputs, tokens)); // passive IAST
+    return null;
+}
+/** argv spawns: the executable equals an input. */
+function detectArgv(argv, inputs) {
+    if (!argv.length)
+        return null;
+    for (const inp of inputs)
+        if (inp.value.length >= 1 && inp.value === argv[0])
+            return { attack: 'command_injection', rule: 'cmdi.executable', input: inp };
+    // Passive IAST: a `sh -c <script>` spawn's script is checked as shell text instead.
+    (0, iast_scope_1.noteVulnerability)(() => (shellScriptOf(argv) ? null : (0, iast_rules_1.vulnArgv)(argv, inputs)));
+    return null;
+}
+/** shell_spawn: a shell or downloader started during a request, or curl|sh at any time. */
+function detectShellSpawn(opts) {
+    const allowed = new Set(opts.allow.map(exeName));
+    if (opts.command) {
+        const words = (0, lexers_1.shellTokens)(opts.command).tokens;
+        for (let i = 0; i < words.length; i++) {
+            if (words[i].kind !== 'word' || !exports.DOWNLOADERS.has(exeName(unquoteWord(words[i].text))))
+                continue;
+            for (let k = i + 1; k < words.length - 1; k++) {
+                if (words[k].kind === 'op' && words[k].text === '|' && words[k + 1].kind === 'word' && exports.SHELLS.has(exeName(unquoteWord(words[k + 1].text)))) {
+                    return { attack: 'shell_spawn', rule: 'shell_spawn.download_exec' };
+                }
+            }
+        }
+    }
+    if (!opts.inRequest)
+        return null;
+    let name = opts.argv0 ? exeName(opts.argv0) : '';
+    if (!name && opts.command) {
+        const first = (0, lexers_1.shellTokens)(opts.command).tokens.find((t) => t.kind === 'word');
+        name = first ? exeName(unquoteWord(first.text)) : '';
+    }
+    if (name && (exports.SHELLS.has(name) || exports.DOWNLOADERS.has(name)) && !allowed.has(name))
+        return { attack: 'shell_spawn', rule: 'shell_spawn.shell', target: name };
+    return null;
+}
+/** The script of `sh -c <script>` style argv, if any. */
+function shellScriptOf(argv) {
+    if (argv.length < 3 || !exports.SHELLS.has(exeName(argv[0])))
+        return null;
+    const i = argv.findIndex((a, k) => k > 0 && (a === '-c' || a.toLowerCase() === '/c' || a.toLowerCase() === '-command'));
+    return i > 0 && i + 1 < argv.length ? argv.slice(i + 1).join(' ') : null;
+}
+// ---- Path ----------------------------------------------------------------
+function normPath(p) {
+    let s = p.replace(/\\/g, '/');
+    const unc = s.startsWith('//');
+    while (s.includes('/./'))
+        s = s.replace('/./', '/');
+    s = s.replace(/\/{2,}/g, '/');
+    return unc ? '/' + s : s;
+}
+function resolvePath(p, cwd = process.cwd()) {
+    const s = p.replace(/\\/g, '/');
+    const abs = s.startsWith('/') || /^[A-Za-z]:\//.test(s) ? s : `${cwd.replace(/\\/g, '/')}/${s}`;
+    const drive = /^[A-Za-z]:/.test(abs) ? abs.slice(0, 2) : '';
+    return drive + path_1.posix.normalize('/' + abs.slice(drive.length)).replace(/\/$/, '') || '/';
+}
+const SENSITIVE = ['/etc/passwd', '/etc/shadow', '/proc/self/environ', '/root/.bash_history', '/var/run/secrets/kubernetes.io/serviceaccount/token'];
+exports.SCRIPT_FILE = /\.(aspx?|jspx?|php[3-7]?|phar|phtml|sh|bash|py|pyc|pl|rb|so|dll|dylib|exe|cgi|js|mjs|cjs)\.?$/i;
+function underRoot(resolved, root) {
+    const r = resolvePath(root);
+    return resolved === r || resolved.startsWith(r.endsWith('/') ? r : r + '/');
+}
+/** The directory path.outside_root reports: the resolved path up to its last `/` (README "Allow-list targets"). */
+function targetDirectory(resolved) {
+    const dir = resolved.slice(0, Math.max(0, resolved.lastIndexOf('/')));
+    return dir === '' || /^[A-Za-z]:$/.test(dir) ? dir + '/' : dir;
+}
+function detectPath(path, op, inputs, fileRoots = [], inRequest = true) {
+    if (typeof path !== 'string' || !path)
+        return null;
+    const np = normPath(path);
+    const resolved = resolvePath(path);
+    const writes = op === 'write' || op === 'append' || op === 'rename' || op === 'open';
+    if (writes && /::\$(DATA|INDEX)$/i.test(path))
+        return { attack: 'file_write', rule: 'file_write.ntfs' };
+    const cands = reqInputs(inputs, 3).concat(modelInputs(inputs, 3));
+    for (const inp of cands) {
+        const ni = normPath(inp.value);
+        if (ni.includes('../') && (np.endsWith(ni) || np.includes(ni)))
+            return { attack: 'path_traversal', rule: 'path.traversal', input: inp };
+        const absolute = ni.startsWith('/') || /^[A-Za-z]:\//.test(ni) || inp.value.startsWith('file://');
+        if (absolute) {
+            const target = inp.value.startsWith('file://') ? normPath(inp.value.slice(7)) : ni;
+            if (np === target || np.endsWith(target))
+                return { attack: 'path_traversal', rule: 'path.absolute', input: inp };
+        }
+        const nul = inp.value.indexOf('\0');
+        if (nul > 0 && path.includes(inp.value.slice(0, nul)))
+            return { attack: 'path_traversal', rule: 'path.nullbyte', input: inp };
+    }
+    const contained = cands.find((i) => path.includes(i.value) || np.includes(normPath(i.value)));
+    if (contained && fileRoots.length && !fileRoots.some((r) => underRoot(resolved, r))) {
+        return { attack: 'path_traversal', rule: 'path.outside_root', input: contained, target: targetDirectory(resolved) };
+    }
+    if (contained) {
+        const home = (0, os_1.homedir)().replace(/\\/g, '/');
+        if (SENSITIVE.includes(resolved) || resolved === `${home}/.ssh/id_rsa` || resolved.endsWith('/.ssh/id_rsa')) {
+            return { attack: 'path_traversal', rule: 'path.sensitive', input: contained };
+        }
+    }
+    if (writes && inRequest && exports.SCRIPT_FILE.test(resolved.split('/').pop() || '')) {
+        if (contained || fileRoots.some((r) => underRoot(resolved, r)) || underRoot(resolved, (0, os_1.tmpdir)())) {
+            return { attack: 'file_write', rule: 'file_write.script', input: contained };
+        }
+    }
+    (0, iast_scope_1.noteVulnerability)(() => (0, iast_rules_1.vulnPath)(np, inputs, normPath)); // passive IAST
+    return null;
+}
+// ---- SSRF ----------------------------------------------------------------
+const SSRF_PROTOCOLS = new Set('file gopher dict ftp jar netdoc ldap ldaps php phar expect tftp'.split(' '));
+exports.METADATA_HOSTS = ['169.254.169.254', 'fd00:ec2::254', '100.100.100.200', '168.63.129.16', '169.254.170.2', 'metadata.google.internal', 'metadata'];
+/** Scheme and raw host as written (the WHATWG parser would rewrite numeric hosts). */
+function rawUrl(url) {
+    const m = /^([A-Za-z][A-Za-z0-9+.-]*):/.exec(url);
+    if (!m)
+        return null;
+    const scheme = m[1].toLowerCase();
+    let rest = url.slice(m[0].length);
+    if (!rest.startsWith('//'))
+        return { scheme, host: '' };
+    rest = rest.slice(2);
+    const end = rest.search(/[/?#\\]/);
+    let auth = end < 0 ? rest : rest.slice(0, end);
+    const at = auth.lastIndexOf('@');
+    if (at >= 0)
+        auth = auth.slice(at + 1);
+    let host = auth;
+    if (host.startsWith('['))
+        host = host.slice(1, host.indexOf(']') < 0 ? undefined : host.indexOf(']'));
+    else if (host.includes(':'))
+        host = host.slice(0, host.indexOf(':'));
+    return { scheme, host: host.toLowerCase() };
+}
+function parseV4(s) {
+    const p = s.split('.');
+    if (p.length !== 4)
+        return null;
+    const n = p.map((x) => (/^(0|[1-9]\d{0,2})$/.test(x) ? Number(x) : NaN));
+    return n.every((x) => x >= 0 && x <= 255) ? n : null;
+}
+function parseV6(s) {
+    // Returns 16 bytes, or null.
+    if (!s.includes(':'))
+        return null;
+    let tail = [];
+    let str = s;
+    const lastColon = str.lastIndexOf(':');
+    const v4 = parseV4(str.slice(lastColon + 1));
+    if (v4) {
+        tail = v4;
+        str = str.slice(0, lastColon) + ':0:0';
+    }
+    const halves = str.split('::');
+    if (halves.length > 2)
+        return null;
+    const parse = (h) => (h ? h.split(':').map((x) => (/^[0-9a-f]{1,4}$/i.test(x) ? parseInt(x, 16) : NaN)) : []);
+    const a = parse(halves[0]);
+    const b = halves.length === 2 ? parse(halves[1]) : [];
+    if ([...a, ...b].some((x) => Number.isNaN(x)))
+        return null;
+    const fill = halves.length === 2 ? 8 - a.length - b.length : 0;
+    if (fill < 0 || (halves.length === 1 && a.length !== 8))
+        return null;
+    const words = [...a, ...Array(fill).fill(0), ...b];
+    const bytes = [];
+    for (const w of words)
+        bytes.push(w >> 8, w & 255);
+    if (tail.length)
+        bytes.splice(12, 4, ...tail);
+    return bytes;
+}
+function v4Private(b) {
+    const [a, c] = b;
+    return a === 0 || a === 10 || a === 127 || (a === 100 && c >= 64 && c < 128) || (a === 169 && c === 254) || (a === 172 && c >= 16 && c < 32) || (a === 192 && c === 168) || (a === 198 && (c === 18 || c === 19));
+}
+/** Private, loopback, link-local or unique-local, IPv4-mapped/compatible decoded. */
+function isPrivateAddress(addr) {
+    const a = addr.toLowerCase().replace(/^\[|\]$/g, '').split('%')[0];
+    const v4 = parseV4(a);
+    if (v4)
+        return v4Private(v4);
+    const v6 = parseV6(a);
+    if (!v6)
+        return false;
+    const zero10 = v6.slice(0, 10).every((x) => x === 0);
+    if (zero10 && v6[10] === 0xff && v6[11] === 0xff)
+        return v4Private(v6.slice(12));
+    const zero12 = zero10 && v6[10] === 0 && v6[11] === 0;
+    const loopOrAny = v6.slice(12, 15).every((x) => x === 0) && v6[15] <= 1;
+    if (zero12 && !loopOrAny)
+        return v4Private(v6.slice(12));
+    if (v6.every((x) => x === 0))
+        return true;
+    if (v6.slice(0, 15).every((x) => x === 0) && v6[15] === 1)
+        return true;
+    if ((v6[0] & 0xfe) === 0xfc)
+        return true;
+    if (v6[0] === 0xfe && (v6[1] & 0xc0) === 0x80)
+        return true;
+    return false;
+}
+function isIpLiteral(host) {
+    return Boolean(parseV4(host) || parseV6(host));
+}
+function isObfuscatedV4(host) {
+    if (!host || parseV4(host))
+        return false;
+    if (/^\d+$/.test(host))
+        return true;
+    if (/^0x[0-9a-f]+$/i.test(host))
+        return true;
+    const parts = host.split('.');
+    if (parts.length > 4 || parts.length < 2)
+        return false;
+    if (!parts.every((p) => /^(0x[0-9a-f]+|\d+)$/i.test(p)))
+        return false;
+    return parts.length < 4 || parts.some((p) => /^0\d/.test(p) || /^0x/i.test(p));
+}
+const DNSLOG_SUFFIXES = dnslog_domains_json_1.default.domains;
+const DNSLOG_HOSTS = new Set(dnslog_domains_json_1.default.hosts);
+function hostMatches(host, pattern) {
+    const p = pattern.toLowerCase();
+    if (p.startsWith('*.'))
+        return host.endsWith(p.slice(1)) && host.length > p.length - 1;
+    return host === p;
+}
+/** Whether an input taints the URL's host. */
+function taintOf(url, host, inputs) {
+    const cands = inputs.filter((i) => i.value.length >= 3);
+    if (host) {
+        const hostEnd = url.toLowerCase().indexOf(host) + host.length;
+        return cands.find((i) => i.value.toLowerCase().includes(host) || (url.startsWith(i.value) && i.value.length >= hostEnd));
+    }
+    // No host (file:, gopher: without //): an input that is a prefix past the scheme.
+    const schemeEnd = url.indexOf(':') + 1;
+    return cands.find((i) => url.startsWith(i.value) && i.value.length > schemeEnd);
+}
+function detectSsrf(url, inputs, resolved = []) {
+    const raw = rawUrl(url);
+    if (!raw)
+        return null;
+    const inp = taintOf(url, raw.host, inputs);
+    if (!inp)
+        return null;
+    const host = raw.host;
+    if (SSRF_PROTOCOLS.has(raw.scheme))
+        return { attack: 'ssrf', rule: 'ssrf.protocol', input: inp };
+    if (exports.METADATA_HOSTS.includes(host) || resolved.some((a) => exports.METADATA_HOSTS.includes(a.toLowerCase())))
+        return { attack: 'ssrf', rule: 'ssrf.metadata', input: inp };
+    if (isObfuscatedV4(host))
+        return { attack: 'ssrf', rule: 'ssrf.obfuscated', input: inp };
+    if (host === 'localhost' || host.endsWith('.localhost') || (isIpLiteral(host) && isPrivateAddress(host)) || resolved.some(isPrivateAddress)) {
+        return { attack: 'ssrf', rule: 'ssrf.internal', input: inp };
+    }
+    if (DNSLOG_HOSTS.has(host) || DNSLOG_SUFFIXES.some((s) => host.endsWith(s)))
+        return { attack: 'ssrf', rule: 'ssrf.dnslog', input: inp };
+    (0, iast_scope_1.noteVulnerability)(() => (0, iast_rules_1.vulnSsrf)(url, raw, inputs)); // passive IAST
+    return null;
+}
+/** outbound.not_allowed: host matches none of the allow-list (always-allowed hosts aside). */
+function detectOutbound(url, allow, alwaysAllowed = []) {
+    if (!allow.length)
+        return null;
+    const raw = rawUrl(url);
+    if (!raw || !raw.host)
+        return null;
+    if (alwaysAllowed.includes(raw.host) || allow.some((p) => hostMatches(raw.host, p)))
+        return null;
+    return { attack: 'outbound', rule: 'outbound.not_allowed', target: raw.host };
+}
+// ---- Deserialization, code, XML, XSS ------------------------------------------
+/** Data is tainted when equal to an input, contained in one, or containing one of length >= 8. */
+function taintedData(data, inputs) {
+    if (!data)
+        return undefined;
+    for (const i of inputs) {
+        if (!i.value)
+            continue;
+        if (i.value === data || i.value.includes(data) || (i.value.length >= 8 && data.includes(i.value)))
+            return i;
+        if (i.value.length >= 8 && /^[A-Za-z0-9+/=_-]+$/.test(i.value)) {
+            const dec = Buffer.from(i.value, 'base64').toString('latin1');
+            if (dec && (dec === data || (dec.length >= 8 && (dec.includes(data) || data.includes(dec)))))
+                return i;
+        }
+    }
+    return undefined;
+}
+const JSONPICKLE_MARKS = ['"py/reduce"', '"py/object"', '"py/type"', '"py/function"', '"py/repr"', '"py/newargs"'];
+/** A SnakeYAML global tag naming a Java class; standard tags such as `!!str` have no dot and never match. */
+const SNAKEYAML_CLASS_TAG = /(?:^|[\s[{,])(?:!!|!<tag:yaml\.org,2002:)[A-Za-z_$][A-Za-z0-9_$]*\.[A-Za-z_$]/;
+function detectDeserialization(format, data, inputs) {
+    const inp = taintedData(data, inputs);
+    if (!inp)
+        return null;
+    // Passive IAST: tainted data reaching an unsafe deserializer, whatever the format check says.
+    (0, iast_scope_1.noteVulnerability)(() => (0, iast_rules_1.vulnData)('vuln.deser_input', data, taintedData(data, inputs.filter((i) => i.source === 'request'))));
+    const hit = (rule) => ({ attack: 'deserialization', rule, input: inp });
+    switch (format) {
+        case 'pickle':
+            return hit('deser.pickle');
+        case 'marshal':
+            return hit('deser.marshal');
+        case 'binaryformatter':
+            return hit('deser.binaryformatter');
+        case 'java':
+            return hit('deser.java');
+        case 'snakeyaml':
+            return SNAKEYAML_CLASS_TAG.test(data) ? hit('deser.yaml') : null;
+        case 'yaml':
+            return data.includes('!!python/') || data.includes('!!js/') ? hit('deser.yaml') : null;
+        case 'jsonpickle':
+            return JSONPICKLE_MARKS.some((m) => data.includes(m)) ? hit('deser.jsonpickle') : null;
+        case 'node_serialize':
+            return data.includes('_$$ND_FUNC$$_') ? hit('deser.node_serialize') : null;
+        case 'funcster':
+            return data.includes('__js_function') ? hit('deser.funcster') : null;
+        case 'typename':
+            return data.includes('"$type"') || data.includes('"__type"') ? hit('deser.typename') : null;
+    }
+    return null;
+}
+function detectCode(code, inputs) {
+    if (!code)
+        return null;
+    let tokens = null;
+    for (const inp of inputs) {
+        if (inp.value.length < 3)
+            continue;
+        if (inp.value === code)
+            return { attack: 'code_injection', rule: 'code.eval', input: inp };
+        for (const idx of (0, lexers_1.occurrences)(code, inp.value)) {
+            tokens ?? (tokens = (0, lexers_1.codeTokens)(code));
+            if ((0, lexers_1.overlapping)(tokens, idx, inp.value.length).length >= 2)
+                return { attack: 'code_injection', rule: 'code.eval', input: inp };
+        }
+    }
+    (0, iast_scope_1.noteVulnerability)(() => (0, iast_rules_1.vulnCode)(code, inputs, () => (tokens ?? (tokens = (0, lexers_1.codeTokens)(code))))); // passive IAST
+    return null;
+}
+const INCLUDE_PATHLIKE = /[/\\]|\.\./;
+const INCLUDE_ABSOLUTE = /^(?:\/|[A-Za-z]:[\\/]|\\\\|file:)/i;
+/** code.include: a module specifier that is, or carries a path from, an input. */
+function detectInclude(specifier, inputs) {
+    if (typeof specifier !== 'string' || !specifier)
+        return null;
+    for (const inp of inputs) {
+        if (!inp.value)
+            continue;
+        if (inp.value === specifier)
+            return { attack: 'code_injection', rule: 'code.include', input: inp };
+        if (inp.value.length >= 3 && specifier.includes(inp.value) && (INCLUDE_ABSOLUTE.test(inp.value) || INCLUDE_PATHLIKE.test(inp.value) || inp.value.includes('\0'))) {
+            return { attack: 'code_injection', rule: 'code.include', input: inp };
+        }
+    }
+    (0, iast_scope_1.noteVulnerability)(() => (0, iast_rules_1.vulnInclude)(specifier, inputs)); // passive IAST
+    return null;
+}
+/** file_write.upload: an uploaded file whose name is a script (README "Path"). */
+function detectUpload(input) {
+    const name = input.value.split(/[\\/]/).pop() || '';
+    return exports.SCRIPT_FILE.test(name) ? { attack: 'file_write', rule: 'file_write.upload', input } : null;
+}
+/** Reads the DOCTYPE: external DTD id and entity declarations. */
+function parseDoctype(xml) {
+    const at = xml.indexOf('<!DOCTYPE');
+    if (at < 0)
+        return { hasDoctype: false, externalDtd: null, entities: [] };
+    const head = xml.slice(at, at + 64 * 1024);
+    const bracket = head.indexOf('[');
+    const close = head.indexOf('>');
+    const decl = head.slice(0, bracket >= 0 && bracket < close ? bracket : close);
+    const ext = /\s(SYSTEM|PUBLIC)\s/.exec(decl);
+    let externalDtd = null;
+    if (ext) {
+        const lits = decl.slice(ext.index).match(/"[^"]*"|'[^']*'/g) || [];
+        externalDtd = (lits[ext[1] === 'PUBLIC' ? 1 : 0] || lits[0] || '').slice(1, -1);
+    }
+    const entities = [];
+    let from = 0;
+    while (entities.length < 1000) {
+        const i = head.indexOf('<!ENTITY', from);
+        if (i < 0)
+            break;
+        const end = head.indexOf('>', i);
+        const body = head.slice(i + 8, end < 0 ? undefined : end).trim();
+        from = end < 0 ? head.length : end + 1;
+        const m = /^(%\s+)?([^\s]+)\s+(.*)$/s.exec(body);
+        if (!m)
+            continue;
+        const rest = m[3].trim();
+        const lits = rest.match(/"[^"]*"|'[^']*'/g) || [];
+        const external = /^(SYSTEM|PUBLIC)\b/.test(rest);
+        const uri = external ? (lits[rest.startsWith('PUBLIC') ? 1 : 0] || '').slice(1, -1) : '';
+        entities.push({ name: m[2], external, uri, value: external ? '' : (lits[0] || '').slice(1, -1) });
+    }
+    return { hasDoctype: true, externalDtd, entities };
+}
+const XXE_PROTOCOLS = new Set('ftp dict gopher netdoc mailto jar php expect'.split(' '));
+function detectXml(xml, inputs, resolvesExternal) {
+    // Passive IAST: request data parsed by a parser that resolves external entities, DOCTYPE or not.
+    if (xml && resolvesExternal)
+        (0, iast_scope_1.noteVulnerability)(() => (0, iast_rules_1.vulnData)('vuln.xml_external', xml, taintedData(xml, inputs.filter((i) => i.source === 'request'))));
+    if (!xml || !xml.includes('<!DOCTYPE'))
+        return null;
+    const inp = taintedData(xml, inputs);
+    if (!inp)
+        return null;
+    const d = parseDoctype(xml);
+    const uris = d.entities.filter((e) => e.external).map((e) => e.uri);
+    if (d.externalDtd !== null)
+        uris.push(d.externalDtd);
+    for (const u of uris) {
+        const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(u)?.[1]?.toLowerCase();
+        if ((scheme && XXE_PROTOCOLS.has(scheme)) || u.startsWith('\\\\'))
+            return { attack: 'xxe', rule: 'xxe.protocol', input: inp };
+        if (scheme === 'file') {
+            const p = u.replace(/^file:(\/\/)?/i, '');
+            if ((p.startsWith('/') || /^[A-Za-z]:/.test(p) || p.includes('../')) && !/\.(dtd|xsd|xml)$/i.test(p))
+                return { attack: 'xxe', rule: 'xxe.file', input: inp };
+        }
+    }
+    if (uris.length)
+        return { attack: 'xxe', rule: resolvesExternal ? 'xxe.external_entity' : 'xxe.doctype', input: inp };
+    const referencing = d.entities.filter((e) => !e.external && /[&%][^\s;]+;/.test(e.value));
+    if (referencing.length >= 3)
+        return { attack: 'xxe', rule: 'xxe.billion_laughs', input: inp };
+    return null;
+}
+// The contract's tag pattern (OpenRASP xss_userinput) includes control characters on purpose.
+// eslint-disable-next-line no-control-regex
+const XSS_TAG = /<![-[A-Za-z]|<([A-Za-z]{1,12})[/>\x00-\x20]/;
+const XSS_HANDLER = /\bon[a-z]{3,}\s*=/i;
+exports.MAX_XSS_BODY = 1024 * 1024;
+function detectXss(contentType, body, inputs) {
+    if (!contentType || !contentType.toLowerCase().includes('html') || !body || body.length > exports.MAX_XSS_BODY)
+        return null;
+    for (const inp of inputs) {
+        const v = inp.value;
+        if (v.length < 15)
+            continue;
+        if (!(XSS_TAG.test(v) || v.toLowerCase().includes('javascript:') || XSS_HANDLER.test(v)))
+            continue;
+        if (body.includes(v))
+            return { attack: 'xss', rule: 'xss.reflected', input: inp };
+    }
+    return null;
+}
+// SHIELD: template-source detector uses the same code_injection attack mode.
+var template_1 = require("./template");
+Object.defineProperty(exports, "detectTemplate", { enumerable: true, get: function () { return template_1.detectTemplate; } });
+//# sourceMappingURL=detect.js.map