shield360 1.0.1 → 1.2.0

package/dist/rasp/hooks/code.js

@@ -0,0 +1,334 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RaspCodeInstrumentation = exports.unpatchLibxmljs2 = exports.patchLibxmljs2 = exports.unpatchLibxmljs = exports.patchLibxmljs = exports.unpatchJsYaml = exports.patchJsYaml = exports.unpatchFuncster = exports.patchFuncster = exports.unpatchNodeSerialize = exports.patchNodeSerialize = void 0;
+exports.installCodeHooks = installCodeHooks;
+exports.uninstallCodeHooks = uninstallCodeHooks;
+exports.patchLoaded = patchLoaded;
+/**
+ * Code, deserialization, XML and response sink hooks (README "Code",
+ * "Deserialization", "XXE", "XSS"): `vm` and the `Function` constructor are
+ * checked for tainted code, node-serialize, funcster and js-yaml (unsafe
+ * schemas) for tainted data, libxmljs for external entities, and HTML
+ * responses for reflected input (monitor only). Drafted with ChatGPT,
+ * reviewed and adapted by the repository owner.
+ *
+ * `eval` is deliberately not hooked: a call is direct eval (with the
+ * caller's local scope) only when `eval` is the built-in itself, so
+ * replacing `globalThis.eval` would turn every direct `eval(x)` in the app
+ * into a global-scope evaluation and break it (webpack's eval source maps,
+ * for one). The `Function` hook covers `Function(...)` and `new Function`,
+ * not `(function () {}).constructor(...)`.
+ */
+// SHIELD: optional template-source sinks share the code-hook lifecycle.
+const template_1 = require("./template");
+const vm = require("vm");
+const http = require("http");
+const module_1 = require("module");
+const string_decoder_1 = require("string_decoder");
+const instrumentation_1 = require("@opentelemetry/instrumentation");
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const detect_1 = require("../detect");
+const types_1 = require("../types");
+const marks_1 = require("./marks");
+const esm_1 = require("./esm");
+const registry = new Map();
+let builtins;
+let checking = false;
+// No "inside a wrapped call" skip: code run by vm runs inside the original
+// call, and its own vm/Function calls must still be checked.
+function inspect(sink, run) {
+    if (checking)
+        return;
+    try {
+        if (!(0, engine_1.isActive)())
+            return;
+        checking = true;
+        const ctx = (0, context_1.currentContext)();
+        const all = ctx ? (0, context_1.inputsOf)(ctx) : [];
+        // SHIELD: code generated from a template source was judged by the template check; other input is not.
+        const inputs = sink === 'Function' || sink.startsWith('vm.') ? (0, template_1.unjudgedInputs)(all) : all;
+        if (inputs.length)
+            (0, engine_1.check)(sink, () => run(inputs));
+    }
+    catch (error) {
+        if (error instanceof types_1.RaspBlockedError)
+            throw error;
+    }
+    finally {
+        checking = false;
+    }
+}
+function copy(original, wrapper) {
+    for (const key of Reflect.ownKeys(original)) {
+        // Shimmer metadata must stay private to the tracing wrapper underneath us.
+        if (key === '__wrapped' || key === '__original' || key === '__unwrap')
+            continue;
+        Object.defineProperty(wrapper, key, Object.getOwnPropertyDescriptor(original, key));
+    }
+}
+function wrap(owner, key, before) {
+    let methods = registry.get(owner);
+    const known = methods?.get(key);
+    if (known) {
+        known.on = true;
+        return known;
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+    if (!descriptor || typeof descriptor.value !== 'function')
+        return;
+    const original = descriptor.value;
+    const entry = { owner, key, descriptor, wrapper: original, on: true };
+    const wrapper = function (...values) {
+        if (entry.on)
+            before(values);
+        return new.target ? Reflect.construct(original, values, new.target) : Reflect.apply(original, this, values);
+    };
+    copy(original, wrapper);
+    entry.wrapper = wrapper;
+    (0, marks_1.markRaspWrapper)(wrapper);
+    Object.defineProperty(owner, key, { ...descriptor, value: wrapper });
+    if (!methods)
+        registry.set(owner, methods = new Map());
+    methods.set(key, entry);
+    return entry;
+}
+function restore(entry) {
+    entry.on = false;
+    if (Reflect.get(entry.owner, entry.key) === entry.wrapper) {
+        // No descriptor: RASP added the property itself (ServerResponse write/end), so remove it.
+        if (entry.descriptor)
+            Object.defineProperty(entry.owner, entry.key, entry.descriptor);
+        else
+            delete entry.owner[entry.key];
+        registry.get(entry.owner)?.delete(entry.key);
+        if (!registry.get(entry.owner)?.size)
+            registry.delete(entry.owner);
+    }
+}
+const MAX_BODY = 1024 * 1024;
+let bodies = new WeakMap();
+function response(res, values, end) {
+    if (checking)
+        return;
+    try {
+        if (!(0, engine_1.isActive)())
+            return;
+        const type = res.getHeader('content-type');
+        if (typeof type !== 'string' || !type.toLowerCase().includes('html'))
+            return;
+        let body = bodies.get(res);
+        if (!body) {
+            const ctx = (0, context_1.currentContext)();
+            const inputs = ctx ? (0, context_1.inputsOf)(ctx).map((input) => ({ ...input })) : [];
+            // Nothing to compare against: do not collect the body at all.
+            body = { inputs, chunks: [], bytes: 0, stopped: !inputs.length, decoder: new string_decoder_1.StringDecoder('utf8') };
+            bodies.set(res, body);
+        }
+        const chunk = values[0];
+        if (!body.stopped && (typeof chunk === 'string' || Buffer.isBuffer(chunk))) {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, typeof values[1] === 'string' ? values[1] : 'utf8');
+            body.bytes += buffer.length;
+            if (body.bytes > MAX_BODY) {
+                body.stopped = true;
+                body.chunks = [];
+            }
+            else
+                body.chunks.push(body.decoder.write(buffer));
+        }
+        if (end) {
+            bodies.delete(res);
+            if (!body.stopped && body.inputs.length) {
+                checking = true;
+                try {
+                    const text = body.chunks.join('') + body.decoder.end();
+                    (0, engine_1.check)('http.response', () => (0, detect_1.detectXss)(type, text, body.inputs));
+                }
+                finally {
+                    checking = false;
+                }
+            }
+        }
+    }
+    catch { /* A response must never be changed or blocked by monitoring. */ }
+}
+function installCodeHooks() {
+    if (builtins)
+        return true;
+    const saved = [];
+    try {
+        const add = (owner, key, before) => {
+            const entry = wrap(owner, key, before);
+            if (!entry)
+                throw new TypeError(key);
+            saved.push(entry);
+        };
+        for (const key of ['runInThisContext', 'runInNewContext', 'runInContext', 'compileFunction', 'Script']) {
+            add(vm, key, values => inspect(`vm.${key}`, inputs => typeof values[0] === 'string' ? (0, detect_1.detectCode)(values[0], inputs) : null));
+        }
+        const functionDescriptor = Object.getOwnPropertyDescriptor(globalThis, 'Function');
+        if (functionDescriptor?.configurable)
+            add(globalThis, 'Function', values => inspect('Function', inputs => {
+                const body = values[values.length - 1];
+                const finding = typeof body === 'string' ? (0, detect_1.detectCode)(body, inputs) : null;
+                if (finding)
+                    return finding;
+                const params = values.slice(0, -1);
+                return params.length && params.every(value => typeof value === 'string') ? (0, detect_1.detectCode)(params.join(','), inputs) : null;
+            }));
+        // write/end live on OutgoingMessage.prototype (shared with client
+        // requests): RASP adds its own on ServerResponse.prototype, calling
+        // whatever is inherited, and removes them again on uninstall.
+        const proto = http.ServerResponse.prototype;
+        for (const key of ['write', 'end']) {
+            if (Object.prototype.hasOwnProperty.call(proto, key) || typeof Reflect.get(proto, key) !== 'function')
+                continue;
+            const inherited = Reflect.get(Object.getPrototypeOf(proto), key);
+            const wrapper = function (...values) {
+                if (entry.on)
+                    response(this, values, key === 'end');
+                return Reflect.apply(Reflect.get(Object.getPrototypeOf(proto), key), this, values);
+            };
+            copy(inherited, wrapper);
+            Object.defineProperty(proto, key, { value: wrapper, writable: true, configurable: true, enumerable: false });
+            const entry = { owner: proto, key, wrapper, on: true };
+            saved.push(entry);
+        }
+        instrumentation = new RaspCodeInstrumentation();
+        instrumentation.enable();
+        patchLoaded();
+        (0, template_1.installTemplateHooks)(); // SHIELD: patch only imported template engines.
+        (0, module_1.syncBuiltinESMExports)();
+        builtins = saved;
+        return true;
+    }
+    catch {
+        (0, template_1.uninstallTemplateHooks)(); // SHIELD: roll back optional template hooks.
+        try {
+            instrumentation?.disable();
+        }
+        catch { /* Never throw. */ }
+        instrumentation = undefined;
+        for (const entry of saved.reverse()) {
+            try {
+                restore(entry);
+            }
+            catch { /* Never throw. */ }
+        }
+        try {
+            (0, module_1.syncBuiltinESMExports)();
+        }
+        catch { /* Never throw. */ }
+        return false;
+    }
+}
+function uninstallCodeHooks() {
+    (0, template_1.uninstallTemplateHooks)(); // SHIELD: invalidate template generations.
+    for (const entry of builtins ?? []) {
+        try {
+            restore(entry);
+        }
+        catch { /* Never throw. */ }
+    }
+    builtins = undefined;
+    bodies = new WeakMap();
+    try {
+        instrumentation?.disable();
+    }
+    catch { /* Never throw. */ }
+    instrumentation = undefined;
+    for (const methods of [...registry.values()])
+        for (const entry of [...methods.values()]) {
+            try {
+                restore(entry);
+            }
+            catch { /* Never throw. */ }
+        }
+    try {
+        (0, module_1.syncBuiltinESMExports)();
+    }
+    catch { /* Never throw. */ }
+}
+function patch(library, exports, version) {
+    try {
+        if (!exports || (typeof exports !== 'object' && typeof exports !== 'function'))
+            return;
+        const module = exports;
+        const methods = library === 'node-serialize' ? ['unserialize'] : library === 'funcster' ? ['deepDeserialize']
+            : library === 'js-yaml' ? ['load', 'loadAll'] : ['parseXml', 'parseXmlString'];
+        for (const method of methods)
+            wrap(module, method, values => inspect(`${library}.${method}`, inputs => {
+                if (library === 'node-serialize')
+                    return (0, detect_1.detectDeserialization)('node_serialize', String(values[0]), inputs);
+                if (library === 'funcster') {
+                    const text = typeof values[0] === 'string' ? values[0] : JSON.stringify(values[0]);
+                    return typeof text === 'string' ? (0, detect_1.detectDeserialization)('funcster', text, inputs) : null;
+                }
+                if (typeof values[0] !== 'string')
+                    return null;
+                if (library === 'js-yaml') {
+                    const options = (method === 'loadAll' && typeof values[1] === 'function' ? values[2] : values[1]);
+                    const schema = options?.schema;
+                    const major = version ? Number(version.split('.')[0]) : module.DEFAULT_FULL_SCHEMA ? 3 : 4;
+                    const unsafe = major < 4 ? !schema || schema === module.DEFAULT_FULL_SCHEMA
+                        : Boolean(schema && !['DEFAULT_SCHEMA', 'CORE_SCHEMA', 'JSON_SCHEMA', 'FAILSAFE_SCHEMA'].some(key => schema === module[key]));
+                    return unsafe ? (0, detect_1.detectDeserialization)('yaml', values[0], inputs) : null;
+                }
+                const options = values[1];
+                return (0, detect_1.detectXml)(values[0], inputs, Boolean(options && (options.noent || options.dtdload)));
+            }));
+    }
+    catch { /* Optional library or unsupported shape. */ }
+}
+function unpatch(exports) {
+    const methods = registry.get(exports);
+    for (const entry of [...(methods?.values() ?? [])]) {
+        try {
+            restore(entry);
+        }
+        catch { /* Fail open. */ }
+    }
+}
+const patchNodeSerialize = (exports) => patch('node-serialize', exports);
+exports.patchNodeSerialize = patchNodeSerialize;
+exports.unpatchNodeSerialize = unpatch;
+const patchFuncster = (exports) => patch('funcster', exports);
+exports.patchFuncster = patchFuncster;
+exports.unpatchFuncster = unpatch;
+const patchJsYaml = (exports, version) => patch('js-yaml', exports, version);
+exports.patchJsYaml = patchJsYaml;
+exports.unpatchJsYaml = unpatch;
+const patchLibxmljs = (exports) => patch('libxmljs', exports);
+exports.patchLibxmljs = patchLibxmljs;
+exports.unpatchLibxmljs = unpatch;
+const patchLibxmljs2 = (exports) => patch('libxmljs2', exports);
+exports.patchLibxmljs2 = patchLibxmljs2;
+exports.unpatchLibxmljs2 = unpatch;
+const libraries = ['node-serialize', 'funcster', 'js-yaml', 'libxmljs', 'libxmljs2'];
+class RaspCodeInstrumentation extends instrumentation_1.InstrumentationBase {
+    constructor() { super('shield360/instrumentation-rasp-code', '1.0.0', { enabled: false }); }
+    init() {
+        return libraries.map(name => new instrumentation_1.InstrumentationNodeModuleDefinition(name, ['*'], (exports, version) => { patch(name, (0, esm_1.moduleExports)(exports), version); return exports; }, exports => unpatch((0, esm_1.moduleExports)(exports))));
+    }
+}
+exports.RaspCodeInstrumentation = RaspCodeInstrumentation;
+let instrumentation;
+function patchLoaded() {
+    for (const library of libraries) {
+        try {
+            const id = require.resolve(library);
+            const cached = require.cache[id];
+            if (cached) {
+                let version;
+                try {
+                    const manifest = require.cache[require.resolve(`${library}/package.json`)];
+                    version = manifest?.exports?.version;
+                }
+                catch { /* Schema exports distinguish legacy js-yaml without loading it. */ }
+                patch(library, cached.exports, version);
+            }
+        }
+        catch { /* Never load an optional library. */ }
+    }
+}
+//# sourceMappingURL=code.js.map

package/dist/rasp/hooks/code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code.js","sourceRoot":"","sources":["../../../src/rasp/hooks/code.ts"],"names":[],"mappings":";;;AAgIA,4CAmDC;AACD,gDAWC;AAmDD,kCAeC;AAjQD;;;;;;;;;;;;;;GAcG;AACH,wEAAwE;AACxE,yCAA0F;AAC1F,yBAA0B;AAC1B,6BAA8B;AAC9B,mCAA+C;AAC/C,mDAA+C;AAC/C,oEAA0G;AAC1G,wCAAsD;AACtD,sCAA4C;AAC5C,sCAAoF;AACpF,oCAA0E;AAC1E,mCAA0C;AAC1C,+BAAsC;AAMtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;AACvD,IAAI,QAA6B,CAAC;AAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB,2EAA2E;AAC3E,6DAA6D;AAC7D,SAAS,OAAO,CAAC,IAAY,EAAE,GAA4C;IACzE,IAAI,QAAQ;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO;QACxB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,sGAAsG;QACtG,MAAM,MAAM,GAAG,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,yBAAc,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACzF,IAAI,MAAM,CAAC,MAAM;YAAE,IAAA,cAAK,EAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,KAAK,YAAY,wBAAgB;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;YAC/D,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,SAAS,IAAI,CAAC,QAAgB,EAAE,OAAe;IAC7C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,UAAU;YAAE,SAAS;QAChF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,GAAG,CAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AACD,SAAS,IAAI,CAAC,KAAa,EAAE,GAAW,EAAE,MAAmC;IAC3E,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO;IAClE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAe,CAAC;IAC5C,MAAM,KAAK,GAAU,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,UAAyB,GAAG,MAAiB;QAC3D,IAAI,KAAK,CAAC,EAAE;YAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9G,CAAC,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxB,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC;IACzB,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,OAAO,CAAC,KAAY;IAC3B,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1D,0FAA0F;QAC1F,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;;YACjF,OAAQ,KAAK,CAAC,KAAiC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI;YAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7B,IAAI,MAAM,GAAG,IAAI,OAAO,EAA6B,CAAC;AACtD,SAAS,QAAQ,CAAC,GAAwB,EAAE,MAAiB,EAAE,GAAY;IACzE,IAAI,QAAQ;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO;QAC7E,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,8DAA8D;YAC9D,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,8BAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACrG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;YAC5B,IAAI,IAAI,CAAC,KAAK,GAAG,QAAQ,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YAAC,CAAC;;gBAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxC,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBACvD,IAAA,cAAK,EAAC,eAAe,EAAE,GAAG,EAAE,CAAC,IAAA,kBAAS,EAAC,IAAI,EAAE,IAAI,EAAE,IAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpE,CAAC;wBAAS,CAAC;oBAAC,QAAQ,GAAG,KAAK,CAAC;gBAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,gEAAgE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAgB,gBAAgB;IAC9B,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,MAAmC,EAAE,EAAE;YAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvG,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/H,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACnF,IAAI,kBAAkB,EAAE,YAAY;YAAE,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;gBACvG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACvC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3E,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;gBAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnC,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAA,mBAAU,EAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzH,CAAC,CAAC,CAAC,CAAC;QACJ,kEAAkE;QAClE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,UAAU;gBAAE,SAAS;YAChH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,CAAW,CAAC;YAC3E,MAAM,OAAO,GAAG,UAAqC,GAAG,MAAiB;gBACvE,IAAI,KAAK,CAAC,EAAE;oBAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC;gBACpD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,CAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/F,CAAC,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACzB,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7G,MAAM,KAAK,GAAU,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAChD,eAAe,CAAC,MAAM,EAAE,CAAC;QACzB,WAAW,EAAE,CAAC;QACd,IAAA,+BAAoB,GAAE,CAAC,CAAC,gDAAgD;QACxE,IAAA,8BAAqB,GAAE,CAAC;QACxB,QAAQ,GAAG,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,IAAA,iCAAsB,GAAE,CAAC,CAAC,6CAA6C;QACvE,IAAI,CAAC;YAAC,eAAe,EAAE,OAAO,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChE,eAAe,GAAG,SAAS,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAAC,CAAC;QAC7F,IAAI,CAAC;YAAC,IAAA,8BAAqB,GAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,SAAgB,kBAAkB;IAChC,IAAA,iCAAsB,GAAE,CAAC,CAAC,2CAA2C;IACrE,KAAK,MAAM,KAAK,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAAC,CAAC;IAC5F,QAAQ,GAAG,SAAS,CAAC;IACrB,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QAAC,eAAe,EAAE,OAAO,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAChE,eAAe,GAAG,SAAS,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAAE,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACxF,IAAI,CAAC;gBAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;IACD,IAAI,CAAC;QAAC,IAAA,8BAAqB,GAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,KAAK,CAAC,OAAgB,EAAE,OAAgB,EAAE,OAAgB;IACjE,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,UAAU,CAAC;YAAE,OAAO;QACvF,MAAM,MAAM,GAAG,OAAkC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC3G,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACjF,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE;gBACpG,IAAI,OAAO,KAAK,gBAAgB;oBAAE,OAAO,IAAA,8BAAqB,EAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC5G,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;oBAC3B,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnF,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,8BAAqB,EAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3F,CAAC;gBACD,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;gBAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,OAAO,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAqC,CAAC;oBACtI,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;oBAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3F,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,mBAAmB;wBACzE,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAChI,OAAO,MAAM,CAAC,CAAC,CAAC,IAAA,8BAAqB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1E,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAuD,CAAC;gBAChF,OAAO,IAAA,kBAAS,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9F,CAAC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;AAC1D,CAAC;AACD,SAAS,OAAO,CAAC,OAAgB;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAiB,CAAC,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;AAC5G,CAAC;AACM,MAAM,kBAAkB,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAAlF,QAAA,kBAAkB,sBAAgE;AAClF,QAAA,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAvE,QAAA,aAAa,iBAA0D;AACvE,QAAA,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAE,OAAgB,EAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAA/F,QAAA,WAAW,eAAoF;AAC/F,QAAA,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAvE,QAAA,aAAa,iBAA0D;AACvE,QAAA,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAAzE,QAAA,cAAc,kBAA2D;AACzE,QAAA,gBAAgB,GAAG,OAAO,CAAC;AACxC,MAAM,SAAS,GAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAChG,MAAa,uBAAwB,SAAQ,qCAAmB;IAC9D,gBAAgB,KAAK,CAAC,qCAAqC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI;QACZ,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,qDAAmC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAC9E,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,IAAA,mBAAa,EAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAA,mBAAa,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1I,CAAC;CACF;AAND,0DAMC;AACD,IAAI,eAAoD,CAAC;AACzD,SAAgB,WAAW;IACzB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,OAA2B,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,eAAe,CAAC,CAAC,CAAC;oBAC3E,OAAO,GAAI,QAAQ,EAAE,OAA4C,EAAE,OAAO,CAAC;gBAC7E,CAAC;gBAAC,MAAM,CAAC,CAAC,mEAAmE,CAAC,CAAC;gBAC/E,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}

package/dist/rasp/hooks/db.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Database sink hook (README "SQL", "NoSQL"): SQL text sent through pg,
+ * mysql2, mysql, sqlite3, better-sqlite3, mssql, tedious (SQL Server),
+ * oracledb (Oracle) and ibm_db (Db2), and MongoDB filter,
+ * update and pipeline documents, are checked for injection before the
+ * driver sends them. Drivers are hooked by name when the app loads them; no
+ * driver is imported. Drafted with ChatGPT, reviewed and adapted by the
+ * repository owner.
+ *
+ * Wrappers are RASP's own, not shimmer's: the SDK's tracing (and other
+ * OpenTelemetry instrumentations) wrap the same methods with shimmer, which
+ * unwraps whatever shimmer-wrapped method it finds. Kept apart, the two
+ * stack in either order and neither removes the other.
+ */
+import { InstrumentationBase, InstrumentationNodeModuleDefinition } from '@opentelemetry/instrumentation';
+type Driver = 'pg' | 'mysql2' | 'mysql' | 'sqlite3' | 'better-sqlite3' | 'mssql' | 'tedious' | 'oracledb' | 'ibm_db' | 'mongodb';
+export declare class RaspDbInstrumentation extends InstrumentationBase {
+    constructor();
+    protected init(): InstrumentationNodeModuleDefinition[];
+    patch(driver: Driver, exports: unknown): void;
+    unpatch(driver: Driver, exports: unknown): void;
+    restoreAll(): void;
+}
+export declare const patchPg: (exports: unknown) => void;
+export declare const unpatchPg: (exports: unknown) => void;
+export declare const patchMysql2: (exports: unknown) => void;
+export declare const unpatchMysql2: (exports: unknown) => void;
+export declare const patchMysql: (exports: unknown) => void;
+export declare const unpatchMysql: (exports: unknown) => void;
+export declare const patchSqlite3: (exports: unknown) => void;
+export declare const unpatchSqlite3: (exports: unknown) => void;
+export declare const patchBetterSqlite3: (exports: unknown) => void;
+export declare const unpatchBetterSqlite3: (exports: unknown) => void;
+export declare const patchMssql: (exports: unknown) => void;
+export declare const unpatchMssql: (exports: unknown) => void;
+export declare const patchTedious: (exports: unknown) => void;
+export declare const unpatchTedious: (exports: unknown) => void;
+export declare const patchOracledb: (exports: unknown) => void;
+export declare const unpatchOracledb: (exports: unknown) => void;
+export declare const patchIbmDb: (exports: unknown) => void;
+export declare const unpatchIbmDb: (exports: unknown) => void;
+export declare const patchMongodb: (exports: unknown) => void;
+export declare const unpatchMongodb: (exports: unknown) => void;
+/** Inspect the cache only: resolving a driver never executes its code. */
+export declare function patchLoaded(): void;
+export declare function installDbHooks(): boolean;
+export declare function uninstallDbHooks(): void;
+export {};