shield360 1.0.1 → 1.2.0

package/dist/rasp/hooks/db.js

@@ -0,0 +1,322 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unpatchMongodb = exports.patchMongodb = exports.unpatchIbmDb = exports.patchIbmDb = exports.unpatchOracledb = exports.patchOracledb = exports.unpatchTedious = exports.patchTedious = exports.unpatchMssql = exports.patchMssql = exports.unpatchBetterSqlite3 = exports.patchBetterSqlite3 = exports.unpatchSqlite3 = exports.patchSqlite3 = exports.unpatchMysql = exports.patchMysql = exports.unpatchMysql2 = exports.patchMysql2 = exports.unpatchPg = exports.patchPg = exports.RaspDbInstrumentation = void 0;
+exports.patchLoaded = patchLoaded;
+exports.installDbHooks = installDbHooks;
+exports.uninstallDbHooks = uninstallDbHooks;
+/**
+ * Database sink hook (README "SQL", "NoSQL"): SQL text sent through pg,
+ * mysql2, mysql, sqlite3, better-sqlite3, mssql, tedious (SQL Server),
+ * oracledb (Oracle) and ibm_db (Db2), and MongoDB filter,
+ * update and pipeline documents, are checked for injection before the
+ * driver sends them. Drivers are hooked by name when the app loads them; no
+ * driver is imported. Drafted with ChatGPT, reviewed and adapted by the
+ * repository owner.
+ *
+ * Wrappers are RASP's own, not shimmer's: the SDK's tracing (and other
+ * OpenTelemetry instrumentations) wrap the same methods with shimmer, which
+ * unwraps whatever shimmer-wrapped method it finds. Kept apart, the two
+ * stack in either order and neither removes the other.
+ */
+const instrumentation_1 = require("@opentelemetry/instrumentation");
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const detect_1 = require("../detect");
+const types_1 = require("../types");
+const marks_1 = require("./marks");
+const esm_1 = require("./esm");
+const specs = {
+    pg: { version: '>=7', constructor: 'Client', methods: ['query'], dialect: 'postgres', field: 'text' },
+    mysql2: { version: '>=2', constructor: 'Connection', methods: ['query', 'execute'], dialect: 'mysql', field: 'sql' },
+    mysql: { version: '>=2', constructor: '', methods: ['query'], dialect: 'mysql', field: 'sql' },
+    sqlite3: { version: '>=5', constructor: 'Database', methods: ['run', 'get', 'all', 'each', 'exec', 'prepare'], dialect: 'sqlite' },
+    'better-sqlite3': { version: '>=7', constructor: '', methods: ['prepare', 'exec'], dialect: 'sqlite' },
+    // query and batch live on mssql's shared base Request, which the exported Request inherits.
+    mssql: { version: '>=6', constructor: 'Request', methods: ['query', 'batch', 'execute'], dialect: 'mssql',
+        handsTo: { query: 'tedious', batch: 'tedious', execute: 'tedious' },
+        // mssql prepares through sp_prepare (a tedious procedure call, not hooked), so its text is checked here.
+        also: { PreparedStatement: ['prepare'] } },
+    // tedious takes a Request built with the SQL text; mssql's default driver calls it too.
+    tedious: { version: '>=6', constructor: 'Connection', methods: ['execSql', 'execSqlBatch', 'prepare'], dialect: 'mssql', field: 'sqlTextOrProcedure' },
+    // queryStream runs this.execute on the next tick.
+    oracledb: { version: '>=4', constructor: 'Connection', methods: ['execute', 'executeMany', 'queryStream'], dialect: 'oracle',
+        handsTo: { queryStream: 'oracledb.execute' } },
+    // queryStream delegates to queryResult, so it is covered there.
+    ibm_db: { version: '>=2', constructor: 'Database', methods: [
+            'query', 'querySync', 'queryResult', 'queryResultSync', 'prepare', 'prepareSync',
+        ], dialect: 'db2', field: 'sql' },
+    mongodb: { version: '>=4', constructor: 'Collection', methods: [
+            'find', 'findOne', 'countDocuments', 'updateOne', 'updateMany', 'replaceOne',
+            'deleteOne', 'deleteMany', 'findOneAndUpdate', 'findOneAndDelete', 'findOneAndReplace', 'aggregate',
+        ] },
+};
+/**
+ * Text a call already checked and handed on (mssql -> tedious, oracledb
+ * queryStream -> execute), as `receiver\0text`, so the receiving call made
+ * later (asynchronously, with the same text) is not checked again: one check
+ * per call. Kept per RASP context, consumed by the receiver, at most 32.
+ */
+const handedOn = new WeakMap();
+let checking = false;
+// Suppress synchronous delegation, e.g. sqlite Database.get -> prepare.
+let depth = 0;
+function inspect(driver, method, values) {
+    if (checking || depth)
+        return;
+    try {
+        if (!(0, engine_1.isActive)())
+            return;
+        checking = true;
+        const ctx = (0, context_1.currentContext)();
+        if (!ctx)
+            return;
+        (0, engine_1.check)(`db.${driver}.${method}`, () => {
+            const inputs = (0, context_1.inputsOf)(ctx);
+            if (driver === 'mongodb') {
+                const docs = method === 'aggregate'
+                    ? Array.isArray(values[0]) ? values[0] : []
+                    : ['updateOne', 'updateMany', 'replaceOne', 'findOneAndUpdate', 'findOneAndReplace'].includes(method)
+                        ? [values[0], values[1]] : [values[0]];
+                for (const doc of docs) {
+                    const finding = (0, detect_1.detectNoSql)(doc, ctx.trees, inputs);
+                    if (finding)
+                        return finding;
+                }
+                return null;
+            }
+            const first = values[0];
+            const field = specs[driver].field;
+            const text = typeof first === 'string' ? first
+                : first && typeof first === 'object' && field ? first[field] : undefined;
+            if (typeof text !== 'string')
+                return null;
+            const seen = handedOn.get(ctx);
+            if (seen) {
+                let at = seen.indexOf(`${driver}.${method}\0${text}`);
+                if (at < 0)
+                    at = seen.indexOf(`${driver}\0${text}`);
+                if (at >= 0) {
+                    seen.splice(at, 1);
+                    return null;
+                }
+            }
+            const finding = (0, detect_1.detectSql)(text, inputs, specs[driver].dialect);
+            const receiver = specs[driver].handsTo?.[method];
+            if (receiver) {
+                const list = seen ?? [];
+                if (list.length >= 32)
+                    list.shift();
+                list.push(`${receiver}\0${text}`);
+                handedOn.set(ctx, list);
+            }
+            return finding;
+        });
+    }
+    catch (error) {
+        if (error instanceof types_1.RaspBlockedError)
+            throw error;
+    }
+    finally {
+        checking = false;
+    }
+}
+const registry = new Map();
+/** The prototype in the chain that defines `method` itself (mssql's Request inherits query from its base). */
+function ownerOf(proto, method) {
+    for (let p = proto; p && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+        if (Object.prototype.hasOwnProperty.call(p, method))
+            return p;
+    }
+    return undefined;
+}
+function wrapMethods(driver, exported, list = specs[driver].methods) {
+    for (const method of list) {
+        const proto = ownerOf(exported, method);
+        if (!proto)
+            continue;
+        let methods = registry.get(proto);
+        if (!methods)
+            registry.set(proto, (methods = new Map()));
+        const descriptor = Object.getOwnPropertyDescriptor(proto, method);
+        const current = descriptor?.value;
+        if (typeof current !== 'function')
+            continue;
+        const known = methods.get(method);
+        if (known) {
+            // Patched again (a reload, or the app loaded the driver after patchLoaded): turn it back on.
+            known.on = true;
+            continue;
+        }
+        const entry = { original: current, wrapper: current, on: true };
+        const wrapper = function (...values) {
+            if (entry.on)
+                inspect(driver, method, values);
+            depth++;
+            try {
+                return Reflect.apply(current, this, values);
+            }
+            finally {
+                depth--;
+            }
+        };
+        for (const key of Reflect.ownKeys(current)) {
+            if (key !== 'prototype')
+                Object.defineProperty(wrapper, key, Object.getOwnPropertyDescriptor(current, key));
+        }
+        entry.wrapper = wrapper;
+        (0, marks_1.markRaspWrapper)(wrapper);
+        Object.defineProperty(proto, method, { ...descriptor, value: wrapper });
+        methods.set(method, entry);
+    }
+}
+function restoreMethods(proto) {
+    const methods = registry.get(proto);
+    if (!methods)
+        return;
+    for (const [method, entry] of methods) {
+        entry.on = false;
+        // Put the original back only while ours is on top; under another
+        // wrapper (tracing patched after RASP) ours stays, switched off.
+        if (proto[method] === entry.wrapper) {
+            const descriptor = Object.getOwnPropertyDescriptor(proto, method);
+            Object.defineProperty(proto, method, { ...descriptor, value: entry.original });
+            methods.delete(method);
+        }
+    }
+    if (!methods.size)
+        registry.delete(proto);
+}
+class RaspDbInstrumentation extends instrumentation_1.InstrumentationBase {
+    constructor() { super('shield360/instrumentation-rasp-db', '1.0.0', { enabled: false }); }
+    init() {
+        return Object.keys(specs).map(driver => {
+            const versions = [specs[driver].version];
+            if (driver === 'mysql')
+                return new instrumentation_1.InstrumentationNodeModuleDefinition(driver, versions, undefined, undefined, [
+                    new instrumentation_1.InstrumentationNodeModuleFile('mysql/lib/Connection.js', versions, exports => { this.patch(driver, exports); return exports; }, exports => this.unpatch(driver, exports)),
+                ]);
+            return new instrumentation_1.InstrumentationNodeModuleDefinition(driver, versions, exports => { this.patch(driver, (0, esm_1.moduleExports)(exports)); return exports; }, exports => this.unpatch(driver, (0, esm_1.moduleExports)(exports)));
+        });
+    }
+    patch(driver, exports) {
+        try {
+            const spec = specs[driver];
+            const ctor = spec.constructor ? exports?.[spec.constructor] : exports;
+            const proto = ctor?.prototype;
+            if (proto)
+                wrapMethods(driver, proto);
+            for (const [name, methods] of Object.entries(spec.also ?? {})) {
+                const other = exports?.[name]?.prototype;
+                if (other)
+                    wrapMethods(driver, other, methods);
+            }
+        }
+        catch { /* Optional or unsupported driver shape: leave it alone. */ }
+    }
+    unpatch(driver, exports) {
+        try {
+            const spec = specs[driver];
+            const ctors = [spec.constructor ? exports?.[spec.constructor] : exports,
+                ...Object.keys(spec.also ?? {}).map(name => exports?.[name])];
+            for (const ctor of ctors) {
+                const proto = ctor?.prototype;
+                for (let p = proto ?? null; p && p !== Object.prototype; p = Object.getPrototypeOf(p)) {
+                    restoreMethods(p);
+                }
+            }
+        }
+        catch { /* Fail open during driver unload. */ }
+    }
+    restoreAll() {
+        for (const proto of [...registry.keys()])
+            restoreMethods(proto);
+    }
+}
+exports.RaspDbInstrumentation = RaspDbInstrumentation;
+let manual;
+let active;
+const patcher = () => manual ?? (manual = new RaspDbInstrumentation());
+const patchPg = (exports) => patcher().patch('pg', exports);
+exports.patchPg = patchPg;
+const unpatchPg = (exports) => manual?.unpatch('pg', exports);
+exports.unpatchPg = unpatchPg;
+const patchMysql2 = (exports) => patcher().patch('mysql2', exports);
+exports.patchMysql2 = patchMysql2;
+const unpatchMysql2 = (exports) => manual?.unpatch('mysql2', exports);
+exports.unpatchMysql2 = unpatchMysql2;
+const patchMysql = (exports) => patcher().patch('mysql', exports);
+exports.patchMysql = patchMysql;
+const unpatchMysql = (exports) => manual?.unpatch('mysql', exports);
+exports.unpatchMysql = unpatchMysql;
+const patchSqlite3 = (exports) => patcher().patch('sqlite3', exports);
+exports.patchSqlite3 = patchSqlite3;
+const unpatchSqlite3 = (exports) => manual?.unpatch('sqlite3', exports);
+exports.unpatchSqlite3 = unpatchSqlite3;
+const patchBetterSqlite3 = (exports) => patcher().patch('better-sqlite3', exports);
+exports.patchBetterSqlite3 = patchBetterSqlite3;
+const unpatchBetterSqlite3 = (exports) => manual?.unpatch('better-sqlite3', exports);
+exports.unpatchBetterSqlite3 = unpatchBetterSqlite3;
+const patchMssql = (exports) => patcher().patch('mssql', exports);
+exports.patchMssql = patchMssql;
+const unpatchMssql = (exports) => manual?.unpatch('mssql', exports);
+exports.unpatchMssql = unpatchMssql;
+const patchTedious = (exports) => patcher().patch('tedious', exports);
+exports.patchTedious = patchTedious;
+const unpatchTedious = (exports) => manual?.unpatch('tedious', exports);
+exports.unpatchTedious = unpatchTedious;
+const patchOracledb = (exports) => patcher().patch('oracledb', exports);
+exports.patchOracledb = patchOracledb;
+const unpatchOracledb = (exports) => manual?.unpatch('oracledb', exports);
+exports.unpatchOracledb = unpatchOracledb;
+const patchIbmDb = (exports) => patcher().patch('ibm_db', exports);
+exports.patchIbmDb = patchIbmDb;
+const unpatchIbmDb = (exports) => manual?.unpatch('ibm_db', exports);
+exports.unpatchIbmDb = unpatchIbmDb;
+const patchMongodb = (exports) => patcher().patch('mongodb', exports);
+exports.patchMongodb = patchMongodb;
+const unpatchMongodb = (exports) => manual?.unpatch('mongodb', exports);
+exports.unpatchMongodb = unpatchMongodb;
+/** Inspect the cache only: resolving a driver never executes its code. */
+function patchLoaded() {
+    for (const driver of Object.keys(specs)) {
+        try {
+            const id = require.resolve(driver === 'mysql' ? 'mysql/lib/Connection.js' : driver);
+            const cached = require.cache[id];
+            if (cached)
+                (active ?? patcher()).patch(driver, cached.exports);
+        }
+        catch { /* Driver absent or not resolvable from the SDK. */ }
+    }
+}
+function installDbHooks() {
+    if (active)
+        return true;
+    let instance;
+    try {
+        instance = new RaspDbInstrumentation();
+        instance.enable();
+        active = instance;
+        patchLoaded();
+        return true;
+    }
+    catch {
+        try {
+            instance?.disable();
+            instance?.restoreAll();
+        }
+        catch { /* Never throw. */ }
+        active = undefined;
+        return false;
+    }
+}
+function uninstallDbHooks() {
+    try {
+        active?.disable();
+    }
+    finally {
+        active?.restoreAll();
+        manual?.restoreAll();
+        active = undefined;
+    }
+}
+//# sourceMappingURL=db.js.map

package/dist/rasp/hooks/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/rasp/hooks/db.ts"],"names":[],"mappings":";;;AAoQA,kCAQC;AAED,wCAcC;AACD,4CAMC;AAnSD;;;;;;;;;;;;;GAaG;AACH,oEAGwC;AACxC,wCAAsD;AACtD,sCAA4C;AAC5C,sCAAmD;AAEnD,oCAA4C;AAC5C,mCAA0C;AAC1C,+BAAsC;AAmBtC,MAAM,KAAK,GAAyB;IAClC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;IACrG,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;IACpH,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;IAC9F,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IAClI,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IACtG,4FAA4F;IAC5F,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO;QACvG,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;QACnE,yGAAyG;QACzG,IAAI,EAAE,EAAE,iBAAiB,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE;IAC5C,wFAAwF;IACxF,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACtJ,kDAAkD;IAClD,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,QAAQ;QAC1H,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE;IAChD,gEAAgE;IAChE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE;YAC1D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa;SACjF,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;IACjC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE;YAC7D,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY;YAC5E,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,WAAW;SACpG,EAAE;CACJ,CAAC;AACF;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAoB,CAAC;AACjD,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,wEAAwE;AACxE,IAAI,KAAK,GAAG,CAAC,CAAC;AAEd,SAAS,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,MAAiB;IAChE,IAAI,QAAQ,IAAI,KAAK;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO;QACxB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAA,cAAK,EAAC,MAAM,MAAM,IAAI,MAAM,EAAE,EAAE,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,MAAM,KAAK,WAAW;oBACjC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;oBAC3C,CAAC,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;wBACnG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,OAAO,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBACpD,IAAI,OAAO;wBAAE,OAAO,OAAO,CAAC;gBAC9B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC;YAClC,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK;gBAC5C,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAE,KAAiC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxG,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;gBACtD,IAAI,EAAE,GAAG,CAAC;oBAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;gBACpD,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAC;gBAAC,CAAC;YACnD,CAAC;YACD,MAAM,OAAO,GAAG,IAAA,kBAAS,EAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE;oBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,wBAAgB;YAAE,MAAM,KAAK,CAAC;IACrD,CAAC;YAAS,CAAC;QAAC,QAAQ,GAAG,KAAK,CAAC;IAAC,CAAC;AACjC,CAAC;AAID,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;AAE5D,8GAA8G;AAC9G,SAAS,OAAO,CAAC,KAAgB,EAAE,MAAc;IAC/C,KAAK,IAAI,CAAC,GAAqB,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAqB,EAAE,CAAC;QACpH,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,QAAmB,EAAE,OAAiB,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO;IAC9F,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,UAAU,EAAE,KAAK,CAAC;QAClC,IAAI,OAAO,OAAO,KAAK,UAAU;YAAE,SAAS;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,CAAC;YACV,6FAA6F;YAC7F,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,UAAyB,GAAG,MAAiB;YAC3D,IAAI,KAAK,CAAC,EAAE;gBAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9C,KAAK,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,KAAK,WAAW;gBAAE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAE,CAAC,CAAC;QAC/G,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC;QACjB,iEAAiE;QACjE,iEAAiE;QACjE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAE,CAAC;YACnE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAa,qBAAsB,SAAQ,qCAAmB;IAC5D,gBAAgB,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhF,IAAI;QACZ,OAAQ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YACnD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,IAAI,qDAAmC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE;oBAC7G,IAAI,+CAA6B,CAAC,yBAAyB,EAAE,QAAQ,EACnE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;iBACzG,CAAC,CAAC;YACH,OAAO,IAAI,qDAAmC,CAAC,MAAM,EAAE,QAAQ,EAC7D,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAA,mBAAa,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAA,mBAAa,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzI,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,MAAc,EAAE,OAAgB;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,OAAmC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACnG,MAAM,KAAK,GAAI,IAA8C,EAAE,SAAS,CAAC;YACzE,IAAI,KAAK;gBAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAK,OAAmC,EAAE,CAAC,IAAI,CAA2C,EAAE,SAAS,CAAC;gBACjH,IAAI,KAAK;oBAAE,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,2DAA2D,CAAC,CAAC;IACzE,CAAC;IAEM,OAAO,CAAC,MAAc,EAAE,OAAgB;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,OAAmC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;gBAClG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAE,OAAmC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAI,IAA8C,EAAE,SAAS,CAAC;gBACzE,KAAK,IAAI,CAAC,GAAqB,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAqB,EAAE,CAAC;oBAC5H,cAAc,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACnD,CAAC;IAEM,UAAU;QACf,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;CACF;AA7CD,sDA6CC;AAED,IAAI,MAAyC,CAAC;AAC9C,IAAI,MAAyC,CAAC;AAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC,CAAC;AAChE,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAArE,QAAA,OAAO,WAA8D;AAC3E,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAAvE,QAAA,SAAS,aAA8D;AAC7E,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAA7E,QAAA,WAAW,eAAkE;AACnF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAA/E,QAAA,aAAa,iBAAkE;AACrF,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAA3E,QAAA,UAAU,cAAiE;AACjF,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAA7E,QAAA,YAAY,gBAAiE;AACnF,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAA/E,QAAA,YAAY,gBAAmE;AACrF,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAAjF,QAAA,cAAc,kBAAmE;AACvF,MAAM,kBAAkB,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAA5F,QAAA,kBAAkB,sBAA0E;AAClG,MAAM,oBAAoB,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;AAA9F,QAAA,oBAAoB,wBAA0E;AACpG,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAA3E,QAAA,UAAU,cAAiE;AACjF,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAA7E,QAAA,YAAY,gBAAiE;AACnF,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAA/E,QAAA,YAAY,gBAAmE;AACrF,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAAjF,QAAA,cAAc,kBAAmE;AACvF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAjF,QAAA,aAAa,iBAAoE;AACvF,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAAnF,QAAA,eAAe,mBAAoE;AACzF,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAA5E,QAAA,UAAU,cAAkE;AAClF,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAA9E,QAAA,YAAY,gBAAkE;AACpF,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAA/E,QAAA,YAAY,gBAAmE;AACrF,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAAjF,QAAA,cAAc,kBAAmE;AAE9F,0EAA0E;AAC1E,SAAgB,WAAW;IACzB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAa,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,MAAM;gBAAE,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC,CAAC,mDAAmD,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAgB,cAAc;IAC5B,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,QAA2C,CAAC;IAChD,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACvC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,GAAG,QAAQ,CAAC;QAClB,WAAW,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACjF,MAAM,GAAG,SAAS,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,SAAgB,gBAAgB;IAC9B,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QAClC,MAAM,EAAE,UAAU,EAAE,CAAC;QACrB,MAAM,EAAE,UAAU,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/rasp/hooks/esm.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A package the app `import`s reaches an instrumentation through the ESM loader hook as its module
+ * namespace. For a CommonJS package the exports object the hooks patch is the namespace's
+ * `default` (its named exports are only what Node's static scan found: none for pg's
+ * `module.exports = new PG()`), so the hooks patch that.
+ */
+export declare function moduleExports(exports: unknown): unknown;

package/dist/rasp/hooks/esm.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.moduleExports = moduleExports;
+/**
+ * A package the app `import`s reaches an instrumentation through the ESM loader hook as its module
+ * namespace. For a CommonJS package the exports object the hooks patch is the namespace's
+ * `default` (its named exports are only what Node's static scan found: none for pg's
+ * `module.exports = new PG()`), so the hooks patch that.
+ */
+function moduleExports(exports) {
+    if (exports && typeof exports === 'object' && exports[Symbol.toStringTag] === 'Module') {
+        const def = exports.default;
+        if (def && (typeof def === 'object' || typeof def === 'function'))
+            return def;
+    }
+    return exports;
+}
+//# sourceMappingURL=esm.js.map

package/dist/rasp/hooks/esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"esm.js","sourceRoot":"","sources":["../../../src/rasp/hooks/esm.ts"],"names":[],"mappings":";;AAMA,sCAMC;AAZD;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,OAAgB;IAC5C,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAK,OAAmC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpH,MAAM,GAAG,GAAI,OAAiC,CAAC,OAAO,CAAC;QACvD,IAAI,GAAG,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,UAAU,CAAC;YAAE,OAAO,GAAG,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/rasp/hooks/fs.d.ts

@@ -0,0 +1,3 @@
+/** Idempotent; a failed installation restores every replaced descriptor. */
+export declare function installFsHooks(): boolean;
+export declare function uninstallFsHooks(): void;

package/dist/rasp/hooks/fs.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installFsHooks = installFsHooks;
+exports.uninstallFsHooks = uninstallFsHooks;
+/**
+ * fs sink hook (README "Path"): reads, writes, deletes, renames, copies and
+ * directory listings on `fs` and `fs.promises` are checked for path
+ * traversal and script writes before the call. Install before application
+ * modules capture bindings. Drafted with ChatGPT, reviewed and adapted by
+ * the repository owner.
+ *
+ * Node calls its own public functions inside some of these (`readFileSync`
+ * opens through `fs.openSync`, streams open through `fs.open` later), so a
+ * path is checked once: calls made while a synchronous fs call runs are
+ * Node's and are skipped, and within a request a path already checked for
+ * the same kind of access is not checked again.
+ */
+const fs = require("fs");
+const module_1 = require("module");
+const url_1 = require("url");
+const util_1 = require("util");
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const detect_1 = require("../detect");
+const types_1 = require("../types");
+const operations = {
+    readFile: 'read', readFileSync: 'read', createReadStream: 'read',
+    open: 'open', openSync: 'open',
+    writeFile: 'write', writeFileSync: 'write', createWriteStream: 'write',
+    appendFile: 'append', appendFileSync: 'append',
+    unlink: 'delete', unlinkSync: 'delete', rm: 'delete', rmSync: 'delete',
+    rename: 'rename', renameSync: 'rename', readdir: 'list', readdirSync: 'list',
+    copyFile: 'read', copyFileSync: 'read',
+};
+let installed;
+/** Bumped by every install and uninstall: a wrapper checks only while its generation is current. */
+let generation = 0;
+let checking = false;
+/** Depth of synchronous fs calls in progress: anything nested is Node's own. */
+let syncDepth = 0;
+/** Per request: paths already checked, by kind of access (capped). */
+const seen = new WeakMap();
+const SEEN_MAX = 256;
+const accessOf = (op) => (op === 'append' || op === 'open' ? 'write' : op);
+const seenKey = (path, op) => `${accessOf(op)}\u0000${path}`;
+/** True when this request already checked this path for this kind of access. */
+function seenBefore(ctx, path, op) {
+    return Boolean(ctx && seen.get(ctx)?.has(seenKey(path, op)));
+}
+/** Records that this request checked this path for this kind of access. */
+function markSeen(ctx, path, op) {
+    if (!ctx)
+        return;
+    let set = seen.get(ctx);
+    if (!set)
+        seen.set(ctx, (set = new Set()));
+    if (set.size < SEEN_MAX)
+        set.add(seenKey(path, op));
+}
+function pathString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Buffer.isBuffer(value))
+        return value.toString();
+    if (value instanceof URL && value.protocol === 'file:')
+        return (0, url_1.fileURLToPath)(value);
+    return undefined;
+}
+function openOp(flags) {
+    if (flags === undefined)
+        return 'read';
+    if (typeof flags === 'string')
+        return /[wa+]/.test(flags) ? 'write' : 'read';
+    if (typeof flags === 'number') {
+        const c = fs.constants;
+        return flags & (c.O_WRONLY | c.O_RDWR | c.O_CREAT | c.O_TRUNC | c.O_APPEND) ? 'write' : 'read';
+    }
+    return 'read';
+}
+function inspect(api, values, promises) {
+    if (checking || syncDepth > 0)
+        return;
+    try {
+        if (!(0, engine_1.isActive)())
+            return;
+        checking = true;
+        (0, engine_1.check)(`fs.${promises ? 'promises.' : ''}${api}`, () => {
+            const ctx = (0, context_1.currentContext)();
+            const inputs = ctx ? (0, context_1.inputsOf)(ctx) : [];
+            const roots = (0, engine_1.allowLists)().fileRoots;
+            const inRequest = Boolean(ctx?.inRequest);
+            const op = operations[api] === 'open' ? openOp(values[1]) : operations[api];
+            const paths = [[pathString(values[0]), op]];
+            if (api === 'rename' || api === 'renameSync' || api === 'copyFile' || api === 'copyFileSync') {
+                paths.push([pathString(values[1]), api.startsWith('copyFile') ? 'write' : 'rename']);
+            }
+            const checks = [];
+            for (const [path, pathOp] of paths) {
+                if (path !== undefined && !seenBefore(ctx, path, pathOp)) {
+                    checks.push({ path, op: pathOp, finding: (0, detect_1.detectPath)(path, pathOp, inputs, roots, inRequest) });
+                }
+            }
+            // Both paths are checked; the strongest decision wins.
+            const winner = (0, engine_1.strongest)(...checks.map((c) => c.finding));
+            // A finding that lost to the winner was never applied: its path stays
+            // unmarked, so a later call on it in this request is checked again.
+            for (const c of checks)
+                if (!(winner && c.finding && c.finding !== winner))
+                    markSeen(ctx, c.path, c.op);
+            return winner;
+        });
+    }
+    catch (error) {
+        if (error instanceof types_1.RaspBlockedError)
+            throw error;
+    }
+    finally {
+        checking = false;
+    }
+}
+/**
+ * Ends this generation (every wrapper stops checking) and puts back the
+ * originals where RASP's wrapper is still the current value. A wrapper put
+ * on top later (tracing) stays, calling RASP's, which now only passes through.
+ */
+function restore(saved) {
+    generation++;
+    for (const entry of [...saved].reverse()) {
+        if (Object.getOwnPropertyDescriptor(entry.owner, entry.api)?.value === entry.wrapper) {
+            Object.defineProperty(entry.owner, entry.api, entry.descriptor);
+        }
+    }
+}
+/** Idempotent; a failed installation restores every replaced descriptor. */
+function installFsHooks() {
+    if (installed)
+        return true;
+    const saved = [];
+    const gen = ++generation;
+    try {
+        for (const [owner, promises] of [[fs, false], [fs.promises, true]]) {
+            for (const api of Object.keys(operations)) {
+                const descriptor = Object.getOwnPropertyDescriptor(owner, api);
+                if (!descriptor && promises)
+                    continue; // No synchronous or stream promise APIs.
+                if (!descriptor || typeof descriptor.value !== 'function')
+                    throw new TypeError(api);
+                const original = descriptor.value;
+                const sync = api.endsWith('Sync');
+                const wrapper = function (...values) {
+                    try {
+                        if (gen === generation)
+                            inspect(api, values, promises);
+                    }
+                    catch (error) {
+                        if (promises)
+                            return Promise.reject(error);
+                        throw error;
+                    }
+                    if (!sync)
+                        return Reflect.apply(original, this, values);
+                    syncDepth++;
+                    try {
+                        return Reflect.apply(original, this, values);
+                    }
+                    finally {
+                        syncDepth--;
+                    }
+                };
+                for (const key of Reflect.ownKeys(original)) {
+                    if (key === 'prototype' || key === util_1.promisify.custom)
+                        continue;
+                    Object.defineProperty(wrapper, key, Object.getOwnPropertyDescriptor(original, key));
+                }
+                const custom = Object.getOwnPropertyDescriptor(original, util_1.promisify.custom);
+                if (custom) {
+                    // Node's custom fs promisifiers (notably read/readv/write) return
+                    // named results. None of the covered APIs has that contract.
+                    const generic = (0, util_1.promisify)(wrapper);
+                    Object.defineProperty(wrapper, util_1.promisify.custom, { ...custom, value: generic });
+                }
+                Object.defineProperty(owner, api, { ...descriptor, value: wrapper });
+                saved.push({ owner, api, descriptor, wrapper });
+            }
+        }
+        (0, module_1.syncBuiltinESMExports)();
+        installed = saved;
+        return true;
+    }
+    catch {
+        restore(saved);
+        try {
+            (0, module_1.syncBuiltinESMExports)();
+        }
+        catch { /* Installation remains unsuccessful. */ }
+        return false;
+    }
+}
+function uninstallFsHooks() {
+    if (!installed)
+        return;
+    restore(installed);
+    installed = undefined;
+    (0, module_1.syncBuiltinESMExports)();
+}
+//# sourceMappingURL=fs.js.map

package/dist/rasp/hooks/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/rasp/hooks/fs.ts"],"names":[],"mappings":";;AA+HA,wCAkDC;AAED,4CAKC;AAxLD;;;;;;;;;;;;GAYG;AACH,yBAA0B;AAC1B,mCAA+C;AAC/C,6BAAoC;AACpC,+BAAiC;AACjC,wCAAwE;AACxE,sCAAmE;AACnE,sCAAoD;AACpD,oCAA0D;AAE1D,MAAM,UAAU,GAAG;IACjB,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM;IAChE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAC9B,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO;IACtE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ;IAC9C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;IACtE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAC5E,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CACG,CAAC;AAG5C,IAAI,SAA8B,CAAC;AACnC,oGAAoG;AACpG,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,gFAAgF;AAChF,IAAI,SAAS,GAAG,CAAC,CAAC;AAClB,sEAAsE;AACtE,MAAM,IAAI,GAAG,IAAI,OAAO,EAA4B,CAAC;AACrD,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE3F,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;AAE7E,gFAAgF;AAChF,SAAS,UAAU,CAAC,GAA4B,EAAE,IAAY,EAAE,EAAU;IACxE,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,GAA4B,EAAE,IAAY,EAAE,EAAU;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,IAAI,GAAG,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpD,IAAI,KAAK,YAAY,GAAG,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAA,mBAAa,EAAC,KAAK,CAAC,CAAC;IACpF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACvB,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,GAAQ,EAAE,MAAiB,EAAE,QAAiB;IAC7D,IAAI,QAAQ,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO;IACtC,IAAI,CAAC;QACH,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO;QACxB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAA,cAAK,EAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,EAAE;YACpD,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAA,mBAAU,GAAE,CAAC,SAAS,CAAC;YACrC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAmC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5E,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;gBAC7F,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,MAAM,GAA4D,EAAE,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACnC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;oBACzD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAA,mBAAU,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;YACD,uDAAuD;YACvD,MAAM,MAAM,GAAG,IAAA,kBAAS,EAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1D,sEAAsE;YACtE,oEAAoE;YACpE,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC;oBAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACxG,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,wBAAgB;YAAE,MAAM,KAAK,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAAc;IAC7B,UAAU,EAAE,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACrF,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAgB,cAAc;IAC5B,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAU,EAAE,CAAC;YAC5E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAU,EAAE,CAAC;gBACnD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC/D,IAAI,CAAC,UAAU,IAAI,QAAQ;oBAAE,SAAS,CAAC,yCAAyC;gBAChF,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;oBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;gBACpF,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAwC,CAAC;gBACrE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAG,UAAyB,GAAG,MAAiB;oBAC3D,IAAI,CAAC;wBACH,IAAI,GAAG,KAAK,UAAU;4BAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;oBACzD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,QAAQ;4BAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAC3C,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,IAAI,CAAC,IAAI;wBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;oBACxD,SAAS,EAAE,CAAC;oBACZ,IAAI,CAAC;wBACH,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC/C,CAAC;4BAAS,CAAC;wBACT,SAAS,EAAE,CAAC;oBACd,CAAC;gBACH,CAAC,CAAC;gBACF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,gBAAS,CAAC,MAAM;wBAAE,SAAS;oBAC9D,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,GAAG,CAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,gBAAS,CAAC,MAAM,CAAC,CAAC;gBAC3E,IAAI,MAAM,EAAE,CAAC;oBACX,kEAAkE;oBAClE,6DAA6D;oBAC7D,MAAM,OAAO,GAAG,IAAA,gBAAS,EAAC,OAAO,CAAC,CAAC;oBACnC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,gBAAS,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAA,8BAAqB,GAAE,CAAC;QACxB,SAAS,GAAG,KAAK,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,IAAI,CAAC;YAAC,IAAA,8BAAqB,GAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wCAAwC,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB;IAC9B,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,OAAO,CAAC,SAAS,CAAC,CAAC;IACnB,SAAS,GAAG,SAAS,CAAC;IACtB,IAAA,8BAAqB,GAAE,CAAC;AAC1B,CAAC"}

package/dist/rasp/hooks/http.d.ts

@@ -0,0 +1,4 @@
+export declare function installHttpHooks(opts: {
+    alwaysAllowedHosts: string[];
+}): boolean;
+export declare function uninstallHttpHooks(): void;