shield360 1.1.0 → 1.2.0

package/dist/rasp/capture.js

@@ -0,0 +1,304 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VP_SINK = exports.INPUT_HEADERS = void 0;
+exports.uploadNames = uploadNames;
+exports.lowerHeaders = lowerHeaders;
+exports.captureRequest = captureRequest;
+exports.bodyAbsent = bodyAbsent;
+exports.captureNoBody = captureNoBody;
+exports.captureBody = captureBody;
+exports.runVirtualPatches = runVirtualPatches;
+exports.runRequestRules = runRequestRules;
+exports.captureLater = captureLater;
+/**
+ * Request capture shared by every framework middleware: turns a request into
+ * the context's inputs (README "Sources of untrusted input") and runs the
+ * virtual patches. Inputs stay in memory, in the request's context only.
+ */
+const context_1 = require("./context");
+const detect_1 = require("./detect");
+const custom_rules_1 = require("./custom-rules");
+const engine_1 = require("./engine");
+const normalize_1 = require("./normalize");
+const types_1 = require("./types");
+const vpatch_1 = require("./vpatch");
+/** Headers the contract treats as input (OpenRASP's headerInjection). */
+exports.INPUT_HEADERS = ['user-agent', 'referer', 'x-forwarded-for'];
+exports.VP_SINK = 'server.request';
+const MAX_UPLOAD_SCAN = 1024 * 1024;
+const MAX_UPLOADS = 32;
+const PART_FILENAME = /content-disposition:[^\r\n]*?\bname="([^"\r\n]*)"[^\r\n]*?\bfilename="([^"\r\n]*)"/gi;
+/** The names of uploaded files: from raw multipart part headers, or a parser's file objects. */
+function uploadNames(b, raw) {
+    const out = [];
+    const ct = (b.contentType || '').toLowerCase();
+    if (raw && ct.includes('multipart/form-data')) {
+        for (const m of raw.slice(0, MAX_UPLOAD_SCAN).matchAll(PART_FILENAME)) {
+            if (out.length >= MAX_UPLOADS)
+                break;
+            if (m[2])
+                out.push({ field: m[1] || 'file', name: m[2] });
+        }
+    }
+    const visit = (f, field) => {
+        if (out.length >= MAX_UPLOADS || !f || typeof f !== 'object')
+            return;
+        const o = f;
+        const name = [o.originalname, o.originalFilename, o.filename, o.name].find((v) => typeof v === 'string' && v);
+        if (typeof name === 'string')
+            out.push({ field: typeof o.fieldname === 'string' ? o.fieldname : field, name });
+    };
+    const files = b.files;
+    if (Array.isArray(files))
+        files.forEach((f) => visit(f, 'file'));
+    else if (files && typeof files === 'object') {
+        const one = files;
+        if (typeof one.originalname === 'string' || typeof one.fieldname === 'string')
+            visit(files, 'file');
+        else
+            for (const [field, v] of Object.entries(one))
+                (Array.isArray(v) ? v : [v]).forEach((f) => visit(f, field));
+    }
+    return out;
+}
+/**
+ * Runs fn with ctx as the current context. Capture runs before the entry
+ * point enters the request's context, and the checks it makes (virtual
+ * patches, request rules, uploads) report findings that custom finding rules
+ * judge with the current request's fields.
+ */
+function inContext(ctx, fn) {
+    return (0, context_1.currentContext)() === ctx ? fn() : context_1.storage.run(ctx, fn);
+}
+/** Records uploaded file names as request input and checks each (file_write.upload). Throws the block error when blocking. */
+function captureUploads(ctx, b, raw) {
+    for (const { field, name } of uploadNames(b, raw)) {
+        const key = `body.${field}.filename`;
+        (0, normalize_1.addInput)(ctx.inputs, name, key);
+        inContext(ctx, () => (0, engine_1.check)('request.upload', () => (0, detect_1.detectUpload)({ value: name, key, source: 'request' })));
+    }
+}
+const header = (h, name) => {
+    const v = h[name];
+    return v === undefined ? '' : Array.isArray(v) ? v.join(', ') : String(v);
+};
+function splitUrl(url) {
+    const q = url.indexOf('?');
+    const hash = url.indexOf('#');
+    const end = hash >= 0 ? hash : url.length;
+    return q >= 0 && q < end ? { path: url.slice(0, q), query: url.slice(q + 1, end) } : { path: url.slice(0, end), query: '' };
+}
+/** Lower-cases header names (Node already does; other sources may not). */
+function lowerHeaders(h) {
+    const out = {};
+    if (!h || typeof h !== 'object')
+        return out;
+    for (const [k, v] of Object.entries(h)) {
+        if (typeof v === 'string' || Array.isArray(v))
+            out[k.toLowerCase()] = v;
+        else if (v != null)
+            out[k.toLowerCase()] = String(v);
+    }
+    return out;
+}
+/** Builds the request's context: query, params, cookies, the input headers. */
+function captureRequest(shape) {
+    const { path, query } = splitUrl(shape.url || '/');
+    const ctx = (0, context_1.newContext)({ inRequest: true, method: shape.method, path, route: shape.route, framework: shape.framework });
+    if (typeof shape.ip === 'string' && shape.ip)
+        ctx.ip = shape.ip;
+    const inputs = ctx.inputs;
+    if (shape.query && typeof shape.query === 'object') {
+        (0, normalize_1.flatten)(inputs, shape.query, 'query');
+        ctx.trees.push(shape.query);
+    }
+    else if (query) {
+        const tree = {};
+        for (const [k, v] of new URLSearchParams(query)) {
+            (0, normalize_1.addInput)(inputs, v, `query.${k}`);
+            const prev = tree[k];
+            tree[k] = prev === undefined ? v : Array.isArray(prev) ? [...prev, v] : [prev, v];
+        }
+        ctx.trees.push(tree);
+    }
+    if (shape.params && typeof shape.params === 'object')
+        (0, normalize_1.flatten)(inputs, shape.params, 'params');
+    const cookie = header(shape.headers, 'cookie');
+    for (const [name, value] of (0, normalize_1.parseCookies)(cookie))
+        (0, normalize_1.addInput)(inputs, value, `cookie.${name}`);
+    for (const h of exports.INPUT_HEADERS) {
+        const v = header(shape.headers, h);
+        if (v)
+            (0, normalize_1.addInput)(inputs, v, `header.${h}`);
+    }
+    // SHIELD: inside the zero-code capture's context, the phases it already judged are not judged again,
+    // and its custom-rule state carries over, so a rule matches at most once per request.
+    const auto = (0, context_1.currentContext)()?.auto ? (0, context_1.currentContext)() : undefined;
+    ctx.vp = {
+        req: { method: shape.method, path, query, headers: shape.headers, cookie, body: '' },
+        bodyKnown: false,
+        ranHead: Boolean(auto?.vp?.ranHead),
+        ranBody: Boolean(auto?.vp?.ranBody),
+    };
+    if (auto?.rules)
+        ctx.rules = auto.rules;
+    return ctx;
+}
+/**
+ * Whether the request has no body, by its headers: neither `Transfer-Encoding`
+ * nor a non-zero `Content-Length` (HTTP/1.x; body parsers use the same test).
+ * Over HTTP/2 a body needs no length, so only `Content-Length: 0` says so.
+ */
+function bodyAbsent(h, httpVersionMajor) {
+    if (h['transfer-encoding'] !== undefined)
+        return false;
+    const len = header(h, 'content-length').trim();
+    if (len === '0')
+        return true;
+    return len === '' && !(typeof httpVersionMajor === 'number' && httpVersionMajor >= 2);
+}
+/** Records that the request has no body: the body is known and empty, so the body phase runs. */
+function captureNoBody(ctx) {
+    if (ctx.vp)
+        ctx.vp.bodyKnown = true;
+}
+function isFormType(ct) {
+    return ct.includes('application/x-www-form-urlencoded');
+}
+/**
+ * Adds the body to the context: string leaves of a parsed body (`body.a.b`),
+ * form fields, or the raw text when it is text, unparsed and at most 8 KiB.
+ * Also gives the virtual patches the body text.
+ */
+function captureBody(ctx, b) {
+    const body = b.body;
+    if (body === undefined || body === null)
+        return;
+    // Inputs added from here on are body inputs: head rules never see them.
+    ctx.headInputs ?? (ctx.headInputs = ctx.inputs.length);
+    const ct = (b.contentType || '').toLowerCase();
+    let raw = '';
+    if (typeof body === 'string' || Buffer.isBuffer(body) || body instanceof Uint8Array) {
+        raw = typeof body === 'string' ? body : Buffer.from(body).toString('utf8');
+        let parsed;
+        if (ct.includes('json')) {
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                parsed = undefined;
+            }
+        }
+        else if (isFormType(ct)) {
+            const tree = {};
+            for (const [k, v] of new URLSearchParams(raw.slice(0, 1024 * 1024)))
+                tree[k] = v;
+            parsed = tree;
+        }
+        if (parsed !== undefined && parsed !== null && typeof parsed === 'object') {
+            (0, normalize_1.flatten)(ctx.inputs, parsed, 'body');
+            ctx.trees.push(parsed);
+        }
+        else if (raw.length <= normalize_1.MAX_RAW_BODY) {
+            (0, normalize_1.addInput)(ctx.inputs, raw, 'body');
+        }
+    }
+    else if (typeof body === 'object') {
+        (0, normalize_1.flatten)(ctx.inputs, body, 'body');
+        ctx.trees.push(body);
+        try {
+            raw = JSON.stringify(body) ?? '';
+        }
+        catch {
+            raw = '';
+        }
+    }
+    if (ctx.vp) {
+        ctx.vp.req.body = raw.length > vpatch_1.MAX_VP_TEXT ? raw.slice(0, vpatch_1.MAX_VP_TEXT) : raw;
+        ctx.vp.bodyKnown = true;
+    }
+    captureUploads(ctx, b, raw);
+}
+/**
+ * Runs the virtual patches the request can be judged by so far: rules that
+ * do not read the body at once, rules that do once the body is known. Each
+ * rule set runs once. Throws the block error when a blocking rule matches;
+ * any other failure lets the request through.
+ */
+function runVirtualPatches(ctx) {
+    inContext(ctx, () => runPhases(ctx));
+}
+function runPhases(ctx) {
+    const vp = ctx.vp;
+    if (!vp)
+        return;
+    const phases = [];
+    if (!vp.ranHead) {
+        vp.ranHead = true;
+        phases.push('head');
+    }
+    if (vp.bodyKnown && !vp.ranBody) {
+        vp.ranBody = true;
+        phases.push('body');
+    }
+    for (const phase of phases) {
+        let finding = null;
+        try {
+            finding = (0, vpatch_1.matchVirtualPatches)(vp.req, (0, engine_1.virtualPatches)(), phase);
+        }
+        catch {
+            finding = null;
+        }
+        // A monitored match is reported and the next phase still runs; a blocked one throws.
+        if (finding)
+            (0, engine_1.handleFinding)(finding, exports.VP_SINK, { framework: ctx.framework, route: ctx.route, method: ctx.method, path: ctx.path });
+        runRequestRules(ctx, phase);
+    }
+}
+/**
+ * Custom request rules (README "Custom rules"): each match is reported in
+ * order; the first that blocks throws the block error. Any other failure
+ * lets the request through.
+ */
+function runRequestRules(ctx, phase) {
+    let matches;
+    try {
+        const rules = (0, engine_1.customRules)();
+        // Mode off skips custom rules: nothing is evaluated.
+        if (!rules.length || (0, engine_1.modeFor)('custom_rule') === 'off')
+            return;
+        const inputs = phase === 'head' && ctx.headInputs !== undefined ? ctx.inputs.slice(0, ctx.headInputs) : ctx.inputs;
+        matches = (0, custom_rules_1.matchRequestRules)(rules, ctx, phase, (0, custom_rules_1.requestSubject)(ctx, (0, engine_1.applicationName)(), inputs));
+    }
+    catch {
+        return;
+    }
+    const extra = { framework: ctx.framework, route: ctx.route, method: ctx.method, path: ctx.path };
+    for (const m of matches)
+        (0, engine_1.handleFinding)((0, custom_rules_1.customFinding)(m.rule, m.input), exports.VP_SINK, extra);
+}
+/**
+ * Sets up late body capture: when a sink first reads the inputs, a body a
+ * parser set after the middleware ran is captured and judged.
+ */
+function captureLater(ctx, read) {
+    if (ctx.vp?.bodyKnown)
+        return;
+    ctx.late = () => {
+        try {
+            const b = read();
+            if (!b || b.body === undefined || b.body === null)
+                return false;
+            captureBody(ctx, b);
+        }
+        catch (e) {
+            // An upload check that blocks stops the call; any other failure lets it through.
+            if (e instanceof types_1.RaspBlockedError)
+                throw e;
+            return true;
+        }
+        runVirtualPatches(ctx);
+        return true;
+    };
+}
+//# sourceMappingURL=capture.js.map

package/dist/rasp/capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.js","sourceRoot":"","sources":["../../src/rasp/capture.ts"],"names":[],"mappings":";;;AAmDA,kCAuBC;AAkCD,oCAQC;AAGD,wCAmCC;AAOD,gCAKC;AAGD,sCAEC;AAWD,kCAyCC;AAQD,8CAEC;AAgCD,0CAaC;AAMD,oCAeC;AA3SD;;;;GAIG;AACH,uCAAkF;AAClF,qCAAwC;AACxC,iDAAkF;AAClF,qCAAuG;AACvG,2CAA4E;AAC5E,mCAA2C;AAC3C,qCAA4E;AAE5E,yEAAyE;AAC5D,QAAA,aAAa,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,iBAAiB,CAAU,CAAC;AACtE,QAAA,OAAO,GAAG,gBAAgB,CAAC;AA+BxC,MAAM,eAAe,GAAG,IAAI,GAAG,IAAI,CAAC;AACpC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,aAAa,GAAG,sFAAsF,CAAC;AAE7G,gGAAgG;AAChG,SAAgB,WAAW,CAAC,CAAY,EAAE,GAAW;IACnD,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,CAAC,MAAM,IAAI,WAAW;gBAAE,MAAM;YACrC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,KAAa,EAAE,EAAE;QAC1C,IAAI,GAAG,CAAC,MAAM,IAAI,WAAW,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO;QACrE,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;QAC9G,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;SAC5D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;YAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;;YAC/F,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAI,GAAgB,EAAE,EAAW;IACjD,OAAO,IAAA,wBAAc,GAAE,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,8HAA8H;AAC9H,SAAS,cAAc,CAAC,GAAgB,EAAE,CAAY,EAAE,GAAW;IACjE,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,QAAQ,KAAK,WAAW,CAAC;QACrC,IAAA,oBAAQ,EAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAA,cAAK,EAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAA,qBAAY,EAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,IAAY,EAAU,EAAE;IAClD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAClB,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC,CAAC;AAEF,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC9H,CAAC;AAED,2EAA2E;AAC3E,SAAgB,YAAY,CAAC,CAAU;IACrC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;QAClE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAsB,CAAC;aACxF,IAAI,CAAC,IAAI,IAAI;YAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAmB;IAChD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACxH,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnD,IAAA,mBAAO,EAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,GAAsC,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAA,oBAAQ,EAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,IAAA,mBAAO,EAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAA,wBAAY,EAAC,MAAM,CAAC;QAAE,IAAA,oBAAQ,EAAC,MAAM,EAAE,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,qBAAa,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC;YAAE,IAAA,oBAAQ,EAAC,MAAM,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,qGAAqG;IACrG,sFAAsF;IACtF,MAAM,IAAI,GAAG,IAAA,wBAAc,GAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAA,wBAAc,GAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,GAAG,CAAC,EAAE,GAAG;QACP,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE;QACpF,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC;QACnC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,IAAI,IAAI,EAAE,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,CAAU,EAAE,gBAAyB;IAC9D,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,iGAAiG;AACjG,SAAgB,aAAa,CAAC,GAAgB;IAC5C,IAAI,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,OAAO,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,GAAgB,EAAE,CAAY;IACxD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IAChD,wEAAwE;IACxE,GAAG,CAAC,UAAU,KAAd,GAAG,CAAC,UAAU,GAAK,GAAG,CAAC,MAAM,CAAC,MAAM,EAAC;IACrC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QACpF,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzF,IAAI,MAAe,CAAC;QACpB,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjF,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1E,IAAA,mBAAO,EAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACpC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,IAAI,wBAAY,EAAE,CAAC;YACtC,IAAA,oBAAQ,EAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAA,mBAAO,EAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,oBAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7E,GAAG,CAAC,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC;IAC1B,CAAC;IACD,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,GAAgB;IAChD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;IAClB,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAChB,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,EAAE,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,4BAAmB,EAAC,EAAE,CAAC,GAAgB,EAAE,IAAA,uBAAc,GAAE,EAAE,KAAK,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,qFAAqF;QACrF,IAAI,OAAO;YAAE,IAAA,sBAAa,EAAC,OAAO,EAAE,eAAO,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjI,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,GAAgB,EAAE,KAAsB;IACtE,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,oBAAW,GAAE,CAAC;QAC5B,qDAAqD;QACrD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAA,gBAAO,EAAC,aAAa,CAAC,KAAK,KAAK;YAAE,OAAO;QAC9D,MAAM,MAAM,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QACnH,OAAO,GAAG,IAAA,gCAAiB,EAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAA,6BAAc,EAAC,GAAG,EAAE,IAAA,wBAAe,GAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACjG,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAA,sBAAa,EAAC,IAAA,4BAAa,EAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,eAAO,EAAE,KAAK,CAAC,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,GAAgB,EAAE,IAAiC;IAC9E,IAAI,GAAG,CAAC,EAAE,EAAE,SAAS;QAAE,OAAO;IAC9B,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE;QACd,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAChE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,iFAAiF;YACjF,IAAI,CAAC,YAAY,wBAAgB;gBAAE,MAAM,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/rasp/config-client.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Signed RASP config client (README "The signed config").
+ *
+ * `GET /api/rasp/config?app=` returns `{ config: <compact JWS>, keys }`. The
+ * JWS is trusted only when it verifies against a key the app pinned
+ * (`configPublicKey` / `SHIELD360_CONFIG_PUBLIC_KEY`: a JWK, a JWKS for
+ * rotation, or the bare base64url Ed25519 `x`). The `keys` in the response
+ * are never trusted on their own: they came over the same channel as the
+ * config. Only with trust on first use (development: `allowUnpinnedConfig`
+ * or `SHIELD360_CONFIG_TOFU=dev`, never in production) is the first `kid`
+ * seen pinned; a config signed by another kid after that is rejected. A
+ * pinned key that does not verify never falls back to trust on first use.
+ *
+ * ETag polling every 60 s ± 10 s, 5 minutes after a failure; the last
+ * verified config is kept in memory and in a cache file that is re-verified
+ * when loaded. Never throws and never blocks start-up.
+ */
+import { KeyObject } from 'crypto';
+import type { AttackType, ConfigPublicKey, RaspAllow, RaspMode } from './types';
+import type { VirtualPatch } from './vpatch';
+export declare const JWS_TYPE = "shield360-rasp+jws";
+export declare const SKEW_S = 60;
+export declare const POLL_MS = 60000;
+export declare const JITTER_MS = 10000;
+export declare const BACKOFF_MS: number;
+export type RaspClaims = {
+    v: number;
+    app: string;
+    iat?: number;
+    exp: number;
+    version: string;
+    killSwitch?: boolean;
+    snippets?: boolean;
+    reportTargets?: boolean;
+    mode?: RaspMode;
+    attacks?: Partial<Record<AttackType, RaspMode>>;
+    allow?: Partial<RaspAllow>;
+    rules?: VirtualPatch[] | null;
+    sinks?: unknown[] | null;
+    /** Custom rules (README "Custom rules"); null = none. */
+    customRules?: unknown[] | null;
+    /** Decoy paths as sent (README "Deception"; deception.ts reads them); absent or null = off. */
+    deception?: unknown;
+    /** Passive IAST switch and sampling rate (README "Passive IAST"). */
+    iast?: 'on' | 'off';
+    iastSampleRate?: number;
+};
+export type PinnedKey = {
+    kid?: string;
+    x: string;
+    key: KeyObject;
+};
+/**
+ * Parses a pinned key: a JWK, a JWKS, or the bare base64url Ed25519 `x`
+ * (objects or JSON text). Unusable entries are left out; [] when none is usable.
+ */
+export declare function parsePublicKeys(input: ConfigPublicKey | undefined | null): PinnedKey[];
+export type VerifyResult = {
+    ok: true;
+    claims: RaspClaims;
+    kid?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/** The `kid` in a JWS header, or undefined. */
+export declare function jwsKid(token: string): string | undefined;
+/**
+ * Verifies a compact JWS against the given keys only: `alg` EdDSA, `typ`
+ * shield360-rasp+jws, an Ed25519 signature by the pinned key whose kid
+ * matches the header (any pinned key when the header names none listed), `v` 1, `app` equal to ours, `exp` in the future
+ * (60 s skew).
+ */
+export declare function verifyConfigJws(token: unknown, keys: PinnedKey[], app: string, nowS?: number): VerifyResult;
+export type PollResult = 'updated' | 'unchanged' | 'rejected' | 'failed';
+export type ConfigClientOptions = {
+    url: string;
+    apiKey: string;
+    app: string;
+    /** Pinned keys (parsePublicKeys). */
+    pinned: PinnedKey[];
+    /** Development only (the caller already refused it in production): pin the first kid the server sends. */
+    allowUnpinned?: boolean;
+    cacheDir: string;
+    /** A verified config, or undefined when the one in force expired. */
+    onConfig: (claims: RaspClaims | undefined) => void;
+    /** Why a config was refused (once per reason). */
+    onWarning?: (reason: string) => void;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    random?: () => number;
+};
+export declare class RaspConfigClient {
+    private readonly o;
+    private etag?;
+    private timer?;
+    private readonly base;
+    /** Keys pinned on first use (allowUnpinned only). */
+    private tofu;
+    private readonly warned;
+    current?: RaspClaims;
+    stopped: boolean;
+    constructor(o: ConfigClientOptions);
+    /** The keys a config must verify against right now. */
+    private trusted;
+    private nowMs;
+    cacheFile(): string;
+    private warn;
+    private apply;
+    /** Loads the cached config and re-verifies it. Pinned keys are never read from the cache. */
+    loadCache(): boolean;
+    private saveCache;
+    /** Drops the config in force once it has expired (the platform could not be reached for its whole lifetime). */
+    private expire;
+    /** One poll. Never throws. */
+    poll(): Promise<PollResult>;
+    private fetchOnce;
+    /** The delay before the next poll after a result. */
+    nextDelay(r: PollResult): number;
+    start(): void;
+    stop(): void;
+}