shield360 1.1.0 → 1.2.0

package/dist/rasp/hooks/http.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installHttpHooks = installHttpHooks;
+exports.uninstallHttpHooks = uninstallHttpHooks;
+/**
+ * Outbound HTTP sink hook (README "SSRF"): `http`/`https` `request` and
+ * `get`, and the global `fetch`, are checked for SSRF and for hosts outside
+ * `allow.outboundHosts` before anything is sent, and `http`/`https` again
+ * at the connection's own DNS lookup (DNS rebinding). The Shield360 and OTLP
+ * hosts are always allowed. Drafted with ChatGPT, reviewed and adapted by
+ * the repository owner.
+ */
+const http = require("http");
+const https = require("https");
+const dns = require("dns");
+const net_1 = require("net");
+const module_1 = require("module");
+const url_1 = require("url");
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const detect_1 = require("../detect");
+const types_1 = require("../types");
+let installed;
+/** Bumped by every install and uninstall: a wrapper checks only while its generation is current. */
+let generation = 0;
+let checking = false;
+let depth = 0;
+function target(values, protocol) {
+    const first = values[0];
+    const hasUrl = typeof first === 'string' || first instanceof URL;
+    if (!hasUrl && (!first || typeof first !== 'object'))
+        return;
+    const base = hasUrl ? (0, url_1.urlToHttpOptions)(new URL(String(first))) : {};
+    const extra = hasUrl ? values[1] : first;
+    const options = {
+        ...base,
+        ...(extra && typeof extra === 'object' ? extra : {}),
+    };
+    const host = options.hostname || options.host || 'localhost';
+    const scheme = options.protocol || protocol;
+    const authority = host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+    const url = new URL(`${scheme}//${authority}${options.port ? `:${options.port}` : ''}`);
+    // Assign path components separately: a path beginning // must not replace host.
+    const path = options.path || '/';
+    const split = path.indexOf('?');
+    url.pathname = split < 0 ? path : path.slice(0, split);
+    url.search = split < 0 ? '' : path.slice(split);
+    return {
+        url: url.href, host: url.hostname.replace(/^\[|\]$/g, ''), options,
+        callback: hasUrl ? typeof values[1] === 'function' ? values[1] : values[2] : values[1],
+    };
+}
+function guarded(run) {
+    const previous = checking;
+    checking = true;
+    try {
+        run();
+    }
+    catch (error) {
+        if (error instanceof types_1.RaspBlockedError)
+            throw error;
+    }
+    finally {
+        checking = previous;
+    }
+}
+function resolvedCheck(sink, url, inputs, addresses) {
+    guarded(() => { if ((0, engine_1.isActive)())
+        (0, engine_1.check)(sink, () => (0, detect_1.detectSsrf)(url, inputs, addresses)); });
+}
+function prepare(values, protocol, sink, always) {
+    let result = values;
+    guarded(() => {
+        if (!(0, engine_1.isActive)())
+            return;
+        const parsed = target(values, protocol);
+        if (!parsed)
+            return;
+        const ctx = (0, context_1.currentContext)();
+        const inputs = ctx ? (0, context_1.inputsOf)(ctx).map((input) => ({ ...input })) : [];
+        (0, engine_1.check)(sink, () => (0, engine_1.strongest)((0, detect_1.detectOutbound)(parsed.url, (0, engine_1.allowLists)().outboundHosts, always), (0, detect_1.detectSsrf)(parsed.url, inputs, [])));
+        if (inputs.length && !(0, net_1.isIP)(parsed.host)) {
+            const lookup = parsed.options.lookup || dns.lookup;
+            parsed.options.lookup = function (hostname, options, callback) {
+                // Keep the original lookup's arguments and callback shape, including all:true.
+                const wrapped = (...args) => {
+                    if (!args[0]) {
+                        try {
+                            const answer = args[1];
+                            const addresses = typeof answer === 'string' ? [answer]
+                                : Array.isArray(answer) ? answer.map((entry) => entry.address) : [];
+                            resolvedCheck(sink, parsed.url, inputs, addresses);
+                        }
+                        catch (error) {
+                            if (error instanceof types_1.RaspBlockedError) {
+                                Reflect.apply(callback, undefined, [error]);
+                                return;
+                            }
+                        }
+                    }
+                    Reflect.apply(callback, undefined, args);
+                };
+                Reflect.apply(lookup, this, [hostname, options, wrapped]);
+            };
+            result = typeof parsed.callback === 'function' ? [parsed.options, parsed.callback] : [parsed.options];
+        }
+    });
+    return result;
+}
+function copyProperties(original, wrapper) {
+    for (const key of Reflect.ownKeys(original)) {
+        if (key !== 'prototype')
+            Object.defineProperty(wrapper, key, Object.getOwnPropertyDescriptor(original, key));
+    }
+}
+/**
+ * Ends this generation (every wrapper stops checking) and puts back the
+ * originals where RASP's wrapper is still the current value. A wrapper put
+ * on top later (tracing) stays, calling RASP's, which now only passes through.
+ */
+function restore(saved) {
+    generation++;
+    for (let i = saved.length - 1; i >= 0; i--) {
+        const { owner, key, descriptor, wrapper } = saved[i];
+        if (Object.getOwnPropertyDescriptor(owner, key)?.value === wrapper)
+            Object.defineProperty(owner, key, descriptor);
+    }
+}
+function installHttpHooks(opts) {
+    if (installed)
+        return true;
+    const saved = [];
+    const gen = ++generation;
+    try {
+        const always = opts.alwaysAllowedHosts.slice();
+        const replace = (owner, key, build) => {
+            const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+            if (!descriptor || typeof descriptor.value !== 'function')
+                throw new TypeError(key);
+            const wrapper = build(descriptor.value);
+            copyProperties(descriptor.value, wrapper);
+            Object.defineProperty(owner, key, { ...descriptor, value: wrapper });
+            saved.push({ owner, key, descriptor, wrapper });
+        };
+        for (const [owner, protocol, name] of [[http, 'http:', 'http'], [https, 'https:', 'https']]) {
+            for (const api of ['request', 'get'])
+                replace(owner, api, original => function (...values) {
+                    const args = checking || depth || gen !== generation ? values : prepare(values, protocol, `${name}.${api}`, always);
+                    depth++;
+                    try {
+                        return Reflect.apply(original, this, args);
+                    }
+                    finally {
+                        depth--;
+                    }
+                });
+        }
+        // fetch is optional: a runtime without it, or with fetch as an accessor
+        // (a polyfill), keeps the http/https hooks.
+        const fetchDescriptor = Object.getOwnPropertyDescriptor(globalThis, 'fetch');
+        if (typeof fetchDescriptor?.value === 'function' && fetchDescriptor.configurable)
+            replace(globalThis, 'fetch', original => async function (...values) {
+                if (checking || gen !== generation)
+                    return Reflect.apply(original, this, values);
+                let url;
+                let inputs = [];
+                guarded(() => {
+                    if (!(0, engine_1.isActive)())
+                        return;
+                    const first = values[0];
+                    url = new URL(typeof first === 'string' || first instanceof URL ? String(first) : first.url);
+                    const ctx = (0, context_1.currentContext)();
+                    inputs = ctx ? (0, context_1.inputsOf)(ctx).map((input) => ({ ...input })) : [];
+                    (0, engine_1.check)('fetch', () => (0, engine_1.strongest)((0, detect_1.detectOutbound)(url.href, (0, engine_1.allowLists)().outboundHosts, always), (0, detect_1.detectSsrf)(url.href, inputs, [])));
+                });
+                if (url && inputs.length && !(0, net_1.isIP)(url.hostname.replace(/^\[|\]$/g, ''))) {
+                    try {
+                        const addresses = await dns.promises.lookup(url.hostname, { all: true });
+                        resolvedCheck('fetch', url.href, inputs, addresses.map(address => address.address));
+                    }
+                    catch (error) {
+                        if (error instanceof types_1.RaspBlockedError)
+                            throw error;
+                    }
+                }
+                // Rebinding gap: fetch may resolve again for its connection. Node exposes
+                // no undici connector here without depending on the undici package.
+                return Reflect.apply(original, this, values);
+            });
+        (0, module_1.syncBuiltinESMExports)();
+        installed = saved;
+        return true;
+    }
+    catch {
+        try {
+            restore(saved);
+        }
+        catch { /* Best effort if an external owner froze a property. */ }
+        try {
+            (0, module_1.syncBuiltinESMExports)();
+        }
+        catch { /* Never throw on installation. */ }
+        return false;
+    }
+}
+function uninstallHttpHooks() {
+    if (!installed)
+        return;
+    restore(installed);
+    installed = undefined;
+    (0, module_1.syncBuiltinESMExports)();
+}
+//# sourceMappingURL=http.js.map

package/dist/rasp/hooks/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/rasp/hooks/http.ts"],"names":[],"mappings":";;AAuHA,4CAsDC;AAED,gDAKC;AApLD;;;;;;;GAOG;AACH,6BAA8B;AAC9B,+BAAgC;AAChC,2BAA4B;AAC5B,6BAA2B;AAC3B,mCAA+C;AAC/C,6BAAuC;AACvC,wCAAsD;AACtD,sCAAmE;AACnE,sCAAuD;AACvD,oCAA4D;AAI5D,IAAI,SAA8B,CAAC;AACnC,oGAAoG;AACpG,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,IAAI,KAAK,GAAG,CAAC,CAAC;AAEd,SAAS,MAAM,CAAC,MAAiB,EAAE,QAAgB;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,sBAAgB,EAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,MAAM,OAAO,GAAwB;QACnC,GAAG,IAAI;QACP,GAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,KAAK,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,gFAAgF;IAChF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,GAAG,CAAC,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,GAAG,CAAC,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,OAAO;QAClE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,QAAQ,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,EAAE,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAC5B,IAAI,KAAK,YAAY,wBAAgB;YAAE,MAAM,KAAK,CAAC;IACrD,CAAC;YAAS,CAAC;QAAC,QAAQ,GAAG,QAAQ,CAAC;IAAC,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,GAAW,EAAE,MAAmB,EAAE,SAAmB;IACxF,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,IAAA,iBAAQ,GAAE;QAAE,IAAA,cAAK,EAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,OAAO,CAAC,MAAiB,EAAE,QAAgB,EAAE,IAAY,EAAE,MAAgB;IAClF,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,IAAA,cAAK,EAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,kBAAS,EAAC,IAAA,uBAAc,EAAC,MAAM,CAAC,GAAG,EAAE,IAAA,mBAAU,GAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,IAAA,mBAAU,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACjI,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,UAAI,EAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,UAAyB,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC1E,+EAA+E;gBAC/E,MAAM,OAAO,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;oBACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;wBACb,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;4BACvB,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gCACrD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAA0B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC3F,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;wBACrD,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,KAAK,YAAY,wBAAgB,EAAE,CAAC;gCACtC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gCAC5C,OAAO;4BACT,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBAC3C,CAAC,CAAC;gBACF,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5D,CAAsB,CAAC;YACvB,MAAM,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,QAAyC,EAAE,OAAwC;IACzG,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,IAAI,GAAG,KAAK,WAAW;YAAE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,GAAG,CAAE,CAAC,CAAC;IAChH,CAAC;AACH,CAAC;AACD;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAAc;IAC7B,UAAU,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,KAAK,OAAO;YAAE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACpH,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAsC;IACrE,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,KAAqF,EAAE,EAAE;YACpI,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;YACpF,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxC,cAAc,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC1C,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAU,EAAE,CAAC;YACrG,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;gBAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAyB,GAAG,MAAiB;oBACjH,MAAM,IAAI,GAAG,QAAQ,IAAI,KAAK,IAAI,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;oBACpH,KAAK,EAAE,CAAC;oBACR,IAAI,CAAC;wBAAC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;oBAAC,CAAC;4BAAS,CAAC;wBAAC,KAAK,EAAE,CAAC;oBAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC;QACL,CAAC;QACD,wEAAwE;QACxE,4CAA4C;QAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7E,IAAI,OAAO,eAAe,EAAE,KAAK,KAAK,UAAU,IAAI,eAAe,CAAC,YAAY;YAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,KAAK,WAA0B,GAAG,MAAiB;gBAC5K,IAAI,QAAQ,IAAI,GAAG,KAAK,UAAU;oBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACjF,IAAI,GAAoB,CAAC;gBACzB,IAAI,MAAM,GAAgB,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,EAAE;oBACX,IAAI,CAAC,IAAA,iBAAQ,GAAE;wBAAE,OAAO;oBACxB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;oBACxB,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiB,CAAC,GAAG,CAAC,CAAC;oBAC1G,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;oBAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,IAAA,cAAK,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,kBAAS,EAAC,IAAA,uBAAc,EAAC,GAAI,CAAC,IAAI,EAAE,IAAA,mBAAU,GAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,IAAA,mBAAU,EAAC,GAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpI,CAAC,CAAC,CAAC;gBACH,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,UAAI,EAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;oBACxE,IAAI,CAAC;wBACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;wBACzE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;oBACtF,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAAC,IAAI,KAAK,YAAY,wBAAgB;4BAAE,MAAM,KAAK,CAAC;oBAAC,CAAC;gBACzE,CAAC;gBACD,0EAA0E;gBAC1E,oEAAoE;gBACpE,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;QACH,IAAA,8BAAqB,GAAE,CAAC;QACxB,SAAS,GAAG,KAAK,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;QAC1F,IAAI,CAAC;YAAC,IAAA,8BAAqB,GAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,kBAAkB;IAChC,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,OAAO,CAAC,SAAS,CAAC,CAAC;IACnB,SAAS,GAAG,SAAS,CAAC;IACtB,IAAA,8BAAqB,GAAE,CAAC;AAC1B,CAAC"}

package/dist/rasp/hooks/include.d.ts

@@ -0,0 +1,9 @@
+type Require = (this: unknown, id: string) => unknown;
+type Target = {
+    require: Require;
+};
+/** Wraps `Module.prototype.require`. Idempotent; never throws. */
+export declare function installIncludeHooks(target?: Target): boolean;
+/** Ends this generation; puts the original back where RASP's wrapper is still on top. Idempotent. */
+export declare function uninstallIncludeHooks(): void;
+export {};

package/dist/rasp/hooks/include.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installIncludeHooks = installIncludeHooks;
+exports.uninstallIncludeHooks = uninstallIncludeHooks;
+/**
+ * Module loading sink hook (README "Code", `code.include`): a module
+ * specifier passed to `require` (and the functions `module.createRequire`
+ * returns, which go through the same method) is checked during a request for
+ * a name or path that came from input. Dynamic `import()` is resolved by the
+ * ESM loader and is not covered here.
+ *
+ * `Module.prototype.require` is also wrapped by require-in-the-middle (the
+ * SDK's own instrumentations and OpenTelemetry's), so this hook follows the
+ * same rules as the others: one generation per install, a wrapper checks only
+ * while its generation is current, and uninstall restores the original only
+ * where RASP's wrapper is still on top.
+ */
+const Module = require("module");
+const context_1 = require("../context");
+const detect_1 = require("../detect");
+const engine_1 = require("../engine");
+/** Node's own `Module.prototype` (tests pass a stand-in: under Jest it is Jest's). */
+const proto = Module.prototype;
+let installed;
+let generation = 0;
+let checking = false;
+function inspect(id) {
+    if (checking || typeof id !== 'string' || !(0, engine_1.isActive)())
+        return;
+    const ctx = (0, context_1.currentContext)();
+    if (!ctx?.inRequest)
+        return;
+    checking = true;
+    try {
+        (0, engine_1.check)('module.require', () => (0, detect_1.detectInclude)(id, (0, context_1.inputsOf)(ctx)));
+    }
+    finally {
+        checking = false;
+    }
+}
+/** Wraps `Module.prototype.require`. Idempotent; never throws. */
+function installIncludeHooks(target = proto) {
+    if (installed)
+        return true;
+    try {
+        const descriptor = Object.getOwnPropertyDescriptor(target, 'require');
+        if (!descriptor || typeof descriptor.value !== 'function')
+            return false;
+        const original = descriptor.value;
+        const gen = ++generation;
+        const wrapper = function (id) {
+            if (gen === generation)
+                inspect(id);
+            return Reflect.apply(original, this, [id]);
+        };
+        for (const key of Reflect.ownKeys(original)) {
+            if (key === 'prototype')
+                continue;
+            Object.defineProperty(wrapper, key, Object.getOwnPropertyDescriptor(original, key));
+        }
+        Object.defineProperty(target, 'require', { ...descriptor, value: wrapper });
+        installed = { target, descriptor, wrapper };
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Ends this generation; puts the original back where RASP's wrapper is still on top. Idempotent. */
+function uninstallIncludeHooks() {
+    if (!installed)
+        return;
+    generation++;
+    const { target, descriptor, wrapper } = installed;
+    if (Object.getOwnPropertyDescriptor(target, 'require')?.value === wrapper)
+        Object.defineProperty(target, 'require', descriptor);
+    installed = undefined;
+}
+//# sourceMappingURL=include.js.map

package/dist/rasp/hooks/include.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"include.js","sourceRoot":"","sources":["../../../src/rasp/hooks/include.ts"],"names":[],"mappings":";;AAyCA,kDAqBC;AAGD,sDAMC;AAvED;;;;;;;;;;;;GAYG;AACH,iCAAkC;AAClC,wCAAsD;AACtD,sCAA0C;AAC1C,sCAA4C;AAM5C,sFAAsF;AACtF,MAAM,KAAK,GAAI,MAA2C,CAAC,SAAS,CAAC;AACrE,IAAI,SAA4B,CAAC;AACjC,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB,SAAS,OAAO,CAAC,EAAW;IAC1B,IAAI,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,IAAA,iBAAQ,GAAE;QAAE,OAAO;IAC9D,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO;IAC5B,QAAQ,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,IAAA,cAAK,EAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAA,sBAAa,EAAC,EAAE,EAAE,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAgB,mBAAmB,CAAC,SAAiB,KAAK;IACxD,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAgB,CAAC;QAC7C,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC;QACzB,MAAM,OAAO,GAAG,UAAyB,EAAU;YACjD,IAAI,GAAG,KAAK,UAAU;gBAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAY,CAAC;QACb,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,IAAI,GAAG,KAAK,WAAW;gBAAE,SAAS;YAClC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,GAAG,CAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5E,SAAS,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,SAAgB,qBAAqB;IACnC,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IAClD,IAAI,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,KAAK,OAAO;QAAE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAChI,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC"}

package/dist/rasp/hooks/marks.d.ts

@@ -0,0 +1,2 @@
+export declare function markRaspWrapper(fn: object): void;
+export declare function isRaspWrapper(fn: unknown): boolean;

package/dist/rasp/hooks/marks.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.markRaspWrapper = markRaspWrapper;
+exports.isRaspWrapper = isRaspWrapper;
+/**
+ * Marks RASP's own library wrappers, so a sink rule never wraps a function a
+ * built-in hook already checks (one check per call).
+ */
+const wrappers = new WeakSet();
+function markRaspWrapper(fn) {
+    wrappers.add(fn);
+}
+function isRaspWrapper(fn) {
+    return typeof fn === 'function' && wrappers.has(fn);
+}
+//# sourceMappingURL=marks.js.map

package/dist/rasp/hooks/marks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marks.js","sourceRoot":"","sources":["../../../src/rasp/hooks/marks.ts"],"names":[],"mappings":";;AAMA,0CAEC;AAED,sCAEC;AAZD;;;GAGG;AACH,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAU,CAAC;AAEvC,SAAgB,eAAe,CAAC,EAAU;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,SAAgB,aAAa,CAAC,EAAW;IACvC,OAAO,OAAO,EAAE,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/rasp/hooks/process.d.ts

@@ -0,0 +1,22 @@
+import type { Finding, RaspInput } from '../types';
+export type ProcessApi = 'exec' | 'execSync' | 'spawn' | 'spawnSync' | 'execFile' | 'execFileSync' | 'fork';
+export declare const PROCESS_APIS: readonly ProcessApi[];
+/** What a call is about to run: a shell command line, or an argv. */
+export type ProcessTarget = {
+    command: string;
+} | {
+    argv: string[];
+};
+/**
+ * The call's target, or null when the arguments are not ones Node accepts
+ * (Node then raises its own error). The caller's argv is copied.
+ */
+export declare function processTarget(api: ProcessApi, values: unknown[]): ProcessTarget | null;
+/** Every finding of the contract's command checks for one target, in the contract's order. */
+export declare function processFindings(target: ProcessTarget, inputs: RaspInput[], inRequest: boolean, allow: string[]): Finding[];
+/** The first finding of the contract's command checks for one target. */
+export declare function detectProcess(target: ProcessTarget, inputs: RaspInput[], inRequest: boolean, allow: string[]): Finding | null;
+/** Replaces the child_process functions with checked ones. Idempotent; never throws. */
+export declare function installProcessHooks(): boolean;
+/** Puts the original functions back exactly. Idempotent. */
+export declare function uninstallProcessHooks(): void;

package/dist/rasp/hooks/process.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROCESS_APIS = void 0;
+exports.processTarget = processTarget;
+exports.processFindings = processFindings;
+exports.detectProcess = detectProcess;
+exports.installProcessHooks = installProcessHooks;
+exports.uninstallProcessHooks = uninstallProcessHooks;
+/**
+ * child_process sink hook (README "Command"): every way Node starts a
+ * process is checked before the process starts. Shell-interpreted commands
+ * (`exec`, `execSync`, and `spawn`/`execFile` family calls with `shell`)
+ * go through `detectCommand` and `shell_spawn`; argv spawns go through
+ * `detectArgv`, the script of `sh -c <script>`, and `shell_spawn`.
+ *
+ * The module's functions are replaced in place by wrappers with the same
+ * `name`, `length` and properties, and `syncBuiltinESMExports` carries the
+ * change to ESM named imports. Not a Proxy: `exec` and `execFile` carry a
+ * read-only `util.promisify.custom` that a Proxy may not replace, and the
+ * original's would skip the check. A function an app took out of the module before
+ * install (`const { exec } = require('child_process')` at load) is not
+ * covered; initialise Shield360 before loading the app's modules.
+ *
+ * Fail open: anything that goes wrong in the hook lets the call through,
+ * and Node validates its own arguments as before. Drafted with ChatGPT,
+ * reviewed and adapted by the repository owner.
+ */
+const cp = require("child_process");
+const module_1 = require("module");
+const util_1 = require("util");
+const context_1 = require("../context");
+const detect_1 = require("../detect");
+const engine_1 = require("../engine");
+exports.PROCESS_APIS = ['exec', 'execSync', 'spawn', 'spawnSync', 'execFile', 'execFileSync', 'fork'];
+let installed;
+/** Bumped by every install and uninstall: a wrapper checks only while its generation is current. */
+let generation = 0;
+let checking = false;
+/**
+ * The call's target, or null when the arguments are not ones Node accepts
+ * (Node then raises its own error). The caller's argv is copied.
+ */
+function processTarget(api, values) {
+    const first = values[0];
+    if (api === 'exec' || api === 'execSync')
+        return typeof first === 'string' ? { command: first } : null;
+    const file = typeof first === 'string' ? first : api === 'fork' && first instanceof URL ? first.href : undefined;
+    if (file === undefined)
+        return null;
+    const args = Array.isArray(values[1]) ? values[1] : undefined;
+    if (args?.some((a) => typeof a !== 'string'))
+        return null;
+    const rest = args?.slice() ?? [];
+    const candidate = values[args ? 2 : 1];
+    const options = candidate !== null && typeof candidate === 'object' ? candidate : undefined;
+    if (api === 'fork') {
+        // fork runs a module under Node, or under options.execPath when given.
+        const exe = typeof options?.execPath === 'string' && options.execPath ? options.execPath : process.execPath;
+        return { argv: [exe, file, ...rest] };
+    }
+    const shell = options?.shell;
+    if (shell === true || (typeof shell === 'string' && shell !== '')) {
+        // Node joins the file and arguments with spaces and hands the line to the shell.
+        return { command: [file, ...rest].join(' ') };
+    }
+    return { argv: [file, ...rest] };
+}
+/** Every finding of the contract's command checks for one target, in the contract's order. */
+function processFindings(target, inputs, inRequest, allow) {
+    let found;
+    if ('command' in target) {
+        found = [(0, detect_1.detectCommand)(target.command, inputs), (0, detect_1.detectShellSpawn)({ command: target.command, inRequest, allow })];
+    }
+    else {
+        const { argv } = target;
+        const script = (0, detect_1.shellScriptOf)(argv);
+        found = [(0, detect_1.detectArgv)(argv, inputs)];
+        if (script)
+            found.push((0, detect_1.detectCommand)(script, inputs), (0, detect_1.detectShellSpawn)({ command: script, inRequest: false, allow }));
+        found.push((0, detect_1.detectShellSpawn)({ argv0: argv[0], inRequest, allow }));
+    }
+    return found.filter((f) => f !== null);
+}
+/** The first finding of the contract's command checks for one target. */
+function detectProcess(target, inputs, inRequest, allow) {
+    return processFindings(target, inputs, inRequest, allow)[0] ?? null;
+}
+function inspect(api, values) {
+    if (checking || !(0, engine_1.isActive)())
+        return;
+    checking = true;
+    try {
+        // check() reports what it finds and throws only the block error.
+        (0, engine_1.check)(`child_process.${api}`, () => {
+            const target = processTarget(api, values);
+            if (!target)
+                return null;
+            const ctx = (0, context_1.currentContext)();
+            // The strongest decision wins: a finding in monitor or off mode never hides one that blocks.
+            return (0, engine_1.strongest)(...processFindings(target, ctx ? (0, context_1.inputsOf)(ctx) : [], Boolean(ctx?.inRequest), (0, engine_1.allowLists)().commands));
+        });
+    }
+    finally {
+        checking = false;
+    }
+}
+/** Replaces the child_process functions with checked ones. Idempotent; never throws. */
+function installProcessHooks() {
+    if (installed)
+        return true;
+    const saved = new Map();
+    const gen = ++generation;
+    try {
+        for (const api of exports.PROCESS_APIS) {
+            const descriptor = Object.getOwnPropertyDescriptor(cp, api);
+            if (!descriptor || typeof descriptor.value !== 'function')
+                throw new TypeError(api);
+            const original = descriptor.value;
+            const wrapper = function (...values) {
+                if (gen === generation)
+                    inspect(api, values);
+                return Reflect.apply(original, this, values);
+            };
+            saved.set(api, { descriptor, wrapper });
+            for (const key of Reflect.ownKeys(original)) {
+                if (key === 'prototype' || key === util_1.promisify.custom)
+                    continue;
+                Object.defineProperty(wrapper, key, Object.getOwnPropertyDescriptor(original, key));
+            }
+            // Node's own promisified exec/execFile closes over the original function;
+            // rebuild it around the wrapper so promisify() cannot skip the check.
+            const promisified = (...values) => {
+                let child;
+                const promise = new Promise((resolve, reject) => {
+                    child = Reflect.apply(wrapper, undefined, [
+                        ...values,
+                        (error, stdout, stderr) => {
+                            if (error)
+                                reject(Object.assign(error, { stdout, stderr }));
+                            else
+                                resolve({ stdout, stderr });
+                        },
+                    ]);
+                });
+                return Object.assign(promise, { child });
+            };
+            if (api === 'exec' || api === 'execFile')
+                Object.defineProperty(wrapper, util_1.promisify.custom, { value: promisified });
+            Object.defineProperty(cp, api, { ...descriptor, value: wrapper });
+        }
+        (0, module_1.syncBuiltinESMExports)();
+        installed = saved;
+        return true;
+    }
+    catch {
+        restore(saved);
+        try {
+            (0, module_1.syncBuiltinESMExports)();
+        }
+        catch {
+            // never
+        }
+        return false;
+    }
+}
+/**
+ * Ends this generation (every wrapper stops checking) and puts back the
+ * originals where RASP's wrapper is still the current value. A wrapper put
+ * on top later (tracing) stays, calling RASP's, which now only passes through.
+ */
+function restore(saved) {
+    generation++;
+    for (const [api, { descriptor, wrapper }] of saved) {
+        if (Object.getOwnPropertyDescriptor(cp, api)?.value === wrapper)
+            Object.defineProperty(cp, api, descriptor);
+    }
+}
+/** Puts the original functions back exactly. Idempotent. */
+function uninstallProcessHooks() {
+    if (!installed)
+        return;
+    restore(installed);
+    installed = undefined;
+    try {
+        (0, module_1.syncBuiltinESMExports)();
+    }
+    catch {
+        // never
+    }
+}
+//# sourceMappingURL=process.js.map

package/dist/rasp/hooks/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../../src/rasp/hooks/process.ts"],"names":[],"mappings":";;;AA4CA,sCAuBC;AAGD,0CAYC;AAGD,sCAEC;AAoBD,kDAgDC;AAeD,sDASC;AAnLD;;;;;;;;;;;;;;;;;;GAkBG;AACH,oCAAqC;AACrC,mCAA+C;AAC/C,+BAAiC;AACjC,wCAAsD;AACtD,sCAAuF;AACvF,sCAAmE;AAKtD,QAAA,YAAY,GAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;AAMlI,IAAI,SAA6C,CAAC;AAClD,oGAAoG;AACpG,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB;;;GAGG;AACH,SAAgB,aAAa,CAAC,GAAe,EAAE,MAAiB;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvG,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,CAAC,CAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,IAAI,GAAI,IAA6B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAE,SAAqD,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,uEAAuE;QACvE,MAAM,GAAG,GAAG,OAAO,OAAO,EAAE,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5G,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;QAClE,iFAAiF;QACjF,OAAO,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,8FAA8F;AAC9F,SAAgB,eAAe,CAAC,MAAqB,EAAE,MAAmB,EAAE,SAAkB,EAAE,KAAe;IAC7G,IAAI,KAAyB,CAAC;IAC9B,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,KAAK,GAAG,CAAC,IAAA,sBAAa,EAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAA,yBAAgB,EAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnH,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QACxB,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,IAAI,CAAC,CAAC;QACnC,KAAK,GAAG,CAAC,IAAA,mBAAU,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,IAAA,sBAAa,EAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAA,yBAAgB,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtH,KAAK,CAAC,IAAI,CAAC,IAAA,yBAAgB,EAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,yEAAyE;AACzE,SAAgB,aAAa,CAAC,MAAqB,EAAE,MAAmB,EAAE,SAAkB,EAAE,KAAe;IAC3G,OAAO,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,OAAO,CAAC,GAAe,EAAE,MAAiB;IACjD,IAAI,QAAQ,IAAI,CAAC,IAAA,iBAAQ,GAAE;QAAE,OAAO;IACpC,QAAQ,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,iEAAiE;QACjE,IAAA,cAAK,EAAC,iBAAiB,GAAG,EAAE,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;YAC7B,6FAA6F;YAC7F,OAAO,IAAA,kBAAS,EAAC,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,IAAA,mBAAU,GAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzH,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAgB,mBAAmB;IACjC,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC;IACzB,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,oBAAY,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;YACpF,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAwC,CAAC;YACrE,MAAM,OAAO,GAAG,UAAyB,GAAG,MAAiB;gBAC3D,IAAI,GAAG,KAAK,UAAU;oBAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,gBAAS,CAAC,MAAM;oBAAE,SAAS;gBAC9D,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,GAAG,CAAE,CAAC,CAAC;YACvF,CAAC;YACD,0EAA0E;YAC1E,sEAAsE;YACtE,MAAM,WAAW,GAAG,CAAC,GAAG,MAAiB,EAAE,EAAE;gBAC3C,IAAI,KAAc,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAuC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBACpF,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE;wBACxC,GAAG,MAAM;wBACT,CAAC,KAAmB,EAAE,MAAe,EAAE,MAAe,EAAE,EAAE;4BACxD,IAAI,KAAK;gCAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;;gCACvD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;wBACnC,CAAC;qBACF,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC;YACF,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU;gBAAE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,gBAAS,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACnH,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAA,8BAAqB,GAAE,CAAC;QACxB,SAAS,GAAG,KAAK,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,IAAI,CAAC;YACH,IAAA,8BAAqB,GAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ;QACV,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,KAA6B;IAC5C,UAAU,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,KAAK,OAAO;YAAE,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,SAAgB,qBAAqB;IACnC,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,OAAO,CAAC,SAAS,CAAC,CAAC;IACnB,SAAS,GAAG,SAAS,CAAC;IACtB,IAAI,CAAC;QACH,IAAA,8BAAqB,GAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ;IACV,CAAC;AACH,CAAC"}

package/dist/rasp/hooks/sinks.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Sink rules (README "Sink rules"): data from the built-in list or the
+ * verified signed config that points an existing detector at a library
+ * function the SDK does not hook itself. No rule carries code: a rule names
+ * a module, a dotted path to a function, an argument and one of the checks,
+ * and the generic wrapper here runs that check.
+ *
+ * Rules are applied to modules already loaded and, through one
+ * require-in-the-middle registration per rule set, to modules loaded later.
+ * Wrappers are RASP's own (not shimmer's), as in the database hook, so
+ * tracing that wraps the same function stacks in either order.
+ */
+import { InstrumentationBase, InstrumentationNodeModuleDefinition } from '@opentelemetry/instrumentation';
+import { type DeserFormat, type FileOp } from '../detect';
+import { type SqlDialect } from '../lexers';
+import { type RaspMode } from '../types';
+export type SinkCheck = 'sql' | 'nosql' | 'command' | 'path' | 'ssrf' | 'code' | 'deser' | 'xml';
+export type SinkRule = {
+    id: string;
+    title?: string;
+    runtimes?: string[];
+    module: string;
+    target: string;
+    check: SinkCheck;
+    arg: number;
+    field?: string;
+    dialect?: SqlDialect;
+    op?: FileOp;
+    format?: DeserFormat;
+    resolvesExternal?: boolean;
+    action: Exclude<RaspMode, 'off'>;
+};
+/** One rule, checked field by field; null drops it (never the whole list). */
+export declare function parseSinkRule(raw: unknown): SinkRule | null;
+/** A list: at most 64 rules, invalid ones dropped, duplicate ids keep the first. */
+export declare function parseSinkRules(raw: unknown): SinkRule[];
+export declare const BUILT_IN_SINKS: SinkRule[];
+/** Registers the rule set's modules for when the app loads them. */
+export declare class RaspSinkInstrumentation extends InstrumentationBase {
+    constructor();
+    protected init(): InstrumentationNodeModuleDefinition[];
+}
+/**
+ * Makes `rules` the rule set: rules no longer listed stop checking at once,
+ * new ones apply to loaded modules now and to others when loaded. Never throws.
+ */
+export declare function setSinkRules(rules: SinkRule[]): void;
+/** The rule set in force (tests, diagnostics). */
+export declare function sinkRules(): SinkRule[];
+/** Applies the built-in rules. Idempotent; never throws. */
+export declare function installSinkHooks(): boolean;
+export declare function uninstallSinkHooks(): void;
+/** Tests: apply one rule to a module object directly. */
+export declare function applySinkRule(rule: SinkRule, exports: unknown): void;