shield360 1.1.0 → 1.2.1

package/dist/rasp/__tests__/rule-phases.test.js

@@ -0,0 +1,271 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * When request rules run (README "Custom rules: when rules run"), on every
+ * entry point:
+ * - at head, `input.*` sees only the inputs known before the body, even when
+ *   the framework hands over an already-parsed body;
+ * - a request with no body (or an empty one) has a known, empty body, so the
+ *   body phase still runs; a body the SDK cannot read yet stays unknown;
+ * - findings raised during capture are judged with the request current;
+ * - a rule matches at most once per request, also when framework middleware
+ *   replaces the zero-code capture's context.
+ */
+const http_1 = require("http");
+const auto_http_1 = require("../auto-http");
+const capture_1 = require("../capture");
+const context_1 = require("../context");
+const custom_rules_1 = require("../custom-rules");
+const engine_1 = require("../engine");
+const middleware_1 = require("../middleware");
+const types_1 = require("../types");
+let events = [];
+function remote(customRules, attacks = {}) {
+    return { version: 'v1', exp: Math.floor(Date.now() / 1000) + 3600, killSwitch: false, snippets: false, mode: 'monitor', attacks, rules: [], customRules };
+}
+const rule = (id, expression, action = 'monitor') => ({ id, name: id, expression, action, enabled: true });
+beforeEach(() => {
+    (0, custom_rules_1.resetCustomRuleWarnings)();
+    events = [];
+    (0, engine_1.configureEngine)({ enabled: true, applicationName: 'orders-api', env: {} });
+    (0, engine_1.setEventSink)({ add: (e) => events.push(e) });
+});
+afterEach(() => {
+    (0, engine_1.setEventSink)(undefined);
+    (0, engine_1.setRemoteConfig)(undefined);
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+});
+const fired = () => events.filter((e) => e.attrs['shield360.rasp.attack'] === 'custom_rule').map((e) => e.attrs['shield360.rasp.rule']);
+function res() {
+    const r = { statusCode: 0, headersSent: false, writableEnded: false, body: '', setHeader: () => undefined };
+    r.end = (b) => ((r.body = b), (r.writableEnded = true));
+    return r;
+}
+function fastify() {
+    const hooks = {};
+    (0, middleware_1.raspFastify)({ addHook: (name, fn) => (hooks[name] = fn) }, {}, () => undefined);
+    const reply = { status: 0, code: (n) => ((reply.status = n), reply), header: () => reply, send: (b) => (reply.sent = b) };
+    return { hooks, reply };
+}
+const JSON_POST = { 'content-type': 'application/json', 'content-length': '13' };
+describe('head rules see only the inputs known before the body', () => {
+    // In list order: a body rule, then an input rule that only a body input matches.
+    // Judged at head, the input rule would match first; judged at body, it follows the body rule.
+    beforeEach(() => (0, engine_1.setRemoteConfig)(remote([rule('body-rule', 'request.body["role"] != null'), rule('input-rule', 'input.key == "body.role"')])));
+    const atBody = ['custom.body-rule', 'custom.input-rule'];
+    it('capture core: a body captured before the head is judged', () => {
+        const ctx = (0, capture_1.captureRequest)({ framework: 'test', method: 'POST', url: '/a', headers: JSON_POST });
+        (0, capture_1.captureBody)(ctx, { body: { role: 'admin' }, contentType: 'application/json' });
+        (0, capture_1.runVirtualPatches)(ctx);
+        expect(fired()).toEqual(atBody);
+    });
+    it('raspExpress with an already-parsed body', () => {
+        const next = jest.fn();
+        (0, middleware_1.raspExpress)()({ method: 'POST', url: '/a', originalUrl: '/a', headers: JSON_POST, query: {}, params: {}, body: { role: 'admin' } }, res(), next);
+        expect(next).toHaveBeenCalled();
+        expect(fired()).toEqual(atBody);
+    });
+    it('raspKoa with an already-parsed body', async () => {
+        const k = { method: 'POST', url: '/a', headers: JSON_POST, query: {}, request: { body: { role: 'admin' } }, set: jest.fn() };
+        await (0, middleware_1.raspKoa)()(k, jest.fn(async () => undefined));
+        expect(fired()).toEqual(atBody);
+    });
+    it('raspHttp with a body a parser set', () => {
+        const handler = jest.fn();
+        (0, middleware_1.raspHttp)(handler)({ method: 'POST', url: '/a', headers: JSON_POST, body: { role: 'admin' }, socket: {} }, res());
+        expect(handler).toHaveBeenCalled();
+        expect(fired()).toEqual(atBody);
+    });
+    it('raspFastify (body arrives in preHandler)', () => {
+        const { hooks, reply } = fastify();
+        const request = { method: 'POST', url: '/a', headers: JSON_POST, query: {}, params: {} };
+        hooks.onRequest(request, reply, jest.fn());
+        request.body = { role: 'admin' };
+        const next = jest.fn();
+        hooks.preHandler(request, reply, next);
+        expect(next).toHaveBeenCalled();
+        expect(fired()).toEqual(atBody);
+    });
+    it('withRasp (body read from a clone)', async () => {
+        const out = await (0, middleware_1.withRasp)(async () => new Response('ran'))(new Request('http://localhost/a', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{"role":"admin"}' }), {});
+        expect(await out.text()).toBe('ran');
+        expect(fired()).toEqual(atBody);
+    });
+    it('upload file names join at body too', () => {
+        (0, engine_1.setRemoteConfig)(remote([rule('body-rule', 'request.method == "POST" && request.body["x"] == null'), rule('upload-name', 'input.key == "body.doc.filename"')]));
+        const next = jest.fn();
+        (0, middleware_1.raspExpress)()({ method: 'POST', url: '/up', originalUrl: '/up', headers: { 'content-length': '10' }, query: {}, params: {}, body: {}, files: [{ fieldname: 'doc', originalname: 'a.txt' }] }, res(), next);
+        expect(fired()).toEqual(['custom.body-rule', 'custom.upload-name']);
+    });
+    it('a head input rule still matches at head', () => {
+        (0, engine_1.setRemoteConfig)(remote([rule('body-rule', 'request.body["role"] != null'), rule('q', 'input.key == "query.a"')]));
+        const ctx = (0, capture_1.captureRequest)({ framework: 'test', method: 'POST', url: '/a?a=1', headers: JSON_POST });
+        (0, capture_1.captureBody)(ctx, { body: { role: 'admin' }, contentType: 'application/json' });
+        (0, capture_1.runVirtualPatches)(ctx);
+        expect(fired()).toEqual(['custom.q', 'custom.body-rule']);
+    });
+});
+describe('a request with no body has a known, empty body', () => {
+    beforeEach(() => (0, engine_1.setRemoteConfig)(remote([rule('no-role', 'request.body["role"] == null')])));
+    it('raspHttp GET', () => {
+        (0, middleware_1.raspHttp)(jest.fn())({ method: 'GET', url: '/a', headers: {}, httpVersionMajor: 1, socket: {} }, res());
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('raspHttp empty POST (content-length 0)', () => {
+        (0, middleware_1.raspHttp)(jest.fn())({ method: 'POST', url: '/a', headers: { 'content-length': '0' }, httpVersionMajor: 1, socket: {} }, res());
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('raspHttp POST with a body the handler has not read stays unknown until recordRequestBody', () => {
+        const handler = jest.fn((_q, _r) => {
+            expect(fired()).toEqual([]);
+            (0, middleware_1.recordRequestBody)('{}', 'application/json');
+        });
+        (0, middleware_1.raspHttp)(handler)({ method: 'POST', url: '/a', headers: JSON_POST, httpVersionMajor: 1, socket: {} }, res());
+        expect(handler).toHaveBeenCalled();
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('a body that arrives anyway (no length sent) is still captured as input', () => {
+        let keys = [];
+        const handler = jest.fn((_q, _r) => {
+            (0, middleware_1.recordRequestBody)({ file: '../../etc/passwd' });
+            keys = ((0, context_1.currentContext)()?.inputs ?? []).map((i) => i.key);
+        });
+        (0, middleware_1.raspHttp)(handler)({ method: 'POST', url: '/a', headers: {}, httpVersionMajor: 1, socket: {} }, res());
+        expect(fired()).toEqual(['custom.no-role']);
+        expect(keys).toContain('body.file');
+    });
+    it('raspExpress GET without a body parser', () => {
+        (0, middleware_1.raspExpress)()({ method: 'GET', url: '/a', originalUrl: '/a', headers: {}, httpVersionMajor: 1, query: {}, params: {} }, res(), jest.fn());
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('raspExpress empty JSON body', () => {
+        (0, middleware_1.raspExpress)()({ method: 'POST', url: '/a', originalUrl: '/a', headers: JSON_POST, query: {}, params: {}, body: {} }, res(), jest.fn());
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('raspKoa GET', async () => {
+        const k = { method: 'GET', url: '/a', headers: {}, query: {}, request: {}, req: { httpVersionMajor: 1 }, set: jest.fn() };
+        await (0, middleware_1.raspKoa)()(k, jest.fn(async () => undefined));
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('raspFastify GET', () => {
+        const { hooks, reply } = fastify();
+        const request = { method: 'GET', url: '/a', headers: {}, query: {}, params: {} };
+        hooks.onRequest(request, reply, jest.fn());
+        const next = jest.fn();
+        hooks.preHandler(request, reply, next);
+        expect(next).toHaveBeenCalled();
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it.each([
+        ['GET with Content-Length: 0 and a content type', 'GET', { 'content-type': 'application/json', 'content-length': '0' }],
+        ['GET with a content type and no length', 'GET', { 'content-type': 'application/json' }],
+        ['POST with Content-Length: 0 and a content type the parser leaves unset', 'POST', { 'content-type': 'application/json', 'content-length': '0' }],
+    ])('raspFastify %s', (_name, method, headers) => {
+        const { hooks, reply } = fastify();
+        const request = { method, url: '/a', headers, query: {}, params: {} };
+        hooks.onRequest(request, reply, jest.fn());
+        hooks.preHandler(request, reply, jest.fn());
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('raspFastify multipart left unparsed stays unknown', () => {
+        const { hooks, reply } = fastify();
+        const request = { method: 'POST', url: '/a', headers: { 'content-type': 'multipart/form-data; boundary=x', 'content-length': '99' }, query: {}, params: {} };
+        hooks.onRequest(request, reply, jest.fn());
+        hooks.preHandler(request, reply, jest.fn());
+        expect(fired()).toEqual([]);
+    });
+    it('withRasp GET', async () => {
+        const out = await (0, middleware_1.withRasp)(async () => new Response('ran'))(new Request('http://localhost/a'), {});
+        expect(await out.text()).toBe('ran');
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('withRasp empty POST', async () => {
+        await (0, middleware_1.withRasp)(async () => new Response('ran'))(new Request('http://localhost/a', { method: 'POST' }), {});
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('a body-phase rule can block a body-less request', () => {
+        (0, engine_1.setRemoteConfig)(remote([rule('no-role', 'request.method == "GET" && request.body["role"] == null', 'block')], { custom_rule: 'block' }));
+        const handler = jest.fn();
+        const r = res();
+        (0, middleware_1.raspHttp)(handler)({ method: 'GET', url: '/a', headers: {}, httpVersionMajor: 1, socket: {} }, r);
+        expect(handler).not.toHaveBeenCalled();
+        expect(r.statusCode).toBe(403);
+    });
+});
+async function serve(listener, path, opts = {}) {
+    (0, auto_http_1.installAutoHttpCapture)();
+    const server = (0, http_1.createServer)(listener);
+    await new Promise((ok) => server.listen(0, '127.0.0.1', () => ok()));
+    try {
+        const { port } = server.address();
+        return await new Promise((ok, fail) => {
+            const rq = (0, http_1.request)(`http://127.0.0.1:${port}${path}`, { method: opts.method ?? 'GET', headers: opts.headers }, (r) => {
+                r.resume();
+                r.on('end', () => ok(r.statusCode || 0));
+            }).on('error', fail);
+            rq.end(opts.body);
+        });
+    }
+    finally {
+        server.closeAllConnections();
+        await new Promise((ok) => server.close(ok));
+        (0, auto_http_1.uninstallAutoHttpCapture)();
+    }
+}
+describe('the zero-code http capture', () => {
+    it('runs the body phase for a GET', async () => {
+        (0, engine_1.setRemoteConfig)(remote([rule('no-role', 'request.body["role"] == null')]));
+        expect(await serve((_q, r) => r.end('ran'), '/a')).toBe(200);
+        expect(fired()).toEqual(['custom.no-role']);
+    });
+    it('a rule matches once when framework middleware replaces its context (GET)', async () => {
+        (0, engine_1.setRemoteConfig)(remote([rule('q', 'input.key == "query.a"'), rule('no-role', 'request.body["role"] == null')]));
+        const status = await serve((req, r) => {
+            const q = req;
+            q.originalUrl = req.url;
+            q.query = { a: '1' };
+            q.params = {};
+            (0, middleware_1.raspExpress)()(q, r, () => r.end('ran'));
+        }, '/a?a=1');
+        expect(status).toBe(200);
+        expect(fired()).toEqual(['custom.q', 'custom.no-role']);
+    });
+    it('a rule matches once when framework middleware replaces its context (POST body)', async () => {
+        (0, engine_1.setRemoteConfig)(remote([rule('q', 'input.key == "query.a"')]));
+        const status = await serve((req, r) => {
+            const q = req;
+            q.originalUrl = req.url;
+            q.query = { a: '1' };
+            q.params = {};
+            q.body = { role: 'admin' };
+            (0, middleware_1.raspExpress)()(q, r, () => r.end('ran'));
+        }, '/a?a=1', { method: 'POST', body: '{"role":"admin"}', headers: { 'content-type': 'application/json' } });
+        expect(status).toBe(200);
+        expect(fired()).toEqual(['custom.q']);
+    });
+});
+describe('findings raised during capture are judged with the request current', () => {
+    it('an upload finding rule sees request.ip and the inputs (raspExpress)', () => {
+        (0, engine_1.setRemoteConfig)(remote([rule('upload', 'attack.type == "file_write" && request.ip == "10.0.0.9" && input.key == "body.f.filename"', 'block')], { custom_rule: 'block' }));
+        const next = jest.fn();
+        const r = res();
+        (0, middleware_1.raspExpress)()({ method: 'POST', url: '/up', originalUrl: '/up', headers: {}, ip: '10.0.0.9', query: {}, params: {}, body: {}, files: [{ fieldname: 'f', originalname: 'shell.php' }] }, r, next);
+        expect(next).not.toHaveBeenCalled();
+        expect(r.statusCode).toBe(403);
+        expect(JSON.parse(r.body)).toMatchObject({ rule: 'custom.upload' });
+    });
+    it('a late upload check blocks through recordRequestBody', () => {
+        (0, engine_1.setRemoteConfig)(remote([rule('upload', 'attack.type == "file_write" && request.path == "/up"', 'block')], { custom_rule: 'block' }));
+        let thrown;
+        (0, middleware_1.raspHttp)((_q, _r) => {
+            try {
+                (0, middleware_1.recordRequestBody)('--x\r\ncontent-disposition: form-data; name="f"; filename="shell.php"\r\n\r\n<?php\r\n--x--', 'multipart/form-data; boundary=x');
+            }
+            catch (e) {
+                thrown = e;
+            }
+        })({ method: 'POST', url: '/up', headers: { 'content-length': '80' }, httpVersionMajor: 1, socket: {} }, res());
+        expect(thrown).toBeInstanceOf(types_1.RaspBlockedError);
+    });
+});
+//# sourceMappingURL=rule-phases.test.js.map

package/dist/rasp/__tests__/rule-phases.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-phases.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/rule-phases.test.ts"],"names":[],"mappings":";;AAAA;;;;;;;;;;GAUG;AACH,+BAA+F;AAE/F,4CAAgF;AAChF,wCAA4E;AAC5E,wCAA4C;AAC5C,kDAA0D;AAC1D,sCAA8F;AAC9F,8CAAyG;AACzG,oCAA4C;AAG5C,IAAI,MAAM,GAAY,EAAE,CAAC;AAEzB,SAAS,MAAM,CAAC,WAAsB,EAAE,UAAmC,EAAE;IAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;AAC5J,CAAC;AACD,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,UAAkB,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAE3H,UAAU,CAAC,GAAG,EAAE;IACd,IAAA,sCAAuB,GAAE,CAAC;IAC1B,MAAM,GAAG,EAAE,CAAC;IACZ,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,GAAG,EAAE;IACb,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,IAAA,wBAAe,EAAC,SAAS,CAAC,CAAC;IAC3B,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAExI,SAAS,GAAG;IACV,MAAM,CAAC,GAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IACjH,CAAC,CAAC,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO;IACd,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,IAAA,wBAAW,EAAC,EAAE,OAAO,EAAE,CAAC,IAAY,EAAE,EAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpG,MAAM,KAAK,GAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;IAChJ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,SAAS,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;AAEjF,QAAQ,CAAC,sDAAsD,EAAE,GAAG,EAAE;IACpE,iFAAiF;IACjF,8FAA8F;IAC9F,UAAU,CAAC,GAAG,EAAE,CACd,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,8BAA8B,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAC7H,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IAEzD,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,GAAG,GAAG,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACjG,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/E,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,IAAA,wBAAW,GAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QACxJ,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,CAAC,GAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;QAClI,MAAM,IAAA,oBAAO,GAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1B,IAAA,qBAAQ,EAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACxH,MAAM,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC9F,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,GAAG,GAAG,MAAM,IAAA,qBAAQ,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CACzD,IAAI,OAAO,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EAChI,EAAE,CACH,CAAC;QACF,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,uDAAuD,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/J,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,IAAA,wBAAW,GAAE,CACX,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,EAAS,EACrL,GAAG,EAAE,EACL,IAAI,CACL,CAAC;QACF,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,8BAA8B,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC;QAClH,MAAM,GAAG,GAAG,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/E,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,UAAU,CAAC,GAAG,EAAE,CAAC,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7F,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,IAAA,qBAAQ,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,IAAA,qBAAQ,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACtI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,GAAG,EAAE;QAClG,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,EAAW,EAAE,EAAW,EAAE,EAAE;YACnD,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAA,8BAAiB,EAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAA,qBAAQ,EAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACpH,MAAM,CAAC,OAAO,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,EAAW,EAAE,EAAW,EAAE,EAAE;YACnD,IAAA,8BAAiB,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChD,IAAI,GAAG,CAAC,IAAA,wBAAc,GAAE,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,IAAA,qBAAQ,EAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7G,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,IAAA,wBAAW,GAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjJ,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,IAAA,wBAAW,GAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9I,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;QAC3B,MAAM,CAAC,GAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;QAC/H,MAAM,IAAA,oBAAO,GAAE,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;QACzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACtF,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,+CAA+C,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;QACvH,CAAC,uCAAuC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACxF,CAAC,wEAAwE,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;KAClJ,CAAC,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;QAC9C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC3E,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAClK,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAA,qBAAQ,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,IAAA,qBAAQ,EAAC,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3G,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,yDAAyD,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACzI,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,IAAA,qBAAQ,EAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,CAAC,CAAC,CAAC;QACxG,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,KAAK,CAAC,QAAgD,EAAE,IAAY,EAAE,OAA6E,EAAE;IAClK,IAAA,kCAAsB,GAAE,CAAC;IACzB,MAAM,MAAM,GAAW,IAAA,mBAAY,EAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QACjD,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE;YAC5C,MAAM,EAAE,GAAG,IAAA,cAAW,EAAC,oBAAoB,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;gBACvH,CAAC,CAAC,MAAM,EAAE,CAAC;gBACX,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,IAAA,oCAAwB,GAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;QAChH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACpC,MAAM,CAAC,GAAG,GAAU,CAAC;YACrB,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;YACrB,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;YACd,IAAA,wBAAW,GAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACT,MAAM,CAAC,GAAG,GAAU,CAAC;YACrB,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;YACrB,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;YACd,CAAC,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,IAAA,wBAAW,GAAE,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC,EACD,QAAQ,EACR,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAC9F,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oEAAoE,EAAE,GAAG,EAAE;IAClF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,IAAA,wBAAe,EACb,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,2FAA2F,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CACzJ,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,IAAA,wBAAW,GAAE,CACX,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,EAAS,EAC/K,CAAC,EACD,IAAI,CACL,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,IAAA,wBAAe,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,sDAAsD,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACrI,IAAI,MAAe,CAAC;QACpB,IAAA,qBAAQ,EAAC,CAAC,EAAW,EAAE,EAAW,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,IAAA,8BAAiB,EAAC,6FAA6F,EAAE,iCAAiC,CAAC,CAAC;YACtJ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,GAAG,CAAC,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACvH,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,wBAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/sinks-hook.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/sinks-hook.test.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Sink rules: validation, the generic wrapper running the named check, the
+ * rule's action capping the decision, rule sets replacing each other, and
+ * built-in hooks never wrapped twice. Fake modules only.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const detect = __importStar(require("../detect"));
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const db_1 = require("../hooks/db");
+const sinks_1 = require("../hooks/sinks");
+const types_1 = require("../types");
+const hook_kit_1 = require("./hook-kit");
+const corpus_1 = require("./corpus");
+const input = "' OR '1'='1";
+const query = `SELECT * FROM products WHERE name = '${input}'`;
+const req = (value) => ({ value, key: 'query.q', source: 'request' });
+const tainted = (fn, trees = []) => (0, context_1.runWithInputs)([req(input)], fn, { inRequest: true, trees });
+const rule = (extra = {}) => (0, sinks_1.parseSinkRule)({ id: 'sink.fake.query', module: 'fake-driver', target: 'Connection.prototype.query', check: 'sql', dialect: 'postgres', action: 'block', ...extra });
+function fakeDriver() {
+    const original = jest.fn((..._values) => 'rows');
+    class Connection {
+    }
+    Object.defineProperty(Connection.prototype, 'query', { value: original, configurable: true, writable: true });
+    return { original, exports: { Connection }, Connection: Connection };
+}
+const events = [];
+beforeEach(() => {
+    events.length = 0;
+    (0, engine_1.configureEngine)({ enabled: true, applicationName: 'a', mode: 'block', env: {} });
+    (0, engine_1.setEventSink)({ add: (e) => events.push(e) });
+});
+afterEach(() => {
+    (0, sinks_1.setSinkRules)([]);
+    jest.restoreAllMocks();
+    (0, engine_1.setEventSink)(undefined);
+    (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+});
+describe('parseSinkRule', () => {
+    it('accepts a complete rule and fills defaults', () => {
+        expect((0, sinks_1.parseSinkRule)({ id: 'sink.x', module: '@scope/pkg', target: 'default.query', check: 'sql' })).toMatchObject({ arg: 0, action: 'monitor' });
+        for (const dialect of ['oracle', 'db2'])
+            expect((0, sinks_1.parseSinkRule)({ id: 'sink.x', module: 'm', target: 'a', check: 'sql', dialect })).toMatchObject({ dialect });
+    });
+    it.each([
+        ['no id', { module: 'm', target: 'a', check: 'sql' }],
+        ['an id with a hyphen', { id: 'sink.my-driver.query', module: 'm', target: 'a', check: 'sql' }],
+        ['an id too long for the event sink', { id: `s${'x'.repeat(59)}`, module: 'm', target: 'a', check: 'sql' }],
+        ['__proto__ in the path', { id: 'x', module: 'm', target: 'a.__proto__.b', check: 'sql' }],
+        ['constructor in the path', { id: 'x', module: 'm', target: 'constructor', check: 'sql' }],
+        ['too deep a path', { id: 'x', module: 'm', target: 'a.b.c.d.e', check: 'sql' }],
+        ['an unknown check', { id: 'x', module: 'm', target: 'a', check: 'eval-anything' }],
+        ['deser without a format', { id: 'x', module: 'm', target: 'a', check: 'deser' }],
+        ['an action of off', { id: 'x', module: 'm', target: 'a', check: 'sql', action: 'off' }],
+        ['another runtime only', { id: 'x', module: 'm', target: 'a', check: 'sql', runtimes: ['python'] }],
+        ['a module path with ..', { id: 'x', module: '../m', target: 'a', check: 'sql' }],
+        ['a field that is not a name', { id: 'x', module: 'm', target: 'a', check: 'sql', field: 'a.b' }],
+    ])('drops %s', (_n, raw) => {
+        expect((0, sinks_1.parseSinkRule)(raw)).toBeNull();
+    });
+    it('keeps the valid rules of a list, at most 64, first id wins', () => {
+        const many = Array.from({ length: 70 }, (_, i) => ({ id: `r${i}`, module: 'm', target: 'a', check: 'sql' }));
+        expect((0, sinks_1.parseSinkRules)([{ bad: true }, ...many])).toHaveLength(64);
+        expect((0, sinks_1.parseSinkRules)([{ id: 'a', module: 'm', target: 'x', check: 'sql' }, { id: 'a', module: 'm', target: 'y', check: 'sql' }])[0].target).toBe('x');
+        expect((0, sinks_1.parseSinkRules)('nope')).toEqual([]);
+    });
+    it('the built-in list is the contract copy and parses', () => {
+        const embedded = (0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', 'data', 'default-sinks.json'));
+        expect(embedded.equals((0, fs_1.readFileSync)((0, path_1.join)(corpus_1.RASP_DIR, 'rules', 'default-sinks.json')))).toBe(true);
+        expect(Array.isArray(sinks_1.BUILT_IN_SINKS)).toBe(true);
+    });
+});
+describe('a rule at work', () => {
+    it('blocks when the rule and the attack mode both say block, with the rule as the sink', () => {
+        const d = fakeDriver();
+        (0, sinks_1.applySinkRule)(rule(), d.exports);
+        expect(() => tainted(() => new d.Connection().query(query))).toThrow(types_1.RaspBlockedError);
+        expect(d.original).not.toHaveBeenCalled();
+        expect(events[0].attrs['shield360.rasp.sink']).toBe('rule:sink.fake.query');
+    });
+    it('a monitor rule only reports, even in block mode', () => {
+        const d = fakeDriver();
+        (0, sinks_1.applySinkRule)(rule({ action: 'monitor' }), d.exports);
+        expect(tainted(() => new d.Connection().query(query))).toBe('rows');
+        expect(events[0].attrs['shield360.rasp.decision']).toBe('monitored');
+    });
+    it('reads an object argument through field, and passes bound parameters', () => {
+        const d = fakeDriver();
+        (0, sinks_1.applySinkRule)(rule({ field: 'sql' }), d.exports);
+        expect(() => tainted(() => new d.Connection().query({ sql: query }))).toThrow(types_1.RaspBlockedError);
+        expect(tainted(() => new d.Connection().query('SELECT * FROM products WHERE name = $1', [input]))).toBe('rows');
+    });
+    it('runs the nosql check on the request trees', () => {
+        const d = fakeDriver();
+        (0, sinks_1.applySinkRule)(rule({ check: 'nosql' }), d.exports);
+        const body = { name: { $ne: null } };
+        expect(() => tainted(() => new d.Connection().query({ name: body.name }), [body])).toThrow(types_1.RaspBlockedError);
+    });
+    it('a new rule set switches the old rules off at once', () => {
+        const d = fakeDriver();
+        (0, sinks_1.applySinkRule)(rule(), d.exports);
+        (0, sinks_1.setSinkRules)([]);
+        expect(tainted(() => new d.Connection().query(query))).toBe('rows');
+        expect(d.Connection.prototype.query).toBe(d.original);
+    });
+    it('never wraps a function a built-in hook already checks', () => {
+        class Client {
+            query(...v) {
+                return v.length;
+            }
+        }
+        (0, db_1.patchPg)({ Client });
+        const wrapped = Client.prototype.query;
+        const detector = jest.spyOn(detect, 'detectSql');
+        (0, sinks_1.applySinkRule)(rule({ module: 'pg', target: 'Client.prototype.query' }), { Client });
+        expect(Client.prototype.query).toBe(wrapped);
+        expect(() => tainted(() => new Client().query(query))).toThrow(types_1.RaspBlockedError);
+        expect(detector).toHaveBeenCalledTimes(1);
+        (0, db_1.unpatchPg)({ Client });
+    });
+    it('a target that does not exist leaves the module alone', () => {
+        const d = fakeDriver();
+        (0, sinks_1.applySinkRule)(rule({ target: 'Missing.prototype.query' }), d.exports);
+        expect(d.Connection.prototype.query).toBe(d.original);
+    });
+});
+const contractDriver = fakeDriver();
+(0, hook_kit_1.describeHookContract)({
+    name: 'sink rule (sql)',
+    install: () => {
+        (0, sinks_1.applySinkRule)(rule(), contractDriver.exports);
+        return true;
+    },
+    uninstall: () => (0, sinks_1.setSinkRules)([]),
+    replaced: [{ owner: contractDriver.Connection.prototype, key: 'query' }],
+    trigger: () => new contractDriver.Connection().query(query),
+    inputs: [req(input)],
+    detector: { module: detect, name: 'detectSql' },
+    attack: 'sql_injection',
+});
+//# sourceMappingURL=sinks-hook.test.js.map

package/dist/rasp/__tests__/sinks-hook.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sinks-hook.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/sinks-hook.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;GAIG;AACH,2BAAkC;AAClC,+BAA4B;AAC5B,kDAAoC;AACpC,wCAA2C;AAC3C,sCAA0D;AAC1D,oCAAiD;AACjD,0CAA2H;AAC3H,oCAA4D;AAC5D,yCAAkD;AAClD,qCAAoC;AAEpC,MAAM,KAAK,GAAG,aAAa,CAAC;AAC5B,MAAM,KAAK,GAAG,wCAAwC,KAAK,GAAG,CAAC;AAC/D,MAAM,GAAG,GAAG,CAAC,KAAa,EAAa,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AACzF,MAAM,OAAO,GAAG,CAAI,EAAW,EAAE,QAAmB,EAAE,EAAK,EAAE,CAAC,IAAA,uBAAa,EAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAE1H,MAAM,IAAI,GAAG,CAAC,QAA2B,EAAE,EAAY,EAAE,CACvD,IAAA,qBAAa,EAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAE,CAAC;AAEvK,SAAS,UAAU;IACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,OAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,UAAU;KAAG;IACnB,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,UAA4F,EAAE,CAAC;AACzJ,CAAC;AAED,MAAM,MAAM,GAAwC,EAAE,CAAC;AACvD,UAAU,CAAC,GAAG,EAAE;IACd,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACjF,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,GAAG,EAAE;IACb,IAAA,oBAAY,EAAC,EAAE,CAAC,CAAC;IACjB,IAAI,CAAC,eAAe,EAAE,CAAC;IACvB,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;IACxB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,IAAA,qBAAa,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClJ,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,IAAA,qBAAa,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/J,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC/F,CAAC,mCAAmC,EAAE,EAAE,EAAE,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC3G,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAChF,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACnF,CAAC,wBAAwB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACjF,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACxF,CAAC,sBAAsB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnG,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACjF,CAAC,4BAA4B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;KAClG,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;QACzB,MAAM,CAAC,IAAA,qBAAa,EAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7G,MAAM,CAAC,IAAA,sBAAc,EAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,IAAA,sBAAc,EAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvJ,MAAM,CAAC,IAAA,sBAAc,EAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,QAAQ,GAAG,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACnF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAA,iBAAY,EAAC,IAAA,WAAI,EAAC,iBAAQ,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;QACvB,IAAA,qBAAa,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;QACvF,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;QACvB,IAAA,qBAAa,EAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;QACvB,IAAA,qBAAa,EAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;QAChG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,wCAAwC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;QACvB,IAAA,qBAAa,EAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;QACvB,IAAA,qBAAa,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACjC,IAAA,oBAAY,EAAC,EAAE,CAAC,CAAC;QACjB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM;YACV,KAAK,CAAC,GAAG,CAAY;gBACnB,OAAO,CAAC,CAAC,MAAM,CAAC;YAClB,CAAC;SACF;QACD,IAAA,YAAO,EAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACjD,IAAA,qBAAa,EAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;QACjF,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAA,cAAS,EAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;QACvB,IAAA,qBAAa,EAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,UAAU,EAAE,CAAC;AACpC,IAAA,+BAAoB,EAAC;IACnB,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,GAAG,EAAE;QACZ,IAAA,qBAAa,EAAC,IAAI,EAAE,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,oBAAY,EAAC,EAAE,CAAC;IACjC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACxE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;IAC3D,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;IAC/C,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC"}

package/dist/rasp/__tests__/targets.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/rasp/__tests__/targets.test.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Allow-list targets and the SQL dialect (README "Events", "Allow-list
+ * targets"): the shared conformance file, the detectors, and the engine's
+ * gating on the signed `reportTargets` flag.
+ */
+const detect_1 = require("../detect");
+const engine_1 = require("../engine");
+const corpus_1 = require("./corpus");
+const targets = (0, corpus_1.loadJson)('testdata/targets.json');
+describe('targets.json conformance', () => {
+    it('masks every raw target as the file says', () => {
+        for (const c of targets.mask)
+            expect([c.raw, (0, engine_1.maskTarget)(c.raw) ?? null]).toEqual([c.raw, c.target]);
+    });
+    it('gives every resolved path its directory', () => {
+        for (const c of targets.directory)
+            expect((0, detect_1.targetDirectory)(c.resolved)).toBe(c.directory);
+    });
+});
+describe('detectors', () => {
+    const inp = (value) => [{ value, key: 'query.q', source: 'request' }];
+    it('shell_spawn.shell names the executable basename, never the arguments', () => {
+        const f = (0, detect_1.detectShellSpawn)({ argv0: '/usr/bin/BASH.exe', inRequest: true, allow: [] });
+        expect(f).toMatchObject({ rule: 'shell_spawn.shell', target: 'bash' });
+    });
+    it('outbound.not_allowed names the host only', () => {
+        expect((0, detect_1.detectOutbound)('https://API.Example.com:8443/p?q=1', ['ok.example.com'])).toMatchObject({ target: 'api.example.com' });
+    });
+    it('path.outside_root names the directory, never the file name; other path rules name nothing', () => {
+        const f = (0, detect_1.detectPath)('/var/data/report.txt', 'read', inp('report.txt'), ['/srv/app']);
+        expect(f).toMatchObject({ rule: 'path.outside_root', target: '/var/data' });
+        expect((0, detect_1.detectPath)('/srv/app/../../etc/passwd', 'read', inp('../../etc/passwd'), ['/srv/app'])?.target).toBeUndefined();
+    });
+    it('SQL findings carry the dialect', () => {
+        expect((0, detect_1.detectSql)("SELECT * FROM t WHERE id = 1 OR 1=1", inp('1 OR 1=1'), 'postgres')).toMatchObject({ rule: 'sqli.userinput', dialect: 'postgres' });
+        expect((0, detect_1.detectSql)("SELECT * FROM t WHERE id = 1 OR 1=1", inp('1 OR 1=1'))?.dialect).toBe('generic');
+    });
+});
+describe('engine', () => {
+    const events = [];
+    const remote = (over = {}) => ({ version: 'v1', exp: Date.now() / 1000 + 3600, killSwitch: false, snippets: false, attacks: {}, rules: null, ...over });
+    const outbound = { attack: 'outbound', rule: 'outbound.not_allowed', target: 'api.example.com' };
+    const attrs = (f) => {
+        events.length = 0;
+        (0, engine_1.handleFinding)(f, 'http.request');
+        return events[0].attrs;
+    };
+    beforeEach(() => {
+        (0, engine_1.configureEngine)({ enabled: true, applicationName: 'orders-api', env: {} });
+        (0, engine_1.setEventSink)({ add: (e) => events.push(e) });
+    });
+    afterAll(() => {
+        (0, engine_1.setEventSink)(undefined);
+        (0, engine_1.configureEngine)({ enabled: false, applicationName: 'default', env: {} });
+    });
+    it('sends the target only with the signed reportTargets flag', () => {
+        expect(attrs(outbound)['shield360.rasp.target']).toBeUndefined();
+        (0, engine_1.setRemoteConfig)(remote({ reportTargets: false }));
+        expect(attrs(outbound)['shield360.rasp.target']).toBeUndefined();
+        (0, engine_1.setRemoteConfig)(remote({ reportTargets: true }));
+        expect(attrs(outbound)['shield360.rasp.target']).toBe('api.example.com');
+        expect(attrs({ attack: 'shell_spawn', rule: 'shell_spawn.shell', target: 'curl' })['shield360.rasp.target']).toBe('curl');
+    });
+    it('only for the three allow-list rules', () => {
+        (0, engine_1.setRemoteConfig)(remote({ reportTargets: true }));
+        expect(attrs({ attack: 'path_traversal', rule: 'path.traversal', target: '/var/data' })['shield360.rasp.target']).toBeUndefined();
+    });
+    it('masked and capped', () => {
+        (0, engine_1.setRemoteConfig)(remote({ reportTargets: true }));
+        expect(attrs({ ...outbound, target: `${'abcdefghijklmnopqrstuvwxyz0123'}.example.com` })['shield360.rasp.target']).toBe('***.example.com');
+        expect(attrs({ attack: 'path_traversal', rule: 'path.outside_root', target: '/ab'.repeat(100) })['shield360.rasp.target']).toBeUndefined();
+    });
+    it('SQL events carry the dialect whatever reportTargets says; unknown dialects are left out', () => {
+        const sql = { attack: 'sql_injection', rule: 'sqli.userinput', dialect: 'oracle' };
+        expect(attrs(sql)['shield360.rasp.sql.dialect']).toBe('oracle');
+        expect(attrs({ ...sql, dialect: 'cobol' })['shield360.rasp.sql.dialect']).toBeUndefined();
+        expect(attrs(outbound)['shield360.rasp.sql.dialect']).toBeUndefined();
+    });
+});
+//# sourceMappingURL=targets.test.js.map

package/dist/rasp/__tests__/targets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"targets.test.js","sourceRoot":"","sources":["../../../src/rasp/__tests__/targets.test.ts"],"names":[],"mappings":";;AAAA;;;;GAIG;AACH,sCAAqG;AACrG,sCAAyH;AAEzH,qCAAoC;AAEpC,MAAM,OAAO,GAAG,IAAA,iBAAQ,EAAC,uBAAuB,CAAC,CAAC;AAElD,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAgD;YAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAA,mBAAU,EAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAClJ,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,SAAsD;YAAE,MAAM,CAAC,IAAA,wBAAe,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxI,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC;IACvF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,GAAG,IAAA,yBAAgB,EAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,IAAA,uBAAc,EAAC,oCAAoC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChI,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,CAAC,GAAG,IAAA,mBAAU,EAAC,sBAAsB,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAA,mBAAU,EAAC,2BAA2B,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IACzH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,IAAA,kBAAS,EAAC,qCAAqC,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACrJ,MAAM,CAAC,IAAA,kBAAS,EAAC,qCAAqC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,OAA8B,EAAE,EAAgB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7L,MAAM,QAAQ,GAAY,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1G,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE;QAC3B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAClB,IAAA,sBAAa,EAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,KAA+B,CAAC;IACnD,CAAC,CAAC;IACF,UAAU,CAAC,GAAG,EAAE;QACd,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAA,qBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,EAAE;QACZ,IAAA,qBAAY,EAAC,SAAS,CAAC,CAAC;QACxB,IAAA,wBAAe,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACjE,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACjE,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5H,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACpI,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,IAAA,wBAAe,EAAC,MAAM,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,gCAAgC,cAAc,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3I,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC7I,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,GAAG,GAAY,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC5F,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rasp/__tests__/template-hook.test.d.ts

@@ -0,0 +1 @@
+export {};