shield360 1.1.0 → 1.2.1

package/dist/rasp/auto-http.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installAutoHttpCapture = installAutoHttpCapture;
+exports.uninstallAutoHttpCapture = uninstallAutoHttpCapture;
+exports.autoHttpCaptureInstalled = autoHttpCaptureInstalled;
+/**
+ * Zero-code request capture for RASP: every `http` and `https` server's
+ * `request` event runs inside a RASP request context, so sinks see the
+ * request's input without any framework middleware. `shield360/register`
+ * installs it when RASP is on.
+ *
+ * It patches `Server.prototype.emit` once, which covers Express, Fastify,
+ * Koa, Nest and raw `http` alike (they all serve through `http.Server`).
+ * A body a parser sets later on `req.body` is picked up when a sink first
+ * reads the inputs. Framework middleware added on top (`raspExpress()` and
+ * the others) replaces this context with its richer one and does not judge
+ * a phase this capture already judged (a custom rule matches at most once).
+ * A request with no body (no `Content-Length` or `Transfer-Encoding`) has a
+ * known, empty body here, so the body phase runs at once.
+ *
+ * Deception (deception.ts) runs here only for plain listeners, where the
+ * socket's peer is the client address and a plain `404 Not Found` is the
+ * normal answer: a decoy gets that 404 before the listener, and middleware
+ * added on top does not run deception again. When the listener is a framework
+ * app (Express 4/5, Koa, Fastify, and Nest on them), this capture never
+ * marks, judges or answers for deception: the framework knows the trusted
+ * client address (`trust proxy`) and has its own not-found, so its adapter
+ * (`raspExpress()`, `raspKoa()`, `raspFastify`) runs deception, and without
+ * the adapter such an app gets none.
+ *
+ * Fail open: when capture fails the request is served as before. A block
+ * thrown from a `request` listener, synchronously or as the rejection of an
+ * async listener (`http.createServer(async (req, res) => ...)`), becomes the
+ * contract's 403 instead of an unhandled rejection. Frameworks catch errors
+ * from their own route handlers, so a block raised there is the framework's to
+ * map (Express without `raspExpressErrorHandler()` answers a 500).
+ */
+const events_1 = require("events");
+const http = require("http");
+const https = require("https");
+const capture_1 = require("./capture");
+const context_1 = require("./context");
+const engine_1 = require("./engine");
+const deception_1 = require("./deception");
+const middleware_1 = require("./middleware");
+const types_1 = require("./types");
+const PATCHED = Symbol.for('shield360.rasp.autoHttp');
+let patched = [];
+const contentTypeOf = (req) => {
+    const v = req.headers?.['content-type'];
+    return typeof v === 'string' ? v : undefined;
+};
+/** The client address `request.ip` uses: the socket's peer (no framework is in the picture yet). */
+const peerOf = (req) => {
+    const v = req.socket?.remoteAddress;
+    return typeof v === 'string' && v ? v : undefined;
+};
+/** The request's context, or `blocked` when a virtual patch blocks, or nothing when capture failed. */
+function capture(req, deceptionDone) {
+    try {
+        const ctx = (0, capture_1.captureRequest)({ framework: 'http', method: req.method || 'GET', url: req.url || '/', headers: req.headers, ip: peerOf(req) });
+        ctx.auto = true;
+        if (deceptionDone)
+            ctx.deception = true;
+        const withBody = req;
+        const read = () => {
+            const files = withBody.files ?? withBody.file;
+            if (withBody.body === undefined && files === undefined)
+                return undefined;
+            return { body: withBody.body ?? {}, contentType: contentTypeOf(req), files };
+        };
+        const now = read();
+        if (now)
+            (0, capture_1.captureBody)(ctx, now);
+        else {
+            (0, capture_1.captureLater)(ctx, read);
+            if ((0, capture_1.bodyAbsent)(req.headers, req.httpVersionMajor))
+                (0, capture_1.captureNoBody)(ctx);
+        }
+        (0, capture_1.runVirtualPatches)(ctx);
+        return { ctx };
+    }
+    catch (e) {
+        if (e instanceof types_1.RaspBlockedError)
+            return { blocked: e };
+        return {};
+    }
+}
+const CAPTURE_REJECTION = events_1.EventEmitter.captureRejectionSymbol;
+/** What a rejected async listener's error would have met without the capture: the server's rejection handler, or an unhandled rejection. */
+function passOn(server, e, req, res) {
+    const s = server;
+    const kCapture = Object.getOwnPropertySymbols(s).find((k) => k.description === 'kCapture');
+    const handler = s[CAPTURE_REJECTION];
+    if (kCapture && s[kCapture] === true && typeof handler === 'function') {
+        handler.call(server, e, 'request', req, res);
+        return;
+    }
+    void Promise.reject(e);
+}
+/** Calls the `request` listeners as `emit` would, and maps a block from any of them, sync or async, to the 403. */
+function serve(server, req, res) {
+    const listeners = server.rawListeners('request');
+    if (listeners.length === 0)
+        return false;
+    for (const listener of listeners) {
+        let out;
+        try {
+            out = listener.call(server, req, res);
+        }
+        catch (e) {
+            if (e instanceof types_1.RaspBlockedError) {
+                (0, middleware_1.sendBlocked)(res, e);
+                return true;
+            }
+            throw e;
+        }
+        if (out && typeof out.then === 'function') {
+            out.then(undefined, (e) => {
+                if (e instanceof types_1.RaspBlockedError)
+                    (0, middleware_1.sendBlocked)(res, e);
+                else
+                    passOn(server, e, req, res);
+            });
+        }
+    }
+    return true;
+}
+function wrap(original) {
+    return function shield360Emit(event, ...args) {
+        if (event !== 'request' || !(0, engine_1.isActive)())
+            return original.call(this, event, ...args);
+        const req = args[0];
+        const res = args[1];
+        // A framework app's adapter runs deception with its own client address and not-found.
+        const plain = !(0, middleware_1.frameworkServes)(this);
+        if (plain) {
+            const d = (0, deception_1.checkDeception)({ framework: 'http', method: req.method || 'GET', url: req.url || '/', ip: peerOf(req) });
+            if (d.notFound) {
+                (0, middleware_1.sendNotFound)(res);
+                return true;
+            }
+            if (d.blocked) {
+                (0, middleware_1.sendBlocked)(res, d.blocked);
+                return true;
+            }
+        }
+        const r = capture(req, plain);
+        if (r.blocked) {
+            (0, middleware_1.sendBlocked)(res, r.blocked);
+            return true;
+        }
+        if (!r.ctx)
+            return original.call(this, event, ...args);
+        return context_1.storage.run(r.ctx, () => serve(this, req, res));
+    };
+}
+/** Installs the capture on `http.Server` and `https.Server`. Idempotent; returns whether it is in place. */
+function installAutoHttpCapture() {
+    try {
+        for (const S of [http.Server, https.Server]) {
+            const proto = S.prototype;
+            if (proto[PATCHED])
+                continue;
+            const own = Object.prototype.hasOwnProperty.call(proto, 'emit');
+            const original = proto.emit;
+            if (typeof original !== 'function')
+                continue;
+            proto.emit = wrap(original);
+            Object.defineProperty(proto, PATCHED, { value: true, configurable: true });
+            patched.push({ proto, own, original });
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Removes the capture (tests). */
+function uninstallAutoHttpCapture() {
+    for (const p of patched) {
+        if (p.own)
+            p.proto.emit = p.original;
+        else
+            delete p.proto.emit;
+        delete p.proto[PATCHED];
+    }
+    patched = [];
+}
+/** Whether the capture is installed. */
+function autoHttpCaptureInstalled() {
+    return Boolean(http.Server.prototype[PATCHED]);
+}
+//# sourceMappingURL=auto-http.js.map

package/dist/rasp/auto-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-http.js","sourceRoot":"","sources":["../../src/rasp/auto-http.ts"],"names":[],"mappings":";;AA2JA,wDAgBC;AAGD,4DAOC;AAGD,4DAEC;AA1LD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,mCAAsC;AACtC,6BAA8B;AAC9B,+BAAgC;AAEhC,uCAAoH;AACpH,uCAAsD;AACtD,qCAAoC;AACpC,2CAA6C;AAC7C,6CAA0E;AAC1E,mCAA2C;AAE3C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAKtD,IAAI,OAAO,GAAc,EAAE,CAAC;AAE5B,MAAM,aAAa,GAAG,CAAC,GAAoB,EAAsB,EAAE;IACjE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,GAAG,CAAC,GAAoB,EAAsB,EAAE;IAC1D,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;IACpC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC,CAAC;AAEF,uGAAuG;AACvG,SAAS,OAAO,CAAC,GAAoB,EAAE,aAAsB;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,wBAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3I,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,aAAa;YAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,GAA4E,CAAC;QAC9F,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;YAC9C,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACzE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;QAC/E,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;QACnB,IAAI,GAAG;YAAE,IAAA,qBAAW,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;aAC1B,CAAC;YACJ,IAAA,sBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC;gBAAE,IAAA,uBAAa,EAAC,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,IAAA,2BAAiB,EAAC,GAAG,CAAC,CAAC;QACvB,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,wBAAgB;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,qBAAY,CAAC,sBAAsB,CAAC;AAE9D,4IAA4I;AAC5I,SAAS,MAAM,CAAC,MAAe,EAAE,CAAU,EAAE,GAAoB,EAAE,GAAmB;IACpF,MAAM,CAAC,GAAG,MAA0C,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACrC,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QACrE,OAAqE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5G,OAAO;IACT,CAAC;IACD,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,mHAAmH;AACnH,SAAS,KAAK,CAAC,MAAkD,EAAE,GAAoB,EAAE,GAAmB;IAC1G,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAoD,CAAC;IACpG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,wBAAgB,EAAE,CAAC;gBAClC,IAAA,wBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACpB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,GAAG,IAAI,OAAQ,GAAwB,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/D,GAAwB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAU,EAAE,EAAE;gBACvD,IAAI,CAAC,YAAY,wBAAgB;oBAAE,IAAA,wBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;;oBAClD,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,QAAc;IAC1B,OAAO,SAAS,aAAa,CAAgB,KAAsB,EAAE,GAAG,IAAe;QACrF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAA,iBAAQ,GAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAoB,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAmB,CAAC;QACtC,sFAAsF;QACtF,MAAM,KAAK,GAAG,CAAC,IAAA,4BAAe,EAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,IAAA,0BAAc,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnH,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACf,IAAA,yBAAY,EAAC,GAAG,CAAC,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,IAAA,wBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,IAAA,wBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QACvD,OAAO,iBAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAkD,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,SAAgB,sBAAsB;IACpC,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,SAAwD,CAAC;YACzE,IAAI,KAAK,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAY,CAAC;YACpC,IAAI,OAAO,QAAQ,KAAK,UAAU;gBAAE,SAAS;YAC7C,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,SAAgB,wBAAwB;IACtC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,GAAG;YAAE,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;;YAChC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACzB,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,EAAE,CAAC;AACf,CAAC;AAED,wCAAwC;AACxC,SAAgB,wBAAwB;IACtC,OAAO,OAAO,CAAE,IAAI,CAAC,MAAM,CAAC,SAAgD,CAAC,OAAO,CAAC,CAAC,CAAC;AACzF,CAAC"}

package/dist/rasp/baseline.d.ts

@@ -0,0 +1,35 @@
+import type { Finding } from './types';
+/**
+ * End of life of each Node.js release line (the last day it gets security
+ * fixes). Odd lines end six months after their release; only the long-term
+ * lines an app is likely to run are listed.
+ */
+export declare const NODE_END_OF_LIFE: Readonly<Record<number, string>>;
+export type BaselineInput = {
+    env: NodeJS.ProcessEnv;
+    /** The SDK's own environment name (init option). */
+    environment?: string;
+    /** A signed config was expected (URL and API key set, remote on). */
+    remoteWanted: boolean;
+    /** A config public key is pinned. */
+    pinned: boolean;
+    execArgv: readonly string[];
+    nodeVersion: string;
+    /** POSIX user id, when the platform has one. */
+    uid?: number;
+    /** Whether the inspector is listening. */
+    inspectorOpen: boolean;
+    now: Date;
+};
+export declare function isProduction(env: NodeJS.ProcessEnv, environment?: string): boolean;
+/** The baseline rules that fire for this process, in a fixed order. Pure. */
+export declare function baselineFindings(i: BaselineInput): Finding[];
+/** Runs the baseline once per process and reports what it finds. Never throws. */
+export declare function runBaseline(opts: {
+    environment?: string;
+    remoteWanted: boolean;
+    pinned: boolean;
+    env?: NodeJS.ProcessEnv;
+}): void;
+/** Tests only: lets the baseline run again. */
+export declare function resetBaseline(): void;

package/dist/rasp/baseline.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NODE_END_OF_LIFE = void 0;
+exports.isProduction = isProduction;
+exports.baselineFindings = baselineFindings;
+exports.runBaseline = runBaseline;
+exports.resetBaseline = resetBaseline;
+/**
+ * Security baseline (README "Security baseline"): a one-time look, when RASP
+ * starts, at how the running process is set up, reported as `baseline`
+ * events (monitor only, never blocks). Each rule reads a flag, a version or
+ * an id, never a secret value, and reports only that a setting is risky.
+ * Adapted from the idea of OpenRASP's start-up security policy checks.
+ */
+const inspector = require("inspector");
+const engine_1 = require("./engine");
+const PRODUCTION = /^prod(uction)?$/i;
+const INSPECT_FLAG = /(^|\s)--inspect(-brk|-port|-wait)?(=|\s|$)/;
+/**
+ * End of life of each Node.js release line (the last day it gets security
+ * fixes). Odd lines end six months after their release; only the long-term
+ * lines an app is likely to run are listed.
+ */
+exports.NODE_END_OF_LIFE = Object.freeze({
+    14: '2023-04-30',
+    16: '2023-09-11',
+    18: '2025-04-30',
+    20: '2026-04-30',
+    22: '2027-04-30',
+    24: '2028-04-30',
+});
+function isProduction(env, environment) {
+    return [env.NODE_ENV, env.ENVIRONMENT, environment].some((v) => PRODUCTION.test((v || '').trim()));
+}
+/** The baseline rules that fire for this process, in a fixed order. Pure. */
+function baselineFindings(i) {
+    const out = [];
+    const production = isProduction(i.env, i.environment);
+    const hit = (rule) => out.push({ attack: 'baseline', rule });
+    // TLS certificate checks switched off for every outbound connection.
+    if ((i.env.NODE_TLS_REJECT_UNAUTHORIZED || '').trim() === '0')
+        hit('baseline.tls_verify_off');
+    // A debugger port open in production lets anyone who reaches it run code.
+    if (production && (i.inspectorOpen || i.execArgv.some((a) => INSPECT_FLAG.test(a)) || INSPECT_FLAG.test(i.env.NODE_OPTIONS || ''))) {
+        hit('baseline.inspector_in_production');
+    }
+    // The SDK says production while NODE_ENV says development: frameworks then run in development mode.
+    if (PRODUCTION.test((i.environment || i.env.ENVIRONMENT || '').trim()) && (i.env.NODE_ENV || '').trim().toLowerCase() === 'development') {
+        hit('baseline.development_mode_in_production');
+    }
+    if (i.uid === 0)
+        hit('baseline.running_as_root');
+    // In production the signed config must be verified against a pinned key.
+    if (production && i.remoteWanted && !i.pinned)
+        hit('baseline.config_key_unpinned');
+    const major = Number(i.nodeVersion.replace(/^v/, '').split('.')[0]);
+    const eol = exports.NODE_END_OF_LIFE[major] ?? (major % 2 === 1 || major < 14 ? '1970-01-01' : undefined);
+    if (eol && i.now.toISOString().slice(0, 10) > eol)
+        hit('baseline.runtime_end_of_life');
+    return out;
+}
+let ran = false;
+/** Runs the baseline once per process and reports what it finds. Never throws. */
+function runBaseline(opts) {
+    if (ran)
+        return;
+    ran = true;
+    try {
+        const findings = baselineFindings({
+            env: opts.env ?? process.env,
+            environment: opts.environment,
+            remoteWanted: opts.remoteWanted,
+            pinned: opts.pinned,
+            execArgv: process.execArgv,
+            nodeVersion: process.versions.node,
+            uid: typeof process.getuid === 'function' ? process.getuid() : undefined,
+            inspectorOpen: Boolean(inspector.url()),
+            now: new Date(),
+        });
+        for (const f of findings)
+            (0, engine_1.check)('startup', () => f);
+    }
+    catch {
+        // fail open
+    }
+}
+/** Tests only: lets the baseline run again. */
+function resetBaseline() {
+    ran = false;
+}
+//# sourceMappingURL=baseline.js.map

package/dist/rasp/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../src/rasp/baseline.ts"],"names":[],"mappings":";;;AA6CA,oCAEC;AAGD,4CAsBC;AAKD,kCAmBC;AAGD,sCAEC;AArGD;;;;;;GAMG;AACH,uCAAwC;AACxC,qCAAiC;AAGjC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAElE;;;;GAIG;AACU,QAAA,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9E,EAAE,EAAE,YAAY;IAChB,EAAE,EAAE,YAAY;IAChB,EAAE,EAAE,YAAY;IAChB,EAAE,EAAE,YAAY;IAChB,EAAE,EAAE,YAAY;IAChB,EAAE,EAAE,YAAY;CACjB,CAAC,CAAC;AAmBH,SAAgB,YAAY,CAAC,GAAsB,EAAE,WAAoB;IACvE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,6EAA6E;AAC7E,SAAgB,gBAAgB,CAAC,CAAgB;IAC/C,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,qEAAqE;IACrE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC9F,0EAA0E;IAC1E,IAAI,UAAU,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnI,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC1C,CAAC;IACD,oGAAoG;IACpG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,aAAa,EAAE,CAAC;QACxI,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAAE,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACjD,yEAAyE;IACzE,IAAI,UAAU,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,wBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG;QAAE,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACvF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,GAAG,GAAG,KAAK,CAAC;AAEhB,kFAAkF;AAClF,SAAgB,WAAW,CAAC,IAA+F;IACzH,IAAI,GAAG;QAAE,OAAO;IAChB,GAAG,GAAG,IAAI,CAAC;IACX,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC;YAChC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAClC,GAAG,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;YACxE,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACvC,GAAG,EAAE,IAAI,IAAI,EAAE;SAChB,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAA,cAAK,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,SAAgB,aAAa;IAC3B,GAAG,GAAG,KAAK,CAAC;AACd,CAAC"}

package/dist/rasp/capture.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Request capture shared by every framework middleware: turns a request into
+ * the context's inputs (README "Sources of untrusted input") and runs the
+ * virtual patches. Inputs stay in memory, in the request's context only.
+ */
+import { type RaspContext } from './context';
+/** Headers the contract treats as input (OpenRASP's headerInjection). */
+export declare const INPUT_HEADERS: readonly ["user-agent", "referer", "x-forwarded-for"];
+export declare const VP_SINK = "server.request";
+export type Headers = Record<string, string | string[] | undefined>;
+/** A request, framework-neutral. */
+export type RequestShape = {
+    framework: string;
+    method: string;
+    /** Path and query as received (`/a/b?x=1`). */
+    url: string;
+    /** Lower-case header names. */
+    headers: Headers;
+    /** The parsed query, when the framework has one (else parsed from `url`). */
+    query?: unknown;
+    /** Route or path parameters. */
+    params?: unknown;
+    /** The route template, when known. */
+    route?: string;
+    /** The client address as the framework reports it (custom rules' `request.ip`). */
+    ip?: string;
+};
+/** What is known about the body. */
+export type BodyShape = {
+    /** A parsed body (object), or raw text / bytes. */
+    body?: unknown;
+    contentType?: string;
+    /** Uploaded files a multipart parser set aside (multer's `req.file` / `req.files`). */
+    files?: unknown;
+};
+/** The names of uploaded files: from raw multipart part headers, or a parser's file objects. */
+export declare function uploadNames(b: BodyShape, raw: string): {
+    field: string;
+    name: string;
+}[];
+/** Lower-cases header names (Node already does; other sources may not). */
+export declare function lowerHeaders(h: unknown): Headers;
+/** Builds the request's context: query, params, cookies, the input headers. */
+export declare function captureRequest(shape: RequestShape): RaspContext;
+/**
+ * Whether the request has no body, by its headers: neither `Transfer-Encoding`
+ * nor a non-zero `Content-Length` (HTTP/1.x; body parsers use the same test).
+ * Over HTTP/2 a body needs no length, so only `Content-Length: 0` says so.
+ */
+export declare function bodyAbsent(h: Headers, httpVersionMajor?: number): boolean;
+/** Records that the request has no body: the body is known and empty, so the body phase runs. */
+export declare function captureNoBody(ctx: RaspContext): void;
+/**
+ * Adds the body to the context: string leaves of a parsed body (`body.a.b`),
+ * form fields, or the raw text when it is text, unparsed and at most 8 KiB.
+ * Also gives the virtual patches the body text.
+ */
+export declare function captureBody(ctx: RaspContext, b: BodyShape): void;
+/**
+ * Runs the virtual patches the request can be judged by so far: rules that
+ * do not read the body at once, rules that do once the body is known. Each
+ * rule set runs once. Throws the block error when a blocking rule matches;
+ * any other failure lets the request through.
+ */
+export declare function runVirtualPatches(ctx: RaspContext): void;
+/**
+ * Custom request rules (README "Custom rules"): each match is reported in
+ * order; the first that blocks throws the block error. Any other failure
+ * lets the request through.
+ */
+export declare function runRequestRules(ctx: RaspContext, phase: 'head' | 'body'): void;
+/**
+ * Sets up late body capture: when a sink first reads the inputs, a body a
+ * parser set after the middleware ran is captured and judged.
+ */
+export declare function captureLater(ctx: RaspContext, read: () => BodyShape | undefined): void;