shield360 1.1.0 → 1.2.1

package/dist/rasp/hooks/sinks.js

@@ -0,0 +1,329 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RaspSinkInstrumentation = exports.BUILT_IN_SINKS = void 0;
+exports.parseSinkRule = parseSinkRule;
+exports.parseSinkRules = parseSinkRules;
+exports.setSinkRules = setSinkRules;
+exports.sinkRules = sinkRules;
+exports.installSinkHooks = installSinkHooks;
+exports.uninstallSinkHooks = uninstallSinkHooks;
+exports.applySinkRule = applySinkRule;
+/**
+ * Sink rules (README "Sink rules"): data from the built-in list or the
+ * verified signed config that points an existing detector at a library
+ * function the SDK does not hook itself. No rule carries code: a rule names
+ * a module, a dotted path to a function, an argument and one of the checks,
+ * and the generic wrapper here runs that check.
+ *
+ * Rules are applied to modules already loaded and, through one
+ * require-in-the-middle registration per rule set, to modules loaded later.
+ * Wrappers are RASP's own (not shimmer's), as in the database hook, so
+ * tracing that wraps the same function stacks in either order.
+ */
+const instrumentation_1 = require("@opentelemetry/instrumentation");
+const context_1 = require("../context");
+const detect_1 = require("../detect");
+const engine_1 = require("../engine");
+const lexers_1 = require("../lexers");
+const types_1 = require("../types");
+const default_sinks_json_1 = __importDefault(require("../data/default-sinks.json"));
+const marks_1 = require("./marks");
+const esm_1 = require("./esm");
+const MAX_RULES = 64;
+/** Rule ids: dot-separated words, short enough that the event sink `rule:<id>` fits its 64 characters. */
+const RULE_ID = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z0-9_]+)*$/;
+const SEGMENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+const MODULE = /^(@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*(\/[\w.-]+)*$/i;
+const CHECKS = new Set(['sql', 'nosql', 'command', 'path', 'ssrf', 'code', 'deser', 'xml']);
+const DIALECTS = new Set(lexers_1.SQL_DIALECTS);
+const OPS = new Set(['read', 'write', 'append', 'delete', 'rename', 'list', 'open']);
+const FORMATS = new Set([
+    'pickle',
+    'marshal',
+    'yaml',
+    'jsonpickle',
+    'node_serialize',
+    'funcster',
+    'binaryformatter',
+    'typename',
+    'java',
+    'snakeyaml',
+]);
+/** One rule, checked field by field; null drops it (never the whole list). */
+function parseSinkRule(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const r = raw;
+    if (typeof r.id !== 'string' || r.id.length > 59 || !RULE_ID.test(r.id))
+        return null;
+    if (typeof r.module !== 'string' || r.module.length > 200 || !MODULE.test(r.module))
+        return null;
+    if (typeof r.target !== 'string')
+        return null;
+    const segments = r.target.split('.');
+    if (!segments.length || segments.length > 4 || segments.some((s) => !SEGMENT.test(s) || s === '__proto__' || s === 'constructor'))
+        return null;
+    if (typeof r.check !== 'string' || !CHECKS.has(r.check))
+        return null;
+    if (r.runtimes !== undefined && !(Array.isArray(r.runtimes) && r.runtimes.every((x) => typeof x === 'string')))
+        return null;
+    if (Array.isArray(r.runtimes) && !r.runtimes.includes('node'))
+        return null;
+    const arg = r.arg === undefined ? 0 : r.arg;
+    if (typeof arg !== 'number' || !Number.isInteger(arg) || arg < 0 || arg > 16)
+        return null;
+    if (r.field !== undefined && (typeof r.field !== 'string' || !SEGMENT.test(r.field)))
+        return null;
+    if (r.dialect !== undefined && !DIALECTS.has(r.dialect))
+        return null;
+    if (r.op !== undefined && !OPS.has(r.op))
+        return null;
+    if (r.check === 'deser' && !FORMATS.has(r.format))
+        return null;
+    const action = r.action === undefined ? 'monitor' : r.action;
+    if (action !== 'monitor' && action !== 'block')
+        return null;
+    return {
+        id: r.id,
+        title: typeof r.title === 'string' ? r.title : undefined,
+        module: r.module,
+        target: r.target,
+        check: r.check,
+        arg,
+        field: r.field,
+        dialect: r.dialect,
+        op: r.op,
+        format: r.format,
+        resolvesExternal: r.resolvesExternal === true,
+        action,
+    };
+}
+/** A list: at most 64 rules, invalid ones dropped, duplicate ids keep the first. */
+function parseSinkRules(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    const ids = new Set();
+    for (const item of raw) {
+        if (out.length >= MAX_RULES)
+            break;
+        const rule = parseSinkRule(item);
+        if (rule && !ids.has(rule.id)) {
+            ids.add(rule.id);
+            out.push(rule);
+        }
+    }
+    return out;
+}
+exports.BUILT_IN_SINKS = parseSinkRules(default_sinks_json_1.default.sinks);
+/** The value a rule checks, from the call's arguments. */
+function valueOf(rule, values) {
+    const v = values[rule.arg];
+    if (rule.check === 'nosql')
+        return v;
+    if (typeof v === 'string')
+        return v;
+    if (rule.field && v && typeof v === 'object') {
+        const f = v[rule.field];
+        if (typeof f === 'string')
+            return f;
+    }
+    return undefined;
+}
+function detect(rule, value) {
+    const ctx = (0, context_1.currentContext)();
+    if (!ctx)
+        return null;
+    const inputs = (0, context_1.inputsOf)(ctx);
+    if (!inputs.length)
+        return null;
+    if (rule.check === 'nosql')
+        return value && typeof value === 'object' ? (0, detect_1.detectNoSql)(value, ctx.trees, inputs) : null;
+    if (typeof value !== 'string')
+        return null;
+    switch (rule.check) {
+        case 'sql':
+            return (0, detect_1.detectSql)(value, inputs, rule.dialect ?? 'generic');
+        case 'command':
+            return (0, detect_1.detectCommand)(value, inputs);
+        case 'path':
+            return (0, detect_1.detectPath)(value, rule.op ?? 'read', inputs, (0, engine_1.allowLists)().fileRoots, ctx.inRequest);
+        case 'ssrf':
+            return (0, detect_1.detectSsrf)(value, inputs, []);
+        case 'code':
+            return (0, detect_1.detectCode)(value, inputs);
+        case 'deser':
+            return (0, detect_1.detectDeserialization)(rule.format, value, inputs);
+        case 'xml':
+            return (0, detect_1.detectXml)(value, inputs, Boolean(rule.resolvesExternal));
+        default:
+            return null;
+    }
+}
+let checking = false;
+function inspect(rule, values) {
+    if (checking || !(0, engine_1.isActive)())
+        return;
+    checking = true;
+    try {
+        // The rule's action caps the decision (the attack type's mode still applies).
+        (0, engine_1.check)(`rule:${rule.id}`, () => {
+            const f = detect(rule, valueOf(rule, values));
+            return f ? { ...f, action: rule.action } : null;
+        });
+    }
+    catch (error) {
+        if (error instanceof types_1.RaspBlockedError)
+            throw error;
+    }
+    finally {
+        checking = false;
+    }
+}
+const registry = new Map();
+/** The owner object and key a rule's target names in a module's exports. */
+function resolve(exports, target) {
+    const segments = target.split('.');
+    let owner = exports;
+    for (const s of segments.slice(0, -1)) {
+        if (!owner || (typeof owner !== 'object' && typeof owner !== 'function'))
+            return null;
+        owner = Reflect.get(owner, s);
+    }
+    if (!owner || (typeof owner !== 'object' && typeof owner !== 'function'))
+        return null;
+    return { owner: owner, key: segments[segments.length - 1] };
+}
+function apply(rule, exports) {
+    try {
+        const at = resolve(exports, rule.target);
+        if (!at)
+            return;
+        let methods = registry.get(at.owner);
+        const known = methods?.get(at.key);
+        if (known) {
+            known.rule = rule;
+            return;
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(at.owner, at.key);
+        const current = descriptor?.value;
+        // Not an own function, or already one of RASP's built-in hooks: one check per call.
+        if (typeof current !== 'function' || (0, marks_1.isRaspWrapper)(current))
+            return;
+        const entry = { original: current, wrapper: current, rule };
+        const wrapper = function (...values) {
+            if (entry.rule)
+                inspect(entry.rule, values);
+            return new.target ? Reflect.construct(current, values, new.target) : Reflect.apply(current, this, values);
+        };
+        for (const key of Reflect.ownKeys(current)) {
+            if (key === '__wrapped' || key === '__original' || key === '__unwrap')
+                continue;
+            Object.defineProperty(wrapper, key, Object.getOwnPropertyDescriptor(current, key));
+        }
+        entry.wrapper = wrapper;
+        (0, marks_1.markRaspWrapper)(wrapper);
+        Object.defineProperty(at.owner, at.key, { ...descriptor, value: wrapper });
+        if (!methods)
+            registry.set(at.owner, (methods = new Map()));
+        methods.set(at.key, entry);
+    }
+    catch {
+        // A shape the rule does not fit: leave the module alone.
+    }
+}
+/** Switches every rule off; puts originals back where RASP's wrapper is still on top. */
+function releaseAll() {
+    for (const [owner, methods] of [...registry]) {
+        for (const [key, entry] of [...methods]) {
+            entry.rule = undefined;
+            if (Object.getOwnPropertyDescriptor(owner, key)?.value === entry.wrapper) {
+                const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+                Object.defineProperty(owner, key, { ...descriptor, value: entry.original });
+                methods.delete(key);
+            }
+        }
+        if (!methods.size)
+            registry.delete(owner);
+    }
+}
+let pending = [];
+/** Registers the rule set's modules for when the app loads them. */
+class RaspSinkInstrumentation extends instrumentation_1.InstrumentationBase {
+    constructor() {
+        super('shield360/instrumentation-rasp-sinks', '1.0.0', { enabled: false });
+    }
+    init() {
+        const byModule = new Map();
+        for (const r of pending)
+            byModule.set(r.module, [...(byModule.get(r.module) ?? []), r]);
+        return [...byModule].map(([name, rules]) => new instrumentation_1.InstrumentationNodeModuleDefinition(name, ['*'], (exports) => {
+            for (const r of rules)
+                apply(r, (0, esm_1.moduleExports)(exports));
+            return exports;
+        }));
+    }
+}
+exports.RaspSinkInstrumentation = RaspSinkInstrumentation;
+let instrumentation;
+let current = [];
+/** Rules for modules the app has already loaded (never loads a module). */
+function applyLoaded(rules) {
+    for (const rule of rules) {
+        try {
+            const cached = require.cache[require.resolve(rule.module)];
+            if (cached)
+                apply(rule, cached.exports);
+        }
+        catch {
+            // not installed, or not resolvable from the SDK
+        }
+    }
+}
+/**
+ * Makes `rules` the rule set: rules no longer listed stop checking at once,
+ * new ones apply to loaded modules now and to others when loaded. Never throws.
+ */
+function setSinkRules(rules) {
+    try {
+        releaseAll();
+        current = rules;
+        try {
+            instrumentation?.disable();
+        }
+        catch {
+            // never
+        }
+        instrumentation = undefined;
+        if (!rules.length)
+            return;
+        pending = rules;
+        instrumentation = new RaspSinkInstrumentation();
+        instrumentation.enable();
+        applyLoaded(rules);
+    }
+    catch {
+        // fail open
+    }
+}
+/** The rule set in force (tests, diagnostics). */
+function sinkRules() {
+    return current;
+}
+/** Applies the built-in rules. Idempotent; never throws. */
+function installSinkHooks() {
+    setSinkRules(exports.BUILT_IN_SINKS);
+    return true;
+}
+function uninstallSinkHooks() {
+    setSinkRules([]);
+}
+/** Tests: apply one rule to a module object directly. */
+function applySinkRule(rule, exports) {
+    current = [...current, rule];
+    apply(rule, exports);
+}
+//# sourceMappingURL=sinks.js.map

package/dist/rasp/hooks/sinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sinks.js","sourceRoot":"","sources":["../../../src/rasp/hooks/sinks.ts"],"names":[],"mappings":";;;;;;AAyEA,sCAiCC;AAGD,wCAaC;AAqKD,oCAkBC;AAGD,8BAEC;AAGD,4CAGC;AAED,gDAEC;AAGD,sCAGC;AAtUD;;;;;;;;;;;GAWG;AACH,oEAA0G;AAC1G,wCAAsD;AACtD,sCAWmB;AACnB,sCAAwD;AACxD,sCAA0D;AAC1D,oCAAyE;AACzE,oFAAiD;AACjD,mCAAyD;AACzD,+BAAsC;AAoBtC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,0GAA0G;AAC1G,MAAM,OAAO,GAAG,8CAA8C,CAAC;AAC/D,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAC7C,MAAM,MAAM,GAAG,qDAAqD,CAAC;AACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAY,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AACvG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAa,qBAAY,CAAC,CAAC;AACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAc;IACnC,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAgB,aAAa,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/I,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5H,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAqB,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAqB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACxD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAkB;QAC3B,GAAG;QACH,KAAK,EAAE,CAAC,CAAC,KAA2B;QACpC,OAAO,EAAE,CAAC,CAAC,OAAiC;QAC5C,EAAE,EAAE,CAAC,CAAC,EAAwB;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAiC;QAC3C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,KAAK,IAAI;QAC7C,MAAM;KACP,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAgB,cAAc,CAAC,GAAY;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM;QACnC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAEY,QAAA,cAAc,GAAe,cAAc,CAAE,4BAA+B,CAAC,KAAK,CAAC,CAAC;AAEjG,0DAA0D;AAC1D,SAAS,OAAO,CAAC,IAAc,EAAE,MAAiB;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAI,CAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,IAAc,EAAE,KAAc;IAC5C,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrH,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,IAAA,kBAAS,EAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QAC7D,KAAK,SAAS;YACZ,OAAO,IAAA,sBAAa,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,KAAK,MAAM;YACT,OAAO,IAAA,mBAAU,EAAC,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,MAAM,EAAE,MAAM,EAAE,IAAA,mBAAU,GAAE,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7F,KAAK,MAAM;YACT,OAAO,IAAA,mBAAU,EAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,KAAK,MAAM;YACT,OAAO,IAAA,mBAAU,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,OAAO;YACV,OAAO,IAAA,8BAAqB,EAAC,IAAI,CAAC,MAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,KAAK,KAAK;YACR,OAAO,IAAA,kBAAS,EAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAClE;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB,SAAS,OAAO,CAAC,IAAc,EAAE,MAAiB;IAChD,IAAI,QAAQ,IAAI,CAAC,IAAA,iBAAQ,GAAE;QAAE,OAAO;IACpC,QAAQ,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,8EAA8E;QAC9E,IAAA,cAAK,EAAC,QAAQ,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,wBAAgB;YAAE,MAAM,KAAK,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;AACH,CAAC;AAKD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;AAEzD,4EAA4E;AAC5E,SAAS,OAAO,CAAC,OAAgB,EAAE,MAAc;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,GAAY,OAAO,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAe,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,EAAE,KAAK,EAAE,KAAe,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,KAAK,CAAC,IAAc,EAAE,OAAgB;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,UAAU,EAAE,KAAK,CAAC;QAClC,oFAAoF;QACpF,IAAI,OAAO,OAAO,KAAK,UAAU,IAAI,IAAA,qBAAa,EAAC,OAAO,CAAC;YAAE,OAAO;QACpE,MAAM,KAAK,GAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,UAAyB,GAAG,MAAiB;YAC3D,IAAI,KAAK,CAAC,IAAI;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5G,CAAC,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,UAAU;gBAAE,SAAS;YAChF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;IAC3D,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,SAAS,UAAU;IACjB,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC;YACvB,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;gBACzE,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAE,CAAC;gBAChE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5E,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,IAAI,OAAO,GAAe,EAAE,CAAC;AAE7B,oEAAoE;AACpE,MAAa,uBAAwB,SAAQ,qCAAmB;IAC9D;QACE,KAAK,CAAC,sCAAsC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACS,IAAI;QACZ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CACtB,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,IAAI,qDAAmC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE;YAC/D,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,KAAK,CAAC,CAAC,EAAE,IAAA,mBAAa,EAAC,OAAO,CAAC,CAAC,CAAC;YACxD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CACL,CAAC;IACJ,CAAC;CACF;AAfD,0DAeC;AAED,IAAI,eAAoD,CAAC;AACzD,IAAI,OAAO,GAAe,EAAE,CAAC;AAE7B,2EAA2E;AAC3E,SAAS,WAAW,CAAC,KAAiB;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,KAAiB;IAC5C,IAAI,CAAC;QACH,UAAU,EAAE,CAAC;QACb,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,CAAC;YACH,eAAe,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ;QACV,CAAC;QACD,eAAe,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO;QAC1B,OAAO,GAAG,KAAK,CAAC;QAChB,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAChD,eAAe,CAAC,MAAM,EAAE,CAAC;QACzB,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,SAAgB,SAAS;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4DAA4D;AAC5D,SAAgB,gBAAgB;IAC9B,YAAY,CAAC,sBAAc,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,kBAAkB;IAChC,YAAY,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,yDAAyD;AACzD,SAAgB,aAAa,CAAC,IAAc,EAAE,OAAgB;IAC5D,OAAO,GAAG,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7B,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvB,CAAC"}

package/dist/rasp/hooks/template.d.ts

@@ -0,0 +1,21 @@
+/** Optional template engines: patch exports only after import, never load an engine. */
+import { InstrumentationBase, InstrumentationNodeModuleDefinition } from '@opentelemetry/instrumentation';
+import { type RaspInput } from '../types';
+/**
+ * Inputs an enclosing template check has not already judged. Internal delegation
+ * (render to compile) and code generated from the source carry the same input, so
+ * it is checked once; an independent call with other input, such as a helper that
+ * compiles request data, is still checked.
+ */
+export declare function unjudgedInputs(inputs: RaspInput[]): RaspInput[];
+/** Node engines hooked here; the detector's table also covers other SDKs' engines. */
+export type HookedTemplateEngine = 'handlebars' | 'ejs' | 'pug' | 'nunjucks' | 'lodash';
+export declare function patchTemplate(engine: HookedTemplateEngine, exports: unknown, keys?: string[]): void;
+export declare const patchHandlebarsCompiler: (exports: unknown) => void;
+export declare function unpatchTemplate(exports: unknown): void;
+export declare class RaspTemplateInstrumentation extends InstrumentationBase {
+    constructor();
+    protected init(): InstrumentationNodeModuleDefinition[];
+}
+export declare function installTemplateHooks(): void;
+export declare function uninstallTemplateHooks(): void;

package/dist/rasp/hooks/template.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RaspTemplateInstrumentation = exports.patchHandlebarsCompiler = void 0;
+exports.unjudgedInputs = unjudgedInputs;
+exports.patchTemplate = patchTemplate;
+exports.unpatchTemplate = unpatchTemplate;
+exports.installTemplateHooks = installTemplateHooks;
+exports.uninstallTemplateHooks = uninstallTemplateHooks;
+/** Optional template engines: patch exports only after import, never load an engine. */
+const instrumentation_1 = require("@opentelemetry/instrumentation");
+const context_1 = require("../context");
+const engine_1 = require("../engine");
+const template_1 = require("../template");
+const types_1 = require("../types");
+const marks_1 = require("./marks");
+const esm_1 = require("./esm");
+const registry = new Map();
+let generation = 0;
+/** Template sources whose engine call is in progress (synchronous, innermost last). */
+const active = [];
+let instrumentation;
+/**
+ * Inputs an enclosing template check has not already judged. Internal delegation
+ * (render to compile) and code generated from the source carry the same input, so
+ * it is checked once; an independent call with other input, such as a helper that
+ * compiles request data, is still checked.
+ */
+function unjudgedInputs(inputs) {
+    return active.length ? inputs.filter(input => !active.some(source => source.includes(input.value))) : inputs;
+}
+// Handlebars.create() instances call this internal module at call time, so patching it covers every instance.
+const HANDLEBARS_COMPILER = 'handlebars/dist/cjs/handlebars/compiler/compiler.js';
+const methods = {
+    handlebars: ['compile', 'precompile'], ejs: ['render', 'compile'], pug: ['compile', 'render', 'compileClient'],
+    nunjucks: ['renderString'], lodash: ['template'],
+};
+function patchTemplate(engine, exports, keys = methods[engine]) {
+    try {
+        if (!exports || (typeof exports !== 'object' && typeof exports !== 'function'))
+            return;
+        const owner = exports;
+        let entries = registry.get(owner);
+        if (!entries)
+            registry.set(owner, entries = new Map());
+        for (const key of keys) {
+            if (entries.get(key)?.generation === generation)
+                continue;
+            const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+            if (typeof descriptor?.value !== 'function')
+                continue;
+            const original = descriptor.value;
+            const entry = { owner, key, descriptor, wrapper: original, generation };
+            const wrapper = function (...args) {
+                const source = args[0];
+                if (entry.generation !== generation || typeof source !== 'string')
+                    return Reflect.apply(original, this, args);
+                try {
+                    if ((0, engine_1.isActive)() && (0, engine_1.modeFor)('code_injection') !== 'off') {
+                        const ctx = (0, context_1.currentContext)();
+                        const inputs = unjudgedInputs(ctx ? (0, context_1.inputsOf)(ctx) : []);
+                        if (inputs.length)
+                            (0, engine_1.check)(`${engine}.${key}`, () => (0, template_1.detectTemplate)(source, inputs, engine));
+                    }
+                }
+                catch (error) {
+                    if (error instanceof types_1.RaspBlockedError)
+                        throw error;
+                }
+                active.push(source);
+                try {
+                    return Reflect.apply(original, this, args);
+                }
+                finally {
+                    active.pop();
+                }
+            };
+            for (const name of Reflect.ownKeys(original)) {
+                if (name === '__wrapped' || name === '__original' || name === '__unwrap')
+                    continue;
+                Object.defineProperty(wrapper, name, Object.getOwnPropertyDescriptor(original, name));
+            }
+            entry.wrapper = wrapper;
+            (0, marks_1.markRaspWrapper)(wrapper);
+            Object.defineProperty(owner, key, { ...descriptor, value: wrapper });
+            entries.set(key, entry);
+        }
+        // Nunjucks also exposes renderString on Environment instances.
+        if (engine === 'nunjucks' && typeof owner.Environment === 'function')
+            patchTemplate(engine, owner.Environment.prototype);
+    }
+    catch { /* Unsupported or immutable exports fail open. */ }
+}
+const patchHandlebarsCompiler = (exports) => patchTemplate('handlebars', exports, ['compile', 'precompile']);
+exports.patchHandlebarsCompiler = patchHandlebarsCompiler;
+function unpatchTemplate(exports) {
+    const entries = registry.get(exports);
+    for (const entry of entries?.values() ?? []) {
+        entry.generation = -1;
+        try {
+            if (Object.getOwnPropertyDescriptor(entry.owner, entry.key)?.value === entry.wrapper) {
+                Object.defineProperty(entry.owner, entry.key, entry.descriptor);
+            }
+        }
+        catch { /* A later wrapper or frozen export belongs to the app. */ }
+    }
+    registry.delete(exports);
+    try {
+        const environment = exports?.Environment;
+        if (environment?.prototype)
+            unpatchTemplate(environment.prototype);
+    }
+    catch { /* Optional export. */ }
+}
+class RaspTemplateInstrumentation extends instrumentation_1.InstrumentationBase {
+    constructor() { super('shield360/instrumentation-rasp-template', '1.0.0', { enabled: false }); }
+    init() {
+        return Object.keys(methods).map(engine => new instrumentation_1.InstrumentationNodeModuleDefinition(engine, ['*'], exports => { patchTemplate(engine, (0, esm_1.moduleExports)(exports)); return exports; }, exports => unpatchTemplate((0, esm_1.moduleExports)(exports)), engine === 'handlebars' ? [new instrumentation_1.InstrumentationNodeModuleFile(HANDLEBARS_COMPILER, ['*'], exports => { (0, exports.patchHandlebarsCompiler)(exports); return exports; }, exports => unpatchTemplate(exports))] : undefined));
+    }
+}
+exports.RaspTemplateInstrumentation = RaspTemplateInstrumentation;
+function installTemplateHooks() {
+    if (instrumentation)
+        return;
+    generation++;
+    instrumentation = new RaspTemplateInstrumentation();
+    instrumentation.enable();
+    for (const engine of Object.keys(methods)) {
+        try {
+            const cached = require.cache[require.resolve(engine)];
+            if (cached)
+                patchTemplate(engine, cached.exports);
+        }
+        catch { /* Never import an optional engine. */ }
+    }
+    try {
+        const cached = require.cache[require.resolve(HANDLEBARS_COMPILER)];
+        if (cached)
+            (0, exports.patchHandlebarsCompiler)(cached.exports);
+    }
+    catch { /* Handlebars absent or laid out differently. */ }
+}
+function uninstallTemplateHooks() {
+    generation++;
+    try {
+        instrumentation?.disable();
+    }
+    catch { /* Fail open. */ }
+    instrumentation = undefined;
+    for (const owner of [...registry.keys()])
+        unpatchTemplate(owner);
+}
+//# sourceMappingURL=template.js.map

package/dist/rasp/hooks/template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.js","sourceRoot":"","sources":["../../../src/rasp/hooks/template.ts"],"names":[],"mappings":";;;AAsBA,wCAEC;AAUD,sCAqCC;AAED,0CAeC;AAUD,oDAeC;AACD,wDAKC;AAvHD,wFAAwF;AACxF,oEAAyI;AACzI,wCAAsD;AACtD,sCAAqD;AACrD,0CAA6C;AAC7C,oCAA4D;AAC5D,mCAA0C;AAC1C,+BAAsC;AAItC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;AACvD,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,uFAAuF;AACvF,MAAM,MAAM,GAAa,EAAE,CAAC;AAC5B,IAAI,eAAwD,CAAC;AAC7D;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAmB;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/G,CAAC;AACD,8GAA8G;AAC9G,MAAM,mBAAmB,GAAG,qDAAqD,CAAC;AAGlF,MAAM,OAAO,GAA2C;IACtD,UAAU,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC;IAC9G,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC;CACjD,CAAC;AAEF,SAAgB,aAAa,CAAC,MAA4B,EAAE,OAAgB,EAAE,OAAiB,OAAO,CAAC,MAAM,CAAC;IAC5G,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,UAAU,CAAC;YAAE,OAAO;QACvF,MAAM,KAAK,GAAG,OAAkC,CAAC;QACjD,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,UAAU,KAAK,UAAU;gBAAE,SAAS;YAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,OAAO,UAAU,EAAE,KAAK,KAAK,UAAU;gBAAE,SAAS;YACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAe,CAAC;YAC5C,MAAM,KAAK,GAAU,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAG,UAAyB,GAAG,IAAe;gBACzD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC9G,IAAI,CAAC;oBACH,IAAI,IAAA,iBAAQ,GAAE,IAAI,IAAA,gBAAO,EAAC,gBAAgB,CAAC,KAAK,KAAK,EAAE,CAAC;wBACtD,MAAM,GAAG,GAAG,IAAA,wBAAc,GAAE,CAAC;wBAC7B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBACxD,IAAI,MAAM,CAAC,MAAM;4BAAE,IAAA,cAAK,EAAC,GAAG,MAAM,IAAI,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC7F,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAI,KAAK,YAAY,wBAAgB;wBAAE,MAAM,KAAK,CAAC;gBAAC,CAAC;gBACvE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,IAAI,CAAC;oBAAC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;gBAAC,CAAC;wBAAS,CAAC;oBAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAAC,CAAC;YAC/E,CAAC,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,UAAU;oBAAE,SAAS;gBACnF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAE,CAAC,CAAC;YACzF,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;YACxB,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC;YACzB,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,+DAA+D;QAC/D,IAAI,MAAM,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU;YAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC3H,CAAC;IAAC,MAAM,CAAC,CAAC,iDAAiD,CAAC,CAAC;AAC/D,CAAC;AACM,MAAM,uBAAuB,GAAG,CAAC,OAAgB,EAAQ,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAAtH,QAAA,uBAAuB,2BAA+F;AACnI,SAAgB,eAAe,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAiB,CAAC,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;gBACrF,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,QAAQ,CAAC,MAAM,CAAC,OAAiB,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,WAAW,GAAI,OAAqD,EAAE,WAAW,CAAC;QACxF,IAAI,WAAW,EAAE,SAAS;YAAE,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;AACpC,CAAC;AACD,MAAa,2BAA4B,SAAQ,qCAAmB;IAClE,gBAAgB,KAAK,CAAC,yCAAyC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI;QACZ,OAAQ,MAAM,CAAC,IAAI,CAAC,OAAO,CAA4B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,qDAAmC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EACzH,OAAO,CAAC,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,IAAA,mBAAa,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,IAAA,mBAAa,EAAC,OAAO,CAAC,CAAC,EACjI,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,+CAA6B,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,EACrF,OAAO,CAAC,EAAE,GAAG,IAAA,+BAAuB,EAAC,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5H,CAAC;CACF;AARD,kEAQC;AACD,SAAgB,oBAAoB;IAClC,IAAI,eAAe;QAAE,OAAO;IAC5B,UAAU,EAAE,CAAC;IACb,eAAe,GAAG,IAAI,2BAA2B,EAAE,CAAC;IACpD,eAAe,CAAC,MAAM,EAAE,CAAC;IACzB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAA2B,EAAE,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACtD,IAAI,MAAM;gBAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM;YAAE,IAAA,+BAAuB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;AAC9D,CAAC;AACD,SAAgB,sBAAsB;IACpC,UAAU,EAAE,CAAC;IACb,IAAI,CAAC;QAAC,eAAe,EAAE,OAAO,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAC9D,eAAe,GAAG,SAAS,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,eAAe,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC"}

package/dist/rasp/iast-rules.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Passive IAST rules (README "Passive IAST"). Pure: each takes what a
+ * detector already computed (the sink text, its tokens, the inputs) and says
+ * whether a request input reaches the sink verbatim in a place the app did
+ * not parameterize, even though the value is harmless and the attack check
+ * found nothing. The detectors call these through iast-scope.ts only when
+ * passive IAST is armed for the current check, so the rules never run, and
+ * never lex, when it is off.
+ */
+import { type Token } from './lexers';
+import type { RaspInput } from './types';
+export declare const VULN_RULES: readonly ["vuln.sql_concat", "vuln.cmd_shell", "vuln.cmd_arg", "vuln.path_from_input", "vuln.ssrf_host", "vuln.code_eval", "vuln.include_from_input", "vuln.deser_input", "vuln.xml_external"];
+export type VulnRule = (typeof VULN_RULES)[number];
+/** Where in the sink argument the input sits. */
+export type VulnPosition = 'string' | 'number' | 'identifier' | 'tokens' | 'word' | 'argument' | 'segment' | 'host' | 'url' | 'specifier' | 'data';
+export type Vuln = {
+    rule: VulnRule;
+    input: RaspInput;
+    position: VulnPosition;
+};
+/** Shortest input considered. */
+export declare const IAST_MIN_LENGTH = 3;
+/** Letters-only inputs shorter than this are common words that also appear hard-coded ('active', 'name'). */
+export declare const IAST_MIN_WORD_LENGTH = 8;
+/** Digits-only inputs shorter than this are small numbers that also appear hard-coded (`LIMIT 100`). */
+export declare const IAST_MIN_NUMBER_LENGTH = 4;
+/**
+ * Whether an input value is specific enough that finding it verbatim in a
+ * sink means it came from the request, not a coincidence with a literal the
+ * app wrote itself. Conservative on purpose (README "Thresholds").
+ */
+export declare function qualifies(value: string): boolean;
+/**
+ * vuln.sql_concat: an input sits in the query text inside a string literal,
+ * as a whole number literal, as a whole identifier (not a keyword), or as a
+ * run of whole tokens the attack check let through (a sort list such as
+ * `created_at desc`). Never inside a comment (sqlcommenter tags), never when
+ * the input is the whole query (a SQL console).
+ */
+export declare function vulnSql(query: string, inputs: RaspInput[], tokens: () => Token[]): Vuln | null;
+/**
+ * vuln.cmd_shell: an input sits inside one word of a shell-interpreted
+ * command (the attack check fires when it spans two or more tokens).
+ */
+export declare function vulnShell(command: string, inputs: RaspInput[], tokens: Token[]): Vuln | null;
+/**
+ * vuln.cmd_arg: an argument (not the executable) of an argv spawn without a
+ * shell equals or contains an input. The caller skips `sh -c <script>`
+ * spawns, whose script is checked as shell text.
+ */
+export declare function vulnArgv(argv: string[], inputs: RaspInput[]): Vuln | null;
+/**
+ * vuln.path_from_input: an input (normalized like the path) forms whole path
+ * segments: it starts at the start of a segment and ends at the end of one,
+ * or right before a `.` in it (`/data/<input>.json`).
+ */
+export declare function vulnPath(normalizedPath: string, inputs: RaspInput[], norm: (p: string) => string): Vuln | null;
+/**
+ * vuln.ssrf_host: the URL's host is an input (equal to the host or to
+ * `host:port`), or an input is a prefix of the URL that covers its scheme
+ * and host (a base URL or whole URL from the request). An input that merely
+ * mentions the host somewhere in longer text does not count.
+ */
+export declare function vulnSsrf(url: string, raw: {
+    scheme: string;
+    host: string;
+}, inputs: RaspInput[]): Vuln | null;
+/**
+ * vuln.code_eval: an input sits inside a string literal of evaluated code,
+ * or is a whole identifier or number in it (the attack check fires when it
+ * spans two or more tokens or is the whole code). Never inside a comment.
+ */
+export declare function vulnCode(code: string, inputs: RaspInput[], tokens: () => Token[]): Vuln | null;
+/** vuln.include_from_input: a module specifier contains an input (the attack check covers equal and path-like inputs). */
+export declare function vulnInclude(specifier: string, inputs: RaspInput[]): Vuln | null;
+/**
+ * vuln.deser_input / vuln.xml_external: the data handed to an unsafe
+ * deserializer, or to an XML parser that resolves external entities, is
+ * tainted (the caller decides with the contract's taintedData), at least
+ * 3 characters long, by an input that qualifies.
+ */
+export declare function vulnData(rule: 'vuln.deser_input' | 'vuln.xml_external', data: string, inp: RaspInput | undefined): Vuln | null;