shield360 1.1.0 → 1.2.1

package/dist/rasp/iast-rules.js

@@ -0,0 +1,240 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IAST_MIN_NUMBER_LENGTH = exports.IAST_MIN_WORD_LENGTH = exports.IAST_MIN_LENGTH = exports.VULN_RULES = void 0;
+exports.qualifies = qualifies;
+exports.vulnSql = vulnSql;
+exports.vulnShell = vulnShell;
+exports.vulnArgv = vulnArgv;
+exports.vulnPath = vulnPath;
+exports.vulnSsrf = vulnSsrf;
+exports.vulnCode = vulnCode;
+exports.vulnInclude = vulnInclude;
+exports.vulnData = vulnData;
+/**
+ * Passive IAST rules (README "Passive IAST"). Pure: each takes what a
+ * detector already computed (the sink text, its tokens, the inputs) and says
+ * whether a request input reaches the sink verbatim in a place the app did
+ * not parameterize, even though the value is harmless and the attack check
+ * found nothing. The detectors call these through iast-scope.ts only when
+ * passive IAST is armed for the current check, so the rules never run, and
+ * never lex, when it is off.
+ */
+const lexers_1 = require("./lexers");
+exports.VULN_RULES = [
+    'vuln.sql_concat',
+    'vuln.cmd_shell',
+    'vuln.cmd_arg',
+    'vuln.path_from_input',
+    'vuln.ssrf_host',
+    'vuln.code_eval',
+    'vuln.include_from_input',
+    'vuln.deser_input',
+    'vuln.xml_external',
+];
+/** Shortest input considered. */
+exports.IAST_MIN_LENGTH = 3;
+/** Letters-only inputs shorter than this are common words that also appear hard-coded ('active', 'name'). */
+exports.IAST_MIN_WORD_LENGTH = 8;
+/** Digits-only inputs shorter than this are small numbers that also appear hard-coded (`LIMIT 100`). */
+exports.IAST_MIN_NUMBER_LENGTH = 4;
+const BORING_WORDS = new Set('true false null none nil undefined yes no on off asc desc'.split(' '));
+/**
+ * Whether an input value is specific enough that finding it verbatim in a
+ * sink means it came from the request, not a coincidence with a literal the
+ * app wrote itself. Conservative on purpose (README "Thresholds").
+ */
+function qualifies(value) {
+    const v = value;
+    if (v.length < exports.IAST_MIN_LENGTH)
+        return false;
+    if (BORING_WORDS.has(v.toLowerCase()))
+        return false;
+    if (/^[A-Za-z]+$/.test(v) && v.length < exports.IAST_MIN_WORD_LENGTH)
+        return false;
+    if (/^[0-9.+-]+$/.test(v) && v.length < exports.IAST_MIN_NUMBER_LENGTH)
+        return false;
+    if (v.split('').every((c) => c === v[0]))
+        return false;
+    // Only spaces and punctuation.
+    if (!/[\p{L}\p{N}]/u.test(v))
+        return false;
+    return true;
+}
+const candidates = (inputs) => inputs.filter((i) => i.source === 'request' && qualifies(i.value));
+const isComment = (t) => t.kind === 'comment' || t.kind === 'version_comment';
+// ---- SQL ----------------------------------------------------------------
+/**
+ * vuln.sql_concat: an input sits in the query text inside a string literal,
+ * as a whole number literal, as a whole identifier (not a keyword), or as a
+ * run of whole tokens the attack check let through (a sort list such as
+ * `created_at desc`). Never inside a comment (sqlcommenter tags), never when
+ * the input is the whole query (a SQL console).
+ */
+function vulnSql(query, inputs, tokens) {
+    const trimmed = query.trim();
+    for (const inp of candidates(inputs)) {
+        const v = inp.value;
+        if (v === query || v.trim() === trimmed)
+            continue;
+        for (const idx of (0, lexers_1.occurrences)(query, v)) {
+            const over = (0, lexers_1.overlapping)(tokens(), idx, v.length);
+            if (!over.length || over.some(isComment))
+                continue;
+            const end = idx + v.length;
+            if (over.length === 1) {
+                const t = over[0];
+                if (t.kind === 'string' && idx > t.s && end <= t.e)
+                    return { rule: 'vuln.sql_concat', input: inp, position: 'string' };
+                const whole = t.s === idx && t.e === end;
+                if (whole && t.kind === 'number')
+                    return { rule: 'vuln.sql_concat', input: inp, position: 'number' };
+                if (whole && t.kind === 'name')
+                    return { rule: 'vuln.sql_concat', input: inp, position: 'identifier' };
+                if (whole && t.kind === 'word' && !lexers_1.SQL_KEYWORDS.has(t.text.toLowerCase()))
+                    return { rule: 'vuln.sql_concat', input: inp, position: 'identifier' };
+                continue;
+            }
+            if (over[0].s === idx && over[over.length - 1].e === end)
+                return { rule: 'vuln.sql_concat', input: inp, position: 'tokens' };
+        }
+    }
+    return null;
+}
+// ---- Command ----------------------------------------------------------------
+/**
+ * vuln.cmd_shell: an input sits inside one word of a shell-interpreted
+ * command (the attack check fires when it spans two or more tokens).
+ */
+function vulnShell(command, inputs, tokens) {
+    const trimmed = command.trim();
+    for (const inp of candidates(inputs)) {
+        const v = inp.value;
+        if (v.trim() === trimmed)
+            continue;
+        for (const idx of (0, lexers_1.occurrences)(command, v)) {
+            const over = (0, lexers_1.overlapping)(tokens, idx, v.length);
+            if (over.length === 1 && over[0].kind === 'word')
+                return { rule: 'vuln.cmd_shell', input: inp, position: 'word' };
+        }
+    }
+    return null;
+}
+/**
+ * vuln.cmd_arg: an argument (not the executable) of an argv spawn without a
+ * shell equals or contains an input. The caller skips `sh -c <script>`
+ * spawns, whose script is checked as shell text.
+ */
+function vulnArgv(argv, inputs) {
+    for (const inp of candidates(inputs)) {
+        for (let k = 1; k < argv.length; k++) {
+            const a = argv[k];
+            if (typeof a === 'string' && a.includes(inp.value))
+                return { rule: 'vuln.cmd_arg', input: inp, position: 'argument' };
+        }
+    }
+    return null;
+}
+// ---- Path ----------------------------------------------------------------
+/**
+ * vuln.path_from_input: an input (normalized like the path) forms whole path
+ * segments: it starts at the start of a segment and ends at the end of one,
+ * or right before a `.` in it (`/data/<input>.json`).
+ */
+function vulnPath(normalizedPath, inputs, norm) {
+    const np = normalizedPath;
+    for (const inp of candidates(inputs)) {
+        const ni = norm(inp.value);
+        if (!ni || ni === '/')
+            continue;
+        for (const idx of (0, lexers_1.occurrences)(np, ni)) {
+            const end = idx + ni.length;
+            const startOk = idx === 0 || np[idx - 1] === '/' || ni.startsWith('/');
+            const endOk = end === np.length || np[end] === '/' || np[end] === '.' || ni.endsWith('/');
+            if (startOk && endOk)
+                return { rule: 'vuln.path_from_input', input: inp, position: 'segment' };
+        }
+    }
+    return null;
+}
+// ---- SSRF ----------------------------------------------------------------
+/**
+ * The `host[:port]` of a URL as written (lower-cased), and the offset just
+ * past the host itself (after any userinfo), or null without an authority.
+ */
+function authorityOf(url, host) {
+    const m = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//.exec(url);
+    if (!m)
+        return null;
+    const rest = url.slice(m[0].length);
+    const end = rest.search(/[/?#\\]/);
+    const auth = end < 0 ? rest : rest.slice(0, end);
+    const hostStart = m[0].length + auth.lastIndexOf('@') + 1;
+    const bracket = url[hostStart] === '[' ? 2 : 0;
+    return { authority: auth.slice(auth.lastIndexOf('@') + 1).toLowerCase(), hostEnd: hostStart + host.length + bracket };
+}
+/**
+ * vuln.ssrf_host: the URL's host is an input (equal to the host or to
+ * `host:port`), or an input is a prefix of the URL that covers its scheme
+ * and host (a base URL or whole URL from the request). An input that merely
+ * mentions the host somewhere in longer text does not count.
+ */
+function vulnSsrf(url, raw, inputs) {
+    const host = raw.host;
+    const auth = host ? authorityOf(url, host) : null;
+    const authority = auth?.authority ?? '';
+    // The prefix must reach past the destination host itself, not a copy of it in the userinfo.
+    const hostEnd = host ? (auth ? auth.hostEnd : url.length + 1) : url.indexOf(':') + 1;
+    for (const inp of candidates(inputs)) {
+        const v = inp.value.toLowerCase();
+        if (host && (v === host || v === authority || v === `[${host}]`))
+            return { rule: 'vuln.ssrf_host', input: inp, position: 'host' };
+        if (url.startsWith(inp.value) && inp.value.length >= hostEnd && (host || inp.value.length > hostEnd))
+            return { rule: 'vuln.ssrf_host', input: inp, position: 'url' };
+    }
+    return null;
+}
+// ---- Code, include, deserialization, XML ------------------------------------
+/**
+ * vuln.code_eval: an input sits inside a string literal of evaluated code,
+ * or is a whole identifier or number in it (the attack check fires when it
+ * spans two or more tokens or is the whole code). Never inside a comment.
+ */
+function vulnCode(code, inputs, tokens) {
+    for (const inp of candidates(inputs)) {
+        const v = inp.value;
+        if (v === code)
+            continue;
+        for (const idx of (0, lexers_1.occurrences)(code, v)) {
+            const over = (0, lexers_1.overlapping)(tokens(), idx, v.length);
+            if (over.length !== 1)
+                continue;
+            const t = over[0];
+            const end = idx + v.length;
+            if (t.kind === 'string' && idx > t.s && end <= t.e)
+                return { rule: 'vuln.code_eval', input: inp, position: 'string' };
+            if (t.s === idx && t.e === end && (t.kind === 'word' || t.kind === 'number'))
+                return { rule: 'vuln.code_eval', input: inp, position: t.kind === 'word' ? 'identifier' : 'number' };
+        }
+    }
+    return null;
+}
+/** vuln.include_from_input: a module specifier contains an input (the attack check covers equal and path-like inputs). */
+function vulnInclude(specifier, inputs) {
+    for (const inp of candidates(inputs)) {
+        if (inp.value !== specifier && specifier.includes(inp.value))
+            return { rule: 'vuln.include_from_input', input: inp, position: 'specifier' };
+    }
+    return null;
+}
+/**
+ * vuln.deser_input / vuln.xml_external: the data handed to an unsafe
+ * deserializer, or to an XML parser that resolves external entities, is
+ * tainted (the caller decides with the contract's taintedData), at least
+ * 3 characters long, by an input that qualifies.
+ */
+function vulnData(rule, data, inp) {
+    if (!inp || inp.source !== 'request' || data.length < exports.IAST_MIN_LENGTH || !qualifies(inp.value))
+        return null;
+    return { rule, input: inp, position: 'data' };
+}
+//# sourceMappingURL=iast-rules.js.map

package/dist/rasp/iast-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iast-rules.js","sourceRoot":"","sources":["../../src/rasp/iast-rules.ts"],"names":[],"mappings":";;;AA4CA,8BAUC;AAeD,0BAsBC;AAQD,8BAWC;AAOD,4BAQC;AASD,4BAaC;AAyBD,4BAYC;AASD,4BAcC;AAGD,kCAKC;AAQD,4BAGC;AAlOD;;;;;;;;GAQG;AACH,qCAA8E;AAGjE,QAAA,UAAU,GAAG;IACxB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,yBAAyB;IACzB,kBAAkB;IAClB,mBAAmB;CACX,CAAC;AAQX,iCAAiC;AACpB,QAAA,eAAe,GAAG,CAAC,CAAC;AACjC,6GAA6G;AAChG,QAAA,oBAAoB,GAAG,CAAC,CAAC;AACtC,wGAAwG;AAC3F,QAAA,sBAAsB,GAAG,CAAC,CAAC;AAExC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,2DAA2D,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAErG;;;;GAIG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,MAAM,CAAC,GAAG,KAAK,CAAC;IAChB,IAAI,CAAC,CAAC,MAAM,GAAG,uBAAe;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,4BAAoB;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,8BAAsB;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,+BAA+B;IAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAE/G,MAAM,SAAS,GAAG,CAAC,CAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC;AAErF,4EAA4E;AAE5E;;;;;;GAMG;AACH,SAAgB,OAAO,CAAC,KAAa,EAAE,MAAmB,EAAE,MAAqB;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO;YAAE,SAAS;QAClD,KAAK,MAAM,GAAG,IAAI,IAAA,oBAAW,EAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YACnD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;gBACvH,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;gBACzC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;gBACrG,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;gBACvG,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,qBAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;gBAClJ,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC/H,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,SAAgB,SAAS,CAAC,OAAe,EAAE,MAAmB,EAAE,MAAe;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,IAAA,oBAAW,EAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACpH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,IAAc,EAAE,MAAmB;IAC1D,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QACxH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAE7E;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,cAAsB,EAAE,MAAmB,EAAE,IAA2B;IAC/F,MAAM,EAAE,GAAG,cAAc,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG;YAAE,SAAS;QAChC,KAAK,MAAM,GAAG,IAAI,IAAA,oBAAW,EAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC;YAC5B,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,GAAG,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1F,IAAI,OAAO,IAAI,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACjG,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;AACxH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,GAAW,EAAE,GAAqC,EAAE,MAAmB;IAC9F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IACxC,4FAA4F;IAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrF,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAClI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvK,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,IAAY,EAAE,MAAmB,EAAE,MAAqB;IAC/E,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACzB,KAAK,MAAM,GAAG,IAAI,IAAA,oBAAW,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YACtH,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0HAA0H;AAC1H,SAAgB,WAAW,CAAC,SAAiB,EAAE,MAAmB;IAChE,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC9I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,IAA8C,EAAE,IAAY,EAAE,GAA0B;IAC/G,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,uBAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5G,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/dist/rasp/iast-scope.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Passive IAST: the slot a check's detectors write a vulnerability into
+ * (README "Passive IAST"). engine.ts arms a slot for one check when passive
+ * IAST is on and the check is sampled; the detectors in detect.ts call
+ * `noteVulnerability` with a rule from iast-rules.ts, which runs only while a
+ * slot is armed. Unarmed, the cost is one comparison per detector call.
+ */
+import type { Vuln } from './iast-rules';
+export type IastSlot = {
+    prev: IastSlot | null;
+    vuln: Vuln | null;
+    closed: boolean;
+};
+/** Arms a slot for the check about to run (nested checks keep their own). */
+export declare function armIastSlot(): IastSlot;
+/** Disarms a slot; returns the vulnerability noted in it, once. Idempotent. */
+export declare function closeIastSlot(slot: IastSlot): Vuln | null;
+/** Whether a slot is armed for the running check. */
+export declare function iastArmed(): boolean;
+/**
+ * Runs a vulnerability rule when a slot is armed and keeps its first result.
+ * Never throws: a rule that fails is ignored.
+ */
+export declare function noteVulnerability(rule: () => Vuln | null): void;
+/** Runs fn with a slot armed and returns what it returned and the vulnerability noted (tests, conformance). */
+export declare function captureVulnerability<T>(fn: () => T): {
+    result: T;
+    vuln: Vuln | null;
+};

package/dist/rasp/iast-scope.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.armIastSlot = armIastSlot;
+exports.closeIastSlot = closeIastSlot;
+exports.iastArmed = iastArmed;
+exports.noteVulnerability = noteVulnerability;
+exports.captureVulnerability = captureVulnerability;
+let current = null;
+/** Arms a slot for the check about to run (nested checks keep their own). */
+function armIastSlot() {
+    const slot = { prev: current, vuln: null, closed: false };
+    current = slot;
+    return slot;
+}
+/** Disarms a slot; returns the vulnerability noted in it, once. Idempotent. */
+function closeIastSlot(slot) {
+    if (slot.closed)
+        return null;
+    slot.closed = true;
+    if (current === slot)
+        current = slot.prev;
+    return slot.vuln;
+}
+/** Whether a slot is armed for the running check. */
+function iastArmed() {
+    return current !== null;
+}
+/**
+ * Runs a vulnerability rule when a slot is armed and keeps its first result.
+ * Never throws: a rule that fails is ignored.
+ */
+function noteVulnerability(rule) {
+    const slot = current;
+    if (!slot || slot.vuln)
+        return;
+    try {
+        slot.vuln = rule();
+    }
+    catch {
+        // passive IAST never breaks a check
+    }
+}
+/** Runs fn with a slot armed and returns what it returned and the vulnerability noted (tests, conformance). */
+function captureVulnerability(fn) {
+    const slot = armIastSlot();
+    try {
+        const result = fn();
+        return { result, vuln: closeIastSlot(slot) };
+    }
+    finally {
+        closeIastSlot(slot);
+    }
+}
+//# sourceMappingURL=iast-scope.js.map

package/dist/rasp/iast-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iast-scope.js","sourceRoot":"","sources":["../../src/rasp/iast-scope.ts"],"names":[],"mappings":";;AAcA,kCAIC;AAGD,sCAKC;AAGD,8BAEC;AAMD,8CAQC;AAGD,oDAQC;AA7CD,IAAI,OAAO,GAAoB,IAAI,CAAC;AAEpC,6EAA6E;AAC7E,SAAgB,WAAW;IACzB,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACpE,OAAO,GAAG,IAAI,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAgB,aAAa,CAAC,IAAc;IAC1C,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,SAAgB,SAAS;IACvB,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,IAAuB;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,SAAgB,oBAAoB,CAAI,EAAW;IACjD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/rasp/iast.d.ts

@@ -0,0 +1,81 @@
+import { eventRouteOf } from './context';
+/** Where reports go: the RASP reporter. `add` returning false means it refused the event (rate limit, full queue). */
+export type IastEventSink = {
+    add(event: {
+        name: string;
+        time: string;
+        attrs: Record<string, string>;
+    }, foldKey: string): boolean | void;
+};
+import { type IastSlot } from './iast-scope';
+export declare const RASP_VULNERABILITY = "shield360.rasp.vulnerability";
+/** A fingerprint is reported at most once per this period per process. */
+export declare const IAST_REPORT_EVERY_MS: number;
+/** Fingerprints remembered per process; the oldest is forgotten past this. */
+export declare const IAST_MAX_FINGERPRINTS = 10000;
+export declare const IAST_DEFAULT_RATE = 1;
+export declare const IAST_DEFAULT_RATE_PRODUCTION = 0.1;
+export type IastSetting = 'on' | 'off';
+/** `init({ rasp: { iast } })`: true / false, or options. */
+export type IastOptions = boolean | {
+    enabled?: boolean;
+    sampleRate?: number;
+};
+export type IastSettings = {
+    option?: IastOptions;
+    applicationName: string;
+    environment?: string;
+    env?: NodeJS.ProcessEnv;
+    /** Tests: a clock and a sampler. */
+    now?: () => number;
+    random?: () => number;
+};
+/** Reads the local option and the environment (`SHIELD360_IAST`, `SHIELD360_IAST_SAMPLE_RATE`). Forgets what was seen. */
+export declare function configureIast(s: IastSettings): void;
+/** The verified signed config's switch and rate (undefined drops them). */
+export declare function setIastRemote(c: {
+    iast?: unknown;
+    iastSampleRate?: unknown;
+    version?: string;
+} | undefined): void;
+export declare function setIastSink(sink: IastEventSink | undefined): void;
+/**
+ * Whether passive IAST is on. Order: `SHIELD360_IAST=off` wins; then the
+ * signed config's `iast`; then the local option or `SHIELD360_IAST=on`.
+ */
+export declare function iastEnabled(): boolean;
+/** The share of checks that run the IAST rules: env, then the signed config, then the option, then 1.0 (0.1 in production). */
+export declare function iastSampleRate(): number;
+/**
+ * Arms the IAST slot for one check, or returns null: off, not sampled, or
+ * no request input in scope. engine.check calls it only while RASP is active.
+ */
+export declare function beginIast(): IastSlot | null;
+export type IastExtra = {
+    framework?: string;
+    route?: string;
+    method?: string;
+    path?: string;
+};
+/**
+ * Disarms the slot. With a sink (the check found no attack), reports the
+ * vulnerability its detectors noted, if any. Never throws.
+ */
+export declare function endIast(slot: IastSlot, report?: {
+    sink: string;
+    extra?: IastExtra;
+}): void;
+/** The fingerprint: SHA-256 of route, sink, input key and rule (NUL-separated), first 32 hex. */
+export declare function vulnFingerprint(route: string, sink: string, inputKey: string, rule: string): string;
+/** The route of a finding whose framework gave no template: the event route (README "Event route"). */
+export declare const iastRouteOf: typeof eventRouteOf;
+/** Whether a stack frame's file is the app's own code. */
+export declare function isAppFrame(file: string): boolean;
+/**
+ * The top stack frame in the app's own code (outside node_modules, Node's
+ * internals and the SDK), as `path:line` relative to the working directory
+ * (only the last three segments when outside it), or '' when there is none.
+ */
+export declare function codeLocation(stack?: string): string;
+/** Forgets every fingerprint seen and the configuration (tests, re-init). */
+export declare function resetIast(): void;