37 lines
2.0 KiB
JavaScript
37 lines
2.0 KiB
JavaScript
"use strict";
|
|
|
|
const fs = require("node:fs");
|
|
const path = require("node:path");
|
|
|
|
const tracePath = process.env.AAS_NETWORK_TRACE;
|
|
if (!tracePath) throw new Error("AAS network observer requires an isolated trace path");
|
|
|
|
function deny(api) {
|
|
return function deniedNetworkAttempt() {
|
|
fs.mkdirSync(path.dirname(tracePath), { recursive: true, mode: 0o700 });
|
|
fs.appendFileSync(tracePath, `${JSON.stringify({ schemaVersion: 1, api })}\n`, { encoding: "utf8", mode: 0o600 });
|
|
const error = new Error(`Network attempt denied by legacy baseline observer: ${api}`);
|
|
error.code = "AAS_LEGACY_NETWORK_DENIED";
|
|
throw error;
|
|
};
|
|
}
|
|
|
|
function replaceFunctions(target, names, prefix) {
|
|
for (const name of names) {
|
|
if (typeof target?.[name] === "function") target[name] = deny(`${prefix}.${name}`);
|
|
}
|
|
}
|
|
|
|
const net = require("node:net");
|
|
replaceFunctions(net, ["connect", "createConnection"], "net");
|
|
if (net.Socket?.prototype) net.Socket.prototype.connect = deny("net.Socket.connect");
|
|
replaceFunctions(require("node:tls"), ["connect"], "tls");
|
|
replaceFunctions(require("node:http"), ["request", "get"], "http");
|
|
replaceFunctions(require("node:https"), ["request", "get"], "https");
|
|
replaceFunctions(require("node:dgram"), ["createSocket"], "dgram");
|
|
const dns = require("node:dns");
|
|
replaceFunctions(dns, ["lookup", "lookupService", "resolve", "resolve4", "resolve6", "resolveAny", "resolveCaa", "resolveCname", "resolveMx", "resolveNaptr", "resolveNs", "resolvePtr", "resolveSoa", "resolveSrv", "resolveTxt", "reverse"], "dns");
|
|
replaceFunctions(dns.promises, ["lookup", "lookupService", "resolve", "resolve4", "resolve6", "resolveAny", "resolveCaa", "resolveCname", "resolveMx", "resolveNaptr", "resolveNs", "resolvePtr", "resolveSoa", "resolveSrv", "resolveTxt", "reverse"], "dns.promises");
|
|
if (typeof globalThis.fetch === "function") globalThis.fetch = deny("global.fetch");
|
|
if (typeof globalThis.WebSocket === "function") globalThis.WebSocket = class DeniedWebSocket { constructor() { return deny("global.WebSocket")(); } };
|