32 lines
2.0 KiB
JavaScript
32 lines
2.0 KiB
JavaScript
'use strict';
|
|
let variants;
|
|
// Inspect decoded text independently; concatenating it could dilute a semantic match.
|
|
async function inspectTextRepresentations({bytes,policy,inspectLocal,inspectEnterprise,isCurrent,traceOperation=(_name,_facts,fn)=>fn()}){
|
|
const block=ruleId=>({decision:'block',ruleId});
|
|
let values;
|
|
try{const text=new TextDecoder('utf-8',{fatal:true}).decode(bytes);variants??=import('../../packages/core/text-variants.mjs');values=(await variants).inspectionTextVariants(text,policy.dlp.maxBytes);}
|
|
catch{return block('normalization-uninspectable');}
|
|
const current=()=>{try{return isCurrent()===true;}catch{return false;}};
|
|
if(policy.enterprise?.icap?.enabled&&policy.enterprise.icap.scanUploads!==false&&typeof inspectEnterprise!=='function')return block('icap-unavailable');
|
|
for(let index=0;index<values.length;index++){
|
|
if(!current())return block('inspection-context-changed');
|
|
const data=Buffer.from(values[index]);
|
|
try{
|
|
if(policy.dlp.semantic.enabled||policy.security.yara.enabled){
|
|
if(typeof inspectLocal!=='function')return block('inspector-unavailable');
|
|
const local=await traceOperation('text.local',{bytes:data.length,index,count:values.length},()=>inspectLocal(data,policy));
|
|
if(!current())return block('inspection-context-changed');
|
|
if(local?.decision!=='allow')return local?.decision==='block'?local:block('inspection-failed');
|
|
if(local.coverage?.complete!==true)return block('inspection-incomplete');
|
|
}
|
|
if(typeof inspectEnterprise==='function'){
|
|
const external=await traceOperation('text.enterprise',{bytes:data.length,index,count:values.length},()=>inspectEnterprise(data,policy));
|
|
if(!current())return block('inspection-context-changed');
|
|
if(external?.decision!=='allow'||external.coverage?.complete!==true)return external?.decision==='block'?external:block('inspection-incomplete');
|
|
}
|
|
}finally{data.fill(0);}
|
|
}
|
|
return current()?{decision:'allow',ruleId:null}:block('inspection-context-changed');
|
|
}
|
|
module.exports={inspectTextRepresentations};
|