Dlp

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/Action.java

@@ -0,0 +1,20 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.predic8.membrane.annot.MCAttribute;
+
+public abstract class Action implements DLPAction {
+
+    private String field;
+
+    public String getField() {
+        return field;
+    }
+
+    @MCAttribute
+    public void setField(String field) {
+        this.field = field;
+    }
+
+    @Override
+    public abstract String apply(DLPContext context);
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/CsvFieldConfiguration.java

@@ -0,0 +1,78 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.util.*;
+
+/**
+ * Loads field risk mappings from a CSV file with format:
+ * field_name,description,risk_level
+ * where risk_level must be one of: high, medium, low, unclassified
+ */
+public class CsvFieldConfiguration implements FieldConfiguration {
+
+    private static final Logger log = LoggerFactory.getLogger(CsvFieldConfiguration.class);
+
+    @Override
+    public Map<String, String> getFields(String fileName) {
+        Map<String, String> riskDict = new HashMap<>();
+
+        try (InputStream inputStream = getResourceAsStream(fileName)) {
+            BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
+            String line;
+            boolean isHeader = true;
+
+            while ((line = reader.readLine()) != null) {
+                if (isHeader) {
+                    isHeader = false;
+                    continue;
+                }
+
+                line = line.trim();
+                if (line.isEmpty() || line.startsWith("#")) continue;
+
+                String[] parts = line.split(",", -1);
+                if (parts.length < 3) {
+                    log.warn("Skipping invalid line (less than 3 columns): {}", line);
+                    continue;
+                }
+
+                String field = parts[0].trim().toLowerCase(Locale.ROOT);
+                String riskLevel = parts[2].trim().toLowerCase(Locale.ROOT);
+
+                if (!isValidRiskLevel(riskLevel)) {
+                    log.warn("Invalid risk level '{}' for field '{}'. Defaulting to 'unclassified'", riskLevel, field);
+                    riskLevel = "unclassified";
+                }
+
+                riskDict.put(field, riskLevel);
+            }
+
+        } catch (IOException e) {
+            throw new RuntimeException("Error reading CSV field configuration: " + fileName, e);
+        }
+        return riskDict;
+    }
+
+    private InputStream getResourceAsStream(String fileName) {
+        InputStream is = CsvFieldConfiguration.class.getClassLoader().getResourceAsStream(fileName);
+        if (is == null) {
+            String msg = "Could not find CSV config file: " + fileName;
+            log.error(msg);
+            throw new IllegalArgumentException(msg);
+        }
+        return is;
+    }
+
+    private boolean isValidRiskLevel(String level) {
+        return switch (level) {
+            case "high", "medium", "low", "unclassified" -> true;
+            default -> false;
+        };
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/DLPAction.java

@@ -0,0 +1,5 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+public interface DLPAction {
+    String apply(DLPContext context);
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/DLPAnalyzer.java

@@ -0,0 +1,78 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonFactoryBuilder;
+import com.fasterxml.jackson.core.StreamReadConstraints;
+import com.fasterxml.jackson.core.json.JsonReadFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.predic8.membrane.core.http.Message;
+
+import java.io.InputStream;
+import java.util.*;
+
+public class DLPAnalyzer {
+
+    private static final JsonFactory JSON_FACTORY = new JsonFactoryBuilder()
+            .configure(JsonReadFeature.ALLOW_TRAILING_COMMA, true)
+            .configure(JsonReadFeature.ALLOW_UNESCAPED_CONTROL_CHARS, false)
+            .streamReadConstraints(StreamReadConstraints.builder()
+                    .maxNestingDepth(64)
+                    .maxStringLength(16 * 1024)
+                    .build())
+            .build();
+
+    private static final ObjectMapper MAPPER = new ObjectMapper(JSON_FACTORY);
+
+    private final Map<String, RiskReport.Category> riskDict;
+
+    public DLPAnalyzer(Map<String, String> rawRiskMap) {
+        this.riskDict = mapToEnumRiskLevels(rawRiskMap);
+    }
+
+    private Map<String, RiskReport.Category> mapToEnumRiskLevels(Map<String, String> raw) {
+        Map<String, RiskReport.Category> result = new HashMap<>();
+        raw.forEach((key, value) -> {
+            RiskReport.Category level = RiskReport.Category.fromString(value);
+            result.put(key.toLowerCase(Locale.ROOT), level);
+        });
+        return result;
+    }
+
+    public RiskReport analyze(Message msg) {
+        try (InputStream is = msg.getBodyAsStreamDecoded()) {
+            JsonNode root = MAPPER.readTree(is);
+            RiskReport report = new RiskReport();
+            traverse(root, new ArrayDeque<>(), report);
+            return report;
+        } catch (Exception e) {
+            throw new RuntimeException("Failed to analyze message", e);
+        }
+    }
+
+    private void traverse(JsonNode node, Deque<String> path, RiskReport report) {
+        if (node.isObject()) {
+            node.fieldNames().forEachRemaining(fieldName -> {
+                path.addLast(fieldName);
+                traverse(node.get(fieldName), path, report);
+                path.removeLast();
+            });
+        } else if (node.isArray()) {
+            for (JsonNode child : node) {
+                traverse(child, path, report);
+            }
+        } else {
+            String fullPath = String.join(".", path).toLowerCase(Locale.ROOT);
+            String lastSegment = path.peekLast() != null ? path.peekLast().toLowerCase(Locale.ROOT) : "";
+
+            RiskReport.Category level = classify(fullPath, lastSegment);
+            report.recordField(fullPath, level.name());
+        }
+    }
+
+    private RiskReport.Category classify(String fullPath, String simpleName) {
+        return Optional.ofNullable(riskDict.get(fullPath))
+                .or(() -> Optional.ofNullable(riskDict.get(simpleName)))
+                .orElse(RiskReport.Category.UNCLASSIFIED);
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/DLPContext.java

@@ -0,0 +1,24 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+public class DLPContext {
+
+    private final String body;
+    private final RiskReport riskReport;
+
+    public DLPContext(String body, RiskReport riskReport) {
+        this.riskReport = riskReport;
+        this.body = body;
+    }
+
+    public RiskReport getRiskReport() {
+        return riskReport;
+    }
+
+    public boolean hasRiskReport() {
+        return riskReport != null;
+    }
+
+    public String getBody() {
+        return body;
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/DLPInterceptor.java

@@ -0,0 +1,107 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.predic8.membrane.annot.MCAttribute;
+import com.predic8.membrane.annot.MCChildElement;
+import com.predic8.membrane.annot.MCElement;
+import com.predic8.membrane.core.exchange.Exchange;
+import com.predic8.membrane.core.http.Message;
+import com.predic8.membrane.core.interceptor.AbstractInterceptor;
+import com.predic8.membrane.core.interceptor.Outcome;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import static com.predic8.membrane.core.interceptor.Outcome.CONTINUE;
+
+@MCElement(name = "dlp")
+public class DLPInterceptor extends AbstractInterceptor {
+
+    private static final Logger log = LoggerFactory.getLogger(DLPInterceptor.class);
+
+    private DLPAnalyzer dlpAnalyzer;
+    private String fieldsConfig;
+
+    private List<Mask> masks = new ArrayList<>();
+    private List<Filter> filters = new ArrayList<>();
+    private List<Report> reports = new ArrayList<>();
+
+    private final List<DLPAction> actions = new ArrayList<>();
+
+    @Override
+    public void init() {
+        Map<String, String> config = fieldsConfig != null ?
+                new CsvFieldConfiguration().getFields(fieldsConfig) :
+                Map.of();
+        actions.addAll(masks);
+        actions.addAll(filters);
+        actions.addAll(reports);
+        this.dlpAnalyzer = new DLPAnalyzer(config);
+        super.init();
+    }
+
+    @Override
+    public Outcome handleRequest(Exchange exc) {
+        return handleInternal(exc.getRequest());
+    }
+
+    private Outcome handleInternal(Message msg) {
+        try {
+            String body = msg.getBodyAsStringDecoded();
+            RiskReport report = dlpAnalyzer.analyze(msg);
+            log.info("DLP Risk Analysis: {}", report.getStructuredReport());
+
+            for (DLPAction action : actions) {
+                body = action.apply(new DLPContext(body, report));
+            }
+
+            msg.setBodyContent(body.getBytes(StandardCharsets.UTF_8));
+            return CONTINUE;
+
+        } catch (Exception e) {
+            log.error("Exception in DLPInterceptor.handleInternal: ", e);
+            return Outcome.ABORT;
+        }
+    }
+
+    public String getFieldsConfig() {
+        return fieldsConfig;
+    }
+
+    @MCAttribute
+    public void setFieldsConfig(String fieldsConfig) {
+        this.fieldsConfig = fieldsConfig;
+    }
+
+    public List<Mask> getMasks() {
+        return masks;
+    }
+
+    @MCChildElement
+    public DLPInterceptor setMasks(List<Mask> masks) {
+        this.masks = masks;
+        return this;
+    }
+
+    public List<Filter> getFilters() {
+        return filters;
+    }
+
+    @MCChildElement(order = 1)
+    public DLPInterceptor setFilters(List<Filter> filters) {
+        this.filters = filters;
+        return this;
+    }
+
+    public List<Report> getReports() {
+        return reports;
+    }
+
+    @MCChildElement(order = 2)
+    public void setReports(List<Report> reports) {
+        this.reports = reports;
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/Field.java

@@ -0,0 +1,19 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.predic8.membrane.annot.MCAttribute;
+import com.predic8.membrane.annot.MCElement;
+
+@MCElement(name = "field")
+public class Field {
+
+    private String jsonpath;
+
+    public String getJsonpath() {
+        return jsonpath;
+    }
+
+    @MCAttribute
+    public void setJsonpath(String jsonpath) {
+        this.jsonpath = jsonpath;
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/FieldConfiguration.java

@@ -0,0 +1,7 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import java.util.Map;
+
+public interface FieldConfiguration {
+    Map<String, String> getFields(String fileName);
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/Fields.java

@@ -0,0 +1,23 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.predic8.membrane.annot.MCChildElement;
+import com.predic8.membrane.annot.MCElement;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@MCElement(name = "fields")
+public class Fields {
+
+    private List<Field> fields = new ArrayList<>();
+
+    @MCChildElement
+    public Fields setFields(List<Field> fields) {
+        this.fields = fields;
+        return this;
+    }
+
+    public List<Field> getFields() {
+        return fields;
+    }
+}