Dlp

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/CsvFieldConfiguration.java

@@ -0,0 +1,50 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.util.HashMap;
+import java.util.Map;
+
+public class CsvFieldConfiguration implements FieldConfiguration {
+
+    private static final Logger log = LoggerFactory.getLogger(CsvFieldConfiguration.class);
+
+    @Override
+    public Map<String, String> getFields(String fileName) {
+        try (InputStream inputStream = CsvFieldConfiguration.class.getClassLoader().getResourceAsStream(fileName)) {
+            Map<String, String> riskDict = new HashMap<>();
+            if (inputStream == null) {
+                log.error("Could not find file: {}", fileName);
+                throw new NullPointerException("InputStream is null. File not found: " + fileName);
+            }
+
+            BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
+            String line;
+            boolean isHeader = true;
+
+            while ((line = reader.readLine()) != null) {
+                if (isHeader) {
+                    isHeader = false;
+                    continue;
+                }
+
+                String[] parts = line.split(",", -1);
+                if (parts.length >= 3) {
+                    String field = parts[0].trim().toLowerCase();
+                    String riskLevel = parts[2].trim();
+                    riskDict.put(field, riskLevel);
+                } else {
+                    log.warn("Invalid CSV line: {}", line);
+                }
+            }
+            return riskDict;
+        } catch (IOException e) {
+            throw new RuntimeException("Failed to load risk data from " + fileName, e);
+        }
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/DLPAnalyzer.java

@@ -0,0 +1,87 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.fasterxml.jackson.core.JsonFactory;
+import com.fasterxml.jackson.core.JsonFactoryBuilder;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.StreamReadConstraints;
+import com.fasterxml.jackson.core.json.JsonReadFeature;
+import com.predic8.membrane.core.http.Message;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.util.*;
+
+public class DLPAnalyzer {
+
+    private static final int MAX_DEPTH = 64;
+    private static final int MAX_STRING_LENGTH = 16 * 1024; // 16 KiB
+
+    private static final JsonFactory JSON_FACTORY = new JsonFactoryBuilder()
+            .configure(JsonReadFeature.ALLOW_TRAILING_COMMA, true)
+            .configure(JsonReadFeature.ALLOW_UNESCAPED_CONTROL_CHARS, false)
+            .streamReadConstraints(StreamReadConstraints.builder()
+                    .maxNestingDepth(MAX_DEPTH)
+                    .maxStringLength(MAX_STRING_LENGTH)
+                    .build())
+            .build();
+
+    private final Map<String, String> riskDict;
+
+    public DLPAnalyzer(Map<String, String> riskDict) {
+        this.riskDict = Map.copyOf(riskDict); // immutable defensive copy
+    }
+
+    public RiskReport analyze(Message msg) {
+        try (BufferedReader reader = new BufferedReader(new InputStreamReader(msg.getBodyAsStreamDecoded(), Optional.ofNullable(msg.getCharset())
+                .map(Charset::forName)
+                .orElse(StandardCharsets.UTF_8)));
+             JsonParser parser = JSON_FACTORY.createParser(reader)) {
+
+            Deque<String> ctx = new ArrayDeque<>();
+            RiskReport report = new RiskReport();
+            String currentField = null;
+
+            while (parser.nextToken() != null) {
+                switch (parser.currentToken()) {
+                    case FIELD_NAME -> currentField = parser.currentName();
+                    case START_OBJECT, START_ARRAY -> {
+                        if (currentField != null) {
+                            ctx.addLast(currentField);
+                            currentField = null;
+                        }
+                    }
+                    case END_OBJECT, END_ARRAY -> {
+                        if (!ctx.isEmpty()) ctx.removeLast();
+                    }
+                    default -> {
+                        if (currentField != null) {
+                            String fullPath = buildFullPath(ctx, currentField);
+                            String lvl = classify(fullPath, currentField);
+                            report.recordField(fullPath, lvl);
+                            currentField = null;
+                        }
+                    }
+                }
+            }
+            return report;
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    private String classify(String fullPath, String simpleName) {
+        return Optional.ofNullable(riskDict.get(fullPath.toLowerCase()))
+                .or(() -> Optional.ofNullable(riskDict.get(simpleName.toLowerCase())))
+                .orElse("unclassified")
+                .toLowerCase();
+    }
+
+    private static String buildFullPath(Deque<String> stack, String field) {
+        if (stack.isEmpty()) return field;
+        List<String> path = new ArrayList<>(stack);
+        path.add(field);
+        return String.join(".", path);
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/DLPInterceptor.java

@@ -0,0 +1,90 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.predic8.membrane.annot.MCAttribute;
+import com.predic8.membrane.annot.MCChildElement;
+import com.predic8.membrane.annot.MCElement;
+import com.predic8.membrane.core.exchange.Exchange;
+import com.predic8.membrane.core.http.Message;
+import com.predic8.membrane.core.interceptor.AbstractInterceptor;
+import com.predic8.membrane.core.interceptor.Outcome;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import static com.predic8.membrane.core.interceptor.Outcome.CONTINUE;
+
+@MCElement(name = "dlp")
+public class DLPInterceptor extends AbstractInterceptor {
+
+    private static final Logger log = LoggerFactory.getLogger(DLPInterceptor.class);
+    private DLPAnalyzer dlpAnalyzer;
+    private String fieldsConfig;
+    private String action = "report";
+    private Fields fields;
+
+    @Override
+    public void init() {
+        super.init();
+        dlpAnalyzer = new DLPAnalyzer(new CsvFieldConfiguration().getFields(fieldsConfig));
+    }
+
+    @Override
+    public Outcome handleRequest(Exchange exc) {
+        return handleInternal(exc.getRequest());
+    }
+
+    @Override
+    public Outcome handleResponse(Exchange exc) {
+        return handleInternal(exc.getResponse());
+    }
+
+    public Outcome handleInternal(Message msg) {
+        if (dlpAnalyzer == null) {
+            log.warn("DLP not initialized.");
+            return CONTINUE;
+        }
+
+        RiskReport report = dlpAnalyzer.analyze(msg);
+        log.info("DLP Risk Analysis: {}", report.getLogReport());
+
+        if (fields != null && !fields.getFields().isEmpty()) {
+            for (Field f : fields.getFields()) {
+                f.handleAction(msg);
+            }
+        } else {
+            report.getMatchedFields().keySet().forEach(name -> {
+                Field f = new Field();
+                f.setName(name);
+                f.setAction(action);
+                f.handleAction(msg);
+            });
+        }
+        return CONTINUE;
+    }
+
+    public String getFieldsConfig() {
+        return fieldsConfig;
+    }
+
+    @MCAttribute
+    public void setFieldsConfig(String fieldsConfig) {
+        this.fieldsConfig = fieldsConfig;
+    }
+
+    public String getAction() {
+        return action;
+    }
+
+    @MCAttribute
+    public void setAction(String action) {
+        this.action = action;
+    }
+
+    public Fields getFields() {
+        return fields;
+    }
+
+    @MCChildElement
+    public void setFields(Fields fields) {
+        this.fields = fields;
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/Field.java

@@ -0,0 +1,65 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.predic8.membrane.annot.MCAttribute;
+import com.predic8.membrane.annot.MCElement;
+import com.predic8.membrane.core.http.Message;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Locale;
+import java.util.Objects;
+import java.util.regex.Pattern;
+
+@MCElement(name = "field")
+public class Field {
+
+
+    private static final Logger log = LoggerFactory.getLogger(Field.class);
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    private String name;
+    private Action action = Action.REPORT;
+    private Pattern compiled = Pattern.compile(".*");
+
+    @MCAttribute
+    public void setName(String name) {
+        this.name = Objects.requireNonNull(name, "field name must not be null");
+        this.compiled = Pattern.compile(name, Pattern.CASE_INSENSITIVE);
+    }
+
+    @MCAttribute
+    public void setAction(String action) {
+        this.action = Action.valueOf(action.toUpperCase(Locale.ROOT));
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public String getAction() {
+        return action.name().toLowerCase(Locale.ROOT);
+    }
+
+    public void handleAction(Message msg) {
+        try {
+            JsonNode root = MAPPER.readTree(msg.getBodyAsStringDecoded());
+
+            switch (action) {
+                case FILTER -> JsonUtils.filter(root, compiled);
+                case MASK -> JsonUtils.mask(root, compiled);
+                case REPORT -> {/* no?op */}
+            }
+
+            byte[] out = MAPPER.writeValueAsBytes(root);
+            msg.setBodyContent(out);
+            msg.getHeader().setContentLength(out.length);
+            msg.getHeader().setContentType("application/json; charset=UTF-8");
+        } catch (Exception e) {
+            log.error("DLP field action '{}' failed: {}", name, e.toString(), e);
+        }
+    }
+
+    private enum Action {MASK, FILTER, REPORT}
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/FieldConfiguration.java

@@ -0,0 +1,7 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import java.util.Map;
+
+public interface FieldConfiguration {
+    Map<String, String> getFields(String fileName);
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/Fields.java

@@ -0,0 +1,23 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.predic8.membrane.annot.MCChildElement;
+import com.predic8.membrane.annot.MCElement;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@MCElement(name = "fields")
+public class Fields {
+
+    private List<Field> fields = new ArrayList<>();
+
+    @MCChildElement
+    public Fields setFields(List<Field> fields) {
+        this.fields = fields;
+        return this;
+    }
+
+    public List<Field> getFields() {
+        return fields;
+    }
+}

core/src/main/java/com/predic8/membrane/core/interceptor/dlp/JsonUtils.java

@@ -0,0 +1,43 @@
+package com.predic8.membrane.core.interceptor.dlp;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+import java.util.Iterator;
+import java.util.Map;
+import java.util.regex.Pattern;
+
+class JsonUtils {
+
+    static void filter(JsonNode node, Pattern p) {
+        traverse(node, p, true);
+    }
+
+    static void mask(JsonNode node, Pattern p) {
+        traverse(node, p, false);
+    }
+
+    private static void traverse(JsonNode node, Pattern p, boolean remove) {
+        if (node.isObject()) {
+            ObjectNode obj = (ObjectNode) node;
+            Iterator<Map.Entry<String, JsonNode>> it = obj.fields();
+            while (it.hasNext()) {
+                Map.Entry<String, JsonNode> e = it.next();
+                String key = e.getKey();
+                if (p.matcher(key).matches()) {
+                    if (remove) {
+                        it.remove();
+                    } else {
+                        obj.put(key, "****");
+                    }
+                } else {
+                    traverse(e.getValue(), p, remove);
+                }
+            }
+        } else if (node.isArray()) {
+            for (JsonNode child : node) {
+                traverse(child, p, remove);
+            }
+        }
+    }
+}