Sink-aware RASP

Pro Feature - Requires a ContractShield Pro license.

Sink-aware RASP (Runtime Application Self-Protection) monitors dangerous operations like database queries and file system access, blocking attacks that bypass input validation.

What It Detects

Sink	Example Attack
SQL queries	SQL injection reaching the database
NoSQL queries	MongoDB operator injection
File system	Path traversal reaching fs.readFile
Command execution	Shell injection reaching exec
Network requests	SSRF reaching http.request

Configuration

pro:
  sinkRasp:
    enabled: true
    sql: true
    nosql: true
    filesystem: true
    command: true
    network: true

How It Works

RASP instruments your application at runtime, monitoring the actual operations performed - not just the input. Even if an attacker crafts input that passes validation, RASP blocks the dangerous operation.

Input Validation (ContractShield) → Your Code → RASP (blocks dangerous ops)