//! Canonical detection pattern table for guard-core spec 4.0.2.
//!
//! Generated from the reference (`guard_core/handlers/_suspatterns_pattern_table.py`)
//! via the TS port's canonical table. The `source` strings are carried verbatim on
//! threats and compared by the conformance corpus; regenerate from the
//! reference when the spec moves. Entry `id` is the table position and keys
//! the matcher dispatch in `mod.rs`.
use std::sync::LazyLock;
pub const CTX_ALL: &[&str] = &[
"query_param",
"header",
"url_path",
"request_body",
"unknown",
];
pub const CTX_CMD_INJECTION: &[&str] = &["query_param", "header", "request_body", "unknown"];
pub const CTX_SENSITIVE_PATH_FAMILY: &[&str] =
&["query_param", "url_path", "request_body", "unknown"];
pub const CTX_SQLI_NARROW: &[&str] = &["query_param", "request_body", "unknown"];
pub struct TableEntry {
pub id: usize,
pub source: &'static str,
pub contexts: &'static [&'static str],
pub category: &'static str,
}
pub static PATTERN_DEFINITIONS: LazyLock<Vec<TableEntry>> = LazyLock::new(|| {
vec![
TableEntry {
id: 0,
source: r"<script[^>]*>[^<]*<\/script\s*>",
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 1,
source: r"javascript:\s*[^\s]+",
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 2,
source: r"j[\t\r\n]*a[\t\r\n]*v[\t\r\n]*a[\t\r\n]*s[\t\r\n]*c[\t\r\n]*r[\t\r\n]*i[\t\r\n]*p[\t\r\n]*t[\t\r\n]*:\s*[^\s]+",
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 3,
source: r#"(?:<[A-Za-z/](?:[^<>]*[^<>\s/])?(?<!=)(?<!=\")(?<!=')[\s/]+(?:onwebkitplaybacktargetavailabilitychanged|oncontentvisibilityautostatechange|onwebkitpresentationmodechanged|onwebkitmouseforcewillbegin|onwebkitanimationiteration|onsecuritypolicyviolation|onwebkitmouseforcechanged|onvalidationstatuschange|onwebkitfullscreenchange|onwebkitwillrevealbottom|onwebkitanimationstart|onwebkitmouseforcedown|onbeforescriptexecute|onmozfullscreenchange|onwebkittransitionend|onafterscriptexecute|onanimationiteration|onlostpointercapture|onscrollsnapchanging|onunhandledrejection|onwebkitanimationend|onwebkitmouseforceup|ondeviceorientation|ongotpointercapture|onbeforedeactivate|onfullscreenchange|onpointerrawupdate|onreadystatechange|onrejectionhandled|onscrollsnapchange|ontransitioncancel|onanimationcancel|onbeforeeditfocus|oncontextrestored|ondatasetcomplete|onselectionchange|ontransitionstart|onanimationstart|onbeforeactivate|oncanplaythrough|ondatasetchanged|ondurationchange|onlanguagechange|onlayoutcomplete|onloadedmetadata|onpropertychange|oncontrolselect|ondataavailable|ongesturechange|onmediacomplete|onpointercancel|onpromptdismiss|ontransitionend|ontransitionrun|onwebkitneedkey|onanimationend|onbeforetoggle|onbeforeunload|onbeforeupdate|ondevicemotion|onfilterchange|ongesturestart|onmessageerror|onpointerenter|onpointerleave|onpromptaction|onsyncrestored|onvolumechange|onafterupdate|onbeforeinput|onbeforematch|onbeforepaste|onbeforeprint|oncontextlost|oncontextmenu|onerrorupdate|onlosecapture|onpointerdown|onpointermove|onpointerover|onresizestart|onrowinserted|onselectstart|ontouchcancel|ontrackchange|onafterprint|onbeforecopy|oncellchange|ondeactivate|ongestureend|onhashchange|onloadeddata|onmediaerror|onmouseenter|onmouseleave|onmousewheel|onpagereveal|onpointerout|onratechange|onslotchange|ontimeupdate|ontouchstart|onbeforecut|oncuechange|ondragenter|ondragleave|ondragstart|onloadstart|onmousedown|onmousemove|onmouseover|onmovestart|onoutofsync|onpointerup|onresizeend|onrowdelete|onrowsenter|onscrollend|ontimeerror|ontouchmove|onactivate|onauxclick|ondblclick|ondragdrop|ondragexit|ondragover|onfocusout|onformdata|onkeypress|onlocation|onmouseout|onpagehide|onpageshow|onpageswap|onpopstate|onprogress|ontouchend|oncanplay|oncommand|ondragend|onemptied|onfocusin|oninvalid|onkeydown|onmessage|onmouseup|onmoveend|onoffline|onplaying|onreverse|onrowexit|onseeking|onstalled|onstorage|onsuspend|onurlflip|onwaiting|onbounce|oncancel|onchange|onfinish|ononline|onrepeat|onresize|onresume|onscroll|onsearch|onseeked|onselect|onsubmit|ontoggle|onunload|onabort|onbegin|onclick|onclose|onended|onerror|onfocus|oninput|onkeyup|onpaste|onpause|onreset|onstart|onwheel|onblur|oncopy|ondrag|ondrop|onhelp|onload|onmove|onplay|onredo|onseek|onstop|onundo|oncut|onend)\s*=\s{0,20}(?:[\"'][^\"']*[\"']|[^\s>]+))"#,
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 4,
source: r#"(?:<[A-Za-z/](?:[^<>]*[^<>\s])?\s+(?:href|src|data|action)\s*=[\s\"\']*(?:javascript|vbscript|data):)"#,
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 5,
source: r#"(?:<[A-Za-z/][^<>]*style\s*=\s{0,20}[\"']?[^<>\"']*(?:expression|behavior|url)\s*\([^)]*\))"#,
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 6,
source: r"(?:<object[^>]*>[\s\S]*<\/object\s*>)",
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 7,
source: r"(?:<embed[^>]*>[\s\S]*<\/embed\s*>)",
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 8,
source: r"(?:<applet[^>]*>[\s\S]*<\/applet\s*>)",
contexts: CTX_ALL,
category: r"xss",
},
TableEntry {
id: 9,
source: r"(?i)\bSELECT\b(?:(?!\bSELECT\b)[\w\s,\*().])*?\bFROM\b",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 10,
source: r"(?i)SELECT\s+\*",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 11,
source: r#"(?i)\bWHERE\s+[\w."]+\s*(?:=|<|>|<=|>=|LIKE|IN)\b"#,
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 12,
source: r#"(?i)\b(?:OR|AND)\s*(\d+|'[^']*'|\"[^\"]*\"|[@:$][A-Za-z_]\w*)\s*=\s*\1\b"#,
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 13,
source: r"(?i)UNION\s+(?:ALL\s+)?SELECT",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 14,
source: r"(?i)('\s*(?:OR|AND)[\s(]*'?(?:[@:$][A-Za-z_]\w*|[\d\w]+)\s*(?:LIKE|[<>]=?|=)[\s(]*'?(?:[@:$][A-Za-z_]\w*|[\d\w]+))",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 15,
source: r"(?i)(UNION\s+(?:ALL\s+)?SELECT\s+NULL(?:[,\s]*NULL)*[,\s]*|\(\s*SELECT\s+(?:@@|VERSION))",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 16,
source: r"(?i)(?:INTO\s+(?:OUTFILE|DUMPFILE)\s+'[^']+')",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 17,
source: r"(?i)(?:LOAD_FILE\s*\([^)]+\))",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 18,
source: r"(?i)(?:BENCHMARK\s*\(\s*\d+\s*,)",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 19,
source: r"(?i)(?:SLEEP\s*\(\s*\d+\s*\))",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 20,
source: r"(?i)(?:\/\*![0-9]*\s*(?:OR|AND|UNION|SELECT|INSERT|DELETE|DROP|CONCAT|CHAR|UPDATE)\b)",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 21,
source: r"\w/\*(?!!)[^*]*\*/\w",
contexts: CTX_SQLI_NARROW,
category: r"sqli",
},
TableEntry {
id: 22,
source: r"(?i)(?:OR|AND)\s+(?:'[\w\d]*'='[\w\d]*'?|[@:$][A-Za-z_]\w*\s*=\s*[@:$][A-Za-z_]\w*)",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 23,
source: r"(?i);\s*(?:DROP|TRUNCATE|ALTER|CREATE)\s+(?:TABLE|DATABASE|SCHEMA)\b",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 24,
source: r"(?i);\s*(?:INSERT\s+INTO|UPDATE\s+\w+\s+SET|DELETE\s+FROM|SELECT\b[^;]*?\bFROM\b|REPLACE\s+INTO)\b",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 25,
source: r"(?i)\bEXEC(?:UTE)?\s+(?:xp_\w+|sp_\w+)",
contexts: CTX_SQLI_NARROW,
category: r"sqli",
},
TableEntry {
id: 26,
source: r#"(?i)(?:\A|[;'\"])\s*EXEC(?:UTE)?\s+(?:xp_\w+|sp_\w+)"#,
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 27,
source: r"(?i)\bORDER\s+BY\s+\d+\s*(?:--|#|;|\)|,|/\*|\Z)|(?<=[=?&])ORDER\s+BY\s+\d+\s*\n",
contexts: CTX_SQLI_NARROW,
category: r"sqli",
},
TableEntry {
id: 28,
source: r#"(?i)(?:['\")\d]|/\*)\s{0,3}\bORDER\s+BY\s+\d+|\bORDER\s+BY\s+\d+\s*(?:--|#|/\*)"#,
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 29,
source: r"'\s*(?:[\);]+\s*)?--|'[\);]*#(?:\n|\Z)",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 30,
source: r"(?i)\bWAITFOR\s+(?:DELAY|TIME)\s+'\d{1,2}:\d{1,2}:\d{1,2}(?:\.\d+)?'",
contexts: CTX_ALL,
category: r"sqli",
},
TableEntry {
id: 31,
source: r"(?:\.\.\/|\.\.\\)(?:\.\.\/|\.\.\\)+",
contexts: CTX_ALL,
category: r"dir_traversal",
},
TableEntry {
id: 32,
source: r#"\A(?:(?!\n).)*etc/(?:passwd|shadow|group|hosts|motd|issue|mysql/my\.cnf|ssh/ssh_config)(?:[&#;,\"'<>]|\s*\Z)"#,
contexts: CTX_ALL,
category: r"dir_traversal",
},
TableEntry {
id: 33,
source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:etc/(?:passwd|shadow|group|hosts|motd|issue|mysql/my\.cnf|ssh/ssh_config))(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
contexts: CTX_ALL,
category: r"dir_traversal",
},
TableEntry {
id: 34,
source: r#"\A(?:(?!\n).)*(?:boot\.ini|win\.ini|system\.ini|config\.sys)(?:[&#;,\"'<>]|\s*\Z)"#,
contexts: CTX_ALL,
category: r"dir_traversal",
},
TableEntry {
id: 35,
source: r#"\A(?:(?!\n).)*proc/self/environ(?:[&#;,\"'<>]|\s*\Z)"#,
contexts: CTX_ALL,
category: r"dir_traversal",
},
TableEntry {
id: 36,
source: r#"\A(?:(?!\n).)*var/log/[^\s/]+(?:[&#;,\"'<>]|\s*\Z)"#,
contexts: CTX_ALL,
category: r"dir_traversal",
},
TableEntry {
id: 37,
source: r"\.\.;[^/\\]*[/\\]",
contexts: CTX_ALL,
category: r"dir_traversal",
},
TableEntry {
id: 38,
source: r";\s*(?:ls|cat|rm|chmod|chown|wget|curl|nc|netcat|ping|telnet)\s+-[a-zA-Z]+\s+",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 39,
source: r"\|\s*(?:wget|curl|fetch|lwp-download|lynx|links|GET)\s+",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 40,
source: r"(?:[;&|]\s*(?:\$\([^)]+\)|\$\{[^}]+\}))",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 41,
source: r"\A\s*(?:[;&|]\s*)*`\s*(?:[A-Za-z0-9_./~]|\$[({])(?:[^`\\\n]|\\.)*(?:\n\s*)?`(?:\s*[;&|]\s*`\s*(?:[A-Za-z0-9_./~]|\$[({])(?:[^`\\\n]|\\.)*(?:\n\s*)?`)*\s*(?:[;&|]\s*)*\Z",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 42,
source: r"(?<!`)`(?:[A-Za-z0-9_./~]|\$[({])(?:[^`\\\n]|\\.)*`",
contexts: CTX_ALL,
category: r"cmd_injection",
},
TableEntry {
id: 43,
source: r"\$\((?:[^()\\\n]|\\.)*\)|\$\{(?:[^{}\\\n]|\\.)*\}",
contexts: CTX_ALL,
category: r"cmd_injection",
},
TableEntry {
id: 44,
source: r"(?i)\$\{(?:jndi:(?:ldap|rmi|dns)://|\$?\{?(?:lower|upper):j\}ndi|::-j\}ndi)",
contexts: CTX_ALL,
category: r"cmd_injection",
},
TableEntry {
id: 45,
source: r#"(?:\A|[;|&])\s*/?(?:[\w.-]+/)*(?:env\s+/?(?:[\w.-]+/)*)?(?:bash|sh|ksh|csh|tsch|zsh|ash)\s+-[a-zA-Z]+(?:\s+(?:'[^']*'|\"[^\"]*\"|[^\s;|&]+))?(?=\s*(?:[;|&]|\Z))"#,
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 46,
source: r"(?:\A|[;|&])\s*[^=\s;|&]+=[^\s;|&]+\s+(?:/?(?:[\w.-]+/)*env\s+)?/?(?:[\w.-]+/)*(?:bash|sh|ksh|csh|tsch|zsh|ash)\s+-[a-zA-Z]+",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 47,
source: r"\n[^\S\r\n]*(?:[^=\s;|&]+=[^\s;|&]+\s+)*(?:/?(?:[\w.-]+/)*env\s+)?/?(?:[\w.-]+/)*(?:bash|sh|ksh|csh|tsch|zsh|ash)\s+-c\b",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 48,
source: r"\b(?:eval|system|exec|shell_exec|passthru|popen|proc_open|create_function)\s*\(",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 49,
source: r#"(?:require\(\s*[\"']child_process[\"']\s*\)|child_process)\s*\.\s*(?:execSync|spawnSync|spawn|fork)\s*\("#,
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 50,
source: r"\bassert\s*\(\s*\$",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 51,
source: r"\bos\.exec(?:l|le|lp|lpe|v|ve|vp|vpe)\s*\(",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 52,
source: r#"\b(?:new\s+)?Function\s*\(\s*[\"']"#,
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 53,
source: r#"\[\s*[\"']eval[\"']\s*\]\s*\(\s*[\"']"#,
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 54,
source: r#"(?:\.\s*constructor|\[\s*[\"']constructor[\"']\s*\])\s*(?:\.\s*constructor|\[\s*[\"']constructor[\"']\s*\])\s*\(\s*[\"']"#,
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 55,
source: r#"\b(?:setTimeout|setInterval)\s*\(\s*[\"']"#,
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 56,
source: r"[;|&]\s*(?:ls|cat|rm|id|whoami|uname|wget|curl|nc|netcat|socat|bash|sh|python|perl)\b",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 57,
source: r"(?i)\b(?:nc|netcat|ncat)\s+-[a-z]*e\b|/dev/tcp/\d",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 58,
source: r#"(?:\A|[;&|]\s*|\$\()\{[^{}\s,:'\"][^{},:'\"]*(?:,(?:[^{}\s,:'\"][^{},:'\"]*)?)+\}"#,
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 59,
source: r#"\w+(?:['\"]+\w+){1,10}"#,
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 60,
source: r"[A-Za-z0-9_./*?-]*[?*][A-Za-z0-9_./*?-]*",
contexts: CTX_CMD_INJECTION,
category: r"cmd_injection",
},
TableEntry {
id: 61,
source: r"(?:php|data|zip|rar|file|glob|expect|input|phpinfo|zlib|phar|ssh2|rar|ogg|expect)://[^\s]+",
contexts: CTX_ALL,
category: r"file_inclusion",
},
TableEntry {
id: 62,
source: r"(?:(?<!:)\/\/[0-9a-zA-Z](?:[-\w]*[0-9a-zA-Z])?(?:\.[0-9a-zA-Z](?:[-\w]*[0-9a-zA-Z])?)+(:[0-9]+)?(?:\/?)(?:[a-zA-Z0-9\-\.\?,'/\\\+&%\$#_]*)?)",
contexts: CTX_ALL,
category: r"file_inclusion",
},
TableEntry {
id: 63,
source: r#"=(?:https?|ftp):\/\/[^\s'\"<>]+\/[^\s'\"<>\/]*\.(?:phtml|php[3-5]?|phar|jsp|aspx?|pl|py|txt|inc)(?![a-zA-Z0-9])"#,
contexts: CTX_ALL,
category: r"file_inclusion",
},
TableEntry {
id: 64,
source: r#"[\"'](?:template|include|tpl|module|layout)[\"']\s*:\s*[\"'](?:https?|ftp)://[^\s'\"<>]+/[^\s'\"<>/]*\.(?:phtml|php[3-5]?|phar|jsp|aspx?|cgi|pl|py|sh|txt|inc)(?![a-zA-Z0-9])[\"']"#,
contexts: CTX_ALL,
category: r"file_inclusion",
},
TableEntry {
id: 65,
source: r"\([\s]*[|&][\s]*\([^)(]+=[*]",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 66,
source: r"\*\s*\)+\s*(?:[|&!]\s*)?\(+\s*(?:[&|!]|(?::)?(?:[a-zA-Z][\w.-]*|\d+(?:\.\d+)*)(?:;[\w.-]+)*(?::[\w.-]+)*\s*:?=)",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 67,
source: r"\)\s*\(\s*(?:[&|!]|(?::)?(?:[a-zA-Z][\w.-]*|\d+(?:\.\d+)*)(?:;[\w.-]+)*(?::[\w.-]+)*\s*:?[=~<>])",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 68,
source: r"\(\s*[&|]\s*",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 69,
source: r"\*\)[|&]?\(+\s*(?::)?(?:[a-zA-Z][\w.-]*|\d+(?:\.\d+)*)(?:;[\w.-]+)*(?::[\w.-]+)*\s*:?=",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 70,
source: r"[a-zA-Z][\w-]*\s*=[\d\w\s]*\*\)+(?:%00|\\u0000|\\x00|\\0|\x00)",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 71,
source: r"\*\)\)+(?:%00|\\u0000|\\x00|\\0|\x00)",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 72,
source: r"[a-zA-Z][\w-]*\s*=[\d\w\s]*\*\)+\x00",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 73,
source: r"\*\)\)+\x00",
contexts: CTX_ALL,
category: r"ldap",
},
TableEntry {
id: 74,
source: r"<!(?:ENTITY|DOCTYPE)[^>]+SYSTEM[^>]+>",
contexts: CTX_ALL,
category: r"xml",
},
TableEntry {
id: 75,
source: r#"<!DOCTYPE[^>\[]+PUBLIC[^>\[]+[\"']https?://(?!(?:www\.)?w3\.org/)[^\"'>]+[\"'][^>\[]*>"#,
contexts: CTX_ALL,
category: r"xml",
},
TableEntry {
id: 76,
source: r"(?:<!\[CDATA\[.*?\]\]>)",
contexts: CTX_ALL,
category: r"xml",
},
TableEntry {
id: 77,
source: r"<!DOCTYPE[^>\[]*\[[\s\S]*?<!ENTITY",
contexts: CTX_ALL,
category: r"xml",
},
TableEntry {
id: 78,
source: r"(?:^|\s|/)(?:(?<=://)[^\s/@]*@)?(?:localhost\.?|127\.0\.0\.1|0\.0\.0\.0|\[::(?:\d*)\]|\[::ffff:127\.0\.0\.1\]|169\.254(?:\.\d{1,3}){2}|192\.168(?:\.\d{1,3}){2}|10(?:\.\d{1,3}){3}|172\.(?:1[6-9]|2[0-9]|3[01])(?:\.\d{1,3}){2}|metadata\.google\.internal|metadata\.goog|100\.100\.100\.200)(?::\d+)?(?:\s|$|/)",
contexts: CTX_ALL,
category: r"ssrf",
},
TableEntry {
id: 79,
source: r"://(?:[^/@\s]*@)?((?:0[xX][0-9a-fA-F]+|0[0-7]+|[1-9]\d*|0)(?:\.(?:0[xX][0-9a-fA-F]+|0[0-7]+|[1-9]\d*|0)){0,3})(?=[:/\s]|$)",
contexts: CTX_ALL,
category: r"ssrf",
},
TableEntry {
id: 80,
source: r"(?:file|dict|gopher|jar|tftp)://[^\s]+",
contexts: CTX_ALL,
category: r"ssrf",
},
TableEntry {
id: 81,
source: r"://[^/\s@]*@[^/\s@]*@",
contexts: CTX_ALL,
category: r"ssrf",
},
TableEntry {
id: 82,
source: r"://(?:metadata|instance-data)(?::\d+)?(?:/|\s|$)",
contexts: CTX_ALL,
category: r"ssrf",
},
TableEntry {
id: 83,
source: r"\{\s*\$(?:where|gt|lt|ne|eq|regex|in|nin|all|size|exists|type|mod|options):",
contexts: CTX_ALL,
category: r"nosql",
},
TableEntry {
id: 84,
source: r"(?:\{\s*\$[a-zA-Z]+\s*:\s*(?:\{|\[))",
contexts: CTX_ALL,
category: r"nosql",
},
TableEntry {
id: 85,
source: r#""\$(?:where|regex|expr|jsonSchema|function|accumulator|type|exists|size)"\s*:"#,
contexts: CTX_ALL,
category: r"nosql",
},
TableEntry {
id: 86,
source: r#""\$(?:gt|gte|lt|lte|ne|eq|in|nin|all|mod)"\s*:\s*(?:""|null|\{|\[)"#,
contexts: CTX_ALL,
category: r"nosql",
},
TableEntry {
id: 87,
source: r#""[^"]+"\s*:\s*\{\s*"\$(?:ne|eq)"\s*:\s*(?:true|false)"#,
contexts: CTX_ALL,
category: r"nosql",
},
TableEntry {
id: 88,
source: r"\[\$(?:where|gt|gte|lt|lte|ne|eq|regex|in|nin|nor|and|or|not|all|size|exists|type|mod|options|expr|function|elemMatch)\]",
contexts: CTX_ALL,
category: r"nosql",
},
TableEntry {
id: 89,
source: r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|com|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)[\"']"#,
contexts: CTX_CMD_INJECTION,
category: r"file_upload",
},
TableEntry {
id: 90,
source: r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:[^ \"'][^\"']*)?\.(?:docx|jpeg|pptx|tiff|webm|webp|xlsx|avi|bmp|doc|gif|ico|jpg|mkv|mov|mp3|mp4|odt|pdf|png|ppt|svg|tif|wav|xls)[\"']"#,
contexts: CTX_CMD_INJECTION,
category: r"file_upload",
},
TableEntry {
id: 91,
source: r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:(?:%00|\\u0000|\\x00|\\0|\x00|;)[^\"']*|\.)[\"']"#,
contexts: CTX_CMD_INJECTION,
category: r"file_upload",
},
TableEntry {
id: 92,
source: r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:(?:\x00|;)[^\"']*|\.)[\"']"#,
contexts: CTX_CMD_INJECTION,
category: r"file_upload",
},
TableEntry {
id: 93,
source: r"(?:%2e%2e|%252e%252e|%uff0e%uff0e|%c0%ae%c0%ae|%e0%40%ae|%c0%ae%e0%80%ae|%25c0%25ae)/",
contexts: CTX_ALL,
category: r"path_traversal",
},
TableEntry {
id: 94,
source: r"\{\{\s*[^\}]+(?:system|exec|popen|eval|require|include)\s*\}\}",
contexts: CTX_ALL,
category: r"template",
},
TableEntry {
id: 95,
source: r"\{\%\s*[^\%]+(?:system|exec|popen|eval|require|include)\s*\%\}",
contexts: CTX_ALL,
category: r"template",
},
TableEntry {
id: 96,
source: r"(?i)<%[=#]?[^%]*(?:system|exec|eval|`|Runtime|IO\.|File\.|Dir\.|\d+\s*[-+*/]\s*\d+)[^%]*%>",
contexts: CTX_ALL,
category: r"template",
},
TableEntry {
id: 97,
source: r"\$\{[^}]*(?:@[\w.]+@|\b\w+\s*\(|\d+\s*[*/%+\-]\s*\d+)[^}]*\}",
contexts: CTX_ALL,
category: r"template",
},
TableEntry {
id: 98,
source: r#"\{\{(?![^\}]*\d{4}-\d{1,2}-\d{1,2}(?!\d))(?=[^\}]*(?:@[\w.]+@|\b\w+\(\s*\)|['\"]?\d+['\"]?\s*[*/%+\-]\s*['\"]?\d+['\"]?))[^\}]*\}\}"#,
contexts: CTX_ALL,
category: r"template",
},
TableEntry {
id: 99,
source: r#"#\{(?![^\}]*\d{4}-\d{1,2}-\d{1,2}(?!\d))(?=[^\}]*(?:@[\w.]+@|\b\w+\s*\(|['\"]?\d+['\"]?\s*[*/%+\-]\s*['\"]?\d+['\"]?))[^\}]*\}"#,
contexts: CTX_ALL,
category: r"template",
},
TableEntry {
id: 100,
source: r"[\r\n][^\S\r\n]*(?:HTTP\/[0-9.]+|Location:|Set-Cookie:)",
contexts: CTX_ALL,
category: r"http_split",
},
TableEntry {
id: 101,
source: r"\A[/\\]?(?:(?!\.env(?:\.\w+)?(?:[/\\]|\Z))[\w.\-~%]+[/\\])*\.env(?:\.\w+)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"sensitive_file",
},
TableEntry {
id: 102,
source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:\.env(?:\.\w+)?)(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"sensitive_file",
},
TableEntry {
id: 103,
source: r"\A[/\\]?(?:(?!(?:(?!config)[\w-])*config[\w-]*\.(?:env|yml|yaml|json|toml|ini|xml|conf)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:(?!config)[\w-])*config[\w-]*\.(?:env|yml|yaml|json|toml|ini|xml|conf)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"sensitive_file",
},
TableEntry {
id: 104,
source: r"\A[/\\]?(?:(?![\w.\-~%]*\.map(?:[/\\]|\Z))[\w.\-~%]+[/\\])*[\w.\-~%]*\.map(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"sensitive_file",
},
TableEntry {
id: 105,
source: r"\A[/\\]?(?:[\w.\-~%]+[/\\])*[\w.\-~%]*\.(?:ts|tsx|jsx|py|rb|java|go|rs|php|pl|sh|sql)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"sensitive_file",
},
TableEntry {
id: 106,
source: r"\A[/\\]?(?:(?!\.(?:git|svn|hg|bzr)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*\.(?:git|svn|hg|bzr)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"sensitive_file",
},
TableEntry {
id: 107,
source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:\.(?:git|svn|hg|bzr))(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"sensitive_file",
},
TableEntry {
id: 108,
source: r"\A[/\\]?(?:[\w.\-~%]+[/\\])*[\w.\-~%]*\.\w+~(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"sensitive_file",
},
TableEntry {
id: 109,
source: r"\A[/\\]?(?:(?!(?:wp-(?:admin|login|content|includes|config)|administrator|xmlrpc)\.?(?:php)?(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:wp-(?:admin|login|content|includes|config)|administrator|xmlrpc)\.?(?:php)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"cms_probing",
},
TableEntry {
id: 110,
source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:(?:wp-(?:admin|login|content|includes|config)|administrator|xmlrpc)\.?(?:php)?)(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"cms_probing",
},
TableEntry {
id: 111,
source: r"\A[/\\]?(?:(?!(?:phpinfo|info|test|php_info)\.php(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:phpinfo|info|test|php_info)\.php(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"cms_probing",
},
TableEntry {
id: 112,
source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:(?:phpinfo|info|test|php_info)\.php)(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"cms_probing",
},
TableEntry {
id: 113,
source: r"\A[/\\]?(?:(?![\w.\-~%]*\.(?:bak|backup|old|orig|save|swp|swo|tmp|temp)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*[\w.\-~%]*\.(?:bak|backup|old|orig|save|swp|swo|tmp|temp)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"cms_probing",
},
TableEntry {
id: 114,
source: r"\A[/\\]?(?:(?!(?:\.htaccess|\.htpasswd|\.DS_Store|Thumbs\.db|\.npmrc|\.dockerenv|web\.config)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:\.htaccess|\.htpasswd|\.DS_Store|Thumbs\.db|\.npmrc|\.dockerenv|web\.config)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"cms_probing",
},
TableEntry {
id: 115,
source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:(?:\.htaccess|\.htpasswd|\.DS_Store|Thumbs\.db|\.npmrc|\.dockerenv|web\.config))(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"cms_probing",
},
TableEntry {
id: 116,
source: r"\A[/\\]?(?:[\w.\-~%]+[/\\])*[\w.\-~%]*\.(?:asp|aspx|jsp|jsa|jhtml|shtml|cfm|cgi|do|action|lua|inc|woa|nsf|esp)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 117,
source: r"\A[/\\](?:(?!(?:management|config_dump|credentials|system[/\\]version|version[/\\]system)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:management|config_dump|credentials|system[/\\]version|version[/\\]system)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 118,
source: r"\A[/\\](?:system|version)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 119,
source: r"\A[/\\]?(?:(?!(?:actuator|server-status|telescope)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:actuator|server-status|telescope)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 120,
source: r"(?:CSCOE|dana-(?:na|cached)|sslvpn|RDWeb|/owa/|/ecp/|global-protect|ssl-vpn/|svpn/|sonicui|/remote/login|myvpn|vpntunnel|versa/login)",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 121,
source: r"\A[/\\]?(?:(?!(?:geoserver|confluence|nifi|ScadaBR|pandora_console|centreon|kylin|decisioncenter|evox|MagicInfo|metasys|officescan|helpdesk|ignite)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:geoserver|confluence|nifi|ScadaBR|pandora_console|centreon|kylin|decisioncenter|evox|MagicInfo|metasys|officescan|helpdesk|ignite)(?:[.\-][\w.\-~%]*)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 122,
source: r"\A[/\\]?(?:(?!cgi-(?:bin|mod)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*cgi-(?:bin|mod)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 123,
source: r"\A[/\\]?(?:(?!(?:HNAP1|IPCamDesc\.xml|SDK/webLanguage)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:HNAP1|IPCamDesc\.xml|SDK/webLanguage)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 124,
source: r"\A[/\\]?(?:(?!(?:language|languages)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:language|languages)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 125,
source: r"\A[/\\]?(?:(?!(?:readme\.txt|README\.md|CHANGELOG|pom\.xml|build\.gradle|appsettings\.json|crossdomain\.xml)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:readme\.txt|README\.md|CHANGELOG|pom\.xml|build\.gradle|appsettings\.json|crossdomain\.xml)(?:\.[\w.\-~%]*)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 126,
source: r"\A[/\\]?(?:(?!(?:sap|ise|nidp|cslu|rustfs|developmentserver|fog/management|lms/db|json/login_session|sms_mp|plugin/webs_model|wsman|am_bin)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:sap|ise|nidp|cslu|rustfs|developmentserver|fog/management|lms/db|json/login_session|sms_mp|plugin/webs_model|wsman|am_bin)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 127,
source: r"(?:nmaplowercheck|nice\s+ports|Trinity\.txt)",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 128,
source: r"\A[/\\]?(?:(?!\.(?:openclaw|clawdbot)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*\.(?:openclaw|clawdbot)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 129,
source: r"\A[/\\]?(?:default|inicio|indice|localstart)(?:\.[\w.\-~%]*)?(?:[/\\])?(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 130,
source: r"\A[/\\]?(?:(?!inicio\.html?(?:[/\\]|\Z))[\w.\-~%]+[/\\])*inicio\.html?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 131,
source: r"\A[/\\]?(?:(?!(?:\.streamlit|\.gpt-pilot|\.aider|\.cursor|\.windsurf|\.copilot|\.devcontainer)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:\.streamlit|\.gpt-pilot|\.aider|\.cursor|\.windsurf|\.copilot|\.devcontainer)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 132,
source: r"\A[/\\]?(?:(?!(?:docker-compose|Dockerfile|Makefile|Vagrantfile|Jenkinsfile|Procfile)(?:\.ya?ml)?(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:docker-compose|Dockerfile|Makefile|Vagrantfile|Jenkinsfile|Procfile)(?:\.ya?ml)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 133,
source: r"\A[/\\]?(?:(?![\w.\-~%]*(?:secrets?|credentials?)\.(?:py|json|yml|yaml|toml|txt|env|xml|conf|cfg)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*[\w.\-~%]*(?:secrets?|credentials?)\.(?:py|json|yml|yaml|toml|txt|env|xml|conf|cfg)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 134,
source: r"\A[/\\]?(?:(?!autodiscover(?:[/\\]|\Z))[\w.\-~%]+[/\\])*autodiscover(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 135,
source: r"\A[/\\]?(?:(?!dns-query(?:[/\\]|\Z))[\w.\-~%]+[/\\])*dns-query(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 136,
source: r"\A[/\\]?(?:(?!\.git/(?:refs|index|HEAD|objects|logs)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*\.git/(?:refs|index|HEAD|objects|logs)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
contexts: CTX_SENSITIVE_PATH_FAMILY,
category: r"recon",
},
TableEntry {
id: 137,
source: r#"(?:__proto__|constructor)\s*(?:\[\s*[\"']prototype[\"']\s*\]|\.\s*prototype)|[\"']__proto__[\"']\s*:"#,
contexts: CTX_ALL,
category: r"proto_pollution",
},
TableEntry {
id: 138,
source: r#"__proto__\s*(?:\[|\.)|\[\s*[\"']?__proto__[\"']?\s*\]|constructor\s*\[\s*[\"']?prototype[\"']?\s*\]|\[\s*[\"']?constructor[\"']?\s*\]\s*\[\s*[\"']?prototype[\"']?\s*\]"#,
contexts: CTX_ALL,
category: r"proto_pollution",
},
TableEntry {
id: 139,
source: r"Object\.prototype\.[A-Za-z_$][\w$]*\s*=(?!=)",
contexts: CTX_ALL,
category: r"proto_pollution",
},
TableEntry {
id: 140,
source: r"\b(?:Object|Reflect)\.setPrototypeOf\s*\(",
contexts: CTX_ALL,
category: r"proto_pollution",
},
TableEntry {
id: 141,
source: r"System\.Diagnostics\.Process\.Start\s*\(|System\.Reflection\.|Assembly\.Load\s*\(",
contexts: CTX_ALL,
category: r"code_injection",
},
TableEntry {
id: 142,
source: r#"(?-i:\bgetattr\(\s*(?:__import__\(\s*['\"](?:os|subprocess|builtins|importlib)['\"]\s*\)|\b(?:os|subprocess|builtins|importlib)\b)\s*,\s*['\"](?:system|popen|exec|eval|call|run|Popen|check_output|check_call)['\"]\s*\)\s*\()"#,
contexts: CTX_ALL,
category: r"code_injection",
},
TableEntry {
id: 143,
source: r#"(?-i:\bvars\(\s*(?:__import__\(\s*['\"](?:os|subprocess|builtins|importlib)['\"]\s*\)|\b(?:os|subprocess|builtins|importlib)\b)\s*\)\s*\[\s*['\"](?:system|popen|exec|eval|call|run|Popen|check_output|check_call)['\"]\s*\]\s*\()"#,
contexts: CTX_ALL,
category: r"code_injection",
},
TableEntry {
id: 144,
source: r"(?<![A-Za-z0-9+/])(?-i:rO0AB)",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 145,
source: r"(?<![A-Za-z0-9+/])(?-i:AAEAAAD)",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 146,
source: r"(?<![A-Za-z0-9+/])(?-i:gA[SW]V)",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 147,
source: r"(?<![A-Za-z0-9+/])(?-i:BAh[Jv7bV])",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 148,
source: r"cos\n",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 149,
source: r"c__builtin__",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 150,
source: r"csubprocess",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 151,
source: r"cposix",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 152,
source: r"(c[A-Za-z_][A-Za-z0-9_]{0,100}(?:\.[A-Za-z_][A-Za-z0-9_]{0,100}){0,20}\n[A-Za-z_][A-Za-z0-9_]{0,100}\n)[^ \t]{0,100}?[Rb]",
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 153,
source: r#"O:\d+:""#,
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 154,
source: r#"C:\d+:""#,
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 155,
source: r#"E:\d+:""#,
contexts: CTX_ALL,
category: r"deserialization",
},
TableEntry {
id: 156,
source: r"<ObjectDataProvider\b",
contexts: CTX_ALL,
category: r"deserialization",
},
]
});
/// The optional leading-separator anchor the reference builds the recon
/// whole-value rows from (`_TOP_LEVEL_PATH_PREFIX_RE`, i.e. `\A[/\\]?`).
const TOP_LEVEL_PATH_PREFIX: &str = r"\A[/\\]?";
/// Recon rows whose leading path separator is optional.
///
/// Outside a URL path these rows match bare words such as "default" or
/// "README.md", not only probe paths. Derived from the table (recon category
/// plus the anchor) with the reference's own rule
/// (`_suspatterns_pattern_table.py`), so a new recon row built the same way
/// is covered without a hand-maintained list. Other families (`cms_probing`,
/// `sensitive_file`) also carry the anchor but are deliberately not gated,
/// matching the reference scoping.
pub static RECON_OPTIONAL_SEPARATOR_PATTERN_SOURCES: LazyLock<
std::collections::HashSet<&'static str>,
> = LazyLock::new(|| {
PATTERN_DEFINITIONS
.iter()
.filter(|entry| {
entry.category == "recon" && entry.source.starts_with(TOP_LEVEL_PATH_PREFIX)
})
.map(|entry| entry.source)
.collect()
});
/// Recon rows additionally scanned against the signal-preserving raw view.
///
/// The processed views fold LDAP hex escapes (`\de` -> `Þ`) before the
/// pattern tables run, so separator-prefixed probes such as `\default` or
/// `\default.asp` never reach a recon row there. The raw view keeps them
/// intact; the leading-separator gate still decides which matches are
/// probes, so bare words stay innocent exactly as on the processed views.
pub static DETECTION_RECON_RAW_VIEW_PATTERN_SOURCES: LazyLock<
std::collections::HashSet<&'static str>,
> = LazyLock::new(|| {
PATTERN_DEFINITIONS
.iter()
.filter(|entry| entry.category == "recon")
.map(|entry| entry.source)
.collect()
});
/// Patterns whose matches are suppressed inside binary-dense regions.
pub static NOISE_PRONE_PATTERN_SOURCES: LazyLock<std::collections::HashSet<&'static str>> =
LazyLock::new(|| {
std::collections::HashSet::from([
r#"#\{(?![^\}]*\d{4}-\d{1,2}-\d{1,2}(?!\d))(?=[^\}]*(?:@[\w.]+@|\b\w+\s*\(|['\"]?\d+['\"]?\s*[*/%+\-]\s*['\"]?\d+['\"]?))[^\}]*\}"#,
r"(?:[;&|]\s*(?:\$\([^)]+\)|\$\{[^}]+\}))",
r"(?<!`)`(?:[A-Za-z0-9_./~]|\$[({])(?:[^`\\\n]|\\.)*`",
r"[;|&]\s*(?:ls|cat|rm|id|whoami|uname|wget|curl|nc|netcat|socat|bash|sh|python|perl)\b",
r"[A-Za-z0-9_./*?-]*[?*][A-Za-z0-9_./*?-]*",
r"\$\((?:[^()\\\n]|\\.)*\)|\$\{(?:[^{}\\\n]|\\.)*\}",
r"\$\{[^}]*(?:@[\w.]+@|\b\w+\s*\(|\d+\s*[*/%+\-]\s*\d+)[^}]*\}",
r"\(\s*[&|]\s*",
r#"\w+(?:['\"]+\w+){1,10}"#,
// SQLi comment terminators span arbitrary whitespace between the
// quote and the -- / # terminator, so they routinely fire inside
// text-decoded binary bodies (e.g. "'\n--" byte runs in compressed
// payloads). Parity with upstream commit f5d53ca5.
r"'\s*(?:[\);]+\s*)?--|'[\);]*#(?:\n|\Z)",
])
});
/// Patterns that only run on the raw signal-preserving view.
pub static DETECTION_RAW_VIEW_PATTERN_SOURCES: LazyLock<std::collections::HashSet<&'static str>> =
LazyLock::new(|| {
std::collections::HashSet::from([
r#"#\{(?![^\}]*\d{4}-\d{1,2}-\d{1,2}(?!\d))(?=[^\}]*(?:@[\w.]+@|\b\w+\s*\(|['\"]?\d+['\"]?\s*[*/%+\-]\s*['\"]?\d+['\"]?))[^\}]*\}"#,
r"'\s*(?:[\);]+\s*)?--|'[\);]*#(?:\n|\Z)",
r"(?:%2e%2e|%252e%252e|%uff0e%uff0e|%c0%ae%c0%ae|%e0%40%ae|%c0%ae%e0%80%ae|%25c0%25ae)/",
r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:(?:%00|\\u0000|\\x00|\\0|\x00|;)[^\"']*|\.)[\"']"#,
r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:[^ \"'][^\"']*)?\.(?:docx|jpeg|pptx|tiff|webm|webp|xlsx|avi|bmp|doc|gif|ico|jpg|mkv|mov|mp3|mp4|odt|pdf|png|ppt|svg|tif|wav|xls)[\"']"#,
r"(?<![A-Za-z0-9+/])(?-i:AAEAAAD)",
r"(?<![A-Za-z0-9+/])(?-i:BAh[Jv7bV])",
r"(?<![A-Za-z0-9+/])(?-i:gA[SW]V)",
r"(?<![A-Za-z0-9+/])(?-i:rO0AB)",
r"(?i)\bORDER\s+BY\s+\d+\s*(?:--|#|;|\)|,|/\*|\Z)|(?<=[=?&])ORDER\s+BY\s+\d+\s*\n",
r"(c[A-Za-z_][A-Za-z0-9_]{0,100}(?:\.[A-Za-z_][A-Za-z0-9_]{0,100}){0,20}\n[A-Za-z_][A-Za-z0-9_]{0,100}\n)[^ \t]{0,100}?[Rb]",
r"[\r\n][^\S\r\n]*(?:HTTP\/[0-9.]+|Location:|Set-Cookie:)",
r"[a-zA-Z][\w-]*\s*=[\d\w\s]*\*\)+(?:%00|\\u0000|\\x00|\\0|\x00)",
r"\*\)\)+(?:%00|\\u0000|\\x00|\\0|\x00)",
r"cos\n",
r"j[\t\r\n]*a[\t\r\n]*v[\t\r\n]*a[\t\r\n]*s[\t\r\n]*c[\t\r\n]*r[\t\r\n]*i[\t\r\n]*p[\t\r\n]*t[\t\r\n]*:\s*[^\s]+",
])
});
/// Patterns that only run on the URL-decoded view.
pub static DETECTION_URL_DECODED_VIEW_PATTERN_SOURCES: LazyLock<
std::collections::HashSet<&'static str>,
> = LazyLock::new(|| {
std::collections::HashSet::from([
r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:(?:\x00|;)[^\"']*|\.)[\"']"#,
r#"(?i)(?:['\")\d]|/\*)\s{0,3}\bORDER\s+BY\s+\d+|\bORDER\s+BY\s+\d+\s*(?:--|#|/\*)"#,
r"[a-zA-Z][\w-]*\s*=[\d\w\s]*\*\)+\x00",
r"\*\)\)+\x00",
r#"\A(?:(?!\n).)*(?:boot\.ini|win\.ini|system\.ini|config\.sys)(?:[&#;,\"'<>]|\s*\Z)"#,
r#"\A(?:(?!\n).)*etc/(?:passwd|shadow|group|hosts|motd|issue|mysql/my\.cnf|ssh/ssh_config)(?:[&#;,\"'<>]|\s*\Z)"#,
r#"\A(?:(?!\n).)*proc/self/environ(?:[&#;,\"'<>]|\s*\Z)"#,
r#"\A(?:(?!\n).)*var/log/[^\s/]+(?:[&#;,\"'<>]|\s*\Z)"#,
r"\n[^\S\r\n]*(?:[^=\s;|&]+=[^\s;|&]+\s+)*(?:/?(?:[\w.-]+/)*env\s+)?/?(?:[\w.-]+/)*(?:bash|sh|ksh|csh|tsch|zsh|ash)\s+-c\b",
])
});
/// Per-pattern weight overrides; every other category weighs 1.0.
pub static DETECTION_PATTERN_WEIGHT_OVERRIDES: LazyLock<
std::collections::HashMap<&'static str, f64>,
> = LazyLock::new(|| {
std::collections::HashMap::from([
(
r"(?i)\bSELECT\b(?:(?!\bSELECT\b)[\w\s,\*().])*?\bFROM\b",
0.5_f64,
),
(r"(?i)SELECT\s+\*", 0.5_f64),
(
r#"(?i)\bWHERE\s+[\w."]+\s*(?:=|<|>|<=|>=|LIKE|IN)\b"#,
0.5_f64,
),
])
});