guard-core-engine 4.3.1

Detection engine for the Guard ecosystem: pattern compilation, input preprocessing, and semantic analysis.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

use regex::Regex;

/// Compiled structural regexes that detect attack syntax (HTML tags, function
/// calls, command chains, path traversal, URLs).
///
/// Used by [`super::extract_suspicious_patterns`] and token extraction.
/// Construct with `Default::default()` for the built-in pattern set.
pub struct AttackStructures {
    named: Vec<(&'static str, Regex)>,
}

impl AttackStructures {
    /// Named (category, regex) pairs.
    #[must_use]
    pub fn named(&self) -> &[(&'static str, Regex)] {
        &self.named
    }

    /// Iterate compiled regexes only (no category names).
    pub fn compiled(&self) -> impl Iterator<Item = &Regex> {
        self.named.iter().map(|(_, re)| re)
    }
}

impl Default for AttackStructures {
    fn default() -> Self {
        let definitions: &[(&str, &str)] = &[
            ("tag_like", r"<[^>]+>"),
            ("function_call", r"\w+\s*\([^)]*\)"),
            ("command_chain", r"[;&|]{1,2}"),
            ("path_traversal", r"\.{2,}[/\\]"),
            ("url_pattern", r"[a-z]+://"),
        ];

        let named = definitions
            .iter()
            .map(|&(name, pat)| {
                let re = Regex::new(&format!("(?i){pat}")).expect("static pattern must compile");
                (name, re)
            })
            .collect();

        Self { named }
    }
}