guard-core-engine 4.3.3

Detection engine for the Guard ecosystem: pattern compilation, input preprocessing, and semantic analysis.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126

use std::collections::HashMap;
use std::collections::HashSet;

/// Keyword sets per attack category (xss, sql, command, path, template).
///
/// Used by [`super::analyze_attack_probability`] for base score calculation.
/// Construct with `Default::default()` for the built-in keyword tables.
pub struct AttackKeywords {
    categories: HashMap<&'static str, HashSet<&'static str>>,
}

impl AttackKeywords {
    /// All categories as `name -> keyword set` map.
    #[must_use]
    pub const fn all(&self) -> &HashMap<&'static str, HashSet<&'static str>> {
        &self.categories
    }
}

impl Default for AttackKeywords {
    fn default() -> Self {
        let categories = HashMap::from([
            (
                "xss",
                HashSet::from([
                    "script",
                    "javascript",
                    "onerror",
                    "onload",
                    "onclick",
                    "onmouseover",
                    "alert",
                    "eval",
                    "document",
                    "cookie",
                    "window",
                    "location",
                ]),
            ),
            (
                "sql",
                HashSet::from([
                    "select",
                    "union",
                    "insert",
                    "update",
                    "delete",
                    "drop",
                    "from",
                    "where",
                    "order",
                    "group",
                    "having",
                    "concat",
                    "substring",
                    "database",
                    "table",
                    "column",
                ]),
            ),
            (
                "command",
                HashSet::from([
                    "exec",
                    "system",
                    "shell",
                    "cmd",
                    "bash",
                    "powershell",
                    "wget",
                    "curl",
                    "nc",
                    "netcat",
                    "chmod",
                    "chown",
                    "sudo",
                    "passwd",
                ]),
            ),
            (
                "path",
                HashSet::from([
                    "etc", "passwd", "shadow", "hosts", "proc", "boot", "win", "ini",
                ]),
            ),
            (
                "template",
                HashSet::from([
                    "render",
                    "template",
                    "jinja",
                    "mustache",
                    "handlebars",
                    "ejs",
                    "pug",
                    "twig",
                ]),
            ),
        ]);
        Self { categories }
    }
}

#[cfg(test)]
mod empty_category_tests {
    use super::*;

    #[test]
    fn an_empty_category_scores_zero_without_blocking_the_rest() {
        // a caller can wire a category with no keywords yet: it scores 0.0
        // while the populated categories still compute normally
        let keywords = AttackKeywords {
            categories: HashMap::from([
                ("empty_kind", HashSet::new()),
                ("path", HashSet::from(["etc", "passwd"])),
            ]),
        };
        let probabilities = crate::semantic::attack_probability_with_tokens(
            "/etc/passwd",
            &[String::from("etc"), String::from("passwd")],
            &keywords,
        );
        assert!(probabilities["empty_kind"].abs() < f64::EPSILON);
        assert!(probabilities["path"] > 0.0, "path: {probabilities:?}");
    }
}