tirith-core 0.2.11

Terminal security analysis engine - homograph attacks, pipe-to-shell, ANSI injection
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

use crate::normalize::NormalizedComponent;
use crate::parse::UrlLike;
use crate::util::levenshtein;
use crate::verdict::{Evidence, Finding, RuleId, Severity};

/// Run path rules against a parsed URL.
/// `raw_path` is the path from the original URL string (pre-percent-encoding by url crate).
pub fn check(
    _url: &UrlLike,
    normalized_path: Option<&NormalizedComponent>,
    raw_path: Option<&str>,
) -> Vec<Finding> {
    let mut findings = Vec::new();

    // Use raw_path for non-ASCII detection (url crate percent-encodes non-ASCII)
    if let Some(rp) = raw_path {
        check_non_ascii_path(rp, &mut findings);
        check_homoglyph_in_path(rp, &mut findings);
    } else if let Some(np) = normalized_path {
        check_non_ascii_path(&np.normalized, &mut findings);
        check_homoglyph_in_path(&np.normalized, &mut findings);
    }

    if let Some(np) = normalized_path {
        if np.double_encoded {
            check_double_encoding(&np.raw, &mut findings);
        }
    }

    findings
}

fn check_non_ascii_path(normalized: &str, findings: &mut Vec<Finding>) {
    if normalized.bytes().any(|b| b > 0x7F) {
        findings.push(Finding {
            rule_id: RuleId::NonAsciiPath,
            severity: Severity::Medium,
            title: "Non-ASCII characters in URL path".to_string(),
            description:
                "URL path contains non-ASCII characters which may indicate homoglyph substitution"
                    .to_string(),
            evidence: vec![Evidence::Url {
                raw: normalized.to_string(),
            }],
            human_view: None,
            agent_view: None,
            mitre_id: None,
            custom_rule_id: None,
        });
    }
}

fn check_homoglyph_in_path(normalized: &str, findings: &mut Vec<Finding>) {
    // Check for confusable characters near known path patterns
    let known_paths = [
        "install", "setup", "init", "config", "login", "auth", "admin", "api", "token", "key",
        "secret", "password",
    ];

    for segment in normalized.split('/') {
        if segment.is_empty() {
            continue;
        }
        let lower = segment.to_lowercase();

        // Check if segment has mixed ASCII and non-ASCII suggesting homoglyphs
        let has_ascii = segment.bytes().any(|b| b.is_ascii_alphabetic());
        let has_non_ascii = segment.bytes().any(|b| b > 0x7F);
        if has_ascii && has_non_ascii {
            // Check proximity to known paths
            for known in &known_paths {
                if levenshtein(&lower, known) <= 2 {
                    findings.push(Finding {
                        rule_id: RuleId::HomoglyphInPath,
                        severity: Severity::Medium,
                        title: "Potential homoglyph in URL path".to_string(),
                        description: format!(
                            "Path segment '{segment}' looks similar to '{known}' but contains non-ASCII characters"
                        ),
                        evidence: vec![Evidence::Url { raw: segment.to_string() }],
                        human_view: None,
                        agent_view: None,
                mitre_id: None,
                custom_rule_id: None,
                    });
                    return;
                }
            }
        }
    }
}

fn check_double_encoding(raw_path: &str, findings: &mut Vec<Finding>) {
    findings.push(Finding {
        rule_id: RuleId::DoubleEncoding,
        severity: Severity::Medium,
        title: "Double-encoded URL path detected".to_string(),
        description: "URL path contains percent-encoded percent signs (%25XX) indicating double encoding, which may be used to bypass security filters".to_string(),
        evidence: vec![Evidence::Url { raw: raw_path.to_string() }],
        human_view: None,
        agent_view: None,
                mitre_id: None,
                custom_rule_id: None,
    });
}