erroracle/

classifier.rs

use crate::types::{
    ErrorInsight, HttpResponse, InsightKind, PropertySuggestion, ResponseAnalysis,
    ResponseDisposition, MAX_ANALYSIS_BODY_CHARS,
};
use regex_lite::Regex;

pub fn classify_response(response: &HttpResponse) -> ResponseAnalysis {
    let body = bounded_body(&response.body);
    let lower = body.to_lowercase();
    let insight = analyze_error(&body);
    let disposition = classify_disposition(response.status, &lower, insight.as_ref());

    ResponseAnalysis {
        disposition,
        fingerprint: fingerprint(response.status, &body),
        insight,
    }
}

pub fn analyze_error(error: &str) -> Option<ErrorInsight> {
    let bounded = bounded_body(error);
    let lower = bounded.to_lowercase();

    detect_sql_syntax_issue(&lower, &bounded)
        .or_else(|| detect_missing_property_issue(&lower, &bounded))
        .or_else(|| detect_type_mismatch_issue(&bounded))
        .or_else(|| detect_unknown_dispatch_issue(&lower))
        .or_else(|| detect_auth_issue(&bounded))
        .or_else(|| detect_parse_issue(&lower, &bounded))
        .or_else(|| detect_misc_issue(&lower, &bounded))
}

fn bounded_body(body: &str) -> String {
    body.chars().take(MAX_ANALYSIS_BODY_CHARS).collect()
}

fn classify_disposition(
    status: u16,
    lower: &str,
    insight: Option<&ErrorInsight>,
) -> ResponseDisposition {
    if !is_valid_http_status(status) {
        return ResponseDisposition::Unknown;
    }

    if is_waf_block(status, lower) {
        return ResponseDisposition::WafBlock;
    }

    if is_rate_limited_response(status, lower) {
        return ResponseDisposition::RateLimited;
    }

    if is_auth_required_response(status, lower) {
        return ResponseDisposition::AuthRequired;
    }

    if is_json_parse_error(insight) {
        return ResponseDisposition::JsonParseError;
    }

    if is_application_error(status, insight) {
        return ResponseDisposition::ApplicationError;
    }

    if (200..400).contains(&status) && insight.is_none() {
        return ResponseDisposition::FalsePositive;
    }

    ResponseDisposition::Unknown
}

fn is_valid_http_status(status: u16) -> bool {
    (100..=599).contains(&status)
}

fn is_rate_limited_response(status: u16, lower: &str) -> bool {
    status == 429 || lower.contains("too many requests") || lower.contains("rate limit")
}

fn is_auth_required_response(status: u16, lower: &str) -> bool {
    status == 401 || status == 403 || lower.contains("unauthorized") || lower.contains("forbidden")
}

fn is_json_parse_error(insight: Option<&ErrorInsight>) -> bool {
    matches!(
        insight.map(|item| &item.kind),
        Some(InsightKind::JsonParseError)
    )
}

fn is_application_error(status: u16, insight: Option<&ErrorInsight>) -> bool {
    status >= 500
        || matches!(
            insight.map(|item| &item.kind),
            Some(
                InsightKind::SqlSyntaxError
                    | InsightKind::MissingProperty(_)
                    | InsightKind::TypeMismatch { .. }
                    | InsightKind::UnknownDispatch { .. }
                    | InsightKind::Other
            )
        )
}

fn detect_sql_syntax_issue(lower: &str, error: &str) -> Option<ErrorInsight> {
    if (lower.contains("syntax error")
        && (lower.contains("sql") || lower.contains("near") || lower.contains('\'')))
        || lower.contains("unterminated string")
        || lower.contains("unclosed quotation")
        || lower.contains("sqlstate")
    {
        return Some(ErrorInsight {
            kind: InsightKind::SqlSyntaxError,
            error_text: error.to_string(),
            suggestions: vec![],
        });
    }

    None
}

fn detect_missing_property_issue(lower: &str, error: &str) -> Option<ErrorInsight> {
    extract_missing_property(lower).map(|property| ErrorInsight {
        kind: InsightKind::MissingProperty(property.clone()),
        error_text: error.to_string(),
        suggestions: vec![PropertySuggestion {
            key: property.clone(),
            value: "test".into(),
            reason: format!("handler tried to access missing property `{property}`"),
        }],
    })
}

fn detect_type_mismatch_issue(error: &str) -> Option<ErrorInsight> {
    if let Some((property, expected)) = extract_type_mismatch(error) {
        return Some(ErrorInsight {
            kind: InsightKind::TypeMismatch { property, expected },
            error_text: error.to_string(),
            suggestions: vec![],
        });
    }

    let lower = error.to_lowercase();
    if lower.contains("is not a function") {
        static RE: std::sync::OnceLock<Regex> = std::sync::OnceLock::new();
        let expected =
            if lower.contains("map") || lower.contains("foreach") || lower.contains("filter") {
                "array"
            } else if lower.contains("touppercase")
                || lower.contains("tolowercase")
                || lower.contains("trim")
            {
                "string"
            } else if lower.contains("tofixed") || lower.contains("tostring") {
                "number"
            } else {
                "object"
            };
        let re = RE.get_or_init(|| {
            Regex::new(r"(\w+)\.\w+\s+is not a function").unwrap_or_else(|_| unreachable!())
        });
        let property = re
            .captures(&lower)
            .and_then(|captures| captures.get(1))
            .map(|value| value.as_str().to_string());
        return Some(ErrorInsight {
            kind: InsightKind::TypeMismatch {
                property,
                expected: expected.to_string(),
            },
            error_text: error.to_string(),
            suggestions: vec![],
        });
    }
    None
}

fn detect_unknown_dispatch_issue(lower: &str) -> Option<ErrorInsight> {
    extract_unknown_dispatch(lower).map(|(property, tried)| ErrorInsight {
        kind: InsightKind::UnknownDispatch { property, tried },
        error_text: lower.to_string(),
        suggestions: vec![],
    })
}

fn detect_auth_issue(error: &str) -> Option<ErrorInsight> {
    let lower = error.to_lowercase();
    if lower.contains("unauthorized")
        || lower.contains("permission denied")
        || lower.contains("access denied")
        || lower.contains("forbidden")
        || lower.contains("authentication required")
    {
        return Some(ErrorInsight {
            kind: InsightKind::AuthRequired,
            error_text: error.to_string(),
            suggestions: vec![],
        });
    }
    None
}

fn detect_parse_issue(lower: &str, error: &str) -> Option<ErrorInsight> {
    if (lower.contains("unexpected token") && lower.contains("json"))
        || lower.contains("invalid json")
        || lower.contains("json.parse")
    {
        return Some(ErrorInsight {
            kind: InsightKind::JsonParseError,
            error_text: error.to_string(),
            suggestions: vec![],
        });
    }

    if lower.contains("rate limit") || lower.contains("too many requests") {
        return Some(ErrorInsight {
            kind: InsightKind::RateLimited,
            error_text: error.to_string(),
            suggestions: vec![],
        });
    }
    None
}

fn detect_misc_issue(lower: &str, error: &str) -> Option<ErrorInsight> {
    if lower.contains("no such file")
        || lower.contains("enoent")
        || lower.contains("file not found")
        || lower.contains("path")
    {
        return Some(ErrorInsight {
            kind: InsightKind::Other,
            error_text: error.to_string(),
            suggestions: vec![PropertySuggestion {
                key: "path".into(),
                value: "/etc/passwd".into(),
                reason: "filesystem access is reachable; test traversal-style payloads".into(),
            }],
        });
    }

    if lower.contains("invalid regular expression")
        || lower.contains("unterminated group")
        || lower.contains("nothing to repeat")
    {
        return Some(ErrorInsight {
            kind: InsightKind::Other,
            error_text: error.to_string(),
            suggestions: vec![PropertySuggestion {
                key: "pattern".into(),
                value: "(a+)+$".into(),
                reason: "regex compilation was observed; test ReDoS-sensitive patterns".into(),
            }],
        });
    }

    if lower.contains("invalid url")
        || lower.contains("failed to construct 'url'")
        || lower.contains("malformed url")
    {
        return Some(ErrorInsight {
            kind: InsightKind::Other,
            error_text: error.to_string(),
            suggestions: vec![PropertySuggestion {
                key: "url".into(),
                value: "https://127.0.0.1/admin".into(),
                reason: "URL parsing was observed; SSRF-relevant follow-ups may apply".into(),
            }],
        });
    }

    if lower.contains("nan")
        || lower.contains("not a number")
        || lower.contains("parseint")
        || lower.contains("parsefloat")
    {
        return Some(ErrorInsight {
            kind: InsightKind::TypeMismatch {
                property: None,
                expected: "number".into(),
            },
            error_text: error.to_string(),
            suggestions: vec![],
        });
    }

    if error.len() > 10 && !lower.contains("undefined") {
        return Some(ErrorInsight {
            kind: InsightKind::Other,
            error_text: error.to_string(),
            suggestions: vec![],
        });
    }

    None
}

fn extract_type_mismatch(error: &str) -> Option<(Option<String>, String)> {
    static RE1: std::sync::OnceLock<Regex> = std::sync::OnceLock::new();
    static RE2: std::sync::OnceLock<Regex> = std::sync::OnceLock::new();
    static RE3: std::sync::OnceLock<Regex> = std::sync::OnceLock::new();

    let lower = error.to_lowercase();

    let re1 = RE1.get_or_init(|| {
        Regex::new(r"([a-z_]+)\s+must\s+be\s+(?:a\s+)?([a-z]+)\b(?:\s+or\s+([a-z]+))?")
            .unwrap_or_else(|_| unreachable!())
    });
    if let Some(captures) = re1.captures(&lower) {
        let property = captures.get(1).map(|item| item.as_str().to_string());
        let expected = captures.get(2).or_else(|| captures.get(3))?;
        return Some((property, expected.as_str().to_string()));
    }

    let re2 = RE2.get_or_init(|| {
        Regex::new(
            r"typeerror:\s*([a-z_]+)\s*:\s*expected\s+(?:a\s+)?([a-z]+),?\s*got\s+(?:a\s+)?([a-z]+)",
        )
        .unwrap_or_else(|_| unreachable!())
    });
    if let Some(captures) = re2.captures(&lower) {
        let property = Some(captures.get(1)?.as_str().to_string());
        let expected = captures.get(2)?.as_str().to_string();
        return Some((property, expected));
    }

    let re3 = RE3.get_or_init(|| {
        Regex::new(r"expected\s+(?:a\s+)?([a-z]+),\s*got\s+(?:a\s+)?([a-z]+)")
            .unwrap_or_else(|_| unreachable!())
    });
    if let Some(captures) = re3.captures(&lower) {
        let expected = captures.get(1)?.as_str().to_string();
        return Some((None, expected));
    }

    None
}

fn extract_missing_property(error: &str) -> Option<String> {
    static PATTERNS: std::sync::OnceLock<Vec<Regex>> = std::sync::OnceLock::new();
    let patterns = PATTERNS.get_or_init(|| {
        [
            r"cannot read propert(?:y|ies) (?:of )?'(\w+)'",
            r#"missing (?:required )?(?:property|field)[:\s]+['"]?(\w+)['"]?"#,
            r"reading '(\w+)'",
            r"(\w+) is not defined",
        ]
        .into_iter()
        .filter_map(|pattern| Regex::new(pattern).ok())
        .collect()
    });

    for re in patterns {
        if let Some(captures) = re.captures(error) {
            let property = captures.get(1)?.as_str();
            if ![
                "require", "module", "exports", "window", "document", "process",
            ]
            .contains(&property)
            {
                return Some(property.to_string());
            }
        }
    }
    None
}

fn extract_unknown_dispatch(error: &str) -> Option<(String, String)> {
    static RE: std::sync::OnceLock<Regex> = std::sync::OnceLock::new();
    let re = RE.get_or_init(|| {
        Regex::new(r#"(?:unknown|invalid|unrecognized|unsupported)\s+(\w+):\s*['"]?(\w+)"#)
            .unwrap_or_else(|_| unreachable!())
    });
    let captures = re.captures(error)?;
    Some((
        captures.get(1)?.as_str().to_string(),
        captures.get(2)?.as_str().to_string(),
    ))
}

fn is_waf_block(status: u16, lower: &str) -> bool {
    (status == 403 || status == 406 || status == 429)
        && (lower.contains("access denied")
            || lower.contains("request blocked")
            || lower.contains("forbidden")
            || lower.contains("cloudflare")
            || lower.contains("akamai")
            || lower.contains("imperva")
            || lower.contains("bot protection")
            || lower.contains("waf"))
}

fn fingerprint(status: u16, body: &str) -> String {
    let compact = body
        .split_whitespace()
        .take(12)
        .map(|token| token.chars().take(32).collect::<String>())
        .collect::<Vec<_>>()
        .join(" ");
    format!("{status}:{}", compact.to_lowercase())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn classify_response_detects_waf_block() {
        let analysis =
            classify_response(&HttpResponse::new(403, "Access denied by Cloudflare WAF"));
        assert_eq!(analysis.disposition, ResponseDisposition::WafBlock);
    }

    #[test]
    fn classify_response_detects_rate_limit() {
        let analysis = classify_response(&HttpResponse::new(429, "Too many requests"));
        assert_eq!(analysis.disposition, ResponseDisposition::RateLimited);
    }

    #[test]
    fn classify_response_detects_auth_required() {
        let analysis = classify_response(&HttpResponse::new(401, "Unauthorized"));
        assert_eq!(analysis.disposition, ResponseDisposition::AuthRequired);
    }

    #[test]
    fn classify_response_detects_json_parse_error() {
        let analysis = classify_response(&HttpResponse::new(400, "Unexpected token in JSON input"));
        assert_eq!(analysis.disposition, ResponseDisposition::JsonParseError);
    }

    #[test]
    fn classify_response_detects_application_error() {
        let analysis = classify_response(&HttpResponse::new(500, "SQLSTATE syntax error near foo"));
        assert_eq!(analysis.disposition, ResponseDisposition::ApplicationError);
    }

    #[test]
    fn classify_response_detects_false_positive() {
        let analysis = classify_response(&HttpResponse::new(200, "all clear"));
        assert_eq!(analysis.disposition, ResponseDisposition::FalsePositive);
    }

    #[test]
    fn classify_response_detects_unknown_for_invalid_status() {
        let analysis = classify_response(&HttpResponse::new(99, "whatever"));
        assert_eq!(analysis.disposition, ResponseDisposition::Unknown);
    }

    #[test]
    fn analyze_error_detects_sql_syntax_issue() {
        let insight = analyze_error("SQLSTATE syntax error near 'select'").unwrap();
        assert_eq!(insight.kind, InsightKind::SqlSyntaxError);
    }

    #[test]
    fn analyze_error_detects_missing_property_issue() {
        let insight = analyze_error("missing property: username").unwrap();
        assert_eq!(
            insight.kind,
            InsightKind::MissingProperty("username".to_string())
        );
        assert_eq!(insight.suggestions[0].key, "username");
    }

    #[test]
    fn analyze_error_detects_type_mismatch_issue() {
        let insight = analyze_error("TypeError: age: expected number, got string").unwrap();
        assert_eq!(
            insight.kind,
            InsightKind::TypeMismatch {
                property: Some("age".to_string()),
                expected: "number".to_string(),
            }
        );
    }

    #[test]
    fn analyze_error_detects_unknown_dispatch_issue() {
        let insight = analyze_error("unsupported action: deleteAll").unwrap();
        assert_eq!(
            insight.kind,
            InsightKind::UnknownDispatch {
                property: "action".to_string(),
                tried: "deleteall".to_string(),
            }
        );
    }

    #[test]
    fn analyze_error_detects_auth_issue() {
        let insight = analyze_error("permission denied").unwrap();
        assert_eq!(insight.kind, InsightKind::AuthRequired);
    }

    #[test]
    fn analyze_error_detects_parse_issue() {
        let insight = analyze_error("invalid json payload").unwrap();
        assert_eq!(insight.kind, InsightKind::JsonParseError);
    }

    #[test]
    fn analyze_error_detects_rate_limit_issue() {
        let insight = analyze_error("rate limit exceeded").unwrap();
        assert_eq!(insight.kind, InsightKind::RateLimited);
    }

    #[test]
    fn analyze_error_detects_misc_url_issue() {
        let insight = analyze_error("invalid URL passed to fetch").unwrap();
        assert_eq!(insight.kind, InsightKind::Other);
        assert_eq!(insight.suggestions[0].key, "url");
    }

    #[test]
    fn extract_missing_property_ignores_common_globals() {
        assert_eq!(extract_missing_property("window is not defined"), None);
    }

    #[test]
    fn extract_unknown_dispatch_parses_property_and_value() {
        assert_eq!(
            extract_unknown_dispatch("invalid action: login"),
            Some(("action".to_string(), "login".to_string()))
        );
    }

    #[test]
    fn is_waf_block_requires_blocking_signals() {
        assert!(is_waf_block(403, "akamai request blocked"));
        assert!(!is_waf_block(403, "generic authorization failure"));
    }

    #[test]
    fn fingerprint_normalizes_whitespace_and_case() {
        assert_eq!(fingerprint(500, "Error   HERE"), "500:error here");
    }
}