Module detection_exclusions 

Per-request detection exclusion resolution and the multi-surface request scan.

The Rust port of guard_core/_utils/detection_config.py (via the Go port’s detectionexclusions.go / headerexclusions.go and the pipeline detectThreat). Every route surface overrides the global config when the route carries a non-None value (the Python sentinel is None), and the header exclusion set is additive - the hardcoded defaults merge with the config set and the route set (_resolve_excluded_headers), while the param, body-field, and enabled-category sets replace (_resolve_excluded_params and friends). Matching is case-insensitive: the resolved sets are lowercased at resolution time.

An excluded surface is not skipped outright in every case: excluded headers whose values are known to false-positive a category (the ssrf category for address-carrying proxy headers and for address-chain values) still scan with every other enabled category, so an attack payload smuggled into an excluded header still detects (_excluded_header_skip_categories).

Example

use guard_core_engine::detection_exclusions::{
    resolve, DetectionExclusionConfig, RouteDetectionExclusions,
};
use std::collections::HashSet;

// The global config excludes two params; the route replaces the set.
let global = DetectionExclusionConfig {
    excluded_detection_params: vec!["debug".to_owned(), "Trace".to_owned()],
    ..DetectionExclusionConfig::default()
};
let route = RouteDetectionExclusions {
    excluded_detection_params: Some(vec!["session".to_owned()]),
    ..RouteDetectionExclusions::default()
};
let resolved = resolve(Some(&global), Some(&route));

assert!(resolved.excluded_params.contains("session"));
assert!(
    !resolved.excluded_params.contains("debug") && !resolved.excluded_params.contains("trace"),
    "a non-None route set replaces the global one"
);
// The sets are lowercased at resolution time: the global config's
// mixed-case "Trace" entry resolves to "trace" when no route replaces it.
let inherited = resolve(Some(&global), None);
assert!(inherited.excluded_params.contains("trace"));
// The header set always merges the hardcoded proxy defaults.
assert!(resolved.excluded_headers.contains("x-forwarded-for"));
// Unset route surfaces keep the global resolution; unset everywhere
// means every category scans and the body surface scans.
assert!(resolved.enabled_categories.is_none());
assert!(resolved.scan_body);

Structs

DetectionExclusionConfig

The global config’s detection-exclusion surface.

RequestScanVerdict

The multi-surface verdict (detectThreat’s return shape).

RequestSurfaces

The request surfaces one scan pass covers (the detectThreat input shape). Headers and query params are (name, value) pairs; body values are the crate::body_scan extraction’s output.

ResolvedExclusions

The resolved exclusion sets for one request (routeDetectionExclusions in the Go port).

RouteDetectionExclusions

The route decorator’s detection-exclusion surface.

Constants

DEFAULT_EXCLUDED_HEADERS

The hardcoded header exclusion defaults (_DEFAULT_EXCLUDED_HEADERS).

Functions

check_applies

The check-set liveness semantics (SuspiciousActivityCheck.applies_to).

detection_enabled

The route toggle’s request-time semantics.

excluded_header_skip_categories

The categories an excluded header skips for one value (_excluded_header_skip_categories).

resolve

_resolve_*: every route surface overrides the global config when the route carries a non-None value, except the header set which merges defaults + config + route.

scan_request

The multi-surface scan (detectThreat).

strip_forwarded_entry_port

Remove the port from a forwarded-list entry (_strip_forwarded_entry_port).

value_looks_like_address_chain

Address-chain detection (_value_looks_like_address_chain).