Module patterns 

Detection wiring for the compiled pattern table and its dispatch.

Compiles the canonical pattern table and dispatches each pattern to the same structural matcher, windowed finder, candidate validator and scan-window bounds as the guard-core spec 4.0.2 reference (guard_core/handlers/_suspatterns_regex.py).

Residual patterns (lookaround / backreference constructs the regex crate rejects) are served by structural equivalents in matchers.rs. Table entry id is the table position (see table.rs) and keys the dispatch below.

Modules

binary

Binary artifact density gate and binary-content heuristic, ported from guard_core/detection_engine/binary_prefix.py and semantic.py (looks_like_binary_content).

chars_util

Character helpers shared by the structural matchers. The reference walks Python strings by code point; these helpers provide the same semantics over Rust byte offsets.

file_upload

File-upload matchers ported from guard_core/handlers/_suspatterns_file_upload.py (spec 4.0.2).

ldap_ipv4

LDAP breakout window analysis and legacy IPv4 host validation, ported from guard_core/handlers/_suspatterns_ldap_ipv4.py (spec 4.0.2).

matchers

Structural matchers for pattern-table entries the regex crate rejects.

pickle

Pickle opcode-stream validation ported from guard_core/handlers/_suspatterns_pickle.py (spec 4.0.2).

pyregex

Python re compatibility layer for the detection pattern table.

scan_window

Bounded scan windows ported from guard_core/detection_engine/scan_window.py (spec 4.0.2).

shell_validators

Candidate-rejection validators ported from guard_core/handlers/_suspatterns_shell_validators.py (spec 4.0.2).

table

Canonical detection pattern table for guard-core spec 4.0.2.

templates

Template-injection scan matchers ported from guard_core/handlers/_suspatterns_templates.py (spec 4.0.2).

xml_xxe

XML/XXE structural matchers ported from guard_core/handlers/_suspatterns_xml_xxe.py (spec 4.0.2).

Structs

CompiledEntry

RegexThreat

A regex threat exactly as the reference _build_regex_threat emits it.

Enums

ViewFilter

Which scan view is being processed; mirrors _pattern_excluded_from_view.

Constants

GATED_PATTERN_MAX_SUBJECT_BYTES

SusPatterns::GATED_PATTERN_MAX_SUBJECT_BYTES (15 KiB).

LEXICON_ENV_PATH

LEXICON_ETC_PATH

Lexicon-lookahead path shapes (ids 33/102/107/110/112/115): the reference pattern is \A(?=LEXICON-in-first-line)\A<path-shape>; the lexicon membership becomes a guard on the compiled path shape.

LEXICON_GIT_PATH

LEXICON_HTACCESS_PATH

LEXICON_PHPINFO_PATH

LEXICON_WP_PATH

Statics

COMPILED_TABLE

Functions

decode_budget_exhausted_threat

The synthetic exhaustion threat appended when a decode pass hit its 16-iteration budget.

decoded_view_traversal_threat

_check_decoded_view_path_traversal: the \.\.[\\/] shape fires only when decoding revealed more traversal shapes than the raw view carries.

find_first_threat

First accepted regex threat for one entry (validator + recon leading-separator + noise gates).

is_excluded_from_view

resolve_pattern_weight

scan_time_budget_exhausted_threat

The synthetic pattern_timeout threat recorded when the scan time budget is spent (reference _scan_time_budget_exhausted_threat): empty match, position 0, category custom, the custom category weight.

scan_view

One view pass of _check_regex_patterns: context filter, per-pattern dispatch, validator and binary-density gates, first accepted threat each. Runs with no scan time cap.

scan_view_budgeted

scan_view under a per-request scan time budget.