guard_core_engine/patterns/
table.rs

1//! Canonical detection pattern table for guard-core spec 4.0.2.
2//!
3//! Generated from the reference (`guard_core/handlers/_suspatterns_pattern_table.py`)
4//! via the TS port's canonical table. The `source` strings are carried verbatim on
5//! threats and compared by the conformance corpus; regenerate from the
6//! reference when the spec moves. Entry `id` is the table position and keys
7//! the matcher dispatch in `mod.rs`.
8
9use std::sync::LazyLock;
10
11pub const CTX_ALL: &[&str] = &[
12    "query_param",
13    "header",
14    "url_path",
15    "request_body",
16    "unknown",
17];
18pub const CTX_CMD_INJECTION: &[&str] = &["query_param", "header", "request_body", "unknown"];
19pub const CTX_SENSITIVE_PATH_FAMILY: &[&str] =
20    &["query_param", "url_path", "request_body", "unknown"];
21pub const CTX_SQLI_NARROW: &[&str] = &["query_param", "request_body", "unknown"];
22
23pub struct TableEntry {
24    pub id: usize,
25    pub source: &'static str,
26    pub contexts: &'static [&'static str],
27    pub category: &'static str,
28}
29
30pub static PATTERN_DEFINITIONS: LazyLock<Vec<TableEntry>> = LazyLock::new(|| {
31    vec![
32        TableEntry {
33            id: 0,
34            source: r"<script[^>]*>[^<]*<\/script\s*>",
35            contexts: CTX_ALL,
36            category: r"xss",
37        },
38        TableEntry {
39            id: 1,
40            source: r"javascript:\s*[^\s]+",
41            contexts: CTX_ALL,
42            category: r"xss",
43        },
44        TableEntry {
45            id: 2,
46            source: r"j[\t\r\n]*a[\t\r\n]*v[\t\r\n]*a[\t\r\n]*s[\t\r\n]*c[\t\r\n]*r[\t\r\n]*i[\t\r\n]*p[\t\r\n]*t[\t\r\n]*:\s*[^\s]+",
47            contexts: CTX_ALL,
48            category: r"xss",
49        },
50        TableEntry {
51            id: 3,
52            source: r#"(?:<[A-Za-z/](?:[^<>]*[^<>\s/])?(?<!=)(?<!=\")(?<!=')[\s/]+(?:onwebkitplaybacktargetavailabilitychanged|oncontentvisibilityautostatechange|onwebkitpresentationmodechanged|onwebkitmouseforcewillbegin|onwebkitanimationiteration|onsecuritypolicyviolation|onwebkitmouseforcechanged|onvalidationstatuschange|onwebkitfullscreenchange|onwebkitwillrevealbottom|onwebkitanimationstart|onwebkitmouseforcedown|onbeforescriptexecute|onmozfullscreenchange|onwebkittransitionend|onafterscriptexecute|onanimationiteration|onlostpointercapture|onscrollsnapchanging|onunhandledrejection|onwebkitanimationend|onwebkitmouseforceup|ondeviceorientation|ongotpointercapture|onbeforedeactivate|onfullscreenchange|onpointerrawupdate|onreadystatechange|onrejectionhandled|onscrollsnapchange|ontransitioncancel|onanimationcancel|onbeforeeditfocus|oncontextrestored|ondatasetcomplete|onselectionchange|ontransitionstart|onanimationstart|onbeforeactivate|oncanplaythrough|ondatasetchanged|ondurationchange|onlanguagechange|onlayoutcomplete|onloadedmetadata|onpropertychange|oncontrolselect|ondataavailable|ongesturechange|onmediacomplete|onpointercancel|onpromptdismiss|ontransitionend|ontransitionrun|onwebkitneedkey|onanimationend|onbeforetoggle|onbeforeunload|onbeforeupdate|ondevicemotion|onfilterchange|ongesturestart|onmessageerror|onpointerenter|onpointerleave|onpromptaction|onsyncrestored|onvolumechange|onafterupdate|onbeforeinput|onbeforematch|onbeforepaste|onbeforeprint|oncontextlost|oncontextmenu|onerrorupdate|onlosecapture|onpointerdown|onpointermove|onpointerover|onresizestart|onrowinserted|onselectstart|ontouchcancel|ontrackchange|onafterprint|onbeforecopy|oncellchange|ondeactivate|ongestureend|onhashchange|onloadeddata|onmediaerror|onmouseenter|onmouseleave|onmousewheel|onpagereveal|onpointerout|onratechange|onslotchange|ontimeupdate|ontouchstart|onbeforecut|oncuechange|ondragenter|ondragleave|ondragstart|onloadstart|onmousedown|onmousemove|onmouseover|onmovestart|onoutofsync|onpointerup|onresizeend|onrowdelete|onrowsenter|onscrollend|ontimeerror|ontouchmove|onactivate|onauxclick|ondblclick|ondragdrop|ondragexit|ondragover|onfocusout|onformdata|onkeypress|onlocation|onmouseout|onpagehide|onpageshow|onpageswap|onpopstate|onprogress|ontouchend|oncanplay|oncommand|ondragend|onemptied|onfocusin|oninvalid|onkeydown|onmessage|onmouseup|onmoveend|onoffline|onplaying|onreverse|onrowexit|onseeking|onstalled|onstorage|onsuspend|onurlflip|onwaiting|onbounce|oncancel|onchange|onfinish|ononline|onrepeat|onresize|onresume|onscroll|onsearch|onseeked|onselect|onsubmit|ontoggle|onunload|onabort|onbegin|onclick|onclose|onended|onerror|onfocus|oninput|onkeyup|onpaste|onpause|onreset|onstart|onwheel|onblur|oncopy|ondrag|ondrop|onhelp|onload|onmove|onplay|onredo|onseek|onstop|onundo|oncut|onend)\s*=\s{0,20}(?:[\"'][^\"']*[\"']|[^\s>]+))"#,
53            contexts: CTX_ALL,
54            category: r"xss",
55        },
56        TableEntry {
57            id: 4,
58            source: r#"(?:<[A-Za-z/](?:[^<>]*[^<>\s])?\s+(?:href|src|data|action)\s*=[\s\"\']*(?:javascript|vbscript|data):)"#,
59            contexts: CTX_ALL,
60            category: r"xss",
61        },
62        TableEntry {
63            id: 5,
64            source: r#"(?:<[A-Za-z/][^<>]*style\s*=\s{0,20}[\"']?[^<>\"']*(?:expression|behavior|url)\s*\([^)]*\))"#,
65            contexts: CTX_ALL,
66            category: r"xss",
67        },
68        TableEntry {
69            id: 6,
70            source: r"(?:<object[^>]*>[\s\S]*<\/object\s*>)",
71            contexts: CTX_ALL,
72            category: r"xss",
73        },
74        TableEntry {
75            id: 7,
76            source: r"(?:<embed[^>]*>[\s\S]*<\/embed\s*>)",
77            contexts: CTX_ALL,
78            category: r"xss",
79        },
80        TableEntry {
81            id: 8,
82            source: r"(?:<applet[^>]*>[\s\S]*<\/applet\s*>)",
83            contexts: CTX_ALL,
84            category: r"xss",
85        },
86        TableEntry {
87            id: 9,
88            source: r"(?i)\bSELECT\b(?:(?!\bSELECT\b)[\w\s,\*().])*?\bFROM\b",
89            contexts: CTX_ALL,
90            category: r"sqli",
91        },
92        TableEntry {
93            id: 10,
94            source: r"(?i)SELECT\s+\*",
95            contexts: CTX_ALL,
96            category: r"sqli",
97        },
98        TableEntry {
99            id: 11,
100            source: r#"(?i)\bWHERE\s+[\w."]+\s*(?:=|<|>|<=|>=|LIKE|IN)\b"#,
101            contexts: CTX_ALL,
102            category: r"sqli",
103        },
104        TableEntry {
105            id: 12,
106            source: r#"(?i)\b(?:OR|AND)\s*(\d+|'[^']*'|\"[^\"]*\"|[@:$][A-Za-z_]\w*)\s*=\s*\1\b"#,
107            contexts: CTX_ALL,
108            category: r"sqli",
109        },
110        TableEntry {
111            id: 13,
112            source: r"(?i)UNION\s+(?:ALL\s+)?SELECT",
113            contexts: CTX_ALL,
114            category: r"sqli",
115        },
116        TableEntry {
117            id: 14,
118            source: r"(?i)('\s*(?:OR|AND)[\s(]*'?(?:[@:$][A-Za-z_]\w*|[\d\w]+)\s*(?:LIKE|[<>]=?|=)[\s(]*'?(?:[@:$][A-Za-z_]\w*|[\d\w]+))",
119            contexts: CTX_ALL,
120            category: r"sqli",
121        },
122        TableEntry {
123            id: 15,
124            source: r"(?i)(UNION\s+(?:ALL\s+)?SELECT\s+NULL(?:[,\s]*NULL)*[,\s]*|\(\s*SELECT\s+(?:@@|VERSION))",
125            contexts: CTX_ALL,
126            category: r"sqli",
127        },
128        TableEntry {
129            id: 16,
130            source: r"(?i)(?:INTO\s+(?:OUTFILE|DUMPFILE)\s+'[^']+')",
131            contexts: CTX_ALL,
132            category: r"sqli",
133        },
134        TableEntry {
135            id: 17,
136            source: r"(?i)(?:LOAD_FILE\s*\([^)]+\))",
137            contexts: CTX_ALL,
138            category: r"sqli",
139        },
140        TableEntry {
141            id: 18,
142            source: r"(?i)(?:BENCHMARK\s*\(\s*\d+\s*,)",
143            contexts: CTX_ALL,
144            category: r"sqli",
145        },
146        TableEntry {
147            id: 19,
148            source: r"(?i)(?:SLEEP\s*\(\s*\d+\s*\))",
149            contexts: CTX_ALL,
150            category: r"sqli",
151        },
152        TableEntry {
153            id: 20,
154            source: r"(?i)(?:\/\*![0-9]*\s*(?:OR|AND|UNION|SELECT|INSERT|DELETE|DROP|CONCAT|CHAR|UPDATE)\b)",
155            contexts: CTX_ALL,
156            category: r"sqli",
157        },
158        TableEntry {
159            id: 21,
160            source: r"\w/\*(?!!)[^*]*\*/\w",
161            contexts: CTX_SQLI_NARROW,
162            category: r"sqli",
163        },
164        TableEntry {
165            id: 22,
166            source: r"(?i)(?:OR|AND)\s+(?:'[\w\d]*'='[\w\d]*'?|[@:$][A-Za-z_]\w*\s*=\s*[@:$][A-Za-z_]\w*)",
167            contexts: CTX_ALL,
168            category: r"sqli",
169        },
170        TableEntry {
171            id: 23,
172            source: r"(?i);\s*(?:DROP|TRUNCATE|ALTER|CREATE)\s+(?:TABLE|DATABASE|SCHEMA)\b",
173            contexts: CTX_ALL,
174            category: r"sqli",
175        },
176        TableEntry {
177            id: 24,
178            source: r"(?i);\s*(?:INSERT\s+INTO|UPDATE\s+\w+\s+SET|DELETE\s+FROM|SELECT\b[^;]*?\bFROM\b|REPLACE\s+INTO)\b",
179            contexts: CTX_ALL,
180            category: r"sqli",
181        },
182        TableEntry {
183            id: 25,
184            source: r"(?i)\bEXEC(?:UTE)?\s+(?:xp_\w+|sp_\w+)",
185            contexts: CTX_SQLI_NARROW,
186            category: r"sqli",
187        },
188        TableEntry {
189            id: 26,
190            source: r#"(?i)(?:\A|[;'\"])\s*EXEC(?:UTE)?\s+(?:xp_\w+|sp_\w+)"#,
191            contexts: CTX_ALL,
192            category: r"sqli",
193        },
194        TableEntry {
195            id: 27,
196            source: r"(?i)\bORDER\s+BY\s+\d+\s*(?:--|#|;|\)|,|/\*|\Z)|(?<=[=?&])ORDER\s+BY\s+\d+\s*\n",
197            contexts: CTX_SQLI_NARROW,
198            category: r"sqli",
199        },
200        TableEntry {
201            id: 28,
202            source: r#"(?i)(?:['\")\d]|/\*)\s{0,3}\bORDER\s+BY\s+\d+|\bORDER\s+BY\s+\d+\s*(?:--|#|/\*)"#,
203            contexts: CTX_ALL,
204            category: r"sqli",
205        },
206        TableEntry {
207            id: 29,
208            source: r"'\s*(?:[\);]+\s*)?--|'[\);]*#(?:\n|\Z)",
209            contexts: CTX_ALL,
210            category: r"sqli",
211        },
212        TableEntry {
213            id: 30,
214            source: r"(?i)\bWAITFOR\s+(?:DELAY|TIME)\s+'\d{1,2}:\d{1,2}:\d{1,2}(?:\.\d+)?'",
215            contexts: CTX_ALL,
216            category: r"sqli",
217        },
218        TableEntry {
219            id: 31,
220            source: r"(?:\.\.\/|\.\.\\)(?:\.\.\/|\.\.\\)+",
221            contexts: CTX_ALL,
222            category: r"dir_traversal",
223        },
224        TableEntry {
225            id: 32,
226            source: r#"\A(?:(?!\n).)*etc/(?:passwd|shadow|group|hosts|motd|issue|mysql/my\.cnf|ssh/ssh_config)(?:[&#;,\"'<>]|\s*\Z)"#,
227            contexts: CTX_ALL,
228            category: r"dir_traversal",
229        },
230        TableEntry {
231            id: 33,
232            source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:etc/(?:passwd|shadow|group|hosts|motd|issue|mysql/my\.cnf|ssh/ssh_config))(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
233            contexts: CTX_ALL,
234            category: r"dir_traversal",
235        },
236        TableEntry {
237            id: 34,
238            source: r#"\A(?:(?!\n).)*(?:boot\.ini|win\.ini|system\.ini|config\.sys)(?:[&#;,\"'<>]|\s*\Z)"#,
239            contexts: CTX_ALL,
240            category: r"dir_traversal",
241        },
242        TableEntry {
243            id: 35,
244            source: r#"\A(?:(?!\n).)*proc/self/environ(?:[&#;,\"'<>]|\s*\Z)"#,
245            contexts: CTX_ALL,
246            category: r"dir_traversal",
247        },
248        TableEntry {
249            id: 36,
250            source: r#"\A(?:(?!\n).)*var/log/[^\s/]+(?:[&#;,\"'<>]|\s*\Z)"#,
251            contexts: CTX_ALL,
252            category: r"dir_traversal",
253        },
254        TableEntry {
255            id: 37,
256            source: r"\.\.;[^/\\]*[/\\]",
257            contexts: CTX_ALL,
258            category: r"dir_traversal",
259        },
260        TableEntry {
261            id: 38,
262            source: r";\s*(?:ls|cat|rm|chmod|chown|wget|curl|nc|netcat|ping|telnet)\s+-[a-zA-Z]+\s+",
263            contexts: CTX_CMD_INJECTION,
264            category: r"cmd_injection",
265        },
266        TableEntry {
267            id: 39,
268            source: r"\|\s*(?:wget|curl|fetch|lwp-download|lynx|links|GET)\s+",
269            contexts: CTX_CMD_INJECTION,
270            category: r"cmd_injection",
271        },
272        TableEntry {
273            id: 40,
274            source: r"(?:[;&|]\s*(?:\$\([^)]+\)|\$\{[^}]+\}))",
275            contexts: CTX_CMD_INJECTION,
276            category: r"cmd_injection",
277        },
278        TableEntry {
279            id: 41,
280            source: r"\A\s*(?:[;&|]\s*)*`\s*(?:[A-Za-z0-9_./~]|\$[({])(?:[^`\\\n]|\\.)*(?:\n\s*)?`(?:\s*[;&|]\s*`\s*(?:[A-Za-z0-9_./~]|\$[({])(?:[^`\\\n]|\\.)*(?:\n\s*)?`)*\s*(?:[;&|]\s*)*\Z",
281            contexts: CTX_CMD_INJECTION,
282            category: r"cmd_injection",
283        },
284        TableEntry {
285            id: 42,
286            source: r"(?<!`)`(?:[A-Za-z0-9_./~]|\$[({])(?:[^`\\\n]|\\.)*`",
287            contexts: CTX_ALL,
288            category: r"cmd_injection",
289        },
290        TableEntry {
291            id: 43,
292            source: r"\$\((?:[^()\\\n]|\\.)*\)|\$\{(?:[^{}\\\n]|\\.)*\}",
293            contexts: CTX_ALL,
294            category: r"cmd_injection",
295        },
296        TableEntry {
297            id: 44,
298            source: r"(?i)\$\{(?:jndi:(?:ldap|rmi|dns)://|\$?\{?(?:lower|upper):j\}ndi|::-j\}ndi)",
299            contexts: CTX_ALL,
300            category: r"cmd_injection",
301        },
302        TableEntry {
303            id: 45,
304            source: r#"(?:\A|[;|&])\s*/?(?:[\w.-]+/)*(?:env\s+/?(?:[\w.-]+/)*)?(?:bash|sh|ksh|csh|tsch|zsh|ash)\s+-[a-zA-Z]+(?:\s+(?:'[^']*'|\"[^\"]*\"|[^\s;|&]+))?(?=\s*(?:[;|&]|\Z))"#,
305            contexts: CTX_CMD_INJECTION,
306            category: r"cmd_injection",
307        },
308        TableEntry {
309            id: 46,
310            source: r"(?:\A|[;|&])\s*[^=\s;|&]+=[^\s;|&]+\s+(?:/?(?:[\w.-]+/)*env\s+)?/?(?:[\w.-]+/)*(?:bash|sh|ksh|csh|tsch|zsh|ash)\s+-[a-zA-Z]+",
311            contexts: CTX_CMD_INJECTION,
312            category: r"cmd_injection",
313        },
314        TableEntry {
315            id: 47,
316            source: r"\n[^\S\r\n]*(?:[^=\s;|&]+=[^\s;|&]+\s+)*(?:/?(?:[\w.-]+/)*env\s+)?/?(?:[\w.-]+/)*(?:bash|sh|ksh|csh|tsch|zsh|ash)\s+-c\b",
317            contexts: CTX_CMD_INJECTION,
318            category: r"cmd_injection",
319        },
320        TableEntry {
321            id: 48,
322            source: r"\b(?:eval|system|exec|shell_exec|passthru|popen|proc_open|create_function)\s*\(",
323            contexts: CTX_CMD_INJECTION,
324            category: r"cmd_injection",
325        },
326        TableEntry {
327            id: 49,
328            source: r#"(?:require\(\s*[\"']child_process[\"']\s*\)|child_process)\s*\.\s*(?:execSync|spawnSync|spawn|fork)\s*\("#,
329            contexts: CTX_CMD_INJECTION,
330            category: r"cmd_injection",
331        },
332        TableEntry {
333            id: 50,
334            source: r"\bassert\s*\(\s*\$",
335            contexts: CTX_CMD_INJECTION,
336            category: r"cmd_injection",
337        },
338        TableEntry {
339            id: 51,
340            source: r"\bos\.exec(?:l|le|lp|lpe|v|ve|vp|vpe)\s*\(",
341            contexts: CTX_CMD_INJECTION,
342            category: r"cmd_injection",
343        },
344        TableEntry {
345            id: 52,
346            source: r#"\b(?:new\s+)?Function\s*\(\s*[\"']"#,
347            contexts: CTX_CMD_INJECTION,
348            category: r"cmd_injection",
349        },
350        TableEntry {
351            id: 53,
352            source: r#"\[\s*[\"']eval[\"']\s*\]\s*\(\s*[\"']"#,
353            contexts: CTX_CMD_INJECTION,
354            category: r"cmd_injection",
355        },
356        TableEntry {
357            id: 54,
358            source: r#"(?:\.\s*constructor|\[\s*[\"']constructor[\"']\s*\])\s*(?:\.\s*constructor|\[\s*[\"']constructor[\"']\s*\])\s*\(\s*[\"']"#,
359            contexts: CTX_CMD_INJECTION,
360            category: r"cmd_injection",
361        },
362        TableEntry {
363            id: 55,
364            source: r#"\b(?:setTimeout|setInterval)\s*\(\s*[\"']"#,
365            contexts: CTX_CMD_INJECTION,
366            category: r"cmd_injection",
367        },
368        TableEntry {
369            id: 56,
370            source: r"[;|&]\s*(?:ls|cat|rm|id|whoami|uname|wget|curl|nc|netcat|socat|bash|sh|python|perl)\b",
371            contexts: CTX_CMD_INJECTION,
372            category: r"cmd_injection",
373        },
374        TableEntry {
375            id: 57,
376            source: r"(?i)\b(?:nc|netcat|ncat)\s+-[a-z]*e\b|/dev/tcp/\d",
377            contexts: CTX_CMD_INJECTION,
378            category: r"cmd_injection",
379        },
380        TableEntry {
381            id: 58,
382            source: r#"(?:\A|[;&|]\s*|\$\()\{[^{}\s,:'\"][^{},:'\"]*(?:,(?:[^{}\s,:'\"][^{},:'\"]*)?)+\}"#,
383            contexts: CTX_CMD_INJECTION,
384            category: r"cmd_injection",
385        },
386        TableEntry {
387            id: 59,
388            source: r#"\w+(?:['\"]+\w+){1,10}"#,
389            contexts: CTX_CMD_INJECTION,
390            category: r"cmd_injection",
391        },
392        TableEntry {
393            id: 60,
394            source: r"[A-Za-z0-9_./*?-]*[?*][A-Za-z0-9_./*?-]*",
395            contexts: CTX_CMD_INJECTION,
396            category: r"cmd_injection",
397        },
398        TableEntry {
399            id: 61,
400            source: r"(?:php|data|zip|rar|file|glob|expect|input|phpinfo|zlib|phar|ssh2|rar|ogg|expect)://[^\s]+",
401            contexts: CTX_ALL,
402            category: r"file_inclusion",
403        },
404        TableEntry {
405            id: 62,
406            source: r"(?:(?<!:)\/\/[0-9a-zA-Z](?:[-\w]*[0-9a-zA-Z])?(?:\.[0-9a-zA-Z](?:[-\w]*[0-9a-zA-Z])?)+(:[0-9]+)?(?:\/?)(?:[a-zA-Z0-9\-\.\?,'/\\\+&amp;%\$#_]*)?)",
407            contexts: CTX_ALL,
408            category: r"file_inclusion",
409        },
410        TableEntry {
411            id: 63,
412            source: r#"=(?:https?|ftp):\/\/[^\s'\"<>]+\/[^\s'\"<>\/]*\.(?:phtml|php[3-5]?|phar|jsp|aspx?|pl|py|txt|inc)(?![a-zA-Z0-9])"#,
413            contexts: CTX_ALL,
414            category: r"file_inclusion",
415        },
416        TableEntry {
417            id: 64,
418            source: r#"[\"'](?:template|include|tpl|module|layout)[\"']\s*:\s*[\"'](?:https?|ftp)://[^\s'\"<>]+/[^\s'\"<>/]*\.(?:phtml|php[3-5]?|phar|jsp|aspx?|cgi|pl|py|sh|txt|inc)(?![a-zA-Z0-9])[\"']"#,
419            contexts: CTX_ALL,
420            category: r"file_inclusion",
421        },
422        TableEntry {
423            id: 65,
424            source: r"\([\s]*[|&][\s]*\([^)(]+=[*]",
425            contexts: CTX_ALL,
426            category: r"ldap",
427        },
428        TableEntry {
429            id: 66,
430            source: r"\*\s*\)+\s*(?:[|&!]\s*)?\(+\s*(?:[&|!]|(?::)?(?:[a-zA-Z][\w.-]*|\d+(?:\.\d+)*)(?:;[\w.-]+)*(?::[\w.-]+)*\s*:?=)",
431            contexts: CTX_ALL,
432            category: r"ldap",
433        },
434        TableEntry {
435            id: 67,
436            source: r"\)\s*\(\s*(?:[&|!]|(?::)?(?:[a-zA-Z][\w.-]*|\d+(?:\.\d+)*)(?:;[\w.-]+)*(?::[\w.-]+)*\s*:?[=~<>])",
437            contexts: CTX_ALL,
438            category: r"ldap",
439        },
440        TableEntry {
441            id: 68,
442            source: r"\(\s*[&|]\s*",
443            contexts: CTX_ALL,
444            category: r"ldap",
445        },
446        TableEntry {
447            id: 69,
448            source: r"\*\)[|&]?\(+\s*(?::)?(?:[a-zA-Z][\w.-]*|\d+(?:\.\d+)*)(?:;[\w.-]+)*(?::[\w.-]+)*\s*:?=",
449            contexts: CTX_ALL,
450            category: r"ldap",
451        },
452        TableEntry {
453            id: 70,
454            source: r"[a-zA-Z][\w-]*\s*=[\d\w\s]*\*\)+(?:%00|\\u0000|\\x00|\\0|\x00)",
455            contexts: CTX_ALL,
456            category: r"ldap",
457        },
458        TableEntry {
459            id: 71,
460            source: r"\*\)\)+(?:%00|\\u0000|\\x00|\\0|\x00)",
461            contexts: CTX_ALL,
462            category: r"ldap",
463        },
464        TableEntry {
465            id: 72,
466            source: r"[a-zA-Z][\w-]*\s*=[\d\w\s]*\*\)+\x00",
467            contexts: CTX_ALL,
468            category: r"ldap",
469        },
470        TableEntry {
471            id: 73,
472            source: r"\*\)\)+\x00",
473            contexts: CTX_ALL,
474            category: r"ldap",
475        },
476        TableEntry {
477            id: 74,
478            source: r"<!(?:ENTITY|DOCTYPE)[^>]+SYSTEM[^>]+>",
479            contexts: CTX_ALL,
480            category: r"xml",
481        },
482        TableEntry {
483            id: 75,
484            source: r#"<!DOCTYPE[^>\[]+PUBLIC[^>\[]+[\"']https?://(?!(?:www\.)?w3\.org/)[^\"'>]+[\"'][^>\[]*>"#,
485            contexts: CTX_ALL,
486            category: r"xml",
487        },
488        TableEntry {
489            id: 76,
490            source: r"(?:<!\[CDATA\[.*?\]\]>)",
491            contexts: CTX_ALL,
492            category: r"xml",
493        },
494        TableEntry {
495            id: 77,
496            source: r"<!DOCTYPE[^>\[]*\[[\s\S]*?<!ENTITY",
497            contexts: CTX_ALL,
498            category: r"xml",
499        },
500        TableEntry {
501            id: 78,
502            source: r"(?:^|\s|/)(?:(?<=://)[^\s/@]*@)?(?:localhost\.?|127\.0\.0\.1|0\.0\.0\.0|\[::(?:\d*)\]|\[::ffff:127\.0\.0\.1\]|169\.254(?:\.\d{1,3}){2}|192\.168(?:\.\d{1,3}){2}|10(?:\.\d{1,3}){3}|172\.(?:1[6-9]|2[0-9]|3[01])(?:\.\d{1,3}){2}|metadata\.google\.internal|metadata\.goog|100\.100\.100\.200)(?::\d+)?(?:\s|$|/)",
503            contexts: CTX_ALL,
504            category: r"ssrf",
505        },
506        TableEntry {
507            id: 79,
508            source: r"://(?:[^/@\s]*@)?((?:0[xX][0-9a-fA-F]+|0[0-7]+|[1-9]\d*|0)(?:\.(?:0[xX][0-9a-fA-F]+|0[0-7]+|[1-9]\d*|0)){0,3})(?=[:/\s]|$)",
509            contexts: CTX_ALL,
510            category: r"ssrf",
511        },
512        TableEntry {
513            id: 80,
514            source: r"(?:file|dict|gopher|jar|tftp)://[^\s]+",
515            contexts: CTX_ALL,
516            category: r"ssrf",
517        },
518        TableEntry {
519            id: 81,
520            source: r"://[^/\s@]*@[^/\s@]*@",
521            contexts: CTX_ALL,
522            category: r"ssrf",
523        },
524        TableEntry {
525            id: 82,
526            source: r"://(?:metadata|instance-data)(?::\d+)?(?:/|\s|$)",
527            contexts: CTX_ALL,
528            category: r"ssrf",
529        },
530        TableEntry {
531            id: 83,
532            source: r"\{\s*\$(?:where|gt|lt|ne|eq|regex|in|nin|all|size|exists|type|mod|options):",
533            contexts: CTX_ALL,
534            category: r"nosql",
535        },
536        TableEntry {
537            id: 84,
538            source: r"(?:\{\s*\$[a-zA-Z]+\s*:\s*(?:\{|\[))",
539            contexts: CTX_ALL,
540            category: r"nosql",
541        },
542        TableEntry {
543            id: 85,
544            source: r#""\$(?:where|regex|expr|jsonSchema|function|accumulator|type|exists|size)"\s*:"#,
545            contexts: CTX_ALL,
546            category: r"nosql",
547        },
548        TableEntry {
549            id: 86,
550            source: r#""\$(?:gt|gte|lt|lte|ne|eq|in|nin|all|mod)"\s*:\s*(?:""|null|\{|\[)"#,
551            contexts: CTX_ALL,
552            category: r"nosql",
553        },
554        TableEntry {
555            id: 87,
556            source: r#""[^"]+"\s*:\s*\{\s*"\$(?:ne|eq)"\s*:\s*(?:true|false)"#,
557            contexts: CTX_ALL,
558            category: r"nosql",
559        },
560        TableEntry {
561            id: 88,
562            source: r"\[\$(?:where|gt|gte|lt|lte|ne|eq|regex|in|nin|nor|and|or|not|all|size|exists|type|mod|options|expr|function|elemMatch)\]",
563            contexts: CTX_ALL,
564            category: r"nosql",
565        },
566        TableEntry {
567            id: 89,
568            source: r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|com|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)[\"']"#,
569            contexts: CTX_CMD_INJECTION,
570            category: r"file_upload",
571        },
572        TableEntry {
573            id: 90,
574            source: r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:[^ \"'][^\"']*)?\.(?:docx|jpeg|pptx|tiff|webm|webp|xlsx|avi|bmp|doc|gif|ico|jpg|mkv|mov|mp3|mp4|odt|pdf|png|ppt|svg|tif|wav|xls)[\"']"#,
575            contexts: CTX_CMD_INJECTION,
576            category: r"file_upload",
577        },
578        TableEntry {
579            id: 91,
580            source: r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:(?:%00|\\u0000|\\x00|\\0|\x00|;)[^\"']*|\.)[\"']"#,
581            contexts: CTX_CMD_INJECTION,
582            category: r"file_upload",
583        },
584        TableEntry {
585            id: 92,
586            source: r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:(?:\x00|;)[^\"']*|\.)[\"']"#,
587            contexts: CTX_CMD_INJECTION,
588            category: r"file_upload",
589        },
590        TableEntry {
591            id: 93,
592            source: r"(?:%2e%2e|%252e%252e|%uff0e%uff0e|%c0%ae%c0%ae|%e0%40%ae|%c0%ae%e0%80%ae|%25c0%25ae)/",
593            contexts: CTX_ALL,
594            category: r"path_traversal",
595        },
596        TableEntry {
597            id: 94,
598            source: r"\{\{\s*[^\}]+(?:system|exec|popen|eval|require|include)\s*\}\}",
599            contexts: CTX_ALL,
600            category: r"template",
601        },
602        TableEntry {
603            id: 95,
604            source: r"\{\%\s*[^\%]+(?:system|exec|popen|eval|require|include)\s*\%\}",
605            contexts: CTX_ALL,
606            category: r"template",
607        },
608        TableEntry {
609            id: 96,
610            source: r"(?i)<%[=#]?[^%]*(?:system|exec|eval|`|Runtime|IO\.|File\.|Dir\.|\d+\s*[-+*/]\s*\d+)[^%]*%>",
611            contexts: CTX_ALL,
612            category: r"template",
613        },
614        TableEntry {
615            id: 97,
616            source: r"\$\{[^}]*(?:@[\w.]+@|\b\w+\s*\(|\d+\s*[*/%+\-]\s*\d+)[^}]*\}",
617            contexts: CTX_ALL,
618            category: r"template",
619        },
620        TableEntry {
621            id: 98,
622            source: r#"\{\{(?![^\}]*\d{4}-\d{1,2}-\d{1,2}(?!\d))(?=[^\}]*(?:@[\w.]+@|\b\w+\(\s*\)|['\"]?\d+['\"]?\s*[*/%+\-]\s*['\"]?\d+['\"]?))[^\}]*\}\}"#,
623            contexts: CTX_ALL,
624            category: r"template",
625        },
626        TableEntry {
627            id: 99,
628            source: r#"#\{(?![^\}]*\d{4}-\d{1,2}-\d{1,2}(?!\d))(?=[^\}]*(?:@[\w.]+@|\b\w+\s*\(|['\"]?\d+['\"]?\s*[*/%+\-]\s*['\"]?\d+['\"]?))[^\}]*\}"#,
629            contexts: CTX_ALL,
630            category: r"template",
631        },
632        TableEntry {
633            id: 100,
634            source: r"[\r\n][^\S\r\n]*(?:HTTP\/[0-9.]+|Location:|Set-Cookie:)",
635            contexts: CTX_ALL,
636            category: r"http_split",
637        },
638        TableEntry {
639            id: 101,
640            source: r"\A[/\\]?(?:(?!\.env(?:\.\w+)?(?:[/\\]|\Z))[\w.\-~%]+[/\\])*\.env(?:\.\w+)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
641            contexts: CTX_SENSITIVE_PATH_FAMILY,
642            category: r"sensitive_file",
643        },
644        TableEntry {
645            id: 102,
646            source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:\.env(?:\.\w+)?)(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
647            contexts: CTX_SENSITIVE_PATH_FAMILY,
648            category: r"sensitive_file",
649        },
650        TableEntry {
651            id: 103,
652            source: r"\A[/\\]?(?:(?!(?:(?!config)[\w-])*config[\w-]*\.(?:env|yml|yaml|json|toml|ini|xml|conf)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:(?!config)[\w-])*config[\w-]*\.(?:env|yml|yaml|json|toml|ini|xml|conf)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
653            contexts: CTX_SENSITIVE_PATH_FAMILY,
654            category: r"sensitive_file",
655        },
656        TableEntry {
657            id: 104,
658            source: r"\A[/\\]?(?:(?![\w.\-~%]*\.map(?:[/\\]|\Z))[\w.\-~%]+[/\\])*[\w.\-~%]*\.map(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
659            contexts: CTX_SENSITIVE_PATH_FAMILY,
660            category: r"sensitive_file",
661        },
662        TableEntry {
663            id: 105,
664            source: r"\A[/\\]?(?:[\w.\-~%]+[/\\])*[\w.\-~%]*\.(?:ts|tsx|jsx|py|rb|java|go|rs|php|pl|sh|sql)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
665            contexts: CTX_SENSITIVE_PATH_FAMILY,
666            category: r"sensitive_file",
667        },
668        TableEntry {
669            id: 106,
670            source: r"\A[/\\]?(?:(?!\.(?:git|svn|hg|bzr)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*\.(?:git|svn|hg|bzr)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
671            contexts: CTX_SENSITIVE_PATH_FAMILY,
672            category: r"sensitive_file",
673        },
674        TableEntry {
675            id: 107,
676            source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:\.(?:git|svn|hg|bzr))(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
677            contexts: CTX_SENSITIVE_PATH_FAMILY,
678            category: r"sensitive_file",
679        },
680        TableEntry {
681            id: 108,
682            source: r"\A[/\\]?(?:[\w.\-~%]+[/\\])*[\w.\-~%]*\.\w+~(?:\?\S*)?\s*\Z",
683            contexts: CTX_SENSITIVE_PATH_FAMILY,
684            category: r"sensitive_file",
685        },
686        TableEntry {
687            id: 109,
688            source: r"\A[/\\]?(?:(?!(?:wp-(?:admin|login|content|includes|config)|administrator|xmlrpc)\.?(?:php)?(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:wp-(?:admin|login|content|includes|config)|administrator|xmlrpc)\.?(?:php)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
689            contexts: CTX_SENSITIVE_PATH_FAMILY,
690            category: r"cms_probing",
691        },
692        TableEntry {
693            id: 110,
694            source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:(?:wp-(?:admin|login|content|includes|config)|administrator|xmlrpc)\.?(?:php)?)(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
695            contexts: CTX_SENSITIVE_PATH_FAMILY,
696            category: r"cms_probing",
697        },
698        TableEntry {
699            id: 111,
700            source: r"\A[/\\]?(?:(?!(?:phpinfo|info|test|php_info)\.php(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:phpinfo|info|test|php_info)\.php(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
701            contexts: CTX_SENSITIVE_PATH_FAMILY,
702            category: r"cms_probing",
703        },
704        TableEntry {
705            id: 112,
706            source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:(?:phpinfo|info|test|php_info)\.php)(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
707            contexts: CTX_SENSITIVE_PATH_FAMILY,
708            category: r"cms_probing",
709        },
710        TableEntry {
711            id: 113,
712            source: r"\A[/\\]?(?:(?![\w.\-~%]*\.(?:bak|backup|old|orig|save|swp|swo|tmp|temp)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*[\w.\-~%]*\.(?:bak|backup|old|orig|save|swp|swo|tmp|temp)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
713            contexts: CTX_SENSITIVE_PATH_FAMILY,
714            category: r"cms_probing",
715        },
716        TableEntry {
717            id: 114,
718            source: r"\A[/\\]?(?:(?!(?:\.htaccess|\.htpasswd|\.DS_Store|Thumbs\.db|\.npmrc|\.dockerenv|web\.config)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:\.htaccess|\.htpasswd|\.DS_Store|Thumbs\.db|\.npmrc|\.dockerenv|web\.config)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
719            contexts: CTX_SENSITIVE_PATH_FAMILY,
720            category: r"cms_probing",
721        },
722        TableEntry {
723            id: 115,
724            source: r"\A(?=(?:(?!\n).)*\b(?:scan(?:ner|ning|ned|s)?|attack(?:er|ers|ed|s)?|attempt(?:ed|s)?|exploit(?:ation|ed|s|ing|kit)?|prob(?:e|ed|es|ing)|malicious|intrusion(?:s)?|botnet(?:s)?|honeypot(?:s)?|brute[- ]force|credential[- ]stuffing|threat feed|vulnerabilit(?:y|ies)|hostile|recon(?:naissance)?|spoofed referer|bad actor(?:s)?|WAF|IDS|SOC|pentest(?:ing)?|blocked|flagged|triggered|denied|enumerat(?:e|ed|ing)|suspicious)\b)\A(?:(?!\n).)*[/\\](?:(?:\.htaccess|\.htpasswd|\.DS_Store|Thumbs\.db|\.npmrc|\.dockerenv|web\.config))(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?(?:[/\\][\w.\-~%]{1,64})?\b",
725            contexts: CTX_SENSITIVE_PATH_FAMILY,
726            category: r"cms_probing",
727        },
728        TableEntry {
729            id: 116,
730            source: r"\A[/\\]?(?:[\w.\-~%]+[/\\])*[\w.\-~%]*\.(?:asp|aspx|jsp|jsa|jhtml|shtml|cfm|cgi|do|action|lua|inc|woa|nsf|esp)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
731            contexts: CTX_SENSITIVE_PATH_FAMILY,
732            category: r"recon",
733        },
734        TableEntry {
735            id: 117,
736            source: r"\A[/\\](?:(?!(?:management|config_dump|credentials|system[/\\]version|version[/\\]system)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:management|config_dump|credentials|system[/\\]version|version[/\\]system)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
737            contexts: CTX_SENSITIVE_PATH_FAMILY,
738            category: r"recon",
739        },
740        TableEntry {
741            id: 118,
742            source: r"\A[/\\](?:system|version)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
743            contexts: CTX_SENSITIVE_PATH_FAMILY,
744            category: r"recon",
745        },
746        TableEntry {
747            id: 119,
748            source: r"\A[/\\]?(?:(?!(?:actuator|server-status|telescope)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:actuator|server-status|telescope)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
749            contexts: CTX_SENSITIVE_PATH_FAMILY,
750            category: r"recon",
751        },
752        TableEntry {
753            id: 120,
754            source: r"(?:CSCOE|dana-(?:na|cached)|sslvpn|RDWeb|/owa/|/ecp/|global-protect|ssl-vpn/|svpn/|sonicui|/remote/login|myvpn|vpntunnel|versa/login)",
755            contexts: CTX_SENSITIVE_PATH_FAMILY,
756            category: r"recon",
757        },
758        TableEntry {
759            id: 121,
760            source: r"\A[/\\]?(?:(?!(?:geoserver|confluence|nifi|ScadaBR|pandora_console|centreon|kylin|decisioncenter|evox|MagicInfo|metasys|officescan|helpdesk|ignite)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:geoserver|confluence|nifi|ScadaBR|pandora_console|centreon|kylin|decisioncenter|evox|MagicInfo|metasys|officescan|helpdesk|ignite)(?:[.\-][\w.\-~%]*)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
761            contexts: CTX_SENSITIVE_PATH_FAMILY,
762            category: r"recon",
763        },
764        TableEntry {
765            id: 122,
766            source: r"\A[/\\]?(?:(?!cgi-(?:bin|mod)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*cgi-(?:bin|mod)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
767            contexts: CTX_SENSITIVE_PATH_FAMILY,
768            category: r"recon",
769        },
770        TableEntry {
771            id: 123,
772            source: r"\A[/\\]?(?:(?!(?:HNAP1|IPCamDesc\.xml|SDK/webLanguage)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:HNAP1|IPCamDesc\.xml|SDK/webLanguage)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
773            contexts: CTX_SENSITIVE_PATH_FAMILY,
774            category: r"recon",
775        },
776        TableEntry {
777            id: 124,
778            source: r"\A[/\\]?(?:(?!(?:language|languages)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:language|languages)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
779            contexts: CTX_SENSITIVE_PATH_FAMILY,
780            category: r"recon",
781        },
782        TableEntry {
783            id: 125,
784            source: r"\A[/\\]?(?:(?!(?:readme\.txt|README\.md|CHANGELOG|pom\.xml|build\.gradle|appsettings\.json|crossdomain\.xml)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:readme\.txt|README\.md|CHANGELOG|pom\.xml|build\.gradle|appsettings\.json|crossdomain\.xml)(?:\.[\w.\-~%]*)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
785            contexts: CTX_SENSITIVE_PATH_FAMILY,
786            category: r"recon",
787        },
788        TableEntry {
789            id: 126,
790            source: r"\A[/\\]?(?:(?!(?:sap|ise|nidp|cslu|rustfs|developmentserver|fog/management|lms/db|json/login_session|sms_mp|plugin/webs_model|wsman|am_bin)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:sap|ise|nidp|cslu|rustfs|developmentserver|fog/management|lms/db|json/login_session|sms_mp|plugin/webs_model|wsman|am_bin)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
791            contexts: CTX_SENSITIVE_PATH_FAMILY,
792            category: r"recon",
793        },
794        TableEntry {
795            id: 127,
796            source: r"(?:nmaplowercheck|nice\s+ports|Trinity\.txt)",
797            contexts: CTX_SENSITIVE_PATH_FAMILY,
798            category: r"recon",
799        },
800        TableEntry {
801            id: 128,
802            source: r"\A[/\\]?(?:(?!\.(?:openclaw|clawdbot)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*\.(?:openclaw|clawdbot)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
803            contexts: CTX_SENSITIVE_PATH_FAMILY,
804            category: r"recon",
805        },
806        TableEntry {
807            id: 129,
808            source: r"\A[/\\]?(?:default|inicio|indice|localstart)(?:\.[\w.\-~%]*)?(?:[/\\])?(?:\?\S*)?\s*\Z",
809            contexts: CTX_SENSITIVE_PATH_FAMILY,
810            category: r"recon",
811        },
812        TableEntry {
813            id: 130,
814            source: r"\A[/\\]?(?:(?!inicio\.html?(?:[/\\]|\Z))[\w.\-~%]+[/\\])*inicio\.html?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
815            contexts: CTX_SENSITIVE_PATH_FAMILY,
816            category: r"recon",
817        },
818        TableEntry {
819            id: 131,
820            source: r"\A[/\\]?(?:(?!(?:\.streamlit|\.gpt-pilot|\.aider|\.cursor|\.windsurf|\.copilot|\.devcontainer)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:\.streamlit|\.gpt-pilot|\.aider|\.cursor|\.windsurf|\.copilot|\.devcontainer)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
821            contexts: CTX_SENSITIVE_PATH_FAMILY,
822            category: r"recon",
823        },
824        TableEntry {
825            id: 132,
826            source: r"\A[/\\]?(?:(?!(?:docker-compose|Dockerfile|Makefile|Vagrantfile|Jenkinsfile|Procfile)(?:\.ya?ml)?(?:[/\\]|\Z))[\w.\-~%]+[/\\])*(?:docker-compose|Dockerfile|Makefile|Vagrantfile|Jenkinsfile|Procfile)(?:\.ya?ml)?(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
827            contexts: CTX_SENSITIVE_PATH_FAMILY,
828            category: r"recon",
829        },
830        TableEntry {
831            id: 133,
832            source: r"\A[/\\]?(?:(?![\w.\-~%]*(?:secrets?|credentials?)\.(?:py|json|yml|yaml|toml|txt|env|xml|conf|cfg)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*[\w.\-~%]*(?:secrets?|credentials?)\.(?:py|json|yml|yaml|toml|txt|env|xml|conf|cfg)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
833            contexts: CTX_SENSITIVE_PATH_FAMILY,
834            category: r"recon",
835        },
836        TableEntry {
837            id: 134,
838            source: r"\A[/\\]?(?:(?!autodiscover(?:[/\\]|\Z))[\w.\-~%]+[/\\])*autodiscover(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
839            contexts: CTX_SENSITIVE_PATH_FAMILY,
840            category: r"recon",
841        },
842        TableEntry {
843            id: 135,
844            source: r"\A[/\\]?(?:(?!dns-query(?:[/\\]|\Z))[\w.\-~%]+[/\\])*dns-query(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
845            contexts: CTX_SENSITIVE_PATH_FAMILY,
846            category: r"recon",
847        },
848        TableEntry {
849            id: 136,
850            source: r"\A[/\\]?(?:(?!\.git/(?:refs|index|HEAD|objects|logs)(?:[/\\]|\Z))[\w.\-~%]+[/\\])*\.git/(?:refs|index|HEAD|objects|logs)(?:[/\\][\w.\-~%]*)*(?:\?\S*)?\s*\Z",
851            contexts: CTX_SENSITIVE_PATH_FAMILY,
852            category: r"recon",
853        },
854        TableEntry {
855            id: 137,
856            source: r#"(?:__proto__|constructor)\s*(?:\[\s*[\"']prototype[\"']\s*\]|\.\s*prototype)|[\"']__proto__[\"']\s*:"#,
857            contexts: CTX_ALL,
858            category: r"proto_pollution",
859        },
860        TableEntry {
861            id: 138,
862            source: r#"__proto__\s*(?:\[|\.)|\[\s*[\"']?__proto__[\"']?\s*\]|constructor\s*\[\s*[\"']?prototype[\"']?\s*\]|\[\s*[\"']?constructor[\"']?\s*\]\s*\[\s*[\"']?prototype[\"']?\s*\]"#,
863            contexts: CTX_ALL,
864            category: r"proto_pollution",
865        },
866        TableEntry {
867            id: 139,
868            source: r"Object\.prototype\.[A-Za-z_$][\w$]*\s*=(?!=)",
869            contexts: CTX_ALL,
870            category: r"proto_pollution",
871        },
872        TableEntry {
873            id: 140,
874            source: r"\b(?:Object|Reflect)\.setPrototypeOf\s*\(",
875            contexts: CTX_ALL,
876            category: r"proto_pollution",
877        },
878        TableEntry {
879            id: 141,
880            source: r"System\.Diagnostics\.Process\.Start\s*\(|System\.Reflection\.|Assembly\.Load\s*\(",
881            contexts: CTX_ALL,
882            category: r"code_injection",
883        },
884        TableEntry {
885            id: 142,
886            source: r#"(?-i:\bgetattr\(\s*(?:__import__\(\s*['\"](?:os|subprocess|builtins|importlib)['\"]\s*\)|\b(?:os|subprocess|builtins|importlib)\b)\s*,\s*['\"](?:system|popen|exec|eval|call|run|Popen|check_output|check_call)['\"]\s*\)\s*\()"#,
887            contexts: CTX_ALL,
888            category: r"code_injection",
889        },
890        TableEntry {
891            id: 143,
892            source: r#"(?-i:\bvars\(\s*(?:__import__\(\s*['\"](?:os|subprocess|builtins|importlib)['\"]\s*\)|\b(?:os|subprocess|builtins|importlib)\b)\s*\)\s*\[\s*['\"](?:system|popen|exec|eval|call|run|Popen|check_output|check_call)['\"]\s*\]\s*\()"#,
893            contexts: CTX_ALL,
894            category: r"code_injection",
895        },
896        TableEntry {
897            id: 144,
898            source: r"(?<![A-Za-z0-9+/])(?-i:rO0AB)",
899            contexts: CTX_ALL,
900            category: r"deserialization",
901        },
902        TableEntry {
903            id: 145,
904            source: r"(?<![A-Za-z0-9+/])(?-i:AAEAAAD)",
905            contexts: CTX_ALL,
906            category: r"deserialization",
907        },
908        TableEntry {
909            id: 146,
910            source: r"(?<![A-Za-z0-9+/])(?-i:gA[SW]V)",
911            contexts: CTX_ALL,
912            category: r"deserialization",
913        },
914        TableEntry {
915            id: 147,
916            source: r"(?<![A-Za-z0-9+/])(?-i:BAh[Jv7bV])",
917            contexts: CTX_ALL,
918            category: r"deserialization",
919        },
920        TableEntry {
921            id: 148,
922            source: r"cos\n",
923            contexts: CTX_ALL,
924            category: r"deserialization",
925        },
926        TableEntry {
927            id: 149,
928            source: r"c__builtin__",
929            contexts: CTX_ALL,
930            category: r"deserialization",
931        },
932        TableEntry {
933            id: 150,
934            source: r"csubprocess",
935            contexts: CTX_ALL,
936            category: r"deserialization",
937        },
938        TableEntry {
939            id: 151,
940            source: r"cposix",
941            contexts: CTX_ALL,
942            category: r"deserialization",
943        },
944        TableEntry {
945            id: 152,
946            source: r"(c[A-Za-z_][A-Za-z0-9_]{0,100}(?:\.[A-Za-z_][A-Za-z0-9_]{0,100}){0,20}\n[A-Za-z_][A-Za-z0-9_]{0,100}\n)[^ \t]{0,100}?[Rb]",
947            contexts: CTX_ALL,
948            category: r"deserialization",
949        },
950        TableEntry {
951            id: 153,
952            source: r#"O:\d+:""#,
953            contexts: CTX_ALL,
954            category: r"deserialization",
955        },
956        TableEntry {
957            id: 154,
958            source: r#"C:\d+:""#,
959            contexts: CTX_ALL,
960            category: r"deserialization",
961        },
962        TableEntry {
963            id: 155,
964            source: r#"E:\d+:""#,
965            contexts: CTX_ALL,
966            category: r"deserialization",
967        },
968        TableEntry {
969            id: 156,
970            source: r"<ObjectDataProvider\b",
971            contexts: CTX_ALL,
972            category: r"deserialization",
973        },
974    ]
975});
976
977/// The optional leading-separator anchor the reference builds the recon
978/// whole-value rows from (`_TOP_LEVEL_PATH_PREFIX_RE`, i.e. `\A[/\\]?`).
979const TOP_LEVEL_PATH_PREFIX: &str = r"\A[/\\]?";
980
981/// Recon rows whose leading path separator is optional.
982///
983/// Outside a URL path these rows match bare words such as "default" or
984/// "README.md", not only probe paths. Derived from the table (recon category
985/// plus the anchor) with the reference's own rule
986/// (`_suspatterns_pattern_table.py`), so a new recon row built the same way
987/// is covered without a hand-maintained list. Other families (`cms_probing`,
988/// `sensitive_file`) also carry the anchor but are deliberately not gated,
989/// matching the reference scoping.
990pub static RECON_OPTIONAL_SEPARATOR_PATTERN_SOURCES: LazyLock<
991    std::collections::HashSet<&'static str>,
992> = LazyLock::new(|| {
993    PATTERN_DEFINITIONS
994        .iter()
995        .filter(|entry| {
996            entry.category == "recon" && entry.source.starts_with(TOP_LEVEL_PATH_PREFIX)
997        })
998        .map(|entry| entry.source)
999        .collect()
1000});
1001
1002/// Recon rows additionally scanned against the signal-preserving raw view.
1003///
1004/// The processed views fold LDAP hex escapes (`\de` -> `Þ`) before the
1005/// pattern tables run, so separator-prefixed probes such as `\default` or
1006/// `\default.asp` never reach a recon row there. The raw view keeps them
1007/// intact; the leading-separator gate still decides which matches are
1008/// probes, so bare words stay innocent exactly as on the processed views.
1009pub static DETECTION_RECON_RAW_VIEW_PATTERN_SOURCES: LazyLock<
1010    std::collections::HashSet<&'static str>,
1011> = LazyLock::new(|| {
1012    PATTERN_DEFINITIONS
1013        .iter()
1014        .filter(|entry| entry.category == "recon")
1015        .map(|entry| entry.source)
1016        .collect()
1017});
1018
1019/// Patterns whose matches are suppressed inside binary-dense regions.
1020pub static NOISE_PRONE_PATTERN_SOURCES: LazyLock<std::collections::HashSet<&'static str>> =
1021    LazyLock::new(|| {
1022        std::collections::HashSet::from([
1023            r#"#\{(?![^\}]*\d{4}-\d{1,2}-\d{1,2}(?!\d))(?=[^\}]*(?:@[\w.]+@|\b\w+\s*\(|['\"]?\d+['\"]?\s*[*/%+\-]\s*['\"]?\d+['\"]?))[^\}]*\}"#,
1024            r"(?:[;&|]\s*(?:\$\([^)]+\)|\$\{[^}]+\}))",
1025            r"(?<!`)`(?:[A-Za-z0-9_./~]|\$[({])(?:[^`\\\n]|\\.)*`",
1026            r"[;|&]\s*(?:ls|cat|rm|id|whoami|uname|wget|curl|nc|netcat|socat|bash|sh|python|perl)\b",
1027            r"[A-Za-z0-9_./*?-]*[?*][A-Za-z0-9_./*?-]*",
1028            r"\$\((?:[^()\\\n]|\\.)*\)|\$\{(?:[^{}\\\n]|\\.)*\}",
1029            r"\$\{[^}]*(?:@[\w.]+@|\b\w+\s*\(|\d+\s*[*/%+\-]\s*\d+)[^}]*\}",
1030            r"\(\s*[&|]\s*",
1031            r#"\w+(?:['\"]+\w+){1,10}"#,
1032            // SQLi comment terminators span arbitrary whitespace between the
1033            // quote and the -- / # terminator, so they routinely fire inside
1034            // text-decoded binary bodies (e.g. "'\n--" byte runs in compressed
1035            // payloads). Parity with upstream commit f5d53ca5.
1036            r"'\s*(?:[\);]+\s*)?--|'[\);]*#(?:\n|\Z)",
1037        ])
1038    });
1039
1040/// Patterns that only run on the raw signal-preserving view.
1041pub static DETECTION_RAW_VIEW_PATTERN_SOURCES: LazyLock<std::collections::HashSet<&'static str>> =
1042    LazyLock::new(|| {
1043        std::collections::HashSet::from([
1044            r#"#\{(?![^\}]*\d{4}-\d{1,2}-\d{1,2}(?!\d))(?=[^\}]*(?:@[\w.]+@|\b\w+\s*\(|['\"]?\d+['\"]?\s*[*/%+\-]\s*['\"]?\d+['\"]?))[^\}]*\}"#,
1045            r"'\s*(?:[\);]+\s*)?--|'[\);]*#(?:\n|\Z)",
1046            r"(?:%2e%2e|%252e%252e|%uff0e%uff0e|%c0%ae%c0%ae|%e0%40%ae|%c0%ae%e0%80%ae|%25c0%25ae)/",
1047            r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:(?:%00|\\u0000|\\x00|\\0|\x00|;)[^\"']*|\.)[\"']"#,
1048            r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:[^ \"'][^\"']*)?\.(?:docx|jpeg|pptx|tiff|webm|webp|xlsx|avi|bmp|doc|gif|ico|jpg|mkv|mov|mp3|mp4|odt|pdf|png|ppt|svg|tif|wav|xls)[\"']"#,
1049            r"(?<![A-Za-z0-9+/])(?-i:AAEAAAD)",
1050            r"(?<![A-Za-z0-9+/])(?-i:BAh[Jv7bV])",
1051            r"(?<![A-Za-z0-9+/])(?-i:gA[SW]V)",
1052            r"(?<![A-Za-z0-9+/])(?-i:rO0AB)",
1053            r"(?i)\bORDER\s+BY\s+\d+\s*(?:--|#|;|\)|,|/\*|\Z)|(?<=[=?&])ORDER\s+BY\s+\d+\s*\n",
1054            r"(c[A-Za-z_][A-Za-z0-9_]{0,100}(?:\.[A-Za-z_][A-Za-z0-9_]{0,100}){0,20}\n[A-Za-z_][A-Za-z0-9_]{0,100}\n)[^ \t]{0,100}?[Rb]",
1055            r"[\r\n][^\S\r\n]*(?:HTTP\/[0-9.]+|Location:|Set-Cookie:)",
1056            r"[a-zA-Z][\w-]*\s*=[\d\w\s]*\*\)+(?:%00|\\u0000|\\x00|\\0|\x00)",
1057            r"\*\)\)+(?:%00|\\u0000|\\x00|\\0|\x00)",
1058            r"cos\n",
1059            r"j[\t\r\n]*a[\t\r\n]*v[\t\r\n]*a[\t\r\n]*s[\t\r\n]*c[\t\r\n]*r[\t\r\n]*i[\t\r\n]*p[\t\r\n]*t[\t\r\n]*:\s*[^\s]+",
1060        ])
1061    });
1062
1063/// Patterns that only run on the URL-decoded view.
1064pub static DETECTION_URL_DECODED_VIEW_PATTERN_SOURCES: LazyLock<
1065    std::collections::HashSet<&'static str>,
1066> = LazyLock::new(|| {
1067    std::collections::HashSet::from([
1068        r#"(?:\A|[;,:\n])\s*filename\s*=\s*[\"'][^\"']*\.(?:php\d*|phtml|shtml|asax|ascx|ashx|asmx|aspx|bash|jspx|phar|phps|asa|asp|bat|cer|cfc|cfm|cgi|cmd|exe|hta|jsp|msi|pht|vbe|vbs|war|wsf|js|pl|py|rb|sh|ws)(?![A-Za-z0-9])(?:(?:\x00|;)[^\"']*|\.)[\"']"#,
1069        r#"(?i)(?:['\")\d]|/\*)\s{0,3}\bORDER\s+BY\s+\d+|\bORDER\s+BY\s+\d+\s*(?:--|#|/\*)"#,
1070        r"[a-zA-Z][\w-]*\s*=[\d\w\s]*\*\)+\x00",
1071        r"\*\)\)+\x00",
1072        r#"\A(?:(?!\n).)*(?:boot\.ini|win\.ini|system\.ini|config\.sys)(?:[&#;,\"'<>]|\s*\Z)"#,
1073        r#"\A(?:(?!\n).)*etc/(?:passwd|shadow|group|hosts|motd|issue|mysql/my\.cnf|ssh/ssh_config)(?:[&#;,\"'<>]|\s*\Z)"#,
1074        r#"\A(?:(?!\n).)*proc/self/environ(?:[&#;,\"'<>]|\s*\Z)"#,
1075        r#"\A(?:(?!\n).)*var/log/[^\s/]+(?:[&#;,\"'<>]|\s*\Z)"#,
1076        r"\n[^\S\r\n]*(?:[^=\s;|&]+=[^\s;|&]+\s+)*(?:/?(?:[\w.-]+/)*env\s+)?/?(?:[\w.-]+/)*(?:bash|sh|ksh|csh|tsch|zsh|ash)\s+-c\b",
1077    ])
1078});
1079
1080/// Per-pattern weight overrides; every other category weighs 1.0.
1081pub static DETECTION_PATTERN_WEIGHT_OVERRIDES: LazyLock<
1082    std::collections::HashMap<&'static str, f64>,
1083> = LazyLock::new(|| {
1084    std::collections::HashMap::from([
1085        (
1086            r"(?i)\bSELECT\b(?:(?!\bSELECT\b)[\w\s,\*().])*?\bFROM\b",
1087            0.5_f64,
1088        ),
1089        (r"(?i)SELECT\s+\*", 0.5_f64),
1090        (
1091            r#"(?i)\bWHERE\s+[\w."]+\s*(?:=|<|>|<=|>=|LIKE|IN)\b"#,
1092            0.5_f64,
1093        ),
1094    ])
1095});
guard_core_engine/patterns/table.rs

guard_core_engine/patterns/
table.rs
