Struct Scanner 

pub struct Scanner { /* private fields */ }

Implementations

impl Scanner

pub fn new(sig_set: SigSet) -> Self

Create a new Scanner from a SigSet with default size limits.

Default Limits

• Max extracted file size: 500 MB
• Max total extracted size: 2 GB

Examples

use open_detect::{Scanner, SigSet, Signature};

let sig_set = SigSet::from_signature(
    Signature("rule test { condition: true }".to_string())
).unwrap();
let scanner = Scanner::new(sig_set);

pub fn with_max_extracted_size(self, size: usize) -> Self

Set the maximum size for individual extracted files (default: 500 MB).

This limit applies when scanning archives. Files larger than this limit will be skipped during archive extraction.

Examples

use open_detect::{Scanner, SigSet};

let scanner = Scanner::new(sig_set)
    .with_max_extracted_size(100 * 1024 * 1024); // 100 MB

pub fn with_max_total_extracted_size(self, size: usize) -> Self

Set the maximum total size for all extracted files (default: 2 GB).

This limit applies when scanning archives. Once the total size of extracted files exceeds this limit, extraction stops.

Examples

use open_detect::{Scanner, SigSet};

let scanner = Scanner::new(sig_set)
    .with_max_total_extracted_size(1024 * 1024 * 1024); // 1 GB

pub fn scan_buf(&self, buf: &[u8]) -> Result<ScanResult>

Scan a buffer of data for malicious content.

Automatically detects and extracts archives (ZIP, TAR, etc.) before scanning. If the buffer contains an archive, all files within will be scanned recursively.

Errors

Returns an error if:

• The YARA scanner fails to scan the data
• Archive extraction fails (corrupted archive, etc.)

Examples

use open_detect::{Scanner, SigSet, Signature, ScanResult};

let scanner = Scanner::new(sig_set);
let data = b"data to scan";

match scanner.scan_buf(data).unwrap() {
    ScanResult::Clean => println!("No threats detected"),
    ScanResult::Malicious(detections) => {
        println!("Detected {} threats", detections.len());
    }
}

pub fn scan_file(&self, path: &Path) -> Result<ScanResult>

Scan a file for malicious content.

Reads the entire file into memory and scans it. Automatically detects and extracts archives before scanning.

Errors

Returns an error if:

• The file cannot be read
• The YARA scanner fails to scan the data
• Archive extraction fails

Examples

use open_detect::{Scanner, SigSet};
use std::path::Path;

let scanner = Scanner::new(sig_set);
let result = scanner.scan_file(Path::new("suspicious.exe")).unwrap();

pub fn scan_buf_ft( &self, buf: &[u8], file_type: &MimeType, ) -> Result<ScanResult>

Scan a buffer with an explicitly specified file type.

This is useful when you know the file type and want to skip automatic detection.

Errors

Returns an error if:

• The YARA scanner fails to scan the data
• Archive extraction fails

Examples

use open_detect::{Scanner, SigSet};
use mime_type::{MimeType, Archive};

let scanner = Scanner::new(sig_set);
let data = b"PK\x03\x04..."; // ZIP file data
let result = scanner.scan_buf_ft(
    data,
    &MimeType::Archive(Archive::Zip)
).unwrap();

pub fn scan_file_ft( &self, path: &Path, file_type: &MimeType, ) -> Result<ScanResult>

Scan a file with an explicitly specified file type.

This is useful when you know the file type and want to skip automatic detection.

Errors

Returns an error if:

• The file cannot be read
• The YARA scanner fails to scan the data
• Archive extraction fails

Examples

use open_detect::{Scanner, SigSet};
use mime_type::{MimeType, Archive};
use std::path::Path;

let scanner = Scanner::new(sig_set);
let result = scanner.scan_file_ft(
    Path::new("archive.zip"),
    &MimeType::Archive(Archive::Zip)
).unwrap();

Trait Implementations

impl From<SigSet> for Scanner

fn from(sig_set: SigSet) -> Self

Converts to this type from the input type.