path_security/
constants.rs

1//! Constants for path security
2
3// Path length limits
4pub const MAX_PATH_LENGTH: usize = 4096;
5pub const MAX_FILENAME_LENGTH: usize = 255;
6pub const MAX_PROJECT_NAME_LENGTH: usize = 64;
7
8// Symlink chain limits
9pub const MAX_SYMLINK_CHAIN_LENGTH: usize = 100;
10
11// Encoding detection thresholds
12pub const UTF16_NULL_BYTE_THRESHOLD: f32 = 0.25; // 25% of even positions have null bytes
13
14// Dangerous patterns
15pub const SUSPICIOUS_ENCODED_PATTERNS: &[&str] = &[
16    "%2e", "%2E",  // .
17    "%2f", "%2F",  // /
18    "%5c", "%5C",  // \
19    "%00",         // null byte
20    "%0a", "%0A",  // newline
21    "%0d", "%0D",  // carriage return
22];
23
24pub const OVERLONG_UTF8_PATTERNS: &[&str] = &[
25    "%c0%ae",  // overlong .
26    "%c0%af",  // overlong /
27    "%c1%9c",  // overlong \
28    "%c0%2e",  // invalid encoding
29    "%e0%80%ae", // 3-byte overlong .
30];
31
32pub const TRAVERSAL_PATTERNS: &[&str] = &[
33    "..",
34    "...",   // Some systems treat this specially
35    "....",  // Quad dots
36    ". .",   // Space between dots
37    ". . ",  // Multiple spaces
38    ".\t.",  // Tab between dots
39    ".|.",   // Pipe between dots
40];
41
42pub const NESTED_TRAVERSAL_PATTERNS: &[&str] = &[
43    "....//",   // Quad dot double slash
44    "....\\/",  // Quad dot mixed separator
45    "..../",    // Quad dot slash
46    "....\\\\", // Quad dot backslash
47    ".|./",     // Pipe dot slash
48    ".|\\/",    // Pipe dot backslash-slash
49];
50
51pub const DANGEROUS_SEPARATORS: &[char] = &[';', '\t', '\n', '\r'];
52
53pub const WINDOWS_RESERVED_NAMES: &[&str] = &[
54    "CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", 
55    "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", 
56    "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9"
57];
58
59pub const DANGEROUS_PROTOCOLS: &[&str] = &[
60    "file://", "file:/",
61    "http://", "https://",
62    "ftp://", "ftps://", "sftp://",
63    "gopher://", "data:", "javascript:",
64    "vbscript:", "jar:", "php://",
65];
66
67pub const SYSTEM_PATHS: &[&str] = &[
68    "/proc/", "/sys/", "/dev/",
69    "C:\\Windows\\System32", "C:\\Windows\\Temp",
70    "/tmp/", "/var/tmp/",
71    "/etc/", "/boot/",
72];
73
74pub const SUSPICIOUS_PATTERNS: &[&str] = &[
75    "~",          // Home directory expansion
76    "$",          // Environment variable expansion
77    "\0",         // Null byte injection
78    "\\",         // Backslash (should be caught by separator check, but double-check)
79];
path_security/constants.rs

path_security/
constants.rs
