security_rust/injection/
ssi_injection.rs

1// Copyright (c) 2026 erik <erik@erik.xyz> — https://erik.xyz
2
3use crate::{regex_detect, AttackCategory, DetectionResult, Detector, Severity};
4use regex::Regex;
5use std::sync::LazyLock;
6
7static PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
8    vec![
9        Regex::new(r"<!--#exec cmd=").unwrap(),
10        Regex::new(r"<!--#include file=").unwrap(),
11        Regex::new(r"<!--#echo var=").unwrap(),
12        Regex::new(r"<!--#fsize").unwrap(),
13        Regex::new(r"<!--#flastmod").unwrap(),
14        Regex::new(r"<!--#config").unwrap(),
15        Regex::new(r"<!--#printenv").unwrap(),
16    ]
17});
18
19pub struct SsiInjectionDetector;
20
21impl Detector for SsiInjectionDetector {
22    fn name(&self) -> &'static str {
23        "ssi_injection"
24    }
25
26    fn detect(&self, input: &str) -> Option<DetectionResult> {
27        regex_detect(&PATTERNS, self.name(), AttackCategory::Injection, Severity::High, "SSI Server-Side Include injection detected", input)
28    }
29}
30
31#[cfg(test)]
32mod tests {
33    use super::*;
34
35    fn det() -> SsiInjectionDetector {
36        SsiInjectionDetector
37    }
38
39    fn assert_hit(input: &str) {
40        crate::test_helpers::assert_detected(
41            &det(),
42            input,
43            AttackCategory::Injection,
44            Severity::High,
45        );
46    }
47
48    #[test]
49    fn name_is_ssi_injection() {
50        assert_eq!(det().name(), "ssi_injection");
51    }
52
53    #[test]
54    fn detects_common_payloads() {
55        for input in [
56            r#"<!--#exec cmd="cat /etc/passwd"-->"#,
57            r#"<!--#include file="/etc/passwd"-->"#,
58            r#"<!--#echo var="DATE_LOCAL"-->"#,
59            r#"<!--#fsize file="index.html"-->"#,
60            r#"<!--#flastmod file="index.html"-->"#,
61            r#"<!--#config timefmt="%B"-->"#,
62            r#"<!--#printenv-->"#,
63        ] {
64            assert_hit(input);
65        }
66    }
67
68    #[test]
69    fn benign_inputs_not_detected() {
70        for input in [
71            "Hello, this is a normal text input. Nothing suspicious here.",
72            "<!-- this is a plain comment -->",
73            "The page was generated at 3:00 PM",
74            "Include the file below the table",
75        ] {
76            assert!(det().detect(input).is_none(), "false positive: {input}");
77        }
78    }
79
80    #[test]
81    fn edge_cases() {
82        assert!(det().detect("").is_none());
83        assert!(det().detect(" \t\n ").is_none());
84        assert!(det().detect("你好世界 こんにちは").is_none());
85        // near misses: directive incomplete, or uppercase (patterns are case-sensitive)
86        assert!(det().detect("<!--#exec").is_none());
87        assert!(det().detect(r#"<!--#EXEC cmd="ls"-->"#).is_none());
88        assert!(det().detect("<!-- #exec cmd=\"ls\" -->").is_none());
89    }
90}
security_rust/injection/ssi_injection.rs

security_rust/injection/
ssi_injection.rs
