pub struct WebSocketDetector;Expand description
WebSocket 攻击检测器。
设计修正(重要):本检测器此前把 Upgrade: websocket、Sec-WebSocket-Key:、
ws:// 当作攻击特征,而前两者是合法握手的必需头、后者在正常内容里随处可见 ——
结果是任何合法的 WebSocket 握手都会被判 Severity::High,接入阻断路径会打死
整个 WebSocket 业务。现已收窄为两个真正有信号的形态:
- CSWSH(跨站 WebSocket 劫持):
Origin: null与 WebSocket 升级同时出现。 这两者需要合取判断,正则表达不了(regexcrate 无 lookahead),故在detect里分两步匹配。 - WebSocket SSRF:
ws://指向环回 / 私网 / 链路本地地址(含云元数据端点169.254.169.254)。
Trait Implementations§
Auto Trait Implementations§
impl Freeze for WebSocketDetector
impl RefUnwindSafe for WebSocketDetector
impl Send for WebSocketDetector
impl Sync for WebSocketDetector
impl Unpin for WebSocketDetector
impl UnsafeUnpin for WebSocketDetector
impl UnwindSafe for WebSocketDetector
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more