Skip to main content

WebSocketDetector

Struct WebSocketDetector 

Source
pub struct WebSocketDetector;
Expand description

WebSocket 攻击检测器。

设计修正(重要):本检测器此前把 Upgrade: websocket、Sec-WebSocket-Key:、 ws:// 当作攻击特征,而前两者是合法握手的必需头、后者在正常内容里随处可见 —— 结果是任何合法的 WebSocket 握手都会被判 Severity::High,接入阻断路径会打死 整个 WebSocket 业务。现已收窄为两个真正有信号的形态:

  1. CSWSH(跨站 WebSocket 劫持):Origin: null 与 WebSocket 升级同时出现。 这两者需要合取判断,正则表达不了(regex crate 无 lookahead),故在 detect 里分两步匹配。
  2. WebSocket SSRF:ws:// 指向环回 / 私网 / 链路本地地址(含云元数据端点 169.254.169.254)。

Trait Implementations§

Source§

impl Detector for WebSocketDetector

Source§

fn name(&self) -> &'static str

Source§

fn detect(&self, input: &str) -> Option<DetectionResult>

Auto Trait Implementations§

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = !

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, !>

Performs the conversion.
Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.