Crate shell_sanitize_rules 

Built-in sanitization rules and ready-made presets for shell_sanitize.

Quick start

Use a preset matched to your use case:

use shell_sanitize_rules::presets;

// AI agent validates a file path argument
let s = presets::file_path();
assert!(s.sanitize("uploads/photo.jpg").is_ok());
assert!(s.sanitize("../../etc/passwd").is_err());

// Value interpolated into `sh -c "..."`
let s = presets::shell_command();
assert!(s.sanitize("my-branch").is_ok());
assert!(s.sanitize("branch; rm -rf /").is_err());

See presets module for the full preset catalogue and AI agent architecture guidance.

Rule overlap policy

Some characters are covered by multiple rules with different intent:

Character	Rules	Rationale
$	ShellMetaRule, EnvExpansionRule	Meta rejects the char; Env identifies the variable name
{, }	ShellMetaRule, GlobRule	Meta catches brace expansion; Glob catches filename patterns
\n, \r	ShellMetaRule, ControlCharRule	Meta catches command splitting; Control catches all C0 chars

When multiple rules are active, each reports its own violations independently. This is intentional — overlapping reports give richer context about why an input was rejected. Callers who need unique violations can deduplicate by (position, fragment).

Modules

presets

Ready-made sanitizer configurations for common threat models.

Structs

ControlCharRule

Rejects input containing control characters (U+0000–U+001F, U+007F, U+0080–U+009F).

EnvExpansionRule

Rejects input containing environment variable expansion patterns.

GlobRule

Rejects input containing shell glob characters.

PathTraversalRule

Rejects input containing path traversal patterns.

ShellMetaRule

Rejects input containing shell metacharacters.

Functions

default_shell_rules

Convenience: build a shell_sanitize::Sanitizer with all default rules.