Struct ContentPrefilter 

pub struct ContentPrefilter { /* private fields */ }

A sound, scope-aware skip-prefilter: per-scope unions (RegexSet) of the active content patterns, evaluated over the canonical surface (§6).

Soundness is by construction per scope: each rule’s pattern is scanned over a superset of the fields it actually inspects, so a clean result on every scanned surface proves no content rule matches → the full inspection would return Allow → the caller may safely skip it. The check can only err toward “candidate” (run the full path), never toward a wrong skip.

NB: a character-class pre-check (looking for </'/%/…) would be UNSOUND — keyword rules match plain alphanumerics (union select, sleep(, /etc/passwd) and normalization turns %3C/fullwidth into < — so this MUST stay a regex union over the same patterns and the same canonical surface as the modules.

Implementations

impl ContentPrefilter

pub fn new(paranoia: u8) -> Self

Build the scope-aware prefilter for all content rules active at paranoia.

pub fn rule_ids(&self) -> Vec<&'static str>

All rule_ids covered (main + host) — total-completeness assertions.

pub fn host_rule_ids(&self) -> &[&'static str]

rule_ids in the host-only bucket — scope-correspondence assertions (must be exactly the Scope::HostHeaders rules, never a content rule).

pub fn is_candidate(&self, ctx: &RequestContext) -> bool

true = at least one pattern might match the canonical surface → the full inspection MUST run. false = provably no content rule can match → the caller may skip inspection and treat the request as Allow.