forked from mirrors/kingfisher
1853 lines
75 KiB
Rust
1853 lines
75 KiB
Rust
use std::{
|
|
collections::BTreeMap,
|
|
fs,
|
|
hash::{Hash, Hasher},
|
|
sync::Arc,
|
|
time::{Duration, Instant},
|
|
};
|
|
|
|
use anyhow::Result;
|
|
use dashmap::DashMap;
|
|
use http::StatusCode;
|
|
use liquid::Object;
|
|
use liquid_core::{Value, ValueView};
|
|
use once_cell::sync::{Lazy, OnceCell};
|
|
use reqwest::{header, header::HeaderValue, multipart, Client, Url};
|
|
use rustc_hash::FxHashMap;
|
|
use tokio::{sync::Notify, time};
|
|
use tracing::{debug, trace};
|
|
|
|
use crate::{
|
|
cli::global::TlsMode,
|
|
location::OffsetSpan,
|
|
matcher::{OwnedBlobMatch, SerializableCaptures},
|
|
rules::rule::Validation,
|
|
validation_body::{self},
|
|
};
|
|
|
|
use crate::grpc_validation;
|
|
use crate::validation_rate_limit::should_rate_limit_validation;
|
|
|
|
// Re-export TlsMode from kingfisher_rules for use in client_for_rule
|
|
pub use kingfisher_rules::TlsMode as RuleTlsMode;
|
|
|
|
pub use kingfisher_scanner::validation::aws;
|
|
pub use kingfisher_scanner::validation::http_validation as httpvalidation;
|
|
pub use kingfisher_scanner::validation::mysql::validate_mysql;
|
|
pub use kingfisher_scanner::validation::postgres::validate_postgres;
|
|
pub use kingfisher_scanner::validation::CachedResponse;
|
|
pub use kingfisher_scanner::validation::{
|
|
azure, coinbase, gcp, jdbc, jwt, mongodb, mysql, postgres,
|
|
};
|
|
pub mod utils;
|
|
|
|
const VALIDATION_CACHE_SECONDS: u64 = 1200; // 20 minutes
|
|
|
|
fn truncate_to_char_boundary(s: &mut String, max_len: usize) {
|
|
if s.len() <= max_len {
|
|
return;
|
|
}
|
|
|
|
let mut new_len = max_len;
|
|
while new_len > 0 && !s.is_char_boundary(new_len) {
|
|
new_len -= 1;
|
|
}
|
|
|
|
s.truncate(new_len);
|
|
}
|
|
|
|
/// Build a truncated preview from `body` without cloning the full string.
|
|
/// When `max_len` is 0, truncation is disabled and the full body is returned.
|
|
fn truncate_preview(body: &str, max_len: usize) -> String {
|
|
if max_len == 0 || body.len() <= max_len {
|
|
return body.to_string();
|
|
}
|
|
let mut end = max_len;
|
|
while end > 0 && !body.is_char_boundary(end) {
|
|
end -= 1;
|
|
}
|
|
body[..end].to_string()
|
|
}
|
|
|
|
static USER_AGENT_SUFFIX: OnceCell<String> = OnceCell::new();
|
|
|
|
const BROWSER_USER_AGENT: &str = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) \
|
|
AppleWebKit/537.36 (KHTML, like Gecko) \
|
|
Chrome/140.0.0.0 Safari/537.36";
|
|
|
|
fn build_user_agent() -> String {
|
|
let base = format!("{}/{}", env!("CARGO_PKG_NAME"), env!("CARGO_PKG_VERSION"));
|
|
if let Some(suffix) = USER_AGENT_SUFFIX.get() {
|
|
format!("{base} {suffix} {BROWSER_USER_AGENT}")
|
|
} else {
|
|
format!("{base} {BROWSER_USER_AGENT}")
|
|
}
|
|
}
|
|
|
|
pub static GLOBAL_USER_AGENT: Lazy<String> = Lazy::new(build_user_agent);
|
|
|
|
/// Configure a user-agent suffix that is appended after the Kingfisher package name/version.
|
|
///
|
|
/// The suffix is inserted before the browser portion of the user-agent. Empty or whitespace-only
|
|
/// values are ignored. This should be called once near program start prior to accessing
|
|
/// [`GLOBAL_USER_AGENT`].
|
|
pub fn set_user_agent_suffix<S: Into<String>>(suffix: Option<S>) {
|
|
if let Some(suffix) = suffix {
|
|
let trimmed = suffix.into().trim().to_string();
|
|
if trimmed.is_empty() {
|
|
return;
|
|
}
|
|
|
|
let _ = USER_AGENT_SUFFIX.set(trimmed.clone());
|
|
kingfisher_scanner::validation::set_user_agent_suffix(Some(trimmed));
|
|
}
|
|
}
|
|
|
|
/// Holds HTTP clients for different TLS validation modes.
|
|
///
|
|
/// This struct is created once at scan startup and passed through the validation chain.
|
|
/// The appropriate client is selected based on the global TLS mode and each rule's
|
|
/// declared `tls_mode` setting.
|
|
#[derive(Clone)]
|
|
pub struct ValidationClients {
|
|
/// Client with full TLS certificate validation (WebPKI chain, hostname, expiry).
|
|
strict: Client,
|
|
/// Client that accepts self-signed or invalid certificates.
|
|
/// Used when `--tls-mode=lax` AND the rule opts into lax validation,
|
|
/// or when `--tls-mode=off`.
|
|
lax: Client,
|
|
/// The global TLS mode from CLI arguments.
|
|
pub global_mode: TlsMode,
|
|
/// When true, skip SSRF IP validation and allow requests to internal/private addresses.
|
|
pub allow_internal_ips: bool,
|
|
}
|
|
|
|
/// Build a redirect policy that validates redirect targets against SSRF rules.
|
|
///
|
|
/// Each redirect hop is checked: IP-literal targets are validated directly via
|
|
/// `is_ssrf_safe_ip`, and hostname targets are resolved synchronously via
|
|
/// `std::net::ToSocketAddrs` so that all resolved IPs can be checked. This
|
|
/// significantly reduces the hostname-redirect SSRF risk (e.g., a public URL
|
|
/// that 302s to an attacker-controlled hostname resolving to `169.254.169.254`).
|
|
/// This is a best-effort check: reqwest performs its own DNS resolution when
|
|
/// connecting, so a malicious DNS server could return different IPs between
|
|
/// this check and the actual request (DNS rebinding / TOCTOU). A future
|
|
/// hardening step would be a pinned/custom resolver so that validated IPs are
|
|
/// exactly those used for the outbound connection.
|
|
///
|
|
/// **Note:** reqwest runs redirect callbacks on Tokio worker threads. The DNS
|
|
/// lookup uses `tokio::task::block_in_place` so the runtime can compensate
|
|
/// (e.g., spawn additional worker threads) rather than silently stalling.
|
|
pub(crate) fn ssrf_safe_redirect_policy() -> reqwest::redirect::Policy {
|
|
reqwest::redirect::Policy::custom(|attempt| {
|
|
// Cap redirect depth (reqwest default is 10)
|
|
if attempt.previous().len() >= 10 {
|
|
return attempt.error("too many redirects");
|
|
}
|
|
// Extract URL info before potentially moving `attempt`.
|
|
let url = attempt.url().clone();
|
|
if let Some(host) = url.host_str() {
|
|
if let Ok(ip) = host.parse::<std::net::IpAddr>() {
|
|
// IP-literal: check directly without DNS.
|
|
if !kingfisher_scanner::validation::is_ssrf_safe_ip(&ip) {
|
|
return attempt.error(format!(
|
|
"SSRF protection: redirect to non-public IP {} blocked",
|
|
ip
|
|
));
|
|
}
|
|
} else {
|
|
// Hostname: resolve and check all resolved IPs. We use
|
|
// block_in_place to signal Tokio that this thread is about to
|
|
// block on synchronous DNS, so the runtime can compensate.
|
|
let port = url.port().unwrap_or(if url.scheme() == "https" { 443 } else { 80 });
|
|
let dns_result = tokio::task::block_in_place(|| {
|
|
std::net::ToSocketAddrs::to_socket_addrs(&(host, port))
|
|
});
|
|
match dns_result {
|
|
Ok(addrs) => {
|
|
for addr in addrs {
|
|
if !kingfisher_scanner::validation::is_ssrf_safe_ip(&addr.ip()) {
|
|
return attempt.error(format!(
|
|
"SSRF protection: redirect to '{}' resolves to non-public IP {} — blocked",
|
|
host,
|
|
addr.ip()
|
|
));
|
|
}
|
|
}
|
|
}
|
|
Err(e) => {
|
|
// Fail closed: if we cannot resolve the hostname, we
|
|
// cannot guarantee the redirect target is SSRF-safe.
|
|
return attempt.error(format!(
|
|
"SSRF protection: cannot resolve redirect host '{}' ({}) — blocked",
|
|
host, e
|
|
));
|
|
}
|
|
}
|
|
}
|
|
}
|
|
attempt.follow()
|
|
})
|
|
}
|
|
|
|
impl ValidationClients {
|
|
/// Create validation clients based on the global TLS mode.
|
|
pub fn new(global_mode: TlsMode, allow_internal_ips: bool) -> anyhow::Result<Self> {
|
|
let timeout = std::time::Duration::from_secs(30);
|
|
|
|
let strict = Client::builder()
|
|
.danger_accept_invalid_certs(false)
|
|
.redirect(if allow_internal_ips {
|
|
reqwest::redirect::Policy::default()
|
|
} else {
|
|
ssrf_safe_redirect_policy()
|
|
})
|
|
.timeout(timeout)
|
|
.build()?;
|
|
|
|
let lax = Client::builder()
|
|
.danger_accept_invalid_certs(true)
|
|
.redirect(if allow_internal_ips {
|
|
reqwest::redirect::Policy::default()
|
|
} else {
|
|
ssrf_safe_redirect_policy()
|
|
})
|
|
.timeout(timeout)
|
|
.build()?;
|
|
|
|
Ok(Self { strict, lax, global_mode, allow_internal_ips })
|
|
}
|
|
|
|
/// Get the appropriate client for a given rule's TLS mode.
|
|
///
|
|
/// The effective TLS mode depends on both the global setting and the rule's preference:
|
|
/// - If global mode is `Off`, always use the lax client (no validation).
|
|
/// - If global mode is `Lax` and the rule declares `tls_mode: lax`, use lax client.
|
|
/// - Otherwise, use the strict client.
|
|
pub fn client_for_rule(&self, rule_tls_mode: Option<kingfisher_rules::TlsMode>) -> &Client {
|
|
match self.global_mode {
|
|
TlsMode::Off => &self.lax,
|
|
TlsMode::Lax => {
|
|
// Convert rule's TlsMode to CLI TlsMode for comparison
|
|
let rule_wants_lax = matches!(rule_tls_mode, Some(kingfisher_rules::TlsMode::Lax));
|
|
if rule_wants_lax {
|
|
&self.lax
|
|
} else {
|
|
&self.strict
|
|
}
|
|
}
|
|
TlsMode::Strict => &self.strict,
|
|
}
|
|
}
|
|
|
|
/// Check if lax TLS should be used for a rule.
|
|
///
|
|
/// This is useful for non-HTTP validators (Postgres, MySQL, etc.) that need to
|
|
/// configure their own TLS settings.
|
|
pub fn should_use_lax(&self, rule_tls_mode: Option<kingfisher_rules::TlsMode>) -> bool {
|
|
match self.global_mode {
|
|
TlsMode::Off => true,
|
|
TlsMode::Lax => matches!(rule_tls_mode, Some(kingfisher_rules::TlsMode::Lax)),
|
|
TlsMode::Strict => false,
|
|
}
|
|
}
|
|
}
|
|
|
|
// Use SkipMap-based cache instead of a mutex-wrapped FxHashMap.
|
|
type Cache = kingfisher_scanner::validation::Cache;
|
|
|
|
/// Returns an opaque 64-bit key for internal validation deduplication.
|
|
///
|
|
/// This is an INTERNAL key used only for validation deduplication within a single scan.
|
|
/// It uses `captures.get(0)` to get the primary secret value.
|
|
///
|
|
/// **Important**: This is distinct from the EXTERNAL `finding_fingerprint` used for:
|
|
/// - Baseline comparisons across scans
|
|
/// - Deduplication entries in external systems
|
|
/// - Reporting output
|
|
///
|
|
/// The external fingerprint uses `get(1).or_else(get(0))` for backward compatibility
|
|
/// and must remain stable. This internal key can evolve independently.
|
|
fn validation_dedup_key(m: &OwnedBlobMatch) -> u64 {
|
|
let mut hasher = xxhash_rust::xxh3::Xxh3::new();
|
|
m.rule.syntax().id.hash(&mut hasher);
|
|
|
|
// Use the first capture (primary secret) for deduplication.
|
|
// Note: capture_value is stored in a variable because it's also used in trace! below.
|
|
let capture_value = m.captures.captures.get(0).map(|c| c.raw_value());
|
|
if let Some(val) = capture_value {
|
|
val.hash(&mut hasher);
|
|
}
|
|
let key = hasher.finish();
|
|
|
|
trace!(
|
|
rule_id = %m.rule.syntax().id,
|
|
capture_value = ?capture_value,
|
|
validation_dedup_key = key,
|
|
"Computed internal validation dedup key"
|
|
);
|
|
|
|
key
|
|
}
|
|
|
|
static VALIDATION_CACHE: OnceCell<DashMap<u64, CachedResponse>> = OnceCell::new();
|
|
static IN_FLIGHT: OnceCell<DashMap<u64, Arc<Notify>>> = OnceCell::new();
|
|
|
|
/// Call this once near program start (e.g. in `main()`)
|
|
pub fn init_validation_caches() {
|
|
VALIDATION_CACHE.set(DashMap::new()).ok();
|
|
IN_FLIGHT.set(DashMap::new()).ok();
|
|
aws::set_aws_validation_concurrency(15);
|
|
}
|
|
|
|
pub fn set_skip_aws_account_ids<I, S>(ids: I)
|
|
where
|
|
I: IntoIterator<Item = S>,
|
|
S: Into<String>,
|
|
{
|
|
aws::set_aws_skip_account_ids(ids);
|
|
}
|
|
|
|
/// Returns `true` if the provided string can be parsed as a MongoDB connection URI.
|
|
pub fn is_parseable_mongodb_uri(uri: &str) -> bool {
|
|
mongodb::looks_like_mongodb_uri(uri)
|
|
}
|
|
|
|
/// Returns `true` if the provided string can be parsed as a Postgres connection URI.
|
|
pub fn is_parseable_postgres_uri(uri: &str) -> bool {
|
|
postgres::parse_postgres_url(uri).is_ok()
|
|
}
|
|
|
|
/// Returns `true` if the provided string can be parsed as a MySQL connection URI.
|
|
pub fn is_parseable_mysql_uri(uri: &str) -> bool {
|
|
mysql::parse_mysql_url(uri).is_ok()
|
|
}
|
|
|
|
/// Collect dependent variables and missing dependencies from the provided matches.
|
|
pub fn collect_variables_and_dependencies(
|
|
matches: &[OwnedBlobMatch],
|
|
) -> (FxHashMap<String, Vec<(String, OffsetSpan)>>, FxHashMap<String, Vec<String>>) {
|
|
let mut variable_map: FxHashMap<String, Vec<(String, OffsetSpan)>> = FxHashMap::default();
|
|
let mut missing_deps: FxHashMap<String, Vec<String>> = FxHashMap::default();
|
|
|
|
for m in matches {
|
|
let rule_id = m.rule.syntax().id.clone();
|
|
for dependency in m.rule.syntax().depends_on_rule.iter().flatten() {
|
|
let dependency_rule_id = &dependency.rule_id;
|
|
// Use iterator adapter to get all matching dependencies.
|
|
let matching_dependencies: Vec<_> =
|
|
matches.iter().filter(|x| x.rule.syntax().id == *dependency_rule_id).collect();
|
|
|
|
if !matching_dependencies.is_empty() {
|
|
for other_match in matching_dependencies {
|
|
// VALIDATION: Use get(0) for the primary capture value when collecting
|
|
// dependent variables. This ensures we get the main captured value rather
|
|
// than inner unnamed groups from nested captures like (?<REGEX>...(ABC)...).
|
|
//
|
|
// Note: This differs from fingerprint/reporting code which uses
|
|
// get(1).or_else(get(0)) for backward compatibility.
|
|
let matching_input = other_match
|
|
.captures
|
|
.captures
|
|
.get(0)
|
|
.expect("Expected at least one capture");
|
|
variable_map
|
|
.entry(dependency.variable.to_uppercase())
|
|
.or_insert_with(Vec::new)
|
|
.push((
|
|
matching_input.raw_value().to_string(),
|
|
other_match.matching_input_offset_span,
|
|
));
|
|
}
|
|
} else {
|
|
missing_deps.entry(rule_id.clone()).or_default().push(dependency.rule_id.clone());
|
|
}
|
|
}
|
|
}
|
|
(variable_map, missing_deps)
|
|
}
|
|
|
|
/// Render a template and parse the resulting string as a URL.
|
|
async fn render_and_parse_url(
|
|
parser: &liquid::Parser,
|
|
globals: &liquid::Object,
|
|
rule_name: &str,
|
|
template_url: &str,
|
|
allow_internal_ips: bool,
|
|
) -> Result<Url, String> {
|
|
let rendered_url_str =
|
|
render_template(parser, globals, rule_name, template_url).await.map_err(|e| {
|
|
let error_msg = format!("Error rendering URL template: <{}> {}", rule_name, e);
|
|
debug!("{}", error_msg);
|
|
error_msg
|
|
})?;
|
|
|
|
let url = Url::parse(&rendered_url_str).map_err(|e| {
|
|
let error_msg = format!("Error parsing rendered URL: {}", e);
|
|
debug!("{}", error_msg);
|
|
error_msg
|
|
})?;
|
|
|
|
// Check if the URL is resolvable (with SSRF protection).
|
|
utils::check_url_resolvable(&url, allow_internal_ips).await.map_err(|e| {
|
|
let error_msg = format!("URL <{}> resolution failed: {}", &url, e);
|
|
error_msg
|
|
})?;
|
|
|
|
Ok(url)
|
|
}
|
|
|
|
/// Render a template string using Liquid.
|
|
async fn render_template(
|
|
parser: &liquid::Parser,
|
|
globals: &liquid::Object,
|
|
rule_name: &str,
|
|
template_str: &str,
|
|
) -> Result<String, String> {
|
|
parser
|
|
.parse(template_str)
|
|
.map_err(|e| {
|
|
let msg = format!("Error parsing template for rule <{}>: {}", rule_name, e);
|
|
debug!("{}", msg);
|
|
msg
|
|
})
|
|
.and_then(|template| {
|
|
template.render(globals).map_err(|e| {
|
|
let msg = format!("Error rendering template for rule <{}>: {}", rule_name, e);
|
|
debug!("{}", msg);
|
|
msg
|
|
})
|
|
})
|
|
}
|
|
|
|
/// Validate a single match with a configurable timeout.
|
|
pub async fn validate_single_match(
|
|
m: &mut OwnedBlobMatch,
|
|
parser: &liquid::Parser,
|
|
clients: &ValidationClients,
|
|
dependent_variables: &FxHashMap<String, Vec<(String, OffsetSpan)>>,
|
|
missing_dependencies: &FxHashMap<String, Vec<String>>,
|
|
cache: &Cache,
|
|
validation_timeout: Duration,
|
|
validation_retries: u32,
|
|
rate_limiter: Option<&crate::validation_rate_limit::ValidationRateLimiter>,
|
|
max_body_len: usize,
|
|
) {
|
|
let fp = validation_dedup_key(m);
|
|
let timeout_result = time::timeout(validation_timeout, async {
|
|
timed_validate_single_match(
|
|
m,
|
|
parser,
|
|
clients,
|
|
dependent_variables,
|
|
missing_dependencies,
|
|
cache,
|
|
validation_timeout,
|
|
validation_retries,
|
|
rate_limiter,
|
|
max_body_len,
|
|
)
|
|
.await
|
|
})
|
|
.await;
|
|
|
|
if timeout_result.is_err() {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"Validation timed out after {} seconds",
|
|
validation_timeout.as_secs()
|
|
));
|
|
m.validation_response_status = StatusCode::REQUEST_TIMEOUT;
|
|
|
|
VALIDATION_CACHE.get_or_init(DashMap::new).insert(
|
|
fp,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: false,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
|
|
if let Some((_, notify)) = IN_FLIGHT.get_or_init(DashMap::new).remove(&fp) {
|
|
notify.notify_waiters();
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Perform the actual validation of a match.
|
|
/// Guarantees that each <RULE-ID>|<secret> is validated only once per process,
|
|
/// even when `--no-dedup` is used.
|
|
async fn timed_validate_single_match<'a>(
|
|
m: &mut OwnedBlobMatch,
|
|
parser: &liquid::Parser,
|
|
clients: &ValidationClients,
|
|
dependent_variables: &FxHashMap<String, Vec<(String, OffsetSpan)>>,
|
|
missing_dependencies: &FxHashMap<String, Vec<String>>,
|
|
cache: &Cache,
|
|
validation_timeout: Duration,
|
|
validation_retries: u32,
|
|
rate_limiter: Option<&crate::validation_rate_limit::ValidationRateLimiter>,
|
|
max_body_len: usize,
|
|
) {
|
|
// Select the appropriate HTTP client based on rule's TLS mode preference
|
|
let rule_tls_mode = m.rule.tls_mode();
|
|
let client = clients.client_for_rule(rule_tls_mode);
|
|
let use_lax_tls = clients.should_use_lax(rule_tls_mode);
|
|
// ──────────────────────────────────────────────────────────
|
|
// 1. process-wide fingerprint de-dup
|
|
// ──────────────────────────────────────────────────────────
|
|
let fp = validation_dedup_key(m);
|
|
|
|
if let Some(entry) = VALIDATION_CACHE.get_or_init(DashMap::new).get(&fp) {
|
|
if entry.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = entry.is_valid;
|
|
m.validation_response_body = entry.body.clone();
|
|
m.validation_response_status = entry.status;
|
|
return;
|
|
}
|
|
}
|
|
if let Some(wait) =
|
|
IN_FLIGHT.get_or_init(DashMap::new).get(&fp).map(|entry| entry.value().clone())
|
|
{
|
|
wait.notified().await;
|
|
if let Some(entry) = VALIDATION_CACHE.get().unwrap().get(&fp) {
|
|
m.validation_success = entry.is_valid;
|
|
m.validation_response_body = entry.body.clone();
|
|
m.validation_response_status = entry.status;
|
|
}
|
|
return;
|
|
}
|
|
let notify = Arc::new(Notify::new());
|
|
IN_FLIGHT.get().unwrap().insert(fp, notify.clone());
|
|
|
|
// helper to persist result + notify waiters
|
|
let commit_and_return = |m: &OwnedBlobMatch| {
|
|
VALIDATION_CACHE.get().unwrap().insert(
|
|
fp,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
IN_FLIGHT.get().unwrap().remove(&fp);
|
|
notify.notify_waiters();
|
|
};
|
|
// ──────────────────────────────────────────────────────────
|
|
|
|
// 2. dependency check
|
|
if let Some(missing) = missing_dependencies.get(&m.rule.syntax().id) {
|
|
if !missing.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"Validation skipped - missing dependent rules: {}",
|
|
missing.join(", ")
|
|
));
|
|
m.validation_response_status = StatusCode::PRECONDITION_REQUIRED;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
|
|
// 3. capture processing
|
|
let match_re_result = m.rule.syntax().as_anchored_regex();
|
|
let mut captured_values: Vec<(String, String, usize, usize)> = match match_re_result {
|
|
Ok(_) => utils::process_captures(&m.captures),
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("Regex error: {}", e));
|
|
m.validation_response_status = StatusCode::INTERNAL_SERVER_ERROR;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
};
|
|
|
|
for dep in m.rule.syntax().depends_on_rule.iter().flatten() {
|
|
if let Some(vals) = dependent_variables.get(&dep.variable.to_uppercase()) {
|
|
for (val, span) in vals {
|
|
// Skip adding captured values for TOKEN dependencies
|
|
if dep.variable.eq_ignore_ascii_case("TOKEN") {
|
|
continue;
|
|
}
|
|
captured_values.push((
|
|
dep.variable.to_uppercase(),
|
|
val.clone(),
|
|
span.start,
|
|
span.end,
|
|
));
|
|
// Store the dependent capture for later use in reporting
|
|
// (e.g., generating validate/revoke commands)
|
|
m.dependent_captures.insert(dep.variable.to_uppercase(), val.clone());
|
|
}
|
|
}
|
|
}
|
|
|
|
let mut globals = Object::new();
|
|
populate_globals_from_captures(&mut globals, &captured_values);
|
|
|
|
// Persist named captures (non-TOKEN) for validate/revoke command generation.
|
|
// This is especially important for gRPC validators like Modal where TOKEN_ID is required.
|
|
for (k, v, ..) in &captured_values {
|
|
if k.eq_ignore_ascii_case("TOKEN") {
|
|
continue;
|
|
}
|
|
m.dependent_captures.entry(k.to_uppercase()).or_insert_with(|| v.clone());
|
|
}
|
|
|
|
let rule_syntax = m.rule.syntax();
|
|
|
|
if let (Some(limiter), Some(validation)) = (rate_limiter, rule_syntax.validation.as_ref()) {
|
|
if should_rate_limit_validation(validation) {
|
|
limiter.wait_for_rule(m.rule.id()).await;
|
|
}
|
|
}
|
|
|
|
// ──────────────────────────────────────────────────────────
|
|
// 4. validator switch
|
|
// ──────────────────────────────────────────────────────────
|
|
match &rule_syntax.validation {
|
|
// ---------------------------------------------------- HTTP validator
|
|
Some(Validation::Http(http_validation)) => {
|
|
let request_timeout = validation_timeout;
|
|
let multipart_timeout = validation_timeout;
|
|
let max_retries: u32 = validation_retries;
|
|
let request_globals = httpvalidation::with_request_template_globals(&globals);
|
|
// render URL
|
|
let url = match render_and_parse_url(
|
|
parser,
|
|
&request_globals,
|
|
&rule_syntax.name,
|
|
&http_validation.request.url,
|
|
clients.allow_internal_ips,
|
|
)
|
|
.await
|
|
{
|
|
Ok(u) => u,
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(e);
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
};
|
|
|
|
// build request builder
|
|
let request_builder = match httpvalidation::build_request_builder(
|
|
client,
|
|
&http_validation.request.method,
|
|
&url,
|
|
&http_validation.request.headers,
|
|
&http_validation.request.body,
|
|
request_timeout,
|
|
parser,
|
|
&request_globals,
|
|
) {
|
|
Ok(rb) => rb,
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(e);
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
};
|
|
|
|
let is_multipart = http_validation.request.multipart.is_some();
|
|
let mut cache_key = String::new();
|
|
|
|
// old per-request cache (optional)
|
|
if !is_multipart {
|
|
let rendered_headers = httpvalidation::process_headers(
|
|
&http_validation.request.headers,
|
|
parser,
|
|
&request_globals,
|
|
&url,
|
|
)
|
|
.unwrap_or_default();
|
|
|
|
let mut header_map = BTreeMap::new();
|
|
for (name, value) in rendered_headers.iter() {
|
|
if let Ok(v) = value.to_str() {
|
|
header_map.insert(name.as_str().to_string(), v.to_string());
|
|
}
|
|
}
|
|
|
|
// Render the body template to include in cache key
|
|
let rendered_body =
|
|
http_validation.request.body.as_ref().and_then(|body_template| {
|
|
parser
|
|
.parse(body_template)
|
|
.ok()
|
|
.and_then(|template| template.render(&request_globals).ok())
|
|
});
|
|
|
|
cache_key = httpvalidation::generate_http_cache_key_parts(
|
|
http_validation.request.method.as_str(),
|
|
&url,
|
|
&header_map,
|
|
rendered_body.as_deref(),
|
|
);
|
|
if let Some(cached) = cache.get(&cache_key) {
|
|
let c = cached.value();
|
|
if c.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = c.is_valid;
|
|
m.validation_response_body = c.body.clone();
|
|
m.validation_response_status = c.status;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
|
|
// helper to execute single non-multipart request with retry
|
|
let exec_single = |builder: reqwest::RequestBuilder| async {
|
|
httpvalidation::retry_request(
|
|
builder,
|
|
max_retries,
|
|
Duration::from_millis(500),
|
|
Duration::from_secs(2),
|
|
)
|
|
.await
|
|
};
|
|
|
|
// run request (multipart vs non-multipart)
|
|
let resp_res = if is_multipart {
|
|
// build multipart request each retry
|
|
let build_request = || async {
|
|
let method = httpvalidation::parse_http_method(&http_validation.request.method)
|
|
.unwrap_or(reqwest::Method::GET);
|
|
|
|
let mut fresh_builder =
|
|
client.request(method, url.clone()).timeout(multipart_timeout);
|
|
|
|
if let Ok(mut headers) = httpvalidation::process_headers(
|
|
&http_validation.request.headers,
|
|
parser,
|
|
&request_globals,
|
|
&url,
|
|
) {
|
|
// add realistic UA & accept headers
|
|
let std_headers = [
|
|
(header::USER_AGENT, GLOBAL_USER_AGENT.as_str()),
|
|
(header::ACCEPT , "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"),
|
|
(header::ACCEPT_LANGUAGE, "en-US,en;q=0.5"),
|
|
(header::ACCEPT_ENCODING, "gzip, deflate, br"),
|
|
(header::CONNECTION, "keep-alive"),
|
|
];
|
|
for (hn, hv) in &std_headers {
|
|
if let Ok(v) = HeaderValue::from_str(hv) {
|
|
headers.insert(hn.clone(), v);
|
|
}
|
|
}
|
|
fresh_builder = fresh_builder.headers(headers);
|
|
}
|
|
|
|
// build multipart form
|
|
let mut form = multipart::Form::new();
|
|
for part in http_validation.request.multipart.as_ref().unwrap().parts.iter() {
|
|
match part.part_type.as_str() {
|
|
"file" => {
|
|
let path = render_template(
|
|
parser,
|
|
&request_globals,
|
|
&rule_syntax.name,
|
|
&part.content,
|
|
)
|
|
.await
|
|
.unwrap_or_default();
|
|
let bytes = fs::read(path).unwrap_or_default();
|
|
let p = multipart::Part::bytes(bytes)
|
|
.mime_str(
|
|
part.content_type
|
|
.as_deref()
|
|
.unwrap_or("application/octet-stream"),
|
|
)
|
|
.unwrap_or_else(|_| multipart::Part::text("invalid"));
|
|
form = form.part(part.name.clone(), p);
|
|
}
|
|
"text" => {
|
|
let txt = render_template(
|
|
parser,
|
|
&request_globals,
|
|
&rule_syntax.name,
|
|
&part.content,
|
|
)
|
|
.await
|
|
.unwrap_or_default();
|
|
let p = multipart::Part::text(txt)
|
|
.mime_str(part.content_type.as_deref().unwrap_or("text/plain"))
|
|
.unwrap_or_else(|_| multipart::Part::text("invalid"));
|
|
form = form.part(part.name.clone(), p);
|
|
}
|
|
_ => { /* ignore */ }
|
|
}
|
|
}
|
|
fresh_builder.multipart(form)
|
|
};
|
|
|
|
httpvalidation::retry_multipart_request(
|
|
build_request,
|
|
max_retries as usize,
|
|
Duration::from_millis(500),
|
|
Duration::from_secs(2),
|
|
)
|
|
.await
|
|
} else {
|
|
exec_single(request_builder).await
|
|
};
|
|
|
|
// handle result
|
|
match resp_res {
|
|
Ok(resp) => {
|
|
let status = resp.status();
|
|
let headers = resp.headers().clone();
|
|
let body = match resp.text().await {
|
|
Ok(b) => b,
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"Error reading response: {}",
|
|
e
|
|
));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
};
|
|
let display_body = truncate_preview(&body, max_body_len);
|
|
|
|
m.validation_response_status = status;
|
|
let body_opt = validation_body::from_string(display_body.clone());
|
|
m.validation_response_body = body_opt.clone();
|
|
let matchers = match http_validation.request.response_matcher.as_ref() {
|
|
Some(m) => m,
|
|
None => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"HTTP validation for rule '{}' is missing `response_matcher`",
|
|
rule_syntax.name
|
|
));
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
};
|
|
|
|
m.validation_success = httpvalidation::validate_response(
|
|
matchers,
|
|
&body,
|
|
&status,
|
|
&headers,
|
|
http_validation.request.response_is_html,
|
|
);
|
|
|
|
// Avoid poisoning the cache with transient failures (rate limits, 5xx, etc).
|
|
let cacheable_status = !(status.is_server_error()
|
|
|| status == StatusCode::TOO_MANY_REQUESTS
|
|
|| status == StatusCode::REQUEST_TIMEOUT);
|
|
if !is_multipart && !cache_key.is_empty() && cacheable_status {
|
|
cache.insert(
|
|
cache_key,
|
|
CachedResponse {
|
|
body: body_opt,
|
|
status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
}
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("HTTP error: {:?}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------- gRPC validator
|
|
Some(Validation::Grpc(grpc_validation_cfg)) => {
|
|
let request_timeout = validation_timeout;
|
|
let request_globals = httpvalidation::with_request_template_globals(&globals);
|
|
|
|
// Render URL
|
|
let url = match render_and_parse_url(
|
|
parser,
|
|
&request_globals,
|
|
&rule_syntax.name,
|
|
&grpc_validation_cfg.request.url,
|
|
clients.allow_internal_ips,
|
|
)
|
|
.await
|
|
{
|
|
Ok(u) => u,
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(e);
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
};
|
|
|
|
// Execute gRPC unary call (HTTP/2 + trailers).
|
|
let res = match grpc_validation::grpc_unary_call_from_rule(
|
|
&url,
|
|
&grpc_validation_cfg.request.headers,
|
|
&grpc_validation_cfg.request.body,
|
|
parser,
|
|
&request_globals,
|
|
request_timeout,
|
|
)
|
|
.await
|
|
{
|
|
Ok(r) => r,
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("gRPC error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
};
|
|
|
|
let status = StatusCode::from_u16(res.http_status.as_u16()).unwrap_or(StatusCode::OK);
|
|
let headers = res.headers;
|
|
let mut body = String::from_utf8_lossy(&res.body_bytes).to_string();
|
|
|
|
// gRPC errors are typically reported in trailers, not the body.
|
|
// Surface them for debugging and for `--full-validation-response` output.
|
|
let grpc_status =
|
|
headers.get("grpc-status").and_then(|v| v.to_str().ok()).unwrap_or("").to_string();
|
|
let grpc_message =
|
|
headers.get("grpc-message").and_then(|v| v.to_str().ok()).unwrap_or("").to_string();
|
|
// Avoid storing raw protobuf bytes in the report (they often contain NULs and make
|
|
// output logs non-UTF8). Prefer a compact status/message string.
|
|
if grpc_status == "0" {
|
|
body = "grpc-status=0".to_string();
|
|
} else if body.trim().is_empty()
|
|
&& (!grpc_status.is_empty() || !grpc_message.is_empty())
|
|
{
|
|
body = format!("grpc-status={grpc_status} grpc-message={grpc_message}");
|
|
} else if body.as_bytes().contains(&0) {
|
|
body = format!("grpc-status={grpc_status} grpc-message={grpc_message}");
|
|
}
|
|
if max_body_len > 0 {
|
|
truncate_to_char_boundary(&mut body, max_body_len);
|
|
}
|
|
|
|
m.validation_response_status = status;
|
|
m.validation_response_body = validation_body::from_string(body.clone());
|
|
|
|
let matchers = match grpc_validation_cfg.request.response_matcher.as_ref() {
|
|
Some(m) => m,
|
|
None => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"gRPC validation for rule '{}' is missing `response_matcher`",
|
|
rule_syntax.name
|
|
));
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
};
|
|
|
|
m.validation_success =
|
|
httpvalidation::validate_response(matchers, &body, &status, &headers, false);
|
|
}
|
|
|
|
// ---------------------------------------------------- MongoDB validator
|
|
Some(Validation::MongoDB) => {
|
|
let uri = globals
|
|
.get("TOKEN")
|
|
.and_then(|v| v.as_scalar())
|
|
.map(|s| s.into_owned().to_kstr().to_string())
|
|
.unwrap_or_default();
|
|
|
|
if uri.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string("MongoDB URI not found.".to_string());
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
let cache_key = mongodb::generate_mongodb_cache_key(&uri);
|
|
if let Some(cached) = cache.get(&cache_key) {
|
|
let c = cached.value();
|
|
if c.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = c.is_valid;
|
|
m.validation_response_body = c.body.clone();
|
|
m.validation_response_status = c.status;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
|
|
match mongodb::validate_mongodb(&uri, use_lax_tls).await {
|
|
Ok((ok, msg)) => {
|
|
m.validation_success = ok;
|
|
m.validation_response_body = validation_body::from_string(msg);
|
|
m.validation_response_status =
|
|
if ok { StatusCode::OK } else { StatusCode::UNAUTHORIZED };
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("MongoDB validation error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------- MySQL validator
|
|
Some(Validation::MySQL) => {
|
|
let mysql_url = globals
|
|
.get("TOKEN")
|
|
.and_then(|v| v.as_scalar())
|
|
.map(|s| s.into_owned().to_kstr().to_string())
|
|
.unwrap_or_default();
|
|
|
|
if mysql_url.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string("MySQL URL not found.".to_string());
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
let cache_key = mysql::generate_mysql_cache_key(&mysql_url);
|
|
if let Some(cached) = cache.get(&cache_key) {
|
|
let c = cached.value();
|
|
if c.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = c.is_valid;
|
|
m.validation_response_body = c.body.clone();
|
|
m.validation_response_status = c.status;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
|
|
match mysql::validate_mysql(&mysql_url, use_lax_tls).await {
|
|
Ok((ok, meta)) => {
|
|
m.validation_success = ok;
|
|
m.validation_response_body = validation_body::from_string(if ok {
|
|
format!("MySQL connection is valid. Metadata: {:?}", meta)
|
|
} else {
|
|
"MySQL connection failed.".to_string()
|
|
});
|
|
m.validation_response_status =
|
|
if ok { StatusCode::OK } else { StatusCode::UNAUTHORIZED };
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("MySQL error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
|
|
cache.insert(
|
|
cache_key,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
}
|
|
|
|
// ------------------------------------------------ Azure Storage validator
|
|
Some(Validation::AzureStorage) => {
|
|
let storage_key = captured_values
|
|
.iter()
|
|
.find(|(n, ..)| n == "TOKEN")
|
|
.map(|(_, v, ..)| v.clone())
|
|
.unwrap_or_default();
|
|
let storage_account =
|
|
utils::find_closest_variable(&captured_values, &storage_key, "TOKEN", "AZURENAME")
|
|
.unwrap_or_default();
|
|
|
|
if storage_account.is_empty() || storage_key.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(
|
|
"Missing Azure Storage account or key.".to_string(),
|
|
);
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
let creds_json = format!(
|
|
r#"{{"storage_account":"{}","storage_key":"{}"}}"#,
|
|
storage_account, storage_key
|
|
);
|
|
let cache_key = azure::generate_azure_cache_key(&creds_json);
|
|
|
|
if let Some(cached) = cache.get(&cache_key) {
|
|
let c = cached.value();
|
|
if c.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = c.is_valid;
|
|
m.validation_response_body = c.body.clone();
|
|
m.validation_response_status = c.status;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
|
|
match azure::validate_azure_storage_credentials(&creds_json, cache).await {
|
|
Ok((ok, msg)) => {
|
|
m.validation_success = ok;
|
|
m.validation_response_body = msg;
|
|
m.validation_response_status =
|
|
if ok { StatusCode::OK } else { StatusCode::UNAUTHORIZED };
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("Azure Storage error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
cache.insert(
|
|
cache_key,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
}
|
|
|
|
// ---------------------------------------------------- JDBC validator
|
|
Some(Validation::Jdbc) => {
|
|
let jdbc_conn = captured_values
|
|
.iter()
|
|
.find(|(n, ..)| n == "TOKEN")
|
|
.map(|(_, v, ..)| v.clone())
|
|
.unwrap_or_default();
|
|
|
|
if jdbc_conn.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string("JDBC connection string not found.".to_string());
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
let cache_key = jdbc::generate_jdbc_cache_key(&jdbc_conn);
|
|
if let Some(cached) = cache.get(&cache_key) {
|
|
let c = cached.value();
|
|
if c.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = c.is_valid;
|
|
m.validation_response_body = c.body.clone();
|
|
m.validation_response_status = c.status;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
|
|
match jdbc::validate_jdbc(&jdbc_conn, use_lax_tls).await {
|
|
Ok(outcome) => {
|
|
m.validation_success = outcome.valid;
|
|
m.validation_response_body = validation_body::from_string(outcome.message);
|
|
m.validation_response_status = outcome.status;
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("JDBC validation error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
|
|
cache.insert(
|
|
cache_key,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
}
|
|
|
|
// ------------------------------------------------ Postgres validator
|
|
Some(Validation::Postgres) => {
|
|
let pg_url = globals
|
|
.get("TOKEN")
|
|
.and_then(|v| v.as_scalar())
|
|
.map(|s| s.into_owned().to_kstr().to_string())
|
|
.unwrap_or_default();
|
|
|
|
if pg_url.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string("Postgres URL not found.".to_string());
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
let cache_key = postgres::generate_postgres_cache_key(&pg_url);
|
|
if let Some(cached) = cache.get(&cache_key) {
|
|
let c = cached.value();
|
|
if c.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = c.is_valid;
|
|
m.validation_response_body = c.body.clone();
|
|
m.validation_response_status = c.status;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
|
|
match postgres::validate_postgres(&pg_url, use_lax_tls).await {
|
|
Ok((ok, meta)) => {
|
|
m.validation_success = ok;
|
|
m.validation_response_body = validation_body::from_string(if ok {
|
|
format!("Postgres connection is valid. Metadata: {:?}", meta)
|
|
} else {
|
|
"Postgres connection failed.".to_string()
|
|
});
|
|
m.validation_response_status =
|
|
if ok { StatusCode::OK } else { StatusCode::UNAUTHORIZED };
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("Postgres error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
cache.insert(
|
|
cache_key,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
}
|
|
// ---------------------------------------------------- JWT validator
|
|
Some(Validation::JWT) => {
|
|
let token = captured_values
|
|
.iter()
|
|
.find(|(n, ..)| n == "TOKEN")
|
|
.map(|(_, v, ..)| v.clone())
|
|
.unwrap_or_default();
|
|
|
|
if token.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string("JWT token not found.".to_string());
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
match jwt::validate_jwt(&token, use_lax_tls, clients.allow_internal_ips).await {
|
|
Ok((ok, msg)) => {
|
|
m.validation_success = ok;
|
|
m.validation_response_body = validation_body::from_string(msg);
|
|
m.validation_response_status =
|
|
if ok { StatusCode::OK } else { StatusCode::UNAUTHORIZED };
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("JWT validation error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
}
|
|
}
|
|
}
|
|
// ---------------------------------------------------- AWS validator
|
|
Some(Validation::AWS) => {
|
|
let secret = captured_values
|
|
.iter()
|
|
.find(|(n, ..)| n == "TOKEN")
|
|
.map(|(_, v, ..)| v.clone())
|
|
.unwrap_or_default();
|
|
let akid = utils::find_closest_variable(&captured_values, &secret, "TOKEN", "AKID")
|
|
.unwrap_or_default();
|
|
|
|
if akid.is_empty() || secret.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(
|
|
"Missing AWS access-key ID or secret.".to_string(),
|
|
);
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
let cache_key = aws::generate_aws_cache_key(&akid, &secret);
|
|
if let Some(cached) = cache.get(&cache_key) {
|
|
let c = cached.value();
|
|
if c.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = c.is_valid;
|
|
m.validation_response_body = c.body.clone();
|
|
m.validation_response_status = c.status;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
|
|
if let Some(account_id) = aws::should_skip_aws_validation(&akid) {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"(skip list entry) AWS validation not attempted for account {}.",
|
|
account_id
|
|
));
|
|
m.validation_response_status = StatusCode::PRECONDITION_REQUIRED;
|
|
cache.insert(
|
|
cache_key,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
if let Err(e) = aws::validate_aws_credentials_input(&akid, &secret) {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"Invalid AWS credentials ({}): {}",
|
|
akid, e
|
|
));
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
match aws::validate_aws_credentials(&akid, &secret).await {
|
|
Ok((ok, msg)) => {
|
|
m.validation_success = ok;
|
|
if ok {
|
|
let mut body = format!("{} --- ARN: {}", akid, msg);
|
|
if let Ok(acct) = aws::aws_key_to_account_number(&akid) {
|
|
body.push_str(&format!(" --- AWS Account Number: {:012}", acct));
|
|
}
|
|
m.validation_response_body = validation_body::from_string(body);
|
|
m.validation_response_status = StatusCode::OK;
|
|
} else {
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"AWS validation error ({}): {}",
|
|
akid, msg
|
|
));
|
|
m.validation_response_status = StatusCode::UNAUTHORIZED;
|
|
}
|
|
cache.insert(
|
|
cache_key,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"AWS validation error ({}): {}",
|
|
akid, e
|
|
));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
}
|
|
|
|
// ----------------------------------------------------- GCP validator
|
|
Some(Validation::GCP) => {
|
|
let gcp_json = globals
|
|
.get("TOKEN")
|
|
.and_then(|v| v.as_scalar())
|
|
.map(|s| s.into_owned().to_kstr().to_string())
|
|
.unwrap_or_default();
|
|
|
|
if gcp_json.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string("GCP JSON not found.".to_string());
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
let cache_key = gcp::generate_gcp_cache_key(&gcp_json);
|
|
if let Some(cached) = cache.get(&cache_key) {
|
|
let c = cached.value();
|
|
if c.timestamp.elapsed() < Duration::from_secs(VALIDATION_CACHE_SECONDS) {
|
|
m.validation_success = c.is_valid;
|
|
m.validation_response_body = c.body.clone();
|
|
m.validation_response_status = c.status;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
}
|
|
|
|
match gcp::GcpValidator::global() {
|
|
Ok(validator) => {
|
|
match validator.validate_gcp_credentials(&gcp_json.as_bytes()).await {
|
|
Ok((ok, meta)) => {
|
|
m.validation_success = ok;
|
|
m.validation_response_body =
|
|
validation_body::from_string(meta.join("\n"));
|
|
m.validation_response_status =
|
|
if ok { StatusCode::OK } else { StatusCode::UNAUTHORIZED };
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"GCP validation error: {}",
|
|
e
|
|
));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body = validation_body::from_string(format!(
|
|
"Failed to create GCP validator: {}",
|
|
e
|
|
));
|
|
m.validation_response_status = StatusCode::INTERNAL_SERVER_ERROR;
|
|
}
|
|
}
|
|
cache.insert(
|
|
cache_key,
|
|
CachedResponse {
|
|
body: m.validation_response_body.clone(),
|
|
status: m.validation_response_status,
|
|
is_valid: m.validation_success,
|
|
timestamp: Instant::now(),
|
|
},
|
|
);
|
|
}
|
|
// ----------------------------------------------------- Coinbase validator
|
|
Some(Validation::Coinbase) => {
|
|
let cred_name = globals
|
|
.get("CRED_NAME")
|
|
.and_then(|v| v.as_scalar())
|
|
.map(|s| s.into_owned().to_kstr().to_string())
|
|
.unwrap_or_default();
|
|
let private_key = globals
|
|
.get("PRIVATE_KEY")
|
|
.and_then(|v| v.as_scalar())
|
|
.map(|s| s.into_owned().to_kstr().to_string())
|
|
.unwrap_or_default();
|
|
|
|
if cred_name.is_empty() || private_key.is_empty() {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string("Missing key name or private key.".to_string());
|
|
m.validation_response_status = StatusCode::BAD_REQUEST;
|
|
commit_and_return(m);
|
|
return;
|
|
}
|
|
|
|
match coinbase::validate_cdp_api_key(&cred_name, &private_key, client, parser, cache)
|
|
.await
|
|
{
|
|
Ok((ok, msg)) => {
|
|
m.validation_success = ok;
|
|
m.validation_response_body = msg;
|
|
m.validation_response_status =
|
|
if ok { StatusCode::OK } else { StatusCode::UNAUTHORIZED };
|
|
}
|
|
Err(e) => {
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("Coinbase validation error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
}
|
|
// --------------------------------------------------------- Raw / none
|
|
Some(Validation::Raw(raw)) => {
|
|
match kingfisher_scanner::validation::raw::validate_raw(
|
|
raw,
|
|
&globals,
|
|
client,
|
|
clients.should_use_lax(rule_syntax.tls_mode),
|
|
clients.allow_internal_ips,
|
|
)
|
|
.await
|
|
{
|
|
Ok(result) => {
|
|
m.validation_success = result.valid;
|
|
m.validation_response_body = validation_body::from_string(result.body);
|
|
m.validation_response_status = result.status;
|
|
}
|
|
Err(e) => {
|
|
debug!("Raw validation error for {}: {}", raw, e);
|
|
m.validation_success = false;
|
|
m.validation_response_body =
|
|
validation_body::from_string(format!("Raw validation error: {}", e));
|
|
m.validation_response_status = StatusCode::BAD_GATEWAY;
|
|
}
|
|
}
|
|
}
|
|
None => { /* no validation specified */ }
|
|
}
|
|
|
|
// 5. persist result for success path
|
|
commit_and_return(m);
|
|
}
|
|
|
|
fn populate_globals_from_captures(
|
|
globals: &mut Object,
|
|
captured_values: &[(String, String, usize, usize)],
|
|
) {
|
|
let mut best_token: Option<&String> = None;
|
|
|
|
for (k, v, ..) in captured_values {
|
|
if k.eq_ignore_ascii_case("TOKEN") {
|
|
if best_token.map_or(true, |best| v.len() >= best.len()) {
|
|
best_token = Some(v);
|
|
}
|
|
} else {
|
|
globals.insert(k.to_uppercase().into(), Value::scalar(v.clone()));
|
|
}
|
|
}
|
|
|
|
if let Some(token) = best_token {
|
|
globals.insert("TOKEN".into(), Value::scalar(token.clone()));
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn populate_globals_prefers_longest_token() {
|
|
let captured_values = vec![
|
|
("TOKEN".to_string(), "short".to_string(), 0usize, 5usize),
|
|
("BODY".to_string(), "body".to_string(), 0usize, 4usize),
|
|
("TOKEN".to_string(), "longervalue".to_string(), 0usize, 11usize),
|
|
];
|
|
|
|
let mut globals = Object::new();
|
|
populate_globals_from_captures(&mut globals, &captured_values);
|
|
|
|
assert_eq!(globals.get("TOKEN"), Some(Value::scalar("longervalue")).as_ref());
|
|
assert_eq!(globals.get("BODY"), Some(Value::scalar("body")).as_ref());
|
|
}
|
|
|
|
#[test]
|
|
fn populate_globals_handles_missing_token() {
|
|
let captured_values = vec![("CHECKSUM".to_string(), "123456".to_string(), 0usize, 6usize)];
|
|
|
|
let mut globals = Object::new();
|
|
populate_globals_from_captures(&mut globals, &captured_values);
|
|
|
|
assert!(globals.get("TOKEN").is_none());
|
|
assert_eq!(globals.get("CHECKSUM"), Some(Value::scalar("123456")).as_ref());
|
|
}
|
|
|
|
#[test]
|
|
fn truncate_to_char_boundary_handles_multibyte_characters() {
|
|
let max_len = 2048;
|
|
let mut body = "a".repeat(max_len);
|
|
body.push('é');
|
|
|
|
truncate_to_char_boundary(&mut body, max_len);
|
|
|
|
assert_eq!(body.len(), max_len);
|
|
assert!(body.is_char_boundary(body.len()));
|
|
assert!(body.ends_with('a'));
|
|
}
|
|
|
|
#[test]
|
|
fn truncate_skipped_when_max_body_len_is_zero() {
|
|
let original_len = 4096;
|
|
let body = "x".repeat(original_len);
|
|
|
|
let preview = truncate_preview(&body, 0);
|
|
|
|
assert_eq!(preview.len(), original_len);
|
|
}
|
|
|
|
#[test]
|
|
fn truncate_applies_custom_max_body_len() {
|
|
let body = "y".repeat(5000);
|
|
|
|
let preview = truncate_preview(&body, 1024);
|
|
|
|
assert_eq!(preview.len(), 1024);
|
|
}
|
|
|
|
mod tls_mode_tests {
|
|
use super::*;
|
|
|
|
#[test]
|
|
fn validation_clients_new_creates_both_clients() {
|
|
let clients = ValidationClients::new(TlsMode::Strict, false).unwrap();
|
|
assert_eq!(clients.global_mode, TlsMode::Strict);
|
|
|
|
let clients_lax = ValidationClients::new(TlsMode::Lax, false).unwrap();
|
|
assert_eq!(clients_lax.global_mode, TlsMode::Lax);
|
|
|
|
let clients_off = ValidationClients::new(TlsMode::Off, false).unwrap();
|
|
assert_eq!(clients_off.global_mode, TlsMode::Off);
|
|
}
|
|
|
|
#[test]
|
|
fn client_for_rule_strict_mode_always_returns_strict_client() {
|
|
let clients = ValidationClients::new(TlsMode::Strict, false).unwrap();
|
|
|
|
// With no rule TLS mode
|
|
let client1 = clients.client_for_rule(None);
|
|
// With rule wanting lax
|
|
let client2 = clients.client_for_rule(Some(kingfisher_rules::TlsMode::Lax));
|
|
// With rule wanting strict
|
|
let client3 = clients.client_for_rule(Some(kingfisher_rules::TlsMode::Strict));
|
|
|
|
// In strict mode, all should return the same strict client
|
|
assert!(std::ptr::eq(client1, client2));
|
|
assert!(std::ptr::eq(client2, client3));
|
|
}
|
|
|
|
#[test]
|
|
fn client_for_rule_off_mode_always_returns_lax_client() {
|
|
let clients = ValidationClients::new(TlsMode::Off, false).unwrap();
|
|
|
|
// With no rule TLS mode
|
|
let client1 = clients.client_for_rule(None);
|
|
// With rule wanting lax
|
|
let client2 = clients.client_for_rule(Some(kingfisher_rules::TlsMode::Lax));
|
|
// With rule wanting strict
|
|
let client3 = clients.client_for_rule(Some(kingfisher_rules::TlsMode::Strict));
|
|
|
|
// In off mode, all should return the same lax client
|
|
assert!(std::ptr::eq(client1, client2));
|
|
assert!(std::ptr::eq(client2, client3));
|
|
}
|
|
|
|
#[test]
|
|
fn client_for_rule_lax_mode_respects_rule_preference() {
|
|
let clients = ValidationClients::new(TlsMode::Lax, false).unwrap();
|
|
|
|
// Get references to understand which is which
|
|
let strict_client = clients.client_for_rule(None);
|
|
let lax_client = clients.client_for_rule(Some(kingfisher_rules::TlsMode::Lax));
|
|
|
|
// When rule doesn't specify, should get strict
|
|
assert!(std::ptr::eq(clients.client_for_rule(None), strict_client));
|
|
|
|
// When rule wants strict, should get strict
|
|
assert!(std::ptr::eq(
|
|
clients.client_for_rule(Some(kingfisher_rules::TlsMode::Strict)),
|
|
strict_client
|
|
));
|
|
|
|
// When rule wants lax, should get lax
|
|
assert!(std::ptr::eq(
|
|
clients.client_for_rule(Some(kingfisher_rules::TlsMode::Lax)),
|
|
lax_client
|
|
));
|
|
|
|
// Strict and lax clients should be different
|
|
assert!(!std::ptr::eq(strict_client, lax_client));
|
|
}
|
|
|
|
#[test]
|
|
fn should_use_lax_off_mode_always_returns_true() {
|
|
let clients = ValidationClients::new(TlsMode::Off, false).unwrap();
|
|
|
|
assert!(clients.should_use_lax(None));
|
|
assert!(clients.should_use_lax(Some(kingfisher_rules::TlsMode::Strict)));
|
|
assert!(clients.should_use_lax(Some(kingfisher_rules::TlsMode::Lax)));
|
|
}
|
|
|
|
#[test]
|
|
fn should_use_lax_strict_mode_always_returns_false() {
|
|
let clients = ValidationClients::new(TlsMode::Strict, false).unwrap();
|
|
|
|
assert!(!clients.should_use_lax(None));
|
|
assert!(!clients.should_use_lax(Some(kingfisher_rules::TlsMode::Strict)));
|
|
assert!(!clients.should_use_lax(Some(kingfisher_rules::TlsMode::Lax)));
|
|
}
|
|
|
|
#[test]
|
|
fn should_use_lax_lax_mode_respects_rule_preference() {
|
|
let clients = ValidationClients::new(TlsMode::Lax, false).unwrap();
|
|
|
|
// Only true when rule explicitly opts in
|
|
assert!(!clients.should_use_lax(None));
|
|
assert!(!clients.should_use_lax(Some(kingfisher_rules::TlsMode::Strict)));
|
|
assert!(clients.should_use_lax(Some(kingfisher_rules::TlsMode::Lax)));
|
|
}
|
|
}
|
|
}
|
|
|
|
// #[cfg(test)]
|
|
// mod tests {
|
|
// use std::sync::Arc;
|
|
|
|
// use anyhow::Result;
|
|
// use crossbeam_skiplist::SkipMap;
|
|
// use http::StatusCode;
|
|
// use rustc_hash::FxHashMap;
|
|
// use smallvec::smallvec;
|
|
|
|
// use crate::{
|
|
// blob::BlobId,
|
|
// liquid_filters::register_all,
|
|
// location::OffsetSpan,
|
|
// matcher::{OwnedBlobMatch, SerializableCapture, SerializableCaptures},
|
|
// rules::{
|
|
// rule::{Confidence, Rule},
|
|
// Rules,
|
|
// },
|
|
// util::intern,
|
|
// validation::{validate_single_match, Cache},
|
|
// };
|
|
// #[tokio::test]
|
|
// async fn test_actual_pypi_token_validation() -> Result<()> {
|
|
// // Minimal PyPI YAML snippet for testing
|
|
// let pypi_yaml = r#"
|
|
// rules:
|
|
// - name: PyPI Upload Token
|
|
// id: kingfisher.pypi.1
|
|
// pattern: |
|
|
// (?x)
|
|
// \b
|
|
// (
|
|
// pypi-AgEIcHlwaS5vcmc[a-zA-Z0-9_-]{50,}
|
|
// )
|
|
// (?:[^a-zA-Z0-9_-]|$)
|
|
// min_entropy: 4.0
|
|
// confidence: medium
|
|
// examples:
|
|
// - '# password = pypi-AgEIcHlwaS5vcmcCJDkwNzYwNzU1LWMwOTUtNGNkOC1iYjQzLTU3OWNhZjI1NDQ1MwACJXsicGVybWCf99lvbnMiOiAidXNlciIsICJ2ZXJzaW9uIjogMX0AAAYgSpW5PAywXvchMUQnkF5H6-SolJysfUvIWopMsxE4hCM'
|
|
// - 'password: pypi-AgEIcHlwaS5vcmcCJGExMDIxZjRhLTFhZDMtNDc4YS1iOWNmLWQwCf99OTIwZjFjNwACSHsicGVybWlzc2lvbnMiOiB7InByb2plY3RzIjogWyJkamFuZ28tY2hhbm5lbHMtanNvbnJwYyJdfSwgInZlcnNpb24iOiAxfQAABiBZg48cIBQt7HckwM4G3q-462xphsLbm7IZvjqMS4jvQw'
|
|
// validation:
|
|
// type: Http
|
|
// content:
|
|
// request:
|
|
// method: POST
|
|
// url: https://upload.pypi.org/legacy/
|
|
// response_is_html: true
|
|
// response_matcher:
|
|
// - report_response: true
|
|
// - type: WordMatch
|
|
// words:
|
|
// - "isn't allowed to upload to project"
|
|
// headers:
|
|
// Authorization: 'Basic {{ "__token__:" | append: TOKEN | b64enc }}'
|
|
// multipart:
|
|
// parts:
|
|
// - name: name
|
|
// type: text
|
|
// content: "my-package"
|
|
// - name: version
|
|
// type: text
|
|
// content: "0.0.1"
|
|
// - name: filetype
|
|
// type: text
|
|
// content: "sdist"
|
|
// - name: metadata_version
|
|
// type: text
|
|
// content: "2.1"
|
|
// - name: summary
|
|
// type: text
|
|
// content: "A simple example package"
|
|
// - name: home_page
|
|
// type: text
|
|
// content: "https://github.com/yourusername/my_package"
|
|
// - name: sha256_digest
|
|
// type: text
|
|
// content: "0447379dd46c4ca8b8992bda56d07b358d015efb9300e6e16f224f4536e71d64"
|
|
// - name: md5_digest
|
|
// type: text
|
|
// content: "9b4036ab91a71124ab9f1d32a518e2bb"
|
|
// - name: :action
|
|
// type: text
|
|
// content: "file_upload"
|
|
// - name: protocol_version
|
|
// type: text
|
|
// content: "1"
|
|
// - name: content
|
|
// type: file
|
|
// content: "path/to/my_package-0.0.1.tar.gz"
|
|
// content_type: "application/octet-stream"
|
|
// "#;
|
|
// // Use from_paths_and_contents to parse the YAML snippet into a Rules object
|
|
// let data = vec![(std::path::Path::new("pypi_test.yaml"), pypi_yaml.as_bytes())];
|
|
// let rules = Rules::from_paths_and_contents(data, Confidence::Low)?;
|
|
// // Find the PyPI rule we just loaded
|
|
// let pypi_rule_syntax = rules
|
|
// .iter_rules()
|
|
// .find(|r| r.id == "kingfisher.pypi.1")
|
|
// .expect("Failed to find PyPI rule in test YAML")
|
|
// .clone(); // Clone so we can create a `Rule` from it
|
|
// // Wrap that into a `Rule` object
|
|
// let pypi_rule = Rule::new(pypi_rule_syntax);
|
|
// //////////////////////////////////////////
|
|
// //
|
|
// // Your actual PyPI token to test
|
|
// let token = "<enter_pypi_token_here>";
|
|
// let id = BlobId::new(&pypi_yaml.as_bytes());
|
|
// // Construct an `OwnedBlobMatch` (all fields needed):
|
|
// let mut owned_blob_match = OwnedBlobMatch {
|
|
// rule: pypi_rule.into(),
|
|
// blob_id: id,
|
|
// finding_fingerprint: 0, // dummy value
|
|
// // matching_input: token.as_bytes().to_vec(),
|
|
// matching_input_offset_span: OffsetSpan { start: 0, end: token.len() },
|
|
// captures: SerializableCaptures {
|
|
// captures: smallvec![SerializableCapture {
|
|
// name: Some("TOKEN".to_string()),
|
|
// match_number: -1,
|
|
// start: 0,
|
|
// end: token.len(),
|
|
// value: intern(token),
|
|
// }],
|
|
// },
|
|
// validation_response_body: String::new(),
|
|
// validation_response_status: StatusCode::OK,
|
|
// validation_success: false,
|
|
// calculated_entropy: 0.0, // or compute your own
|
|
// is_base64: false,
|
|
// };
|
|
// let parser = register_all(liquid::ParserBuilder::with_stdlib()).build()?;
|
|
// let client = reqwest::Client::new();
|
|
// let cache: Cache = Arc::new(SkipMap::new());
|
|
// let dependent_vars = FxHashMap::default();
|
|
// let missing_deps = FxHashMap::default();
|
|
// // Run the validation
|
|
// validate_single_match(
|
|
// &mut owned_blob_match,
|
|
// &parser,
|
|
// &client,
|
|
// &dependent_vars,
|
|
// &missing_deps,
|
|
// &cache,
|
|
// )
|
|
// .await;
|
|
// println!("Success? {:?}", owned_blob_match.validation_success);
|
|
// println!("Status: {:?}", owned_blob_match.validation_response_status);
|
|
// println!("Body: {:?}", owned_blob_match.validation_response_body);
|
|
// Ok(())
|
|
// }
|
|
// }
|