なぜ「会社案内だけのホームページ」が偽通販サイトに改造されるのか？
PHP・WordPress脆弱性（CVE-2024-4577等）の解剖と「静的分離」による根本対策

#![no_std]
#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum HttpEdgeVerdict {
    CleanRequest,
    BlockedCve2024_4577BestFitHyphen,
    BlockedCve2024_2961IconvFilterChain,
    BlockedLegacyCmsProbe,
}

/// Inspects raw URI query & path bytes in O(N) time at the Rust reverse-proxy edge
/// to block CVE-2024-4577 (0xAD / Best-Fit hyphen variants) and CVE-2024-2961 (php://filter iconv).
pub fn inspect_raw_uri_bytes(uri_bytes: &[u8]) -> HttpEdgeVerdict {
    // 1. Detect raw 0xAD or percent-encoded %AD / %ad / %u00ad in query string
    let mut i = 0;
    while i < uri_bytes.len() {
        let b = uri_bytes[i];
        if b == 0xAD {
            return HttpEdgeVerdict::BlockedCve2024_4577BestFitHyphen;
        }
        if b == b'%' && i + 2 < uri_bytes.len() {
            let h1 = uri_bytes[i + 1].to_ascii_uppercase();
            let h2 = uri_bytes[i + 2].to_ascii_uppercase();
            if h1 == b'A' && h2 == b'D' {
                return HttpEdgeVerdict::BlockedCve2024_4577BestFitHyphen;
            }
        }
        i += 1;
    }

    // 2. Case-insensitive substring scan for CVE-2024-2961 & legacy CMS probes
    if contains_ascii_case_insensitive(uri_bytes, b"convert.iconv")
        || contains_ascii_case_insensitive(uri_bytes, b"iso-2022-cn-ext")
        || contains_ascii_case_insensitive(uri_bytes, b"auto_prepend_file")
        || contains_ascii_case_insensitive(uri_bytes, b"allow_url_include")
    {
        return HttpEdgeVerdict::BlockedCve2024_2961IconvFilterChain;
    }

    if contains_ascii_case_insensitive(uri_bytes, b"xmlrpc.php")
        || contains_ascii_case_insensitive(uri_bytes, b"wp-config.php")
    {
        return HttpEdgeVerdict::BlockedLegacyCmsProbe;
    }

    HttpEdgeVerdict::CleanRequest
}

#[inline]
const fn to_lower(b: u8) -> u8 {
    if b >= b'A' && b <= b'Z' { b + 32 } else { b }
}

fn contains_ascii_case_insensitive(haystack: &[u8], needle_lower: &[u8]) -> bool {
    if needle_lower.is_empty() || haystack.len() < needle_lower.len() {
        return false;
    }
    let limit = haystack.len() - needle_lower.len();
    let mut pos = 0;
    while pos <= limit {
        let mut j = 0;
        while j < needle_lower.len() {
            if to_lower(haystack[pos + j]) != needle_lower[j] {
                break;
            }
            j += 1;
        }
        if j == needle_lower.len() {
            return true;
        }
        pos += 1;
    }
    false
}