PHPの深刻な脆弱性（CVE-2024-4577）と動的CMS改ざんの仕組みの解説：
なぜ「Astro＋Rust静的生成」で攻撃面が物理的にゼロになるのか

#![forbid(unsafe_code)]

/// Errors returned when inspecting an incoming HTTP request URI at the edge gateway.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum UriSecurityViolation {
    EmptyOrOversizedUri,
    MalformedPercentEncoding,
    BestFitSoftHyphenDetected(usize),
    CgiArgumentInjectionAttempt(usize),
    NonAsciiOrControlByteDetected(usize, u8),
}

/// Inspects raw URI query bytes in O(N) time with zero heap allocations,
/// blocking CVE-2024-4577 (0xAD / U+00AD Soft Hyphen Best-Fit) and RFC 3875 CGI injection vectors.
#[inline]
pub const fn verify_query_string_zero_trust(raw_query: &[u8]) -> Result<(), UriSecurityViolation> {
    if raw_query.len() > 2048 {
        return Err(UriSecurityViolation::EmptyOrOversizedUri);
    }

    let mut i: usize = 0;
    let mut is_token_start: bool = true;

    while i < raw_query.len() {
        let b = raw_query[i];

        // Decode percent-encoded byte if present
        let (decoded_byte, step) = if b == b'%' {
            if i + 2 >= raw_query.len() {
                return Err(UriSecurityViolation::MalformedPercentEncoding);
            }
            let hi = match hex_nibble(raw_query[i + 1]) {
                Some(v) => v,
                None => return Err(UriSecurityViolation::MalformedPercentEncoding),
            };
            let lo = match hex_nibble(raw_query[i + 2]) {
                Some(v) => v,
                None => return Err(UriSecurityViolation::MalformedPercentEncoding),
            };
            // Detect UTF-8 encoded U+00AD (%C2%AD) as well as raw CP932/Latin-1 %AD
            let val = (hi << 4) | lo;
            if val == 0xAD {
                return Err(UriSecurityViolation::BestFitSoftHyphenDetected(i));
            }
            (val, 3)
        } else {
            if b == 0xAD {
                return Err(UriSecurityViolation::BestFitSoftHyphenDetected(i));
            }
            (b, 1)
        };

        // Block raw or encoded '-' at the beginning of a query argument token (CVE-2012-1823 / CVE-2024-4577)
        if is_token_start && decoded_byte == b'-' {
            return Err(UriSecurityViolation::CgiArgumentInjectionAttempt(i));
        }

        // Reject control characters and non-printable bytes
        if decoded_byte < 0x20 || decoded_byte >= 0x7F {
            return Err(UriSecurityViolation::NonAsciiOrControlByteDetected(i, decoded_byte));
        }

        is_token_start = decoded_byte == b'&' || decoded_byte == b'+' || decoded_byte == b' ';
        i += step;
    }

    Ok(())
}

#[inline]
const fn hex_nibble(byte: u8) -> Option<u8> {
    match byte {
        b'0'..=b'9' => Some(byte - b'0'),
        b'a'..=b'f' => Some(byte - b'a' + 10),
        b'A'..=b'F' => Some(byte - b'A' + 10),
        _ => None,
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn blocks_cve_2024_4577_soft_hyphen_payload() {
        let exploit = b"%ADd+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input";
        assert_eq!(
            verify_query_string_zero_trust(exploit),
            Err(UriSecurityViolation::BestFitSoftHyphenDetected(0))
        );
    }

    #[test]
    fn allows_clean_key_value_query() {
        let clean = b"category=security&page=1";
        assert_eq!(verify_query_string_zero_trust(clean), Ok(()));
    }
}