サポート終了PHPと古いCMS放置による
国内サイト大量改ざんの実態と、根本からの解決策

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum RequestSafety {
    SafeStaticPath,
    BlockedPhpCgiBestFitInjection,
    BlockedLegacyCmsProbe,
}

/// Inspects raw URI query & path bytes for CVE-2024-4577 (0xAD soft-hyphen best-fit)
/// and legacy CMS backdoor probes before hitting the static file server.
pub fn inspect_http_target(path: &str, raw_query: Option<&str>) -> RequestSafety {
    let lower_path = path.to_ascii_lowercase();
    if lower_path.ends_with(".php")
        || lower_path.contains("/wp-admin")
        || lower_path.contains("/wp-login")
        || lower_path.contains("/xmlrpc.php")
    {
        return RequestSafety::BlockedLegacyCmsProbe;
    }

    if let Some(q) = raw_query {
        let lower_q = q.to_ascii_lowercase();
        if lower_q.contains("%ad")
            || lower_q.contains("allow_url_include")
            || lower_q.contains("auto_prepend_file")
            || lower_q.contains("php://input")
        {
            return RequestSafety::BlockedPhpCgiBestFitInjection;
        }
        for b in q.as_bytes() {
            if *b == 0xAD {
                return RequestSafety::BlockedPhpCgiBestFitInjection;
            }
        }
    }

    RequestSafety::SafeStaticPath
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn blocks_cve_2024_4577_encoded_payload() {
        let verdict = inspect_http_target(
            "/index.html",
            Some("%ADd+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input"),
        );
        assert_eq!(verdict, RequestSafety::BlockedPhpCgiBestFitInjection);
    }
}