なぜWordPressのプラグイン更新放置から年間数万件のWeb改ざんが起きるのか？
動的DB直結CMSの限界と「静的分離設計」のすすめ

#![forbid(unsafe_code)]

/// Represents a cryptographically pinned static asset in the Astro build output.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct PinnedAssetEntry<'a> {
    pub route_path: &'a [u8],
    pub sha256_digest: [u8; 32],
    pub content_length: u64,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AssetAuditError {
    UnauthorizedExecutableExtension,
    UnregisteredFileDetected,
    SizeMismatch { expected: u64, actual: u64 },
    DigestTampered,
}

/// Constant-time 32-byte digest comparison to prevent timing side-channels.
#[inline]
pub const fn ct_eq_32(a: &[u8; 32], b: &[u8; 32]) -> bool {
    let mut diff: u8 = 0;
    let mut i: usize = 0;
    while i < 32 {
        diff |= a[i] ^ b[i];
        i += 1;
    }
    diff == 0
}

/// Rejects any server-side script extension (.php, .phtml, .phar, .cgi, .pl, .sh)
/// and verifies the file against the build-time immutable manifest.
pub fn verify_static_edge_asset(
    path: &[u8],
    actual_size: u64,
    actual_sha256: &[u8; 32],
    manifest: &[PinnedAssetEntry<'_>],
) -> Result<(), AssetAuditError> {
    // 1. Hard ban on server-side interpreter extensions in static document root
    let forbidden_suffixes: [&[u8]; 6] = [b".php", b".phtml", b".phar", b".cgi", b".asp", b".jsp"];
    for suffix in forbidden_suffixes {
        if path.len() >= suffix.len() && &path[path.len() - suffix.len()..] == suffix {
            return Err(AssetAuditError::UnauthorizedExecutableExtension);
        }
    }

    // 2. Locate path in immutable build manifest
    for entry in manifest {
        if entry.route_path == path {
            if entry.content_length != actual_size {
                return Err(AssetAuditError::SizeMismatch {
                    expected: entry.content_length,
                    actual: actual_size,
                });
            }
            if !ct_eq_32(&entry.sha256_digest, actual_sha256) {
                return Err(AssetAuditError::DigestTampered);
            }
            return Ok(());
        }
    }

    Err(AssetAuditError::UnregisteredFileDetected)
}