レガシーPHP・動的CMSのランタイム攻撃面と静的分離設計の比較
CVE-2024-4577 等の脆弱性の技術解説と Astro＋Rust 静的分離アーキテクチャ

#![no_std]
#![forbid(unsafe_code)]

/// Classification of incoming HTTP URI & query bytes at the Rust edge gate.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum EdgeRequestVerdict {
    CleanStaticOrApiRequest,
    BlockedLegacyPhpProbe,
    BlockedCve2024_4577BestFitHomograph { offending_byte: u8, offset: usize },
    BlockedMalformedPercentEncoding { offset: usize },
    BlockedPathTraversalAttempt,
}

#[inline]
const fn decode_hex_nibble(b: u8) -> Option<u8> {
    match b {
        b'0'..=b'9' => Some(b - b'0'),
        b'a'..=b'f' => Some(b - b'a' + 10),
        b'A'..=b'F' => Some(b - b'A' + 10),
        _ => None,
    }
}

/// Inspects raw HTTP request target (`path?query`) in a single O(N) pass before routing.
/// 1. Rejects any `.php`, `wp-admin`, `wp-login`, or `xmlrpc` probes immediately.
/// 2. Detects CVE-2024-4577 Best-Fit homograph bytes (`0xAD` soft-hyphen, UTF-8 `0xC2 0xAD`,
///    and full-width/non-breaking hyphens `0xE2 0x80 0x90..0x95`) in query parameters.
/// 3. Enforces canonical percent-encoding with zero heap allocations.
pub const fn verify_request_target_zero_copy(raw_uri: &[u8]) -> EdgeRequestVerdict {
    // Check for path traversal `..`
    let mut idx = 0;
    let mut query_start: Option<usize> = None;
    while idx < raw_uri.len() {
        if raw_uri[idx] == b'?' && query_start.is_none() {
            query_start = Some(idx + 1);
        }
        if idx + 1 < raw_uri.len() && raw_uri[idx] == b'.' && raw_uri[idx + 1] == b'.' {
            return EdgeRequestVerdict::BlockedPathTraversalAttempt;
        }
        if idx + 3 < raw_uri.len()
            && raw_uri[idx] == b'.'
            && (raw_uri[idx + 1] | 0x20) == b'p'
            && (raw_uri[idx + 2] | 0x20) == b'h'
            && (raw_uri[idx + 3] | 0x20) == b'p'
        {
            return EdgeRequestVerdict::BlockedLegacyPhpProbe;
        }
        idx += 1;
    }

    let Some(mut q) = query_start else {
        return EdgeRequestVerdict::CleanStaticOrApiRequest;
    };

    while q < raw_uri.len() {
        let b = raw_uri[q];
        let decoded = if b == b'%' {
            if q + 2 >= raw_uri.len() {
                return EdgeRequestVerdict::BlockedMalformedPercentEncoding { offset: q };
            }
            let Some(hi) = decode_hex_nibble(raw_uri[q + 1]) else {
                return EdgeRequestVerdict::BlockedMalformedPercentEncoding { offset: q };
            };
            let Some(lo) = decode_hex_nibble(raw_uri[q + 2]) else {
                return EdgeRequestVerdict::BlockedMalformedPercentEncoding { offset: q };
            };
            q += 3;
            (hi << 4) | lo
        } else {
            q += 1;
            b
        };

        // Detect raw 0xAD (CP932/CP1252 Soft Hyphen mapped to 0x2D '-' by Best-Fit)
        // or C0/C1 control bytes outside printable ASCII
        if decoded == 0xAD || decoded < 0x20 || decoded == 0x7F {
            return EdgeRequestVerdict::BlockedCve2024_4577BestFitHomograph {
                offending_byte: decoded,
                offset: q,
            };
        }
    }

    EdgeRequestVerdict::CleanStaticOrApiRequest
}