|
| 1 | +//! Domain name related scanning, used by both email and URL scanners. |
| 2 | +//! |
| 3 | +//! This is called domains for familiarity but it's about the authority part of URLs as defined in |
| 4 | +//! https://datatracker.ietf.org/doc/html/rfc3986#section-3.2 |
| 5 | +//! |
| 6 | +//! ```text |
| 7 | +//! authority = [ userinfo "@" ] host [ ":" port ] |
| 8 | +//! |
| 9 | +//! |
| 10 | +//! userinfo = *( unreserved / pct-encoded / sub-delims / ":" ) |
| 11 | +//! |
| 12 | +//! host = IP-literal / IPv4address / reg-name |
| 13 | +//! |
| 14 | +//! IP-literal = "[" ( IPv6address / IPvFuture ) "]" |
| 15 | +//! |
| 16 | +//! IPv4address = dec-octet "." dec-octet "." dec-octet "." dec-octet |
| 17 | +//! |
| 18 | +//! reg-name = *( unreserved / pct-encoded / sub-delims ) |
| 19 | +//! |
| 20 | +//! |
| 21 | +//! unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" |
| 22 | +//! |
| 23 | +//! sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "=" |
| 24 | +//! |
| 25 | +//! pct-encoded = "%" HEXDIG HEXDIG |
| 26 | +//! ``` |
| 27 | +
|
| 28 | +use std::char; |
| 29 | + |
| 30 | +pub(crate) fn find_authority_end( |
| 31 | + s: &str, |
| 32 | + mut userinfo_allowed: bool, |
| 33 | + require_host: bool, |
| 34 | + port_allowed: bool, |
| 35 | +) -> (Option<usize>, Option<usize>) { |
| 36 | + let mut end = Some(0); |
| 37 | + |
| 38 | + let mut maybe_last_dot = None; |
| 39 | + let mut last_dot = None; |
| 40 | + let mut dot_allowed = false; |
| 41 | + let mut hyphen_allowed = false; |
| 42 | + let mut all_numeric = true; |
| 43 | + let mut maybe_host = true; |
| 44 | + let mut host_ended = false; |
| 45 | + |
| 46 | + for (i, c) in s.char_indices() { |
| 47 | + let can_be_last = match c { |
| 48 | + // ALPHA |
| 49 | + 'a'..='z' | 'A'..='Z' | '\u{80}'..=char::MAX => { |
| 50 | + // Can start or end a domain label, but not numeric |
| 51 | + dot_allowed = true; |
| 52 | + hyphen_allowed = true; |
| 53 | + last_dot = maybe_last_dot; |
| 54 | + all_numeric = false; |
| 55 | + |
| 56 | + if host_ended { |
| 57 | + maybe_host = false; |
| 58 | + } |
| 59 | + |
| 60 | + !require_host || !host_ended |
| 61 | + } |
| 62 | + // DIGIT |
| 63 | + '0'..='9' => { |
| 64 | + // Same as above, except numeric |
| 65 | + dot_allowed = true; |
| 66 | + hyphen_allowed = true; |
| 67 | + last_dot = maybe_last_dot; |
| 68 | + |
| 69 | + if host_ended { |
| 70 | + maybe_host = false; |
| 71 | + } |
| 72 | + |
| 73 | + !require_host || !host_ended |
| 74 | + } |
| 75 | + // unreserved |
| 76 | + '-' => { |
| 77 | + // Hyphen can't be at start of a label, e.g. `-b` in `a.-b.com` |
| 78 | + if !hyphen_allowed { |
| 79 | + maybe_host = false; |
| 80 | + } |
| 81 | + // Hyphen can't be at end of a label, e.g. `b-` in `a.b-.com` |
| 82 | + dot_allowed = false; |
| 83 | + all_numeric = false; |
| 84 | + |
| 85 | + !require_host |
| 86 | + } |
| 87 | + '.' => { |
| 88 | + if !dot_allowed { |
| 89 | + // Label can't be empty, e.g. `.example.com` or `a..com` |
| 90 | + host_ended = true; |
| 91 | + } |
| 92 | + dot_allowed = false; |
| 93 | + hyphen_allowed = false; |
| 94 | + maybe_last_dot = Some(i); |
| 95 | + |
| 96 | + false |
| 97 | + } |
| 98 | + '_' | '~' => { |
| 99 | + // Hostnames can't contain these and we don't want to treat them as delimiters. |
| 100 | + maybe_host = false; |
| 101 | + |
| 102 | + false |
| 103 | + } |
| 104 | + // sub-delims |
| 105 | + '!' | '$' | '&' | '\'' | '(' | ')' | '*' | '+' | ',' | ';' | '=' => { |
| 106 | + // Can't be in hostnames, but we treat them as delimiters |
| 107 | + host_ended = true; |
| 108 | + |
| 109 | + if !userinfo_allowed && require_host { |
| 110 | + // We don't have to look further |
| 111 | + break; |
| 112 | + } |
| 113 | + |
| 114 | + false |
| 115 | + } |
| 116 | + ':' => { |
| 117 | + // Could be in userinfo, or we're getting a port now. |
| 118 | + if !userinfo_allowed && !port_allowed { |
| 119 | + break; |
| 120 | + } |
| 121 | + |
| 122 | + // Don't advance the last dot when we get to port numbers |
| 123 | + maybe_last_dot = last_dot; |
| 124 | + |
| 125 | + false |
| 126 | + } |
| 127 | + '@' => { |
| 128 | + if !userinfo_allowed { |
| 129 | + // We already had userinfo, can't have another `@` in a valid authority. |
| 130 | + return (None, None); |
| 131 | + } |
| 132 | + |
| 133 | + // Sike! Everything before this has been userinfo, so let's reset our |
| 134 | + // opinions about all the host bits. |
| 135 | + userinfo_allowed = false; |
| 136 | + |
| 137 | + maybe_last_dot = None; |
| 138 | + last_dot = None; |
| 139 | + dot_allowed = false; |
| 140 | + hyphen_allowed = false; |
| 141 | + all_numeric = true; |
| 142 | + maybe_host = true; |
| 143 | + host_ended = false; |
| 144 | + |
| 145 | + false |
| 146 | + } |
| 147 | + '/' => { |
| 148 | + if !require_host { |
| 149 | + // For schemes where we allow anything, we want to stop at delimiter characters |
| 150 | + // except if we get a slash closing the URL, which happened here. |
| 151 | + end = Some(i); |
| 152 | + } |
| 153 | + break; |
| 154 | + } |
| 155 | + _ => { |
| 156 | + // Anything else, this might be the end of the authority (can be empty). |
| 157 | + // Now let the rest of the code handle checking whether the end of the URL is |
| 158 | + // valid. |
| 159 | + break; |
| 160 | + } |
| 161 | + }; |
| 162 | + |
| 163 | + if can_be_last { |
| 164 | + end = Some(i + c.len_utf8()); |
| 165 | + } |
| 166 | + } |
| 167 | + |
| 168 | + if require_host { |
| 169 | + if maybe_host { |
| 170 | + // Can't have just a number without dots as the authority |
| 171 | + if all_numeric && last_dot.is_none() && end != Some(0) { |
| 172 | + return (None, None); |
| 173 | + } |
| 174 | + |
| 175 | + // If we have something that is not just numeric (not an IP address), |
| 176 | + // check that the TLD looks reasonable. This is to avoid linking things like |
| 177 | + |
| 178 | + if !all_numeric { |
| 179 | + if let Some(last_dot) = last_dot { |
| 180 | + if !valid_tld(&s[last_dot + 1..]) { |
| 181 | + return (None, None); |
| 182 | + } |
| 183 | + } |
| 184 | + } |
| 185 | + |
| 186 | + return (end, last_dot); |
| 187 | + } else { |
| 188 | + return (None, None); |
| 189 | + } |
| 190 | + } else { |
| 191 | + return (end, last_dot); |
| 192 | + } |
| 193 | +} |
| 194 | + |
| 195 | +fn valid_tld(tld: &str) -> bool { |
| 196 | + tld.chars() |
| 197 | + .take_while(|c| c.is_ascii_alphabetic()) |
| 198 | + .take(2) |
| 199 | + .count() |
| 200 | + >= 2 |
| 201 | +} |
0 commit comments