builtin.rs

use crate::rule::raw_rule::RawPath;
use crate::severity::Severity;
use crate::Rule as PatternRule;

pub fn get_builtin_rules() -> Vec<PatternRule> {
    let mut collection = vec![];

    collection.append(&mut get_builtin_rules_php());
    collection.append(&mut get_builtin_rules_typo3());

    collection
}

fn get_builtin_rules_php() -> Vec<PatternRule> {
    vec![
        PatternRule::with_path_and_content(
            "php::content::error_reporting",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            r"error_reporting\(",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::preg_",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            "='preg_",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::preg_",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            r#"="preg_"#,
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::eval",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            r"\beval\(",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::gzinflate",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            r"\bgzinflate\(",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::@gzinflate",
            Severity::MINOR,
            RawPath::with_path(".php"),
            r"\b@gzinflate\(",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::substr(MD5(strrev",
            Severity::MINOR,
            RawPath::with_path(".php"),
            r"substr\(MD5\(strrev",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::system",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            r"\bsystem\(",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::exec",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            r"\bexec\(",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::create_function",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            r"\bcreate_function\(",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::return",
            Severity::MAJOR,
            RawPath::with_path(".php"),
            r#"","\."\);return;?>"#,
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::base64_decode",
            Severity::MAJOR,
            RawPath::with_path(".php"),
            r"eval\(base64_decode\(",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::6fbcb8b698317491a5fd7926f2c3b7de",
            Severity::CRITICAL,
            RawPath::with_path(".php"),
            "6fbcb8b698317491a5fd7926f2c3b7de",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::4ngel",
            Severity::CRITICAL,
            RawPath::with_path(".php"),
            r"Codz by angel\(4ngel\)",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::dezmond",
            Severity::CRITICAL,
            RawPath::with_path(".php"),
            "dezmond",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::FilesMan",
            Severity::CRITICAL,
            RawPath::with_path(".php"),
            "FilesMan",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::raprap1",
            Severity::CRITICAL,
            RawPath::with_path(".php"),
            "raprap1",
        )
        .unwrap(),
        PatternRule::with_path(
            "php::file::tx_mocfilemanager",
            Severity::CRITICAL,
            RawPath::with_path("tx_mocfilemanager.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "php::file::cache",
            Severity::CRITICAL,
            RawPath::with_regex(r"/cache\.dat"),
        )
        .unwrap(),
        PatternRule::with_path(
            "php::file::cache",
            Severity::CRITICAL,
            RawPath::with_regex(r"/\.cache\.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "php::file::ext_fpdf",
            Severity::CRITICAL,
            RawPath::with_regex("ext_fpdf.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "php::file::ixwstat",
            Severity::CRITICAL,
            RawPath::with_regex("ixwstat.php"),
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::cialis",
            Severity::NOTICE,
            RawPath::with_path(".php"),
            "='preg_",
        )
        .unwrap(),
        PatternRule::with_path_and_content(
            "php::content::next1.space",
            Severity::CRITICAL,
            RawPath::with_path(".php"),
            "next1.space",
        )
        .unwrap(),
    ]
}

fn get_builtin_rules_typo3() -> Vec<PatternRule> {
    vec![
        PatternRule::with_path_and_content(
            "typo3::file::php-in-typo3conf-wordpress",
            Severity::NOTICE,
            RawPath::with_regex("typo3conf/.*\\.php"),
            "wordpress",
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-typo3conf-static_info_tables",
            Severity::MAJOR,
            RawPath::with_path("typo3conf/ext/static_info_tables/Classes/static_info_tables.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-fileadmin",
            Severity::MINOR,
            RawPath::with_regex(r"fileadmin/.*\.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-l10n",
            Severity::MAJOR,
            RawPath::with_regex(r"typo3conf/l10n/.*\.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-typo3temp",
            Severity::MINOR,
            RawPath::with_regex(r"typo3temp/.*\.php$"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-typo3temp-Cache",
            Severity::WHITELIST,
            RawPath::with_regex(r"typo3temp/(var/)?Cache/.*\.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-typo3temp-autoload",
            Severity::WHITELIST,
            RawPath::with_regex(r"typo3temp/autoload/autoload_[^/]*\.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-typo3temp-autoload-test",
            Severity::WHITELIST,
            RawPath::with_regex(r"typo3temp/autoload-tests/autoload_[^/]*\.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-typo3temp-extupdate",
            Severity::WHITELIST,
            RawPath::with_regex(
                r"typo3temp/ExtensionManager/UpdateScripts/ext_update[a-z0-9]*\.php",
            ),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-typo3temp-extupdate",
            Severity::WHITELIST,
            RawPath::with_regex(r"typo3temp/var/transient/ext_update[a-z0-9]*\.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-uploads",
            Severity::MAJOR,
            RawPath::with_regex(r"/uploads/.*\.php"),
        )
        .unwrap(),
        PatternRule::with_path(
            "typo3::file::php-in-extension-builder-backups",
            Severity::EASE2X, // Decrease ("ease") the rating form MAJOR to NOTICE
            RawPath::with_regex(r"/uploads/tx_extensionbuilder/backups/.*\.php"),
        )
        .unwrap(),
    ]
}