# CorbelPurge v0.4.0 — TODO

Things to build next, grounded in what actually exists in the source.
Each item names the real files and functions involved.

---

## High priority

_(None — all high-priority items from v0.3.0 were completed.)_

---

## Medium priority

_(None — all medium-priority items from v0.3.0 were completed.)_

---

## Low priority

_(None — all low-priority items from v0.3.0 were completed.)_

---

## Deferred

- **Bundled historical exploit corpus** — too risky to ship; would also
  bloat the repo.
- **Sandbox hardening / fuzzing the tool itself** — the tool is not the
  target per the threat model.
- **Encrypted quarantine tarballs** — unnecessary for the research use case;
  disk encryption is the operator's responsibility.
- **Full OOXML schema validation** — the current coarse extraction in
  `docx_parser.rs` (regex on XML text) is sufficient for the threat model.
- **Magic-byte sniffing** — `DocumentFormat::from_path()` uses extension
  only. A mismatched extension causes a parse error (safe failure mode).
- **Full syntect syntax highlighting** — the current cleansed-document viewer
  uses a lightweight approach (dark-panel code blocks). Adding `syntect`
  would provide richer highlighting but adds a heavy dependency to a
  security-critical crate.

---

## Done (v0.3.0)

- Study mode: `corbel-purge study <path>` subcommand producing annotated HTML
  with inline `<span>` wrappers color-coded by classification.
  Files: `src/study/mod.rs`, `src/study/annotator.rs`.
- Payload carving v2: standalone `.hex` (annotated hex dump) and `.info`
  (JSON metadata with vector type, location, classification, CVE tag,
  SHA-256) files alongside existing `.bin`.
  Files: `src/quarantine/hexdump.rs`, `src/quarantine/mod.rs`.
- Multi-page PDF navigation in GUI: prev/next buttons, page number input,
  LRU page cache, wired to `PdfiumRenderer::render_page(document, page_index)`.
  Files: `src/bin/gui.rs`, `src/pdfium_render.rs`. **Removed in v0.4.2** —
  the PDF renderer was the only format being visually rendered (MD/DOCX/EPUB
  were text-only), so the inconsistency was cut. PDF scanning, quarantine,
  and cleansing are unaffected.
- EPUB/Markdown visual rendering in GUI: cleansed document viewer
  using scrollable text widget in the sidebar.
  Files: `src/bin/gui.rs`.
- Syntax highlighting in cleansed-document viewer: lightweight code-block
  distinction using the dark-panel background.
  Files: `src/bin/gui.rs`.
- External threat-intel feed integration: `--rules <path>` and
  `--cve-db <path>` CLI flags, `ExternalRulesData` static storage,
  external TLD/brand/keyword/signature/shellcode matching.
  Files: `src/core/config.rs`, `src/scanner/signatures.rs`,
  `src/scanner/cve_tags.rs`, `src/main.rs`.
- Expanded CVE table: 4 new entries (CVE-2012-0158, CVE-2015-2545,
  CVE-2021-40444, CVE-2022-30190) — total 11 entries.
  Files: `src/scanner/cve_tags.rs`.
- Total-memory budget for multi-entry archives: `total_archive_scan_cap`
  field in `Config` (default 256 MiB), enforced in `epub_parser.rs`
  and `docx_parser.rs`.
  Files: `src/core/config.rs`, `src/parsers/epub_parser.rs`,
  `src/parsers/docx_parser.rs`.
- PDF repackage dangling reference cleanup: `sweep_dangling_references()`
  nullifies `N 0 R` patterns in remaining PDF objects after deletion.
  Files: `src/cleanse/repackage.rs`.
- OPF manifest cleanup after EPUB repackage: `clean_epub_opf()` rewrites
  the OPF XML to remove stale `<manifest>` and `<spine>` entries.
  Files: `src/cleanse/repackage.rs`.
- PDF PreserveFormat integration tests: `preserve_format_pdf_strips_javascript`
  and `preserve_format_pdf_strips_launch` in pipeline_integration.rs.
  Files: `tests/pipeline_integration.rs`.
- GUI CVE badges: CVE tags parsed from `Finding.context_notes` and
  rendered as teal badges in the findings list.
  Files: `src/bin/gui.rs`.

## Done (v0.2.0 and earlier)

- 4-format parsing (PDF via `lopdf`, EPUB via `zip`, Markdown via
  `pulldown-cmark`, DOCX via `zip` + regex XML extraction)
- Unified intermediate representation (`Document` struct with `TextNode`
  and `ExecutableVector`)
- `DocumentParser` trait + `Dispatcher` in `parsers/mod.rs`
- Layered scanner: `heuristics::classify_vector()` for executable vectors,
  `context_filter::evaluate()` for text nodes, `cve_tags::match_cve()`
  for CVE annotation
- Threat signature tables in `signatures.rs`: 30+ phishing TLDs, 50+
  brand homographs, 15+ file signatures, 9 shellcode prologues
- CVE table: 7 entries (CVE-2010-0188, CVE-2018-4990, CVE-2017-11882,
  CVE-2018-0802, CVE-2017-8570, CVE-2017-0199, EPUB-SCRIPT-INJECTION)
- Quarantine: payload carving (`extractor.rs`), JSON + Markdown forensic
  reports (`reporter.rs`), tarball packaging (`quarantine/mod.rs`)
- Document cleansing: Markdown sanitizer (`sanitizer.rs`),
  format-preserving repackage for EPUB/DOCX/PDF (`repackage.rs`)
- Zip-bomb defense: `util::read_with_cap()` with actual-decompressed-byte
  counting, configurable via `Config::epub_entry_scan_cap`
- CLI: `scan` (single file), `scan-dir` (directory, `--recursive`),
  `--abort-on-threat`, `--quiet`, `--preserve-format`, `--workspace`,
  env-var overrides
- iced 0.13 GUI dashboard with dark theme, collapsible panels, file
  picker (`rfd::AsyncFileDialog`), console log, sidebar stats
- 22+ integration tests + zip-bomb defense tests + unit tests across all modules