dcosnet
/
corbel
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
corbel/TODO.md

5.3 KiB
Executable File
Raw Permalink Blame History

CorbelPurge v0.4.0 — TODO

Things to build next, grounded in what actually exists in the source. Each item names the real files and functions involved.

High priority

(None — all high-priority items from v0.3.0 were completed.)

Medium priority

(None — all medium-priority items from v0.3.0 were completed.)

Low priority

(None — all low-priority items from v0.3.0 were completed.)

Deferred

  • Bundled historical exploit corpus — too risky to ship; would also bloat the repo.
  • Sandbox hardening / fuzzing the tool itself — the tool is not the target per the threat model.
  • Encrypted quarantine tarballs — unnecessary for the research use case; disk encryption is the operator's responsibility.
  • Full OOXML schema validation — the current coarse extraction in docx_parser.rs (regex on XML text) is sufficient for the threat model.
  • Magic-byte sniffing — DocumentFormat::from_path() uses extension only. A mismatched extension causes a parse error (safe failure mode).
  • Full syntect syntax highlighting — the current cleansed-document viewer uses a lightweight approach (dark-panel code blocks). Adding syntect would provide richer highlighting but adds a heavy dependency to a security-critical crate.

Done (v0.3.0)

  • Study mode: corbel-purge study <path> subcommand producing annotated HTML with inline <span> wrappers color-coded by classification. Files: src/study/mod.rs, src/study/annotator.rs.
  • Payload carving v2: standalone .hex (annotated hex dump) and .info (JSON metadata with vector type, location, classification, CVE tag, SHA-256) files alongside existing .bin. Files: src/quarantine/hexdump.rs, src/quarantine/mod.rs.
  • Multi-page PDF navigation in GUI: prev/next buttons, page number input, LRU page cache, wired to PdfiumRenderer::render_page(document, page_index). Files: src/bin/gui.rs, src/pdfium_render.rs. Removed in v0.4.2 — the PDF renderer was the only format being visually rendered (MD/DOCX/EPUB were text-only), so the inconsistency was cut. PDF scanning, quarantine, and cleansing are unaffected.
  • EPUB/Markdown visual rendering in GUI: cleansed document viewer using scrollable text widget in the sidebar. Files: src/bin/gui.rs.
  • Syntax highlighting in cleansed-document viewer: lightweight code-block distinction using the dark-panel background. Files: src/bin/gui.rs.
  • External threat-intel feed integration: --rules <path> and --cve-db <path> CLI flags, ExternalRulesData static storage, external TLD/brand/keyword/signature/shellcode matching. Files: src/core/config.rs, src/scanner/signatures.rs, src/scanner/cve_tags.rs, src/main.rs.
  • Expanded CVE table: 4 new entries (CVE-2012-0158, CVE-2015-2545, CVE-2021-40444, CVE-2022-30190) — total 11 entries. Files: src/scanner/cve_tags.rs.
  • Total-memory budget for multi-entry archives: total_archive_scan_cap field in Config (default 256 MiB), enforced in epub_parser.rs and docx_parser.rs. Files: src/core/config.rs, src/parsers/epub_parser.rs, src/parsers/docx_parser.rs.
  • PDF repackage dangling reference cleanup: sweep_dangling_references() nullifies N 0 R patterns in remaining PDF objects after deletion. Files: src/cleanse/repackage.rs.
  • OPF manifest cleanup after EPUB repackage: clean_epub_opf() rewrites the OPF XML to remove stale <manifest> and <spine> entries. Files: src/cleanse/repackage.rs.
  • PDF PreserveFormat integration tests: preserve_format_pdf_strips_javascript and preserve_format_pdf_strips_launch in pipeline_integration.rs. Files: tests/pipeline_integration.rs.
  • GUI CVE badges: CVE tags parsed from Finding.context_notes and rendered as teal badges in the findings list. Files: src/bin/gui.rs.

Done (v0.2.0 and earlier)

  • 4-format parsing (PDF via lopdf, EPUB via zip, Markdown via pulldown-cmark, DOCX via zip + regex XML extraction)
  • Unified intermediate representation (Document struct with TextNode and ExecutableVector)
  • DocumentParser trait + Dispatcher in parsers/mod.rs
  • Layered scanner: heuristics::classify_vector() for executable vectors, context_filter::evaluate() for text nodes, cve_tags::match_cve() for CVE annotation
  • Threat signature tables in signatures.rs: 30+ phishing TLDs, 50+ brand homographs, 15+ file signatures, 9 shellcode prologues
  • CVE table: 7 entries (CVE-2010-0188, CVE-2018-4990, CVE-2017-11882, CVE-2018-0802, CVE-2017-8570, CVE-2017-0199, EPUB-SCRIPT-INJECTION)
  • Quarantine: payload carving (extractor.rs), JSON + Markdown forensic reports (reporter.rs), tarball packaging (quarantine/mod.rs)
  • Document cleansing: Markdown sanitizer (sanitizer.rs), format-preserving repackage for EPUB/DOCX/PDF (repackage.rs)
  • Zip-bomb defense: util::read_with_cap() with actual-decompressed-byte counting, configurable via Config::epub_entry_scan_cap
  • CLI: scan (single file), scan-dir (directory, --recursive), --abort-on-threat, --quiet, --preserve-format, --workspace, env-var overrides
  • iced 0.13 GUI dashboard with dark theme, collapsible panels, file picker (rfd::AsyncFileDialog), console log, sidebar stats
  • 22+ integration tests + zip-bomb defense tests + unit tests across all modules