118 lines
5.3 KiB
Markdown
Executable File
118 lines
5.3 KiB
Markdown
Executable File
# CorbelPurge v0.4.0 — TODO
|
|
|
|
Things to build next, grounded in what actually exists in the source.
|
|
Each item names the real files and functions involved.
|
|
|
|
---
|
|
|
|
## High priority
|
|
|
|
_(None — all high-priority items from v0.3.0 were completed.)_
|
|
|
|
---
|
|
|
|
## Medium priority
|
|
|
|
_(None — all medium-priority items from v0.3.0 were completed.)_
|
|
|
|
---
|
|
|
|
## Low priority
|
|
|
|
_(None — all low-priority items from v0.3.0 were completed.)_
|
|
|
|
---
|
|
|
|
## Deferred
|
|
|
|
- **Bundled historical exploit corpus** — too risky to ship; would also
|
|
bloat the repo.
|
|
- **Sandbox hardening / fuzzing the tool itself** — the tool is not the
|
|
target per the threat model.
|
|
- **Encrypted quarantine tarballs** — unnecessary for the research use case;
|
|
disk encryption is the operator's responsibility.
|
|
- **Full OOXML schema validation** — the current coarse extraction in
|
|
`docx_parser.rs` (regex on XML text) is sufficient for the threat model.
|
|
- **Magic-byte sniffing** — `DocumentFormat::from_path()` uses extension
|
|
only. A mismatched extension causes a parse error (safe failure mode).
|
|
- **Full syntect syntax highlighting** — the current cleansed-document viewer
|
|
uses a lightweight approach (dark-panel code blocks). Adding `syntect`
|
|
would provide richer highlighting but adds a heavy dependency to a
|
|
security-critical crate.
|
|
|
|
---
|
|
|
|
## Done (v0.3.0)
|
|
|
|
- Study mode: `corbel-purge study <path>` subcommand producing annotated HTML
|
|
with inline `<span>` wrappers color-coded by classification.
|
|
Files: `src/study/mod.rs`, `src/study/annotator.rs`.
|
|
- Payload carving v2: standalone `.hex` (annotated hex dump) and `.info`
|
|
(JSON metadata with vector type, location, classification, CVE tag,
|
|
SHA-256) files alongside existing `.bin`.
|
|
Files: `src/quarantine/hexdump.rs`, `src/quarantine/mod.rs`.
|
|
- Multi-page PDF navigation in GUI: prev/next buttons, page number input,
|
|
LRU page cache, wired to `PdfiumRenderer::render_page(document, page_index)`.
|
|
Files: `src/bin/gui.rs`, `src/pdfium_render.rs`. **Removed in v0.4.2** —
|
|
the PDF renderer was the only format being visually rendered (MD/DOCX/EPUB
|
|
were text-only), so the inconsistency was cut. PDF scanning, quarantine,
|
|
and cleansing are unaffected.
|
|
- EPUB/Markdown visual rendering in GUI: cleansed document viewer
|
|
using scrollable text widget in the sidebar.
|
|
Files: `src/bin/gui.rs`.
|
|
- Syntax highlighting in cleansed-document viewer: lightweight code-block
|
|
distinction using the dark-panel background.
|
|
Files: `src/bin/gui.rs`.
|
|
- External threat-intel feed integration: `--rules <path>` and
|
|
`--cve-db <path>` CLI flags, `ExternalRulesData` static storage,
|
|
external TLD/brand/keyword/signature/shellcode matching.
|
|
Files: `src/core/config.rs`, `src/scanner/signatures.rs`,
|
|
`src/scanner/cve_tags.rs`, `src/main.rs`.
|
|
- Expanded CVE table: 4 new entries (CVE-2012-0158, CVE-2015-2545,
|
|
CVE-2021-40444, CVE-2022-30190) — total 11 entries.
|
|
Files: `src/scanner/cve_tags.rs`.
|
|
- Total-memory budget for multi-entry archives: `total_archive_scan_cap`
|
|
field in `Config` (default 256 MiB), enforced in `epub_parser.rs`
|
|
and `docx_parser.rs`.
|
|
Files: `src/core/config.rs`, `src/parsers/epub_parser.rs`,
|
|
`src/parsers/docx_parser.rs`.
|
|
- PDF repackage dangling reference cleanup: `sweep_dangling_references()`
|
|
nullifies `N 0 R` patterns in remaining PDF objects after deletion.
|
|
Files: `src/cleanse/repackage.rs`.
|
|
- OPF manifest cleanup after EPUB repackage: `clean_epub_opf()` rewrites
|
|
the OPF XML to remove stale `<manifest>` and `<spine>` entries.
|
|
Files: `src/cleanse/repackage.rs`.
|
|
- PDF PreserveFormat integration tests: `preserve_format_pdf_strips_javascript`
|
|
and `preserve_format_pdf_strips_launch` in pipeline_integration.rs.
|
|
Files: `tests/pipeline_integration.rs`.
|
|
- GUI CVE badges: CVE tags parsed from `Finding.context_notes` and
|
|
rendered as teal badges in the findings list.
|
|
Files: `src/bin/gui.rs`.
|
|
|
|
## Done (v0.2.0 and earlier)
|
|
|
|
- 4-format parsing (PDF via `lopdf`, EPUB via `zip`, Markdown via
|
|
`pulldown-cmark`, DOCX via `zip` + regex XML extraction)
|
|
- Unified intermediate representation (`Document` struct with `TextNode`
|
|
and `ExecutableVector`)
|
|
- `DocumentParser` trait + `Dispatcher` in `parsers/mod.rs`
|
|
- Layered scanner: `heuristics::classify_vector()` for executable vectors,
|
|
`context_filter::evaluate()` for text nodes, `cve_tags::match_cve()`
|
|
for CVE annotation
|
|
- Threat signature tables in `signatures.rs`: 30+ phishing TLDs, 50+
|
|
brand homographs, 15+ file signatures, 9 shellcode prologues
|
|
- CVE table: 7 entries (CVE-2010-0188, CVE-2018-4990, CVE-2017-11882,
|
|
CVE-2018-0802, CVE-2017-8570, CVE-2017-0199, EPUB-SCRIPT-INJECTION)
|
|
- Quarantine: payload carving (`extractor.rs`), JSON + Markdown forensic
|
|
reports (`reporter.rs`), tarball packaging (`quarantine/mod.rs`)
|
|
- Document cleansing: Markdown sanitizer (`sanitizer.rs`),
|
|
format-preserving repackage for EPUB/DOCX/PDF (`repackage.rs`)
|
|
- Zip-bomb defense: `util::read_with_cap()` with actual-decompressed-byte
|
|
counting, configurable via `Config::epub_entry_scan_cap`
|
|
- CLI: `scan` (single file), `scan-dir` (directory, `--recursive`),
|
|
`--abort-on-threat`, `--quiet`, `--preserve-format`, `--workspace`,
|
|
env-var overrides
|
|
- iced 0.13 GUI dashboard with dark theme, collapsible panels, file
|
|
picker (`rfd::AsyncFileDialog`), console log, sidebar stats
|
|
- 22+ integration tests + zip-bomb defense tests + unit tests across all modules
|