fn should_deny_absolute(url_to_test: &Url, denier: &Url, handles: Arc<Handles>) -> Result<bool> {
    log::trace!(
        "enter: should_deny_absolute({}, {:?})",
        url_to_test.as_str(),
        denier.as_str(),
    );

    // simplest case is an exact match, check for it first
    if url_to_test == denier {
        log::trace!("exit: should_deny_absolute -> true");
        return Ok(true);
    }

    match (url_to_test.host(), denier.host()) {
        // .host() will return an enum with ipv4|6 or domain and is comparable
        // whereas .domain() returns None for ip addresses
        (Some(normed_host), Some(denier_host)) => {
            if normed_host != denier_host {
                // domains don't even match
                return Ok(false);
            }
        }
        _ => {
            // one or the other couldn't determine the host value, which probably means
            // it's not suitable for further comparison
            return Ok(false);
        }
    }

    let tested_host = url_to_test.host().unwrap(); // match above will catch errors

    // at this point, we have a matching set of ips or domain names. now we can process the
    // url path. The goal is to determine whether the given url's path is a subpath of any
    // url in the deny list, for example
    //    GIVEN URL                        URL DENY LIST               USER-SPECIFIED URLS TO SCAN
    //    http://some.domain/stuff/things, [http://some.domain/stuff], [http://some.domain] => true
    //    http://some.domain/stuff/things, [http://some.domain/stuff/things], [http://some.domain] => true
    //    http://some.domain/stuff/things, [http://some.domain/api], [http://some.domain] => false
    // the examples above are all pretty obvious, the kicker comes when the blocking url's
    // path is a parent to a scanned url
    //    http://some.domain/stuff/things, [http://some.domain/], [http://some.domain/stuff] => false
    //    http://some.domain/api, [http://some.domain/], [http://some.domain/stuff] => true
    // we want to deny all children of the parent, unless that child is a child of a scan
    // we specified through -u(s) or --stdin

    let deny_path = denier.path();
    let tested_path = url_to_test.path();

    if tested_path.starts_with(deny_path) {
        // at this point, we know that the given normalized path is a sub-path of the
        // current deny-url, now we just need to check to see if this deny-url is a parent
        // to a scanned url that is also a parent of the given url
        for ferox_scan in handles.ferox_scans()?.get_active_scans() {
            let scanner = Url::parse(ferox_scan.url().trim_end_matches('/'))
                .with_context(|| format!("Could not parse {} as a url", ferox_scan))?;

            if let Some(scan_host) = scanner.host() {
                // same domain/ip check we perform on the denier above
                if tested_host != scan_host {
                    // domains don't even match, keep on keepin' on...
                    continue;
                }
            } else {
                // couldn't process .host from scanner
                continue;
            };

            let scan_path = scanner.path();

            if scan_path.starts_with(deny_path) && tested_path.starts_with(scan_path) {
                // user-specified scan url is a sub-path of the deny-urls's path AND the
                // url to check is a sub-path of the user-specified scan url
                //
                // the assumption is the user knew what they wanted and we're going to give
                // the scanned url precedence, even though it's a sub-path
                log::trace!("exit: should_deny_absolute -> false");
                return Ok(false);
            }
        }
        log::trace!("exit: should_deny_absolute -> true");
        return Ok(true);
    }

    log::trace!("exit: should_deny_absolute -> false");
    Ok(false)
}
/// determine if a url should be denied based on the given absolute url
determine if a url should be denied based on the given absolute url
determine if a url should be denied based on the given absolute url
fn should_deny_absolute(url_to_test: &Url, denier: &Url, handles: Arc<Handles>) -> Result<bool> {
    log::trace!(
        "enter: should_deny_absolute({}, {:?})",
        url_to_test.as_str(),
        denier.as_str(),
    );
    // simplest case is an exact match, check for it first
    if url_to_test == denier {
        log::trace!("exit: should_deny_absolute -> true");
        return Ok(true);
    }
    match (url_to_test.host(), denier.host()) {
        // .host() will return an enum with ipv4|6 or domain and is comparable
        // whereas .domain() returns None for ip addresses
        (Some(normed_host), Some(denier_host)) => {
            if normed_host != denier_host {
                // domains don't even match
                return Ok(false);
            }
        }
        _ => {
            // one or the other couldn't determine the host value, which probably means
            // it's not suitable for further comparison
            return Ok(false);
        }
    }
    let tested_host = url_to_test.host().unwrap(); // match above will catch errors
    // at this point, we have a matching set of ips or domain names. now we can process the
    // url path. The goal is to determine whether the given url's path is a subpath of any
    // url in the deny list, for example
    //    GIVEN URL                        URL DENY LIST               USER-SPECIFIED URLS TO SCAN
    //    http://some.domain/stuff/things, [http://some.domain/stuff], [http://some.domain] => true
    //    http://some.domain/stuff/things, [http://some.domain/stuff/things], [http://some.domain] => true
    //    http://some.domain/stuff/things, [http://some.domain/api], [http://some.domain] => false
    // the examples above are all pretty obvious, the kicker comes when the blocking url's
    // path is a parent to a scanned url
    //    http://some.domain/stuff/things, [http://some.domain/], [http://some.domain/stuff] => false
    //    http://some.domain/api, [http://some.domain/], [http://some.domain/stuff] => true
    // we want to deny all children of the parent, unless that child is a child of a scan
    // we specified through -u(s) or --stdin
    let deny_path = denier.path();
    let tested_path = url_to_test.path();
    if tested_path.starts_with(deny_path) {
        // at this point, we know that the given normalized path is a sub-path of the
        // current deny-url, now we just need to check to see if this deny-url is a parent
        // to a scanned url that is also a parent of the given url
        for ferox_scan in handles.ferox_scans()?.get_active_scans() {
            let scanner = Url::parse(ferox_scan.url().trim_end_matches('/'))
                .with_context(|| format!("Could not parse {} as a url", ferox_scan))?;
            if let Some(scan_host) = scanner.host() {
                // same domain/ip check we perform on the denier above
                if tested_host != scan_host {
                    // domains don't even match, keep on keepin' on...
                    continue;
                }
            } else {
                // couldn't process .host from scanner
                continue;
            };
            let scan_path = scanner.path();
            if scan_path.starts_with(deny_path) && tested_path.starts_with(scan_path) {
                // user-specified scan url is a sub-path of the deny-urls's path AND the
                // url to check is a sub-path of the user-specified scan url
                //
                // the assumption is the user knew what they wanted and we're going to give
                // the scanned url precedence, even though it's a sub-path
                log::trace!("exit: should_deny_absolute -> false");
                return Ok(false);
            }
        }
        log::trace!("exit: should_deny_absolute -> true");
        return Ok(true);
    }
    log::trace!("exit: should_deny_absolute -> false");
    Ok(false)
}
fn should_deny_absolute ( url_to_test : & Url , denier : & Url , handles : Arc < Handles > ) -> Result < bool > { log :: trace ! ( " " url_to_test as_str ( ) denier as_str ( ) ) ; // simplest case is an exact match, check for it first if url_to_test == denier { log :: trace ! ( " " ) ; return Ok ( true ) ; } match ( url_to_test . host ( ) , denier . host ( ) ) { // .host() will return an enum with ipv4|6 or domain and is comparable // whereas .domain() returns None for ip addresses ( Some ( normed_host ) , Some ( denier_host ) ) => { if normed_host != denier_host { // domains don't even match return Ok ( false ) ; } } _ => { // one or the other couldn't determine the host value, which probably means // it's not suitable for further comparison return Ok ( false ) ; } } let tested_host = url_to_test . host ( ) . unwrap ( ) ; // match above will catch errors // at this point, we have a matching set of ips or domain names. now we can process the // url path. The goal is to determine whether the given url's path is a subpath of any // url in the deny list, for example //    GIVEN URL                        URL DENY LIST               USER-SPECIFIED URLS TO SCAN //    http://some.domain/stuff/things, [http://some.domain/stuff], [http://some.domain] => true //    http://some.domain/stuff/things, [http://some.domain/stuff/things], [http://some.domain] => true //    http://some.domain/stuff/things, [http://some.domain/api], [http://some.domain] => false // the examples above are all pretty obvious, the kicker comes when the blocking url's // path is a parent to a scanned url //    http://some.domain/stuff/things, [http://some.domain/], [http://some.domain/stuff] => false //    http://some.domain/api, [http://some.domain/], [http://some.domain/stuff] => true // we want to deny all children of the parent, unless that child is a child of a scan // we specified through -u(s) or --stdin let deny_path = denier . path ( ) ; let tested_path = url_to_test . path ( ) ; if tested_path . starts_with ( deny_path ) { // at this point, we know that the given normalized path is a sub-path of the // current deny-url, now we just need to check to see if this deny-url is a parent // to a scanned url that is also a parent of the given url for ferox_scan in handles . ferox_scans ( ) ? . get_active_scans ( ) { let scanner = Url :: parse ( ferox_scan . url ( ) . trim_end_matches ( '/' ) ) . with_context ( | | format ! ( " " ferox_scan ) ) ? ; if let Some ( scan_host ) = scanner . host ( ) { // same domain/ip check we perform on the denier above if tested_host != scan_host { // domains don't even match, keep on keepin' on... continue ; } } else { // couldn't process .host from scanner continue ; } ; let scan_path = scanner . path ( ) ; if scan_path . starts_with ( deny_path ) && tested_path . starts_with ( scan_path ) { // user-specified scan url is a sub-path of the deny-urls's path AND the // url to check is a sub-path of the user-specified scan url // // the assumption is the user knew what they wanted and we're going to give // the scanned url precedence, even though it's a sub-path log :: trace ! ( " " ) ; return Ok ( false ) ; } } log :: trace ! ( " " ) ; return Ok ( true ) ; } log :: trace ! ( " " ) ; Ok ( false ) }
determine if a url should be denied based on the given absolute url
determine if a url should be denied based on the given absolute url
url_to_test
&Url
denier
&Url
handles
Arc<Handles>