Documentation
¶
Overview ¶
Package decoder provides safe, bounded decoding helpers for the detection pipeline.
Package decoder provides decoder functionality for CheeseWAF.
Index ¶
Constants ¶
const ( // DefaultDecodeDepth handles routinely observed nested encodings without // giving an attacker an unbounded decode loop. DefaultDecodeDepth = 10 // MaxDecodeDepth is the hard ceiling accepted by DecodeWithDepth and the // depth used by DeepDecode. Raising the ceiling covers the nested-encoding // lengths observed in 2022-2026 WAF evasion without an unbounded loop. MaxDecodeDepth = 12 )
Variables ¶
This section is empty.
Functions ¶
func FlattenJSON ¶
FlattenJSON renders raw's decoded JSON as a space-joined stream of keys and scalar values, for detectors that match against structure rather than syntax.
Documents nested deeper than maxJSONDepth are rejected with errJSONTooDeep and returned verbatim rather than partially flattened: a truncated walk drops exactly the deeply nested fields a payload would hide itself in, so whatever survived above the cutoff would read to a detector as a clean request. The untouched bytes come back alongside the error so a caller that mishandles it still hands the whole payload on instead of a truncated prefix. Callers must treat the error as "flattening unavailable", never as "no fields found".
Malformed input is returned unchanged with a nil error, matching the historical behaviour callers rely on.
Types ¶
type Decoded ¶
func DecodeWithDepth ¶
DecodeWithDepth applies at most maxDepth transforming decode layers. Values outside the supported range are normalized to the safe default/ceiling.
func DecodeWithDepthPreserveControls ¶
DecodeWithDepthPreserveControls applies the same bounded transformations as DecodeWithDepth but keeps control bytes introduced by a decoding layer. The semantic detectors use this view so a sanitizer cannot join two tokens across an encoded NUL (for example `new-%00object` -> `new-object`). Callers that need the historical sanitized text should continue using DecodeWithDepth.
func DeepDecode ¶
DeepDecode performs aggressive multi-layer decoding to reveal obfuscated payloads.
Source Files