Documentation
¶
Overview ¶
Package urlcand provides shared URL candidate extraction for reputation-feed checkers (urlhaus, threatfox, feodo). A single Extract call replaces the per-checker redundant regex walk + defang copy that the old code performed on every buffer.
The extraction logic is identical to what the old per-checker Check methods did inline: FindAll on the raw buffer (raw candidates), then — only when the cheap byte-gate fires — FindAll on the defanged copy (deobfuscated candidates). All raw candidates come first; deobfuscated ones follow. A shared budget caps the total across both passes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Candidate ¶
type Candidate struct {
Raw string // the raw URL string as found in the buffer
Deobf bool // true when found only in the defanged copy
}
Candidate is one URL string extracted from a buffer.
func Extract ¶
Extract extracts URL candidates from data. If maxURLs <= 0 it defaults to 64. Raw candidates (Deobf=false) come first; defanged candidates (Deobf=true) follow using the remaining budget. The total number of candidates never exceeds maxURLs.
The extraction mirrors the semantics of the old per-checker inline loop: budget is decremented once per regex match (not per normalized/valid URL), so the same first-N matches are produced regardless of which checker subsequently processes them.
Source Files