Struct LfiXxeScanner 

pub struct LfiXxeScanner { /* private fields */ }

Legacy phase-eight observer with risky probes disabled by default.

Implementations

impl LfiXxeScanner

pub const fn new() -> Self

Creates the quarantined default: no LFI or XXE requests are sent.

pub fn with_oob_domain(oob_domain: String) -> Self

Retains the historical configuration shape without treating a destination string as callback proof.

No callback is contacted and no XXE request is dispatched. A future callback-capable API must accept a trusted verifier that returns a nonce-correlated receipt before it can support an OOB conclusion.

pub fn with_lfi_canary( file_id: Uuid, content_id: Uuid, ) -> Result<Self, ScannerError>

Enables verification with a benign host-provisioned canary.

The authorized fixture must expose the file through the tested query parameter while the file body contains exactly VENOM_LFI_CANARY_CONTENT_<content UUID without hyphens>. The UUIDs must be distinct version-four values so neither the requested name nor ordinary baseline text can predict the file-specific marker.

Trait Implementations

impl Clone for LfiXxeScanner

fn clone(&self) -> LfiXxeScanner

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LfiXxeScanner

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LfiXxeScanner

fn default() -> Self

Returns the “default value” for a type.

impl ScanPhase for LfiXxeScanner

fn phase_number(&self) -> u8

Phase number used to order the pipeline.

fn name(&self) -> &'static str

Human-readable phase name used in logs and events.

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: &'life1 ScanContext, ) -> Pin<Box<dyn Future<Output = Result<Vec<ScanFinding>, ScannerError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Execute phase logic and return structured findings.