feat: rag-embedding-ai-chat (#1)

Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #1

compliance-dast/src/agents/api_fuzzer.rs

@@ -234,10 +234,7 @@ impl ApiFuzzerAgent {
             .ok()?;
 
         let headers = response.headers();
-        let acao = headers
-            .get("access-control-allow-origin")?
-            .to_str()
-            .ok()?;
+        let acao = headers.get("access-control-allow-origin")?.to_str().ok()?;
 
         if acao == "*" || acao == "https://evil.com" {
             let acac = headers
@@ -265,12 +262,9 @@ impl ApiFuzzerAgent {
                 request_body: None,
                 response_status: response.status().as_u16(),
                 response_headers: Some(
-                    [(
-                        "Access-Control-Allow-Origin".to_string(),
-                        acao.to_string(),
-                    )]
-                    .into_iter()
-                    .collect(),
+                    [("Access-Control-Allow-Origin".to_string(), acao.to_string())]
+                        .into_iter()
+                        .collect(),
                 ),
                 response_snippet: None,
                 screenshot_path: None,

compliance-dast/src/agents/auth_bypass.rs

@@ -132,7 +132,10 @@ impl DastAgent for AuthBypassAgent {
                         String::new(),
                         target_id.clone(),
                         DastVulnType::AuthBypass,
-                        format!("HTTP method tampering: {} accepted on {}", method, endpoint.url),
+                        format!(
+                            "HTTP method tampering: {} accepted on {}",
+                            method, endpoint.url
+                        ),
                         format!(
                             "Endpoint {} accepts {} requests which may bypass access controls.",
                             endpoint.url, method

compliance-dast/src/agents/ssrf.rs

@@ -20,10 +20,7 @@ impl SsrfAgent {
             ("http://[::1]", "localhost IPv6"),
             ("http://0.0.0.0", "zero address"),
             ("http://169.254.169.254/latest/meta-data/", "AWS metadata"),
-            (
-                "http://metadata.google.internal/",
-                "GCP metadata",
-            ),
+            ("http://metadata.google.internal/", "GCP metadata"),
             ("http://127.0.0.1:22", "SSH port probe"),
             ("http://127.0.0.1:3306", "MySQL port probe"),
             ("http://localhost/admin", "localhost admin"),
@@ -91,10 +88,7 @@ impl DastAgent for SsrfAgent {
                             .post(&endpoint.url)
                             .form(&[(param.name.as_str(), payload)])
                     } else {
-                        let test_url = format!(
-                            "{}?{}={}",
-                            endpoint.url, param.name, payload
-                        );
+                        let test_url = format!("{}?{}={}", endpoint.url, param.name, payload);
                         self.http.get(&test_url)
                     };
 
@@ -133,10 +127,7 @@ impl DastAgent for SsrfAgent {
                             String::new(),
                             target_id.clone(),
                             DastVulnType::Ssrf,
-                            format!(
-                                "SSRF ({technique}) via parameter '{}'",
-                                param.name
-                            ),
+                            format!("SSRF ({technique}) via parameter '{}'", param.name),
                             format!(
                                 "Server-side request forgery detected in parameter '{}' at {}. \
                                  The application made a request to an internal resource ({}).",

compliance-dast/src/agents/xss.rs

@@ -17,26 +17,11 @@ impl XssAgent {
     fn payloads(&self) -> Vec<(&str, &str)> {
         vec![
             ("<script>alert(1)</script>", "basic script injection"),
-            (
-                "<img src=x onerror=alert(1)>",
-                "event handler injection",
-            ),
-            (
-                "<svg/onload=alert(1)>",
-                "svg event handler",
-            ),
-            (
-                "javascript:alert(1)",
-                "javascript protocol",
-            ),
-            (
-                "'\"><script>alert(1)</script>",
-                "attribute breakout",
-            ),
-            (
-                "<body onload=alert(1)>",
-                "body event handler",
-            ),
+            ("<img src=x onerror=alert(1)>", "event handler injection"),
+            ("<svg/onload=alert(1)>", "svg event handler"),
+            ("javascript:alert(1)", "javascript protocol"),
+            ("'\"><script>alert(1)</script>", "attribute breakout"),
+            ("<body onload=alert(1)>", "body event handler"),
         ]
     }
 }
@@ -65,10 +50,7 @@ impl DastAgent for XssAgent {
             for param in &endpoint.parameters {
                 for (payload, technique) in self.payloads() {
                     let test_url = if endpoint.method == "GET" {
-                        format!(
-                            "{}?{}={}",
-                            endpoint.url, param.name, payload
-                        )
+                        format!("{}?{}={}", endpoint.url, param.name, payload)
                     } else {
                         endpoint.url.clone()
                     };