Flag a Log4Shell JNDI marker

Challenge

Flag a Log4Shell exploitation attempt by spotting the ${jndi: marker in a log line.

Task

Implement int has_jndi_marker(const char *line) that returns 1 if line contains the literal ${jndi: (case-insensitive), else 0.

Input

• line: a NUL-terminated log line the grader passes.

Output

Returns int: 1 if the marker is present (any case), 0 otherwise (NULL also returns 0).

Example

has_jndi_marker("user-agent: ${jndi:ldap://x/a}")  ->   1
has_jndi_marker("X: ${JNDI:rmi://y}")              ->   1   (case-insensitive)
has_jndi_marker("normal request line")            ->   0
has_jndi_marker("mentions jndi: but no brace")    ->   0
has_jndi_marker("${env:HOME}")                    ->   0
has_jndi_marker(NULL)                              ->   0

Edge cases

• A bare jndi: without the ${ prefix does not match.
• Other ${...} lookups (${env:...}) do not match.

Rules

• Detection only — nothing is executed. Heavily obfuscated variants like ${${::-j}ndi: are out of scope; this catches the common literal form.

Why this matters

The Log4Shell signature ${jndi: in a log line is a high-signal indicator of an exploitation attempt. A detector flags it for review.

Input format

A NUL-terminated log line line.

Output format

An int: 1 if line contains ${jndi: (case-insensitive), else 0.

Constraints

Case-insensitive literal match; detection only.

Starter code

int has_jndi_marker(const char *line) {
    /* TODO */
    (void)line;
    return 0;
}

Common mistakes

Case-sensitive matching (misses ${JNDI:). Matching bare 'jndi'. Forgetting NULL.

Edge cases to handle

Mixed case. Other ${...} lookups (env, sys) must not match.

Complexity

O(n×len(needle)).

Background lessons

• Detect failed-login bursts in auth.log

Up next

• Compute a CRC-32 checksum