-
Notifications
You must be signed in to change notification settings - Fork 419
12 post_Mod
star edited this page Jan 7, 2018
·
3 revisions
post_Mod POST请求参数过滤模块
(对应配置文件:conf_json/post_Mod.json)
该模块是整个访问控制规则的 第12步 用于配置POST请求参数的访问控制
[
{
"state": "on",
# 该条规则的开关(on/off)
"posts_data": ["\\.\\./","jio"],
# post_data匹配规则;第一个参数:匹配内容,第二个:匹配方式,正则匹配
"hostname": ["*",""],
# host匹配规则;第一个参数匹配
"action": "deny"
# 执行动作:拒绝(allow/deny/log)
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["'*.*([ |/\\*\\*/]and|or[ |/\\*\\*/]).+=.+","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["select.+(from|limit)","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["(?:(union(.*?)select))","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["having|rongjitest","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["sleep\\((\\s*)(\\d*)(\\s*)\\)","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["benchmark\\((.*)\\,(.*)\\)","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["base64_decode\\(","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["(?:from\\W+information_schema\\W)","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["(?:(?:current_)user|database|schema|connection_id)\\s*\\(","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["(?:etc\\/\\W*passwd)","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["into(\\s+)+(?:dump|out)file\\s*","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["group\\s+by.+\\(","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\(","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["xwork\\.MethodAccessor","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\\:\\/","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["java\\.lang","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["\\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\\[","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["\\<(iframe|script|body|img|layer|div|meta|style|base|object|input)","jio"],
"action": "deny"
},
{
"state": "on",
"hostname": ["*",""],
"posts_data": ["(onmouseover|onerror|onload)\\=\t","jio"],
"action": "deny"
},
... # 下一条规则
]