Saturday, May 09, 2026 AM03:21:24 HKT

2026-05-09 03:21:32 +08:00
commit 41f17b127c
884 changed files with 263824 additions and 0 deletions
@@ -0,0 +1,109 @@
+# Internal rules
+
+Internal rules are rules that can be fired by naxsi, when request is incorrect or extremely unusual - or naxsi is not able to parse the request (ie. unknown content-type).
+Please note that those rules do not set an internal score, but usually just set the `block` flag of the request to `1`.
+
+You can whitelist those, but you should never have to do so.
+When whitelisting an internal rule, you might be disabling naxsi at least partially, so think twice about it.
+
+
+
+
+## weird_request
+ * id: 1
+ * action: block
+ * impact: pass-thru
+
+A request that cannot be understood by naxsi.
+When whitelisting this one, you are telling naxsi to blindly accept the request and not to parse it.
+
+## big_request
+ * id: 2
+ * action: block
+ * impact : pass-thru
+
+A request that is buffered on file system because it's too big.
+Naxsi doesn't parse buffered requests. You can always increase [client_body_buffer_size](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size) in nginx's config.
+
+## uncommon_hex_encoding
+ * id: 10
+ * action: block
+ * impact : partial loss of decoding
+
+Hex encoding that is not valid, and that naxsi cannot "url decode".
+
+## uncommon_content_type
+ * id: 11
+ * action: block
+ * impact : pass-thru on BODY
+
+A content-type unknown to naxsi. Meaning naxsi cannot parse the body.
+However, if id:11 is whitelisted and >= 0.55rc2, [RAW_BODY](rawbody) rules can be used.
+
+## uncommon_url
+ * id: 12
+ * action: block
+ * impact: partial pass-thru on GET args
+
+An URL that is not standard (ie. `?x=foo&z=bar`). Can lead to uncorrectly parsed arguments when whitelisted.
+
+
+# uncommon_post_format
+ * id: 13
+ * action: block
+ * impact: pass-thru on BODY
+
+POST body is malformed, ie.
+ * bad content-disposition
+ * no variable name
+ * malformed attached file content-type
+
+## uncommon_post_boundary
+ * id: 14
+ * action: block
+ * impact: pass-thru on BODY
+
+POST body is malformed, ie.
+ * bad content-type
+ * bad boundary (too short, too long, not rfc compliant)
+
+## invalid_json
+ * id: 15
+ * action: block
+ * impact: pass-thru on BODY (json)
+
+JSON is malformed (ie. missing `} ]`).
+
+
+## empty_body
+ * id: 16
+ * action: block
+ * impact: pass-thru on BODY
+
+Raised when body is empty and/or content-length is zero.
+
+
+## libinjection_sql
+ * id: 17
+ * action: ??
+
+See [libinjection](libinjection-integration.md).
+
+## libinjection_xss
+ * id: 18
+ * action: ??
+
+See [libinjection](libinjection-integration.md).
+
+## no_rules
+ * id: 19
+ * action: drop
+ * impact: no rules checked
+
+Raised when naxsi isn't configured with any MainRules.
+
+## bad_utf8
+ * id: 20
+ * action: drop
+
+Raised when [surrogate utf8](https://tools.ietf.org/html/rfc3629) is detected.