Saturday, May 09, 2026 AM03:21:24 HKT
This commit is contained in:
@@ -0,0 +1,52 @@
|
||||
# SPDX-FileCopyrightText: 2023 wargio <deroad@libero.it>
|
||||
# SPDX-License-Identifier: LGPL-3.0-only
|
||||
|
||||
master_process off;
|
||||
daemon off;
|
||||
|
||||
load_module @TEST_NGINX_NAXSI_MODULE_SO@;
|
||||
events {
|
||||
worker_connections 1024;
|
||||
use select;
|
||||
}
|
||||
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
@RULES_NGINX_NAXSI_CORE@
|
||||
@RULES_NGINX_NAXSI_BLOCKING@
|
||||
|
||||
server {
|
||||
listen 4242;
|
||||
server_name localhost;
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
SecRulesEnabled; #enable naxsi
|
||||
LibInjectionSql; #enable libinjection support for SQLI
|
||||
LibInjectionXss; #enable libinjection support for XSS
|
||||
|
||||
#the location where naxsi will redirect the request when it is blocked
|
||||
DeniedUrl "/NaxsiRequestDenied";
|
||||
|
||||
#the action to take when the $SQL score is superior or equal to 8
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 5" BLOCK;
|
||||
CheckRule "$UPLOAD >= 5" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$UWA >= 8" BLOCK;
|
||||
CheckRule "$EVADE >= 8" BLOCK;
|
||||
|
||||
@RULES_NGINX_NAXSI_WHITELISTS@
|
||||
|
||||
return 200 "200 $request_uri\n";
|
||||
}
|
||||
location /NaxsiRequestDenied {
|
||||
internal;
|
||||
return 406; # Not Acceptable
|
||||
}
|
||||
}
|
||||
}
|
||||
+39
@@ -0,0 +1,39 @@
|
||||
# SPDX-FileCopyrightText: 2022-2023 wargio <deroad@libero.it>
|
||||
# SPDX-License-Identifier: LGPL-3.0-only
|
||||
|
||||
master_process off;
|
||||
daemon off;
|
||||
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
events {
|
||||
worker_connections 1024;
|
||||
use select;
|
||||
}
|
||||
http {
|
||||
include mime.types;
|
||||
default_type application/octet-stream;
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
server {
|
||||
listen 4242 ssl http2;
|
||||
ssl_certificate nginx.crt;
|
||||
ssl_certificate_key nginx.key;
|
||||
server_name localhost;
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/50x.html";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$EVADE >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200;
|
||||
}
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
return 500;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
# -* coding: utf-8
|
||||
# SPDX-FileCopyrightText: 2022 Alex <alex@staticlibs.net>
|
||||
# SPDX-License-Identifier: LGPL-3.0-only
|
||||
+364
@@ -0,0 +1,364 @@
|
||||
# -* coding: utf-8
|
||||
# SPDX-FileCopyrightText: 2022 Alex <alex@staticlibs.net>
|
||||
# SPDX-License-Identifier: LGPL-3.0-only
|
||||
|
||||
import os, re, shutil, socket, subprocess, time
|
||||
from os import path
|
||||
|
||||
|
||||
class NaxsiTestException(Exception):
|
||||
pass
|
||||
|
||||
def is_posix():
|
||||
return "posix" == os.name
|
||||
|
||||
def get_naxsi_dir():
|
||||
python_dir = path.dirname(__file__)
|
||||
unit_tests_dir = path.dirname(python_dir)
|
||||
return path.dirname(unit_tests_dir)
|
||||
|
||||
def get_nginx_dir():
|
||||
naxsi_dir = get_naxsi_dir()
|
||||
return path.join(naxsi_dir, "nginx-tmp")
|
||||
|
||||
def get_nginx_pid_path():
|
||||
nginx_dir = get_nginx_dir()
|
||||
if is_posix():
|
||||
return path.join(nginx_dir, "naxsi_ut", "nginx.pid")
|
||||
else:
|
||||
return path.join(nginx_dir, "logs", "nginx.pid")
|
||||
|
||||
def get_naxsi_module_so_path():
|
||||
nginx_dir = get_nginx_dir()
|
||||
return path.join(nginx_dir, "naxsi_ut", "modules", "ngx_http_naxsi_module.so")
|
||||
|
||||
def get_naxsi_rules_path():
|
||||
naxsi_dir = get_naxsi_dir()
|
||||
return path.join(naxsi_dir, "naxsi_rules", "naxsi_core.rules")
|
||||
|
||||
def get_naxsi_blocking_rules_dir():
|
||||
naxsi_dir = get_naxsi_dir()
|
||||
return path.join(naxsi_dir, "naxsi_rules", "blocking")
|
||||
|
||||
def get_naxsi_whitelists_rules_dir():
|
||||
naxsi_dir = get_naxsi_dir()
|
||||
return path.join(naxsi_dir, "naxsi_rules", "whitelists")
|
||||
|
||||
def get_error_log_path():
|
||||
nginx_dir = get_nginx_dir()
|
||||
if is_posix():
|
||||
log_dir = path.join(nginx_dir, "naxsi_ut")
|
||||
else:
|
||||
log_dir = path.join(nginx_dir, "logs")
|
||||
return path.join(log_dir, "error.log")
|
||||
|
||||
def format_rules_list(rules_dir):
|
||||
names = os.listdir(rules_dir)
|
||||
paths = list(map(lambda n: path.join(rules_dir, n).replace("\\", "/"), names))
|
||||
includes = list(map(lambda p: "include {};".format(p), paths));
|
||||
return "\n".join(includes)
|
||||
|
||||
def write_nginx_conf(port, http_config, config):
|
||||
nginx_dir = get_nginx_dir().replace("\\", "/")
|
||||
main_config = ""
|
||||
if is_posix():
|
||||
naxsi_module_so = get_naxsi_module_so_path()
|
||||
main_config = "load_module {};".format(naxsi_module_so)
|
||||
naxsi_rules = get_naxsi_rules_path().replace("\\", "/")
|
||||
http_config = http_config.replace("$TEST_NGINX_NAXSI_RULES", naxsi_rules)
|
||||
blocking_rules = format_rules_list(get_naxsi_blocking_rules_dir())
|
||||
http_config = http_config.replace("include $TEST_NGINX_NAXSI_BLOCKING_RULES/*;", blocking_rules)
|
||||
config = config.replace("$TEST_NGINX_SERVROOT", nginx_dir)
|
||||
whitelists_rules = format_rules_list(get_naxsi_whitelists_rules_dir())
|
||||
config = config.replace("include $TEST_NGINX_NAXSI_WHITELISTS_RULES/*;", whitelists_rules)
|
||||
conf = """
|
||||
worker_processes 1;
|
||||
%s
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
http {
|
||||
%s
|
||||
server {
|
||||
listen %s;
|
||||
server_name localhost;
|
||||
%s
|
||||
}
|
||||
}
|
||||
""" % (main_config, http_config, port, config)
|
||||
conf_dir = "naxsi_ut" if is_posix() else "conf"
|
||||
nginx_conf = path.join(nginx_dir, conf_dir, "nginx.conf")
|
||||
with open(nginx_conf, "w", encoding="utf-8") as file:
|
||||
file.write(conf)
|
||||
|
||||
def start_nginx():
|
||||
nginx_dir = get_nginx_dir()
|
||||
if is_posix():
|
||||
nginx_exe = path.join(nginx_dir, "sbin", "nginx")
|
||||
else:
|
||||
nginx_exe = path.join(nginx_dir, "nginx.exe")
|
||||
if not path.isfile(nginx_exe):
|
||||
raise NaxsiTestException("Nginx executable not found, directory: [{}]".format(nginx_dir))
|
||||
return subprocess.Popen([nginx_exe], cwd=nginx_dir)
|
||||
|
||||
def get_children_pids(parent_pid):
|
||||
res = []
|
||||
children_pids_text = subprocess.run(["/usr/bin/ps", "-o", "pid", "--ppid", str(parent_pid)],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.STDOUT).stdout.decode("utf-8")
|
||||
for child_pid_text in children_pids_text.split("\n")[1:-1]:
|
||||
child_pid = int(child_pid_text.strip())
|
||||
res.append(child_pid)
|
||||
#grandchildren_pids = get_children_pids(child_pid)
|
||||
#res.extend(grandchildren_pids)
|
||||
return res
|
||||
|
||||
def read_pid_from_file(nginx_pid_path):
|
||||
if not path.isfile(nginx_pid_path):
|
||||
return None
|
||||
with open(nginx_pid_path, encoding="utf-8") as file:
|
||||
return int(file.read().strip())
|
||||
|
||||
def kill_nginx(proc=None):
|
||||
nginx_pid_path = get_nginx_pid_path()
|
||||
if is_posix() or proc is None:
|
||||
master_pid = read_pid_from_file(nginx_pid_path)
|
||||
else:
|
||||
master_pid = proc.pid
|
||||
if master_pid is None:
|
||||
return
|
||||
try:
|
||||
if is_posix():
|
||||
worker_pid_list = get_children_pids(master_pid)
|
||||
pid_list = [master_pid]
|
||||
pid_list.extend(worker_pid_list)
|
||||
for pid in pid_list:
|
||||
subprocess.run(["/usr/bin/kill", "-9", str(pid)],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
|
||||
for pid in pid_list:
|
||||
subprocess.run(["/usr/bin/tail", "--pid={}".format(pid), "-f", "/dev/null"],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
|
||||
else:
|
||||
subprocess.run(["c:/windows/system32/taskkill.exe", "/f", "/t", "/pid", str(proc.pid)],
|
||||
stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
|
||||
if proc is not None:
|
||||
proc.wait()
|
||||
finally:
|
||||
if path.isfile(nginx_pid_path):
|
||||
os.remove(nginx_pid_path)
|
||||
|
||||
def read_headers(sock, buf):
|
||||
view = memoryview(buf)
|
||||
write_pos = 0
|
||||
for _ in range(32):
|
||||
read = sock.recv_into(view[write_pos:])
|
||||
write_pos += read
|
||||
for i in range(3, write_pos):
|
||||
if b"\r\n\r\n" == buf[i - 3:i + 1]:
|
||||
return i + 1, write_pos
|
||||
time.sleep(0.1)
|
||||
raise NaxsiTestException("Headers read failed, read: [{}]".format(buf[:write_pos]))
|
||||
|
||||
def parse_headers(buf, data_begin_pos):
|
||||
lines = buf[:data_begin_pos].split(b"\r\n")
|
||||
status = int(lines[0].split(b" ")[1])
|
||||
headers = {}
|
||||
for ln in lines[1:-2]:
|
||||
parts = ln.decode("utf-8").split(": ")
|
||||
headers[parts[0]] = parts[1]
|
||||
return status, headers
|
||||
|
||||
def read_response(sock):
|
||||
buf = bytearray(4096)
|
||||
data_begin_pos, write_pos = read_headers(sock, buf)
|
||||
status, headers = parse_headers(buf, data_begin_pos)
|
||||
clen = int(headers["Content-Length"])
|
||||
buffered = write_pos - data_begin_pos
|
||||
remaining = clen - buffered
|
||||
if remaining > 0:
|
||||
view = memoryview(buf)
|
||||
for _ in range(32):
|
||||
read = sock.recv_into(view[write_pos:])
|
||||
write_pos += read
|
||||
remaining -= read
|
||||
if remaining <= 0:
|
||||
break
|
||||
time.sleep(0.1)
|
||||
if remaining > 0:
|
||||
raise NaxsiTestException("Body read failed, read: [{}]".format(buf[:write_pos]))
|
||||
body = bytes(buf[data_begin_pos:data_begin_pos + clen])
|
||||
return status, headers, body
|
||||
|
||||
def includes_header(headers, name):
|
||||
lname = name.lower()
|
||||
filtered = list(filter(lambda n: n.lower() == lname, headers.keys()))
|
||||
return len(filtered) > 0
|
||||
|
||||
def send_request(port, url_path, method, headers, data):
|
||||
header_lines = [
|
||||
"{} {} HTTP/1.1".format(method, url_path),
|
||||
]
|
||||
if not includes_header(headers, "Host"):
|
||||
header_lines.append("Host: 127.0.0.1:{}".format(port))
|
||||
if not includes_header(headers, "User-Agent"):
|
||||
header_lines.append("User-Agent: Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10")
|
||||
for name, val in headers.items():
|
||||
header_lines.append("{}: {}".format(name, val))
|
||||
if data is not None and len(data) > 0 and not includes_header(headers, "Content-Length"):
|
||||
header_lines.append("Content-Length: {}".format(len(data)))
|
||||
header_lines.extend(["", ""])
|
||||
req_bytes = "\r\n".join(header_lines).encode("utf-8")
|
||||
if data is not None:
|
||||
req_bytes += data
|
||||
return send_raw_request(port, req_bytes)
|
||||
|
||||
def send_raw_request(port, data):
|
||||
for _ in range(4):
|
||||
try:
|
||||
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
|
||||
sock.connect(("127.0.0.1", port))
|
||||
sock.sendall(data)
|
||||
status, headers, body = read_response(sock)
|
||||
return status, headers, body
|
||||
except (ConnectionRefusedError, ConnectionResetError):
|
||||
time.sleep(0.1)
|
||||
raise NaxsiTestException("Connection failed, port: [{}]".format(port))
|
||||
|
||||
def send_curl(port, url_path, method, headers, data, curl_protocol, curl_options):
|
||||
if is_posix():
|
||||
curl_exe = ["curl"]
|
||||
else:
|
||||
curl_exe = ["curl.exe"]
|
||||
curl_exe.extend(['-i', '-H', 'User-Agent:', '-H', 'Accept:', '-sS'])
|
||||
if curl_options is not None and len(curl_options) > 0:
|
||||
curl_exe.extend(curl_options.split())
|
||||
if not includes_header(headers, "Host"):
|
||||
curl_exe.extend(['-H', "'Host: localhost'"])
|
||||
for name, val in headers.items():
|
||||
curl_exe.extend(['-H', "'{}: {}'".format(name, val)])
|
||||
if data is not None and len(data) > 0 and not includes_header(headers, "Content-Length"):
|
||||
curl_exe.extend(['-H', "'Content-Length: {}'".format(len(data))])
|
||||
if data is not None and len(data) > 0:
|
||||
curl_exe.extend(['-d', "'{}'".format(data)])
|
||||
if method is not None and len(method) > 0:
|
||||
if "HEAD" == method:
|
||||
curl_exe.append('-I')
|
||||
elif "GET" != method:
|
||||
curl_exe.extend(['-X', "'{}'".format(method)])
|
||||
curl_exe.append('{}://127.0.0.1:{}{}'.format(curl_protocol, port, url_path))
|
||||
# print(curl_exe)
|
||||
# print(" ".join(curl_exe))
|
||||
curl_proc = subprocess.Popen(curl_exe, stdout=subprocess.PIPE, stderr=subprocess.PIPE, encoding="utf-8")
|
||||
curl_proc.wait()
|
||||
try:
|
||||
outs, errs = curl_proc.communicate(timeout=15)
|
||||
except TimeoutExpired:
|
||||
curl_proc.kill()
|
||||
outs, errs = curl_proc.communicate()
|
||||
|
||||
if outs is None or len(outs) == 0:
|
||||
if errs is not None and len(errs) > 0:
|
||||
raise NaxsiTestException('ERROR: curl command generates stderr output: "{}"'.format(errs))
|
||||
raise NaxsiTestException('ERROR: curl command generates no stdout output')
|
||||
if errs is not None and len(errs) > 0:
|
||||
print('WARNING: curl command generates stderr output: "{}"'.format(errs))
|
||||
|
||||
crlf = "\n"
|
||||
data_begin_pos = 0
|
||||
for i in range(len(crlf)*2, len(outs)):
|
||||
if crlf+crlf == outs[i - len(crlf)*2:i]:
|
||||
data_begin_pos = i
|
||||
break
|
||||
lines = outs[:data_begin_pos].split(crlf)
|
||||
status = int(lines[0].split(" ")[1])
|
||||
out_headers = {}
|
||||
for ln in lines[1:-2]:
|
||||
parts = ln.split(": ")
|
||||
out_headers[parts[0]] = parts[1]
|
||||
return status, out_headers, outs[data_begin_pos:]
|
||||
|
||||
def write_user_files(files):
|
||||
nginx_dir = get_nginx_dir()
|
||||
for name, value in files.items():
|
||||
filepath = path.join(nginx_dir, "html", name)
|
||||
if name != path.basename(name):
|
||||
os.makedirs(path.dirname(filepath))
|
||||
with open(filepath, "w", encoding="utf-8") as file:
|
||||
file.write(value)
|
||||
|
||||
def delete_user_files(files):
|
||||
nginx_dir = get_nginx_dir()
|
||||
for name in files.keys():
|
||||
filepath = path.join(nginx_dir, "html", name)
|
||||
if name == path.basename(name):
|
||||
os.remove(filepath)
|
||||
else:
|
||||
shutil.rmtree(path.dirname(filepath))
|
||||
|
||||
def delete_error_log():
|
||||
error_log = get_error_log_path()
|
||||
if path.exists(error_log):
|
||||
os.remove(error_log)
|
||||
|
||||
def error_log_matches_re(regexes):
|
||||
error_log = get_error_log_path()
|
||||
with open(error_log, encoding="utf-8") as file:
|
||||
lines = file.readlines()
|
||||
filtered = list(filter(lambda l: " NAXSI_" in l or " {\"" in l, lines))
|
||||
for rg in regexes:
|
||||
for fl in filtered:
|
||||
if rg.match(fl) is not None:
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
class nginx_runner():
|
||||
def __init__(self,
|
||||
http_config="",
|
||||
config="",
|
||||
port=8080,
|
||||
user_files={},
|
||||
):
|
||||
self.port = port
|
||||
self.http_config = http_config
|
||||
self.config = config
|
||||
self.user_files = user_files
|
||||
|
||||
self.proc = None
|
||||
|
||||
def __enter__(self):
|
||||
kill_nginx(self.proc)
|
||||
write_nginx_conf(self.port, self.http_config, self.config)
|
||||
write_user_files(self.user_files)
|
||||
delete_error_log()
|
||||
self.proc = start_nginx()
|
||||
return self
|
||||
|
||||
def __exit__(self, exc_type, exc_value, traceback):
|
||||
if self.proc is not None:
|
||||
kill_nginx(self.proc)
|
||||
delete_user_files(self.user_files)
|
||||
|
||||
def request(self, url, method="GET", headers={}, data=None, resp_body_required=False, curl=False, curl_protocol="http", curl_options=""):
|
||||
if data is not None and type(data) == str:
|
||||
data = data.encode("utf-8")
|
||||
if not curl:
|
||||
status, _, body = send_request(self.port, url, method, headers, data)
|
||||
else:
|
||||
status, _, body = send_curl(self.port, url, method, headers, data, curl_protocol, curl_options)
|
||||
if resp_body_required:
|
||||
return status, body
|
||||
else:
|
||||
return status
|
||||
|
||||
def raw_request(self, data):
|
||||
if data is not None and type(data) == str:
|
||||
data = data.encode("utf-8")
|
||||
if data.startswith(b"\n"):
|
||||
data = data[1:]
|
||||
data = data.replace(b"\\r", b"\r")
|
||||
status, _, _ = send_raw_request(self.port, data)
|
||||
return status
|
||||
|
||||
def error_log_matches(self, lst):
|
||||
regexes = list(map(lambda st: re.compile(r"^.*" + st + r".*$"), lst))
|
||||
return error_log_matches_re(regexes)
|
||||
+1421
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Binary file not shown.
@@ -0,0 +1,151 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1: Basic GET request
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=buibui
|
||||
--- error_code: 200
|
||||
=== TEST 2: DENY : Obvious GET XSS
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a="><ScRiPt>alert(1)</scRiPt>
|
||||
--- error_code: 412
|
||||
=== TEST 2.1: DENY : Obvious RFI
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 2" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=http://evil.com/eva.txt
|
||||
--- error_code: 412
|
||||
=== TEST 2.3: DENY : Obvious LFI
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 2" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=../../../../../bar.txt
|
||||
--- error_code: 412
|
||||
=== TEST 3: OBVIOUS GET SQL INJECTION
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=1'+Or+'1'='1
|
||||
--- error_code: 412
|
||||
=== TEST 3bis: OBVIOUS (quoteless) GET SQL INJECTION
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=1+UnIoN+SeLeCt+1
|
||||
--- error_code: 412
|
||||
+1317
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,500 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== WL TEST 5.0: Two whitelists on two named arguments, same URL
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:bla|$URL:/buixor";
|
||||
BasicRule wl:1998 "mz:$ARGS_VAR:blu|$URL:/buixor";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?bla=1999
|
||||
--- error_code: 200
|
||||
=== WL TEST 5.1: Two whitelists on two named arguments, same URL
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:bla|$URL:/buixor";
|
||||
BasicRule wl:1998 "mz:$ARGS_VAR:blu|$URL:/buixor";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?blu=1999
|
||||
--- error_code: 412
|
||||
=== WL TEST 5.2: Two whitelists on two named arguments, same URL
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:bla|$URL:/buixor";
|
||||
BasicRule wl:1998 "mz:$ARGS_VAR:blu|$URL:/buixor";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?bla=1999&blu=1998
|
||||
--- error_code: 200
|
||||
=== WL TEST 5.3: Two whitelists on two named arguments, same URL
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:bla|$URL:/buixor";
|
||||
BasicRule wl:1998 "mz:$ARGS_VAR:blu|$URL:/buixor";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?buixor=1998
|
||||
--- error_code: 412
|
||||
=== WL TEST 5.4: Whitelists on ARGS/URLs that are URLencoded
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:b_@_la|$URL:/buixor";
|
||||
BasicRule wl:1998 "mz:$ARGS_VAR:blu|$URL:/buixor";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?b_@_la=1999
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 5.5: Whitelists on ARGS/URLs that are URLencoded
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:b[]la|$URL:/buixor";
|
||||
BasicRule wl:1998 "mz:$ARGS_VAR:blu|$URL:/buixor";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?b]la=1999
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 6: Whitelists trying to provoke collisions ($ARGS_VAR:x + $URL:x|ARGS)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
>>> bla
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
# BasicRule wl:1999 "mz:$ARGS_VAR:/bla";
|
||||
BasicRule wl:1998 "mz:$URL:/bla|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /bla?1998
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 6.0: Whitelists trying to provoke collisions ($ARGS_VAR:x + $URL:x|ARGS)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
# BasicRule wl:1999 "mz:$ARGS_VAR:/bla";
|
||||
BasicRule wl:1998 "mz:$URL:/bla|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?/bla=1998
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 6.1: Whitelists trying to provoke collisions ($ARGS_VAR:x + $URL:x|ARGS)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
>>> bla
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:bla";
|
||||
BasicRule wl:1998 "mz:$URL:/bla|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /bla?bla=1999&toto=1998
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 6.2: Whitelists trying to provoke collisions ($ARGS_VAR:x + $URL:x|ARGS)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:/bla";
|
||||
BasicRule wl:1998 "mz:$URL:/bla|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?/bla=1999
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 6.3: Whitelists trying to provoke collisions ($ARGS_VAR:x + $URL:x|ARGS)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
>>> bla
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:/bla";
|
||||
BasicRule wl:1998 "mz:$URL:/bla|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /bla?/bla=1999&bu=1998
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== WL TEST 7.0: Whitelists robots.txt as MainRule
|
||||
--- user_files
|
||||
>>> robots.txt
|
||||
aaaa
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule id:20000003 "s:$UWA:8" "rx:\.txt$" "mz:URL" "msg:file access to .txt";
|
||||
MainRule wl:20000003 "mz:$URL:/robots.txt|URL";
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /robots.txt
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== WL TEST 7.1: Whitelists robots.txt as BasicRule
|
||||
--- user_files
|
||||
>>> robots.txt
|
||||
aaaa
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule id:20000003 "s:$UWA:8" "rx:\.txt$" "mz:URL" "msg:file access to .txt";
|
||||
--- config
|
||||
location / {
|
||||
BasicRule wl:20000003 "mz:$URL:/robots.txt|URL";
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /robots.txt
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 8: Whitelists inheritance
|
||||
--- user_files
|
||||
>>> robots.txt
|
||||
aaaa
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule id:20000003 "s:$UWA:8" "rx:\.txt$" "mz:URL" "msg:file access to .txt";
|
||||
--- config
|
||||
location / {
|
||||
BasicRule wl:20000003 "mz:$URL:/robots.txt|URL";
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
location /child/ {
|
||||
return 200 "200 $request_uri";
|
||||
}
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /child/robots.txt
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== WL TEST 9: FILE_EXT can be mixed with URL_X
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
BasicRule wl:1500 "mz:$URL_X:^/submit/\d+/feedback$|FILE_EXT";
|
||||
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$UPLOAD >= 8" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"POST /submit/875411/feedback HTTP/1.1\r
|
||||
Host: 127.0.0.1\r
|
||||
Connection: Close\r
|
||||
User-Agent: Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B334b Safari/531.21.10\r
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r
|
||||
Accept-Language: en-us,en;q=0.5\r
|
||||
Accept-Encoding: gzip, deflate\r
|
||||
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r
|
||||
Referer: http://127.0.0.1/index.html\r
|
||||
Content-Type: multipart/form-data; boundary=---------------------------85477017311078916741744433009\r
|
||||
Content-Length: 3264\r
|
||||
\r
|
||||
-----------------------------85477017311078916741744433009\r
|
||||
Content-Disposition: form-data; name=\"textline\"\r
|
||||
\r
|
||||
valid text bad file\r
|
||||
-----------------------------85477017311078916741744433009\r
|
||||
Content-Disposition: form-data; name=\"datafile\"; filename=\"bla_med.phx\"\r
|
||||
Content-Type: application/octet-stream\r
|
||||
\r
|
||||
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000\r
|
||||
-----------------------------85477017311078916741744433009--\r
|
||||
"
|
||||
--- error_code: 404
|
||||
|
||||
@@ -0,0 +1,198 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== WL TEST 1.0: weird request in URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?&&&&a&&&&&
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.0a: weird request in URL (?&...)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?&a=2
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.0b: weird request in URL (?...&&...)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=2&&b=3
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.0c: weird request in URL (?...&)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=2&
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.01: weird request in URL (wl on fullzone)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:12 "mz:ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?&&&&a&&&&&
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.02: weird request in URL (wl on zone+URL)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:12 "mz:$URL:/|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?&&&&a&&&&&
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.03: weird request in URL (fail wl on zone+bad URL)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:12 "mz:$URL:/a|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?&&&&a&&&&&
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.04: weird request in URL (fail wl on bad zone+URL)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:12 "mz:$URL:/|URL";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?&&&&a&&&&&
|
||||
--- error_code: 412
|
||||
@@ -0,0 +1,725 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== WL TEST 1.0: Obvious test in arg
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.01: Check non-collision of zone and 'name' flag
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule id:5 "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42";
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=foobar
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.1: Generic whitelist in ARGS_NAME
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== WL TEST 1.11: Generic whitelist in ARGS_NAME, limit
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.12: Generic whitelist in ARGS_NAME, limit
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=foobar
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.2: whitelist in ARGS_NAME+$URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.21: whitelist in ARGS_NAME+$URL, limit
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.22: whitelist in ARGS_NAME+$URL, limit
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=foobar
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== WL TEST 1.3: failed whitelist in ARGS_NAME+$URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/z|ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.31: failed whitelist in ARGS_NAME+$URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=foobar
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.32: failed whitelist in ARGS_NAME+$URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:b|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?b=foobar
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.33: failed whitelist in ARGS_NAME+$URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=bui
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.34: failed whitelist in ARGS_NAME+$URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:foobra" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:2999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
BasicRule wl:2999 "mz:$URL:/|$ARGS_VAR:foobar";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=foobra
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.35: failed whitelist in ARGS_NAME+$URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:foobra" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:2999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
BasicRule wl:2999 "mz:$URL:/|$ARGS_VAR:foobar";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=foobar
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.36: failed whitelist in ARGS_NAME+$URL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:foobra" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:2999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
BasicRule wl:2999 "mz:$URL:/|$ARGS_VAR:foobar";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=foobar
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== WL TEST 1.4: whitelist in ARGS_NAME+$URL+$ARGS_VAR
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.41: whitelist in ARGS_NAME+$URL+$ARGS_VAR
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=foobar
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== WL TEST 1.5: whitelist in ARGS_NAME+$URL+$ARGS_VAR, limit
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=foobar
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== WL TEST 1.51: whitelist in ARGS_NAME+$URL+$ARGS_VAR, limit
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=foo
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.6: whitelist in $URL+$ARGS_VAR | NAME, (collision)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar|NAME";
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR:foobar";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=foobar
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.6.1: whitelist in $URL+ARGS | NAME, (collision)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=foobar
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.6.2: whitelist in $URL+ARGS | NAME, (collision)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=lol
|
||||
--- error_code: 200
|
||||
=== WL TEST 1.6.3: whitelist in $URL+ARGS | NAME, (collision)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?lol=foobar
|
||||
--- error_code: 200
|
||||
=== WL TEST 1.6.4: whitelist in $URL+ARGS | NAME, (collision)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
# BasicRule wl:1999 "mz:$URL:/|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?lol=foobar
|
||||
--- error_code: 412
|
||||
=== WL TEST 1.6.5: whitelist in $URL+ARGS | NAME, (collision)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
# BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=lol
|
||||
--- error_code: 412
|
||||
=== WL TEST 1.6.6: whitelist in $URL+ARGS | NAME, (collision)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
# BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?lol=foobar
|
||||
--- error_code: 200
|
||||
=== WL TEST 1.6.7: whitelist in $URL+ARGS | NAME, (collision)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL:/|ARGS|NAME";
|
||||
# BasicRule wl:1999 "mz:$URL:/|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?lol=foobar
|
||||
--- error_code: 412
|
||||
|
||||
@@ -0,0 +1,367 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
__DATA__
|
||||
|
||||
=== WL TEST 1.0
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "str:foobar" "msg:foobar test pattern" "mz:$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?b=toto
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.01
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "str:foobar" "msg:foobar test pattern" "mz:$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?b=foobar
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.03
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "str:foobar" "msg:foobar test pattern" "mz:$URL:/|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=foobar
|
||||
--- error_code: 404
|
||||
|
||||
=== WL TEST 1.04
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "str:foobar" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=foobrar
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== WL TEST 2.0
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:foobar" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=foobrar
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== WL TEST 2.01
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:foobar" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=foobar
|
||||
--- error_code: 404
|
||||
|
||||
|
||||
=== WL TEST 2.02
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^foobar" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?b=foobar
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 2.03
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^foobar" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=rfoobar
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
=== WL TEST 2.04
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^foobar" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=foobar
|
||||
--- error_code: 404
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
=== WL TEST 2.05
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^foobar$" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=foobar
|
||||
--- error_code: 404
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
=== WL TEST 2.06
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^foobar$" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=foobara
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
=== WL TEST 2.07
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^[0-9]+$" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=foobara
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== WL TEST 2.08
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^[0-9]+$" "msg:foobar test pattern" "mz:$URL:/a|$ARGS_VAR:b" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /a?b=1234
|
||||
--- error_code: 404
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,884 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST: AND+%EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87 UTF-8
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=AND+%EF%BC%871%EF%BC%87=%EF%BC%871%EF%BC%87 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST: AND+%00%271%00%27=%00%271%00%27
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=AND+%00%271%00%27=%00%271%00%27 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: AND+1=1%00 Union select 1
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=AND+1=1%00%20Union%20select%201 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: base64, worthing checking
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=MScgQU5EIFNMRUVQKDUpIw== HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST: 'A+NOT+BETWEEN+0+AND+B'
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a='A+NOT+BETWEEN+0+AND+B' HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=%2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: %u0053%u0045%u004c%u0045%u0043%u0054%u0020
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=%u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045' HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: SELECT+*+FROM+users+WHERE+id+LIKE+1
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=SELECT+*+FROM+users+WHERE+id+LIKE+1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR'
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),+NULL,+NULL#/*!0AND+'QDWa'='QDWa HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: IF(ISNULL(1),+2,+1)
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=IF(ISNULL(1),+2,+1) HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: 1+/*!30000AND+2>1*/--
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1+/*!30000AND+2>1*/-- HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: 1+/*!00000AND+2>1*/--
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1+/*!00000AND+2>1*/-- HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: +UNION+++SELECT++
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=+UNION+++SELECT++ HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: IIS/ASP Encoding
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=%S%E%L%E%C%T+%F%I%E%L%D+%F%R%O%M+%T%A%B%L%E HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: 1 UnioN SeLEct 1
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1%20UnioN%20SeLEct%201 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: AND+1=1+and+'0having'='0having'
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=AND+1=1+and+'0having'='0having' HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: SELECT/**/id/**/FROM/**/users
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=SELECT/**/id/**/FROM/**/users HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: 1--PTTmJopxdWJ%0AAND--cWfcVRPV%0A9227=9227
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1--PTTmJopxdWJ%0AAND--cWfcVRPV%0A9227=9227 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: 1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1%23PTTmJopxdWJ%0AAND%23cWfcVRPV%0A9227=9227 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: SELECT%08id%02FROM%0Fusers
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=SELECT%08id%02FROM%0Fusers HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: 1%23%0A9227=922%237
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1%23%0A9227=922%237 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: SELECT%0Bid%0BFROM%A0users
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=SELECT%0Bid%0BFROM%A0users HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: 1--%0AAND--%0A9227=9227
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1--%0AAND--%0A9227=9227 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: SELECT+id+FROM+users
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=SELECT+id+FROM+users HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== TEST: hey 28
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1%bf%27+AND+1=1--%20 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: hey 29
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,+CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))# HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST: hey 30
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))# HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
@@ -0,0 +1,419 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1.0 : Runtime Learning force (per ip)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
if ($remote_addr = "127.0.0.1") {
|
||||
set $naxsi_flag_learning 1;
|
||||
}
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.01 : Runtime Learning force (absolute)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_learning 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 1.1: Runtime Learning force (fail - per ip)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
if ($remote_addr = "127.0.0.42") {
|
||||
set $naxsi_flag_learning 1;
|
||||
}
|
||||
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.2: Runtime Learning force (fail - in location)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
# this will not work, as naxsi
|
||||
# is processed before var set in location.
|
||||
set $naxsi_flag_learning 1;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== TEST 1.3: Runtime Learning disable (per ip)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
if ($remote_addr = "127.0.0.1") {
|
||||
set $naxsi_flag_learning 0;
|
||||
}
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.4: Runtime Learning disable (fail - per ip)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
if ($remote_addr = "127.0.0.42") {
|
||||
set $naxsi_flag_learning 0;
|
||||
}
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 2.00 : Check that SecRulesDisabled correctly works
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
SecRulesDisabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 2: Runtime disable force (absolute)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_enable 0;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 2.2: Runtime enable force
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_enable 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
SecRulesDisabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 2.3: Runtime enable force, with static learning (which is pointless)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_enable 1;
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
SecRulesDisabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 2.4: Runtime enable + learning mode (absolute)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_learning 1;
|
||||
set $naxsi_flag_enable 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
SecRulesDisabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 3.0: Runtime enable + learning mode (per ip)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
if ($remote_addr = "127.0.0.1") {
|
||||
set $naxsi_flag_enable 1;
|
||||
set $naxsi_flag_learning 1;
|
||||
}
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
SecRulesDisabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 3.1: Runtime enable + learning mode (per ip)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
if ($remote_addr = "127.0.0.42") {
|
||||
set $naxsi_flag_enable 1;
|
||||
set $naxsi_flag_learning 1;
|
||||
}
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
SecRulesDisabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 3.2: Runtime enable + learning mode (per ip)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_enable 1;
|
||||
if ($remote_addr = "127.0.0.1") {
|
||||
set $naxsi_flag_learning 1;
|
||||
}
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
SecRulesDisabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 3.3: Runtime enable (success) + learning mode (fail - per ip)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_enable 1;
|
||||
if ($remote_addr = "127.0.0.42") {
|
||||
set $naxsi_flag_learning 1;
|
||||
}
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
SecRulesDisabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,62 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== WL TEST 1.0: Obvious test in arg
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.1: Obvious test in arg
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:foobar|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foobar=a
|
||||
--- error_code: 200
|
||||
|
||||
+43
@@ -0,0 +1,43 @@
|
||||
#vi:filetype=perl
|
||||
# This File is used for broken tests.
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(4) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
|
||||
=== TEST: 1 UnioN SeLEct 1
|
||||
--- main_config
|
||||
working_directory /tmp/;
|
||||
worker_rlimit_core 25M;
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a=1%20UnioN%20SeLEct%201 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
+1046
File diff suppressed because it is too large
Load Diff
+560
@@ -0,0 +1,560 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== json wl 0.1 : no rulematch
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
{
|
||||
\"lol\" : \"bar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
=== json wl 0.2 : rulematch
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
{
|
||||
\"lol\" : \"foobar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 412
|
||||
=== json wl 0.3 : rulematch + wl on full zone
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:BODY";
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
{
|
||||
\"lol\" : \"foobar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
=== json wl 0.4 : rulematch + wl on zone + varname
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$BODY_VAR:lol";
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
{
|
||||
\"lol\" : \"foobar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
=== json wl 0.5 : rulematch + wl on zone + varname + url
|
||||
--- user_files
|
||||
>>> test_uri
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$BODY_VAR:lol|$URL:/test_uri";
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /test_uri
|
||||
{
|
||||
\"lol\" : \"foobar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
=== json wl 0.6 : rulematch + wl on zone + varname + url [fail]
|
||||
--- user_files
|
||||
>>> test_uri
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$BODY_VAR:lol|$URL:/test_uri";
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
{
|
||||
\"lol\" : \"foobar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
=== json wl 0.7 : rulematch + wl on zone + varname (in sub-json element)
|
||||
--- user_files
|
||||
>>> test_uri
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$BODY_VAR:test_123|$URL:/test_uri";
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /test_uri
|
||||
{
|
||||
\"oh\" : [\"there\", \"is\", \"no\", \"way\"],
|
||||
\"this\" : { \"will\" : [\"work\", \"does\"],
|
||||
\"it\" : \"??\" },
|
||||
\"trigger\" : {\"test_123\" : [\"foobar\", \"will\", \"trigger\", \"it\"]},
|
||||
\"foo\" : \"baar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
=== json wl 0.8 : rulematch + wl on zone + varname (in sub-json element) [fail]
|
||||
--- user_files
|
||||
>>> test_uri
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$BODY_VAR:test_123|$URL:/test_uri";
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /test_uri
|
||||
{
|
||||
\"oh\" : [\"there\", \"is\", \"no\", \"way\"],
|
||||
\"this\" : { \"will\" : [\"work\", \"does\"],
|
||||
\"it\" : \"??\" },
|
||||
\"trigger\" : {\"test_1234\" : [\"foobar\", \"will\", \"trigger\", \"it\"]},
|
||||
\"foo\" : \"baar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 412
|
||||
=== json wl 0.9 : match in varname
|
||||
--- user_files
|
||||
>>> test_uri
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /test_uri
|
||||
{
|
||||
\"oh\" : [\"there\", \"is\", \"no\", \"way\"],
|
||||
\"this\" : { \"will\" : [\"work\", \"does\"],
|
||||
\"it\" : \"??\" },
|
||||
\"tr<igger\" : {\"test_1234\" : [\"foobar\", \"will\", \"trigger\", \"it\"]},
|
||||
\"foo\" : \"baar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 412
|
||||
=== json wl 1.0 : match in varname + wl on varname
|
||||
--- user_files
|
||||
>>> test_uri
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1302 "mz:$BODY_VAR:tr<igger|NAME";
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /test_uri
|
||||
{
|
||||
\"oh\" : [\"there\", \"is\", \"no\", \"way\"],
|
||||
\"this\" : { \"will\" : [\"work\", \"does\"],
|
||||
\"it\" : \"??\" },
|
||||
\"tr<igger\" : {\"test_1234\" : [\"foobar\", \"will\", \"trigger\", \"it\"]},
|
||||
\"foo\" : \"baar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
=== json wl 1.1 : match (empty variable name)
|
||||
--- user_files
|
||||
>>> test_uri
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /test_uri
|
||||
{
|
||||
\"\" : [\"there\", \"is\", \"no\", \"way\"]
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
=== json wl 1.1 : match (no variable name)
|
||||
--- user_files
|
||||
>>> test_uri
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /test_uri
|
||||
{
|
||||
[\"there\", \"is\", \"no\", \"way\"]
|
||||
}
|
||||
"
|
||||
--- error_code: 412
|
||||
=== json wl 2.0 : malformed json (missing opening {)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
|
||||
\"lol\" : \"bar\"
|
||||
}
|
||||
"
|
||||
--- error_code: 412
|
||||
=== json wl 2.1 : Numeric content json
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
{
|
||||
\"lol\" : 372
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
=== json wl 2.2 : true/false content json
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
{
|
||||
\"lol\" : false,
|
||||
\"serious_stuff\" : true,
|
||||
\"extra_coverage\" : null
|
||||
}
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
=== json wl 2.3 : malformed json
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:BODY" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/json
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
{
|
||||
\"lol\" : false,
|
||||
\"serious_stuff\" : true,
|
||||
\"extra_coverage\" : null
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
+576
@@ -0,0 +1,576 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== RXWL TEST 1.0: simple wide regex ($args_var)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:bla";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?bla=1999
|
||||
--- error_code: 200
|
||||
=== RXWL TEST 1.1: simple wide regex ($args_var)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:bla";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?bra=1999
|
||||
--- error_code: 412
|
||||
=== RXWL TEST 1.2: simple wide regex ($args_var)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:bla";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?aablaaa=1999
|
||||
--- error_code: 200
|
||||
=== RXWL TEST 1.3: simple end-restrictive regex ($args_var_x:..$)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:bla$";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?aabla=1999
|
||||
--- error_code: 200
|
||||
=== RXWL TEST 1.3: simple end-restrictive regex ($args_var_x:..$)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:bla$";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?aabla=1999
|
||||
--- error_code: 200
|
||||
=== RXWL TEST 1.4: simple end-restrictive regex ($args_var_x:..$)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:bla$";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?aablaa=1999
|
||||
--- error_code: 412
|
||||
=== RXWL TEST 1.5: simple begin-restrictive regex ($args_var_x:^..)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^bla";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?blaa=1999
|
||||
--- error_code: 200
|
||||
=== RXWL TEST 1.6: simple begin-restrictive regex ($args_var_x:^..)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^bla";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?blaa=1999
|
||||
--- error_code: 200
|
||||
=== RXWL TEST 1.7: simple begin-restrictive regex ($args_var_x:^..)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^bla";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?ablaa=1999
|
||||
--- error_code: 412
|
||||
=== RXWL TEST 1.8: simple full-restrictive regex ($args_var_x:^..$)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^bla$";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?abla=1999
|
||||
--- error_code: 412
|
||||
=== RXWL TEST 1.9: simple full-restrictive regex ($args_var_x:^..$)
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^bla$";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /buixor?bla=1999
|
||||
--- error_code: 200
|
||||
|
||||
=== RXWL TEST 2.0: simple wide regex ($args_var|$url)
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:bla|$URL_X:/foo";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foo?bla=1999
|
||||
--- error_code: 200
|
||||
|
||||
=== RXWL TEST 2.1: simple wide regex ($args_var|$url)
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:bla|$URL_X:/foo";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foz?bla=1999
|
||||
--- error_code: 412
|
||||
=== RXWL TEST 2.2: simple half-restrictive regex ($args_var|$url)
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^bla$|$URL_X:/foo";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foo?blaz=1999
|
||||
--- error_code: 412
|
||||
=== RXWL TEST 3.0: simple wide regex (url|args|name)
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL_X:/foo|ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foo?19991999=foo
|
||||
--- error_code: 200
|
||||
|
||||
=== RXWL TEST 3.1: simple wide regex (url|args|name)
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL_X:/foo|ARGS|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foo?foo=1999
|
||||
--- error_code: 412
|
||||
|
||||
=== RXWL TEST 4.0: simple restrictive+complex regex ($URL_X|URL)
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS|URL" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$URL_X:^/foo_[0-9]+_$|URL";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foo_1999_?x=x
|
||||
--- error_code: 404
|
||||
=== RXWL TEST 4.1: simple restrictive+complex regex ($ARGS_VAR_X|NAME)
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS|URL" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^foo_[0-9]+_$|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foo_1999_inject=x
|
||||
--- error_code: 412
|
||||
=== RXWL TEST 5.0: file ext ($URL|NAME) XXX
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS|URL" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^foo_[0-9]+_$|NAME";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foo_1999_inject=x
|
||||
--- error_code: 412
|
||||
|
||||
=== RXWL TEST 6.0: case sensitiveness
|
||||
--- user_files
|
||||
>>> foo
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:abcd" "msg:foobar test pattern #1" "mz:ARGS|URL" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR_X:^foo_[0-9]+_$";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foo_1999_=ABCD
|
||||
--- error_code: 200
|
||||
+94
@@ -0,0 +1,94 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== WL TEST X.0: URL case sensitive wl
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999,1000 "mz:$URL:/foobar/tableDropdown|URL";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foobar/tableDropdown
|
||||
--- error_code: 404
|
||||
|
||||
=== WL TEST X.1: URL case sensitive wl
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:foobar" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1000 "mz:$URL:/wp-content/plugins/ultimate-tinymce/tableDropdown/editor_plugin.js|URL";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /wp-content/plugins/ultimate-tinymce/tableDropdown/editor_plugin.js
|
||||
--- error_code: 404
|
||||
=== WL TEST 6.3: Whitelists trying to provoke collisions
|
||||
--- user_files
|
||||
>>> buixor
|
||||
eh yo
|
||||
>>> bla
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1999" "msg:foobar test pattern #2" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
#LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:/bla";
|
||||
BasicRule wl:1998 "mz:$URL:/bla|ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /bla?/bla=1999&bu=1998
|
||||
--- error_code: 200
|
||||
+356
@@ -0,0 +1,356 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== ID TEST 1.0: Disabled IDs
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 200
|
||||
=== ID TEST 1.1: Disabled IDs (fail)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1998
|
||||
--- error_code: 412
|
||||
=== ID TEST 1.2: Disabled negative IDs
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:-1999;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1998
|
||||
--- error_code: 200
|
||||
=== ID TEST 1.3: Disabled negative IDs (fail)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:-1999;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
=== ID TEST 1.4: Multiple Disabled negative IDs
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1997" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1997;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:-1999,-1998;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1997
|
||||
--- error_code: 200
|
||||
=== ID TEST 1.5: Multiple Disabled negative IDs
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1997" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1997;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:-1999,-1998;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== ID TEST 2.0: BasicRule negative id test
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1997" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1997;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:-1999 "mz:$URL:/|$ARGS_VAR:foo";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foo=1999
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== ID TEST 2.1: BasicRule negative id test (fail)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1997" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1997;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:-1999 "mz:$URL:/|$ARGS_VAR:foo";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foo=1998
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== ID TEST 2.2: BasicRule negative id test (fail on internal ID)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1999;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
MainRule "str:1997" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1997;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:-1999 "mz:$URL:/|$ARGS_VAR:foo";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foo=a%00a
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== ID TEST 3.0: Partial disabled whitelist
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS|URL" "s:$SQL:42" id:1999;
|
||||
# MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
# MainRule "str:1997" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1997;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?foo=a1999a
|
||||
--- error_code: 200
|
||||
|
||||
=== ID TEST 3.1: Partial disabled whitelist (fail zone)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS|URL" "s:$SQL:42" id:1999;
|
||||
# MainRule "str:1998" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1998;
|
||||
# MainRule "str:1997" "msg:foobar test pattern #1" "mz:ARGS" "s:$SQL:42" id:1997;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1999 "mz:ARGS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /1999?foo=aa
|
||||
--- error_code: 412
|
||||
|
||||
=== ID TEST 4.0: header disabled rule
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:HEADERS|ARGS" "s:$SQL:42" id:1998;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
foo: 1998
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 412
|
||||
|
||||
=== ID TEST 4.1: header disabled rule wl
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1998" "msg:foobar test pattern #1" "mz:HEADERS|ARGS" "s:$SQL:42" id:1998;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
BasicRule wl:1998 "mz:HEADERS";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
foo: 1998
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
|
||||
+383
@@ -0,0 +1,383 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== ID TEST 1.0: Drop rule without learning
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:DROP" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
|
||||
=== ID TEST 1.1: whitelisted drop rule without learning
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:DROP" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
BasicRule wl:1999 "mz:ARGS";
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 200
|
||||
|
||||
=== ID TEST 1.2: bad whitelisted drop rule without learning
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:DROP" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
BasicRule wl:1999 "mz:URL";
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
|
||||
=== ID TEST 1.3: drop rule with learning
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:DROP" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== ID TEST 1.4: drop rule with learning + correct whitelist
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:DROP" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:bla";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== ID TEST 1.5: drop rule with learning + incorrect whitelist
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:DROP" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
BasicRule wl:1999 "mz:$ARGS_VAR:bla|$URL:/x";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== ID TEST 2.0: drop checkrule
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:8" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
|
||||
=== ID TEST 2.1: drop checkrule, with whitelisted rule
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:8" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO >= 8" DROP;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR_X:^bla$";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 200
|
||||
=== ID TEST 2.2: drop checkrule, with failed whitelisted rule
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:8" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO >= 8" DROP;
|
||||
BasicRule wl:1999 "mz:$URL:/|$ARGS_VAR_X:^bla1";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
=== ID TEST 3.0: <= checkrule (why not dude)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:8" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO <= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
=== ID TEST 3.1: <= checkrule : Is useless, as score will go through value 8 before reaching 16, thus the checkrule will be applied
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:8" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO <= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999&blu=1999
|
||||
--- error_code: 412
|
||||
=== ID TEST 3.2: < checkrule (why not dude)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:8" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO < 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 200
|
||||
=== ID TEST 3.3: < checkrule (why not dude)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:7" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO < 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
=== ID TEST 3.4: > checkrule (why not dude)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:8" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO > 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 200
|
||||
|
||||
=== ID TEST 3.5: > checkrule (why not dude)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:1999" "msg:foobar test pattern #1" "mz:ARGS" "s:$FOO:9" id:1999;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO > 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?bla=1999
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== ID TEST 4.0: super long exception (trigger 400 bad request on old versions)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$FOO > 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2=<>(){}[]'--;=a&a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1=<>(){}[]'--;=a&a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3a3=<>(){}[]'--;=a&a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4a4=<>(){}[]'&a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5=<>(){}[]'"
|
||||
--- error_code: 200
|
||||
|
||||
+926
@@ -0,0 +1,926 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1 : sqlmap-master/tamper/randomcomments.py -- I/**/N/**/SERT
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?I/**/N/**/SERT
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 2 : sqlmap-master/tamper/space2plus.py -- SELECT+id+FROM+users
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?SELECT+id+FROM+users
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 3 : sqlmap-master/tamper/multiplespaces.py -- 1++++UNION+++++SELECT+++foobar
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1++++UNION+++++SELECT+++foobar
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 4 : sqlmap-master/tamper/base64encode.py -- MScgQU5EIFNMRUVQKDUpIw==
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?MScgQU5EIFNMRUVQKDUpIw==
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 5 : sqlmap-master/tamper/between.py -- 1+AND+A+NOT+BETWEEN+0+AND+B--
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+AND+A+NOT+BETWEEN+0+AND+B--
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 6 : sqlmap-master/tamper/unmagicquotes.py -- 1%bf%27+AND+1=1--+
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1%bf%27+AND+1=1--+
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 7 : sqlmap-master/tamper/appendnullbyte.py -- 1+AND+1=1%00
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+AND+1=1%00
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 8 : sqlmap-master/tamper/unionalltounion.py -- -1+UNION+SELECT
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?-1+UNION+SELECT
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 9 : sqlmap-master/tamper/greatest.py -- 1+AND+GREATEST(A,B+1)=A
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+AND+GREATEST(A,B+1)=A
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 10 : sqlmap-master/tamper/chardoubleencode.py -- %2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?%2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 11 : sqlmap-master/tamper/space2comment.py -- SELECT/**/id/**/FROM/**/users
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?SELECT/**/id/**/FROM/**/users
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 12 : sqlmap-master/tamper/apostrophenullencode.py -- 1+AND+%00%271%00%27=%00%271
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+AND+%00%271%00%27=%00%271
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 13 : sqlmap-master/tamper/bluecoat.py -- SELECT%09id+FROM+users+where+id+LIKE+1
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?SELECT%09id+FROM+users+where+id+LIKE+1
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 14 : sqlmap-master/tamper/halfversionedmorekeywords.py -- /*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),/*!0NULL,/*!0NULL#/*!0AND+QDWa=
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),/*!0NULL,/*!0NULL#/*!0AND+QDWa=
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 15 : sqlmap-master/tamper/space2dash.py -- 1--nVNaVoPYeva%0AAND--ngNvzqu%0A9227=9227
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1--nVNaVoPYeva%0AAND--ngNvzqu%0A9227=9227
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 16 : sqlmap-master/tamper/space2randomblank.py -- SELECT%0Did%0DFROM%0Ausers
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?SELECT%0Did%0DFROM%0Ausers
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 17 : sqlmap-master/tamper/randomcase.py -- INseRt
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?INseRt+UnIon+plz
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 18 : sqlmap-master/tamper/versionedmorekeywords.py -- 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 19 : sqlmap-master/tamper/percentage.py -- %S%E%L%E%C%T+%F%I%E%L%D+%F%R%O%M+%T%A%B%L%E
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?%S%E%L%E%C%T+%F%I%E%L%D+%F%R%O%M+%T%A%B%L%E
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 20 : sqlmap-master/tamper/ifnull2ifisnull.py -- IF(ISNULL(1),2,1)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?IF(ISNULL(1),2,1)
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 21 : sqlmap-master/tamper/equaltolike.py -- SELECT+*+FROM+users+WHERE+id+LIKE+1
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?SELECT+*+FROM+users+WHERE+id+LIKE+1
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 22 : sqlmap-master/tamper/space2mysqlblank.py -- SELECT%0Bid%0DFROM%0Cusers
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?SELECT%0Bid%0DFROM%0Cusers
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 23 : sqlmap-master/tamper/space2mssqlblank.py -- SELECT%0Eid%0DFROM%07users
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?SELECT%0Eid%0DFROM%07users
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 24 : sqlmap-master/tamper/space2hash.py -- 1%23nVNaVoPYeva%0AAND%23ngNvzqu%0A9227=9227
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1%23nVNaVoPYeva%0AAND%23ngNvzqu%0A9227=9227
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 25 : sqlmap-master/tamper/modsecurityversioned.py -- 1+/*!30874AND+2>1*/--
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+/*!30874AND+2>1*/--
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 26 : sqlmap-master/tamper/versionedkeywords.py -- 1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,+CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,+CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 27 : sqlmap-master/tamper/apostrophemask.py -- 1+AND+%EF%BC%871%EF%BC%87=%EF%BC%871
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+AND+%EF%BC%871%EF%BC%87=%EF%BC%871
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 28 : sqlmap-master/tamper/space2morehash.py -- 1%23ngNvzqu%0AAND%23nVNaVoPYeva%0A%23lujYFWfv%0A9227=9227
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1%23ngNvzqu%0AAND%23nVNaVoPYeva%0A%23lujYFWfv%0A9227=9227
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 29 : sqlmap-master/tamper/securesphere.py -- 0having=0having
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?0having=0having
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 30 : sqlmap-master/tamper/sp_password.py -- 1+AND+9227=9227--+sp_password
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+AND+9227=9227--+sp_password
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 31 : sqlmap-master/tamper/nonrecursivereplacement.py -- 1+UNIOUNIONN+SELESELECTCT+2--
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+UNIOUNIONN+SELESELECTCT+2--
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 32 : sqlmap-master/tamper/charencode.py -- %53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 33 : sqlmap-master/tamper/modsecurityzeroversioned.py -- 1+/*!00000AND+2>1*/--
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1+/*!00000AND+2>1*/--
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 34 : sqlmap-master/tamper/charunicodeencode.py -- %u0053%u0045%u004C%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004C%u0044%u0020%u0046%u0052%u004F%u004D%u0020%u0054%u0041%u0042%u004C%u0045
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?%u0053%u0045%u004C%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004C%u0044%u0020%u0046%u0052%u004F%u004D%u0020%u0054%u0041%u0042%u004C%u0045
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 35 : sqlmap-master/tamper/space2mysqldash.py -- 1--%0AAND--%0A9227=9227
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1--%0AAND--%0A9227=9227
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 36 : sqlmap-master/tamper/space2mssqlhash.py -- 1%23%0AAND%23%0A9227=9227
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?1%23%0AAND%23%0A9227=9227
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 37 : json functions MySQL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
BasicRule wl:1000,1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1013,1015,1016,1017;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=JSON_KEYS((SELECT%20CONVERT((SELECT%20CONCAT('TTT'%2C(A%253DB)%2C'TTT'))%20USING%20utf8)))
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 38 : json functions PostgreSQL
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
BasicRule wl:1000,1001,1002,1003,1004,1005,1006,1007,1008,1009,1010,1011,1013,1015,1016,1017;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a='%7B%22b%22%3A2%7D'%3A%3Ajsonb%20%3C%40%20'%7B%22a%22%3A1%2C%20%22b%22%3A2%7D'%3A%3Ajsonb
|
||||
--- error_code: 412
|
||||
|
||||
@@ -0,0 +1,355 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 2 : Check libinjection_xss is disabled by default
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=a'%20onmouseover='alert(1) HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 2.1 : Check libinjection_xss can be enabled
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LibInjectionXss;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=<script>alert(1)</script> HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 2.2 : Check libinjection_xss can be enabled and dyn disabled
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_xss 0;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LibInjectionXss;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=<script>alert(1)</script> HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 2.3 : Check libinjection_xss can be disabled and dyn enabled
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_xss 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=<script>alert(1)</script> HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 3 : Check libinjection_sql is disabled by default
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=1'%20OR%20'1'='1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 3.1 : Check libinjection_sql can be enabled
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LibInjectionSql;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=1'%20OR%20'1'='1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 3.2 : Check libinjection_sql can be enabled and dyn disabled
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_sql 0;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LibInjectionSql;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=1'%20OR%20'1'='1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
=== TEST 3.3 : Check libinjection_sql can be disabled and dyn enabled
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_sql 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=1'%20OR%20'1'='1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
=== TEST 4.0 : whitelist libinjection_sql
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_sql 1;
|
||||
location / {
|
||||
BasicRule wl:17 "mz:$URL:/|$ARGS_VAR:x";
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=1'%20OR%20'1'='1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
=== TEST 4.1 : whitelist libinjection_xss
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_xss 1;
|
||||
location / {
|
||||
BasicRule wl:18 "mz:$URL:/|$ARGS_VAR:x";
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?x=<script>alert(1)</script> HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 4.2 : whitelist libinjection_xss (|NAME)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_xss 1;
|
||||
location / {
|
||||
BasicRule wl:18 "mz:$URL:/|ARGS|NAME";
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?<script>alert(1)</script>=1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 4.3 : whitelist libinjection_sql (|NAME)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_sql 1;
|
||||
location / {
|
||||
BasicRule wl:17 "mz:$URL:/|ARGS|NAME";
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a/**/UNION+SELECT+1,1=1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 4.3.1 : whitelist fail libinjection_sql (|NAME)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_sql 1;
|
||||
location / {
|
||||
BasicRule wl:17 "mz:$URL:/x|ARGS|NAME";
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a'%20UNION%20SELECT%201,1=1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 4.3.2 : whitelist fail libinjection_xss (|NAME)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_flag_libinjection_xss 1;
|
||||
location / {
|
||||
BasicRule wl:18 "mz:$URL:/x|ARGS|NAME";
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?a><script>alert(1)</script>=1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
+257
File diff suppressed because one or more lines are too long
BIN
Binary file not shown.
@@ -0,0 +1,361 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1.0: Basic GET request, with allow rule (useless, just for coverage. ALLOW should be killed)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule id:4241 "str:ratata" "mz:ARGS" "s:$TEST:42";
|
||||
#MainRule id:4242 "str:XXX" "s:$SQL:8" "mz:ARGS";
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=ratataXXX
|
||||
--- error_code: 200
|
||||
=== TEST 1.1: Basic GET request, with global score increase
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule id:4241 "str:ratata" "mz:ARGS" "s:42";
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=ratataXXX
|
||||
--- error_code: 200
|
||||
=== TEST 1.2: rule on headers
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
BasicRule id:4241 "str:ratata" "mz:HEADERS" "s:BLOCK";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
headertest: ratata
|
||||
--- request
|
||||
GET /?a=XXX
|
||||
--- error_code: 412
|
||||
=== TEST 1.2: extensive log while targeting name
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
BasicRule id:4241 "str:ratata" "mz:ARGS" "s:BLOCK";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?ratata=tututu
|
||||
--- error_code: 200
|
||||
=== TEST 1.2: extensive log while targeting name
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
BasicRule id:4241 "str:ratata" "mz:ARGS" "s:LOG";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?ratata=tututu
|
||||
--- error_code: 200
|
||||
=== TEST 1.3: rule on url
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
BasicRule id:4241 "str:ratata" "mz:URL" "s:BLOCK";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request
|
||||
GET /ratata?x=tututu
|
||||
--- error_code: 412
|
||||
=== TEST 1.4: add post action as dynamic flag
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
set $naxsi_flag_post_acton 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
BasicRule id:4241 "str:ratata" "mz:URL" "s:BLOCK";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request
|
||||
GET /ratata?x=tututu
|
||||
--- error_code: 412
|
||||
=== TEST 1.5.0: HEADER_VAR_X
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule id:4241 "str:ratata" "mz:$HEADERS_VAR_X:ruuu" "s:BLOCK";
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
set $naxsi_flag_post_acton 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
# BasicRule id:4241 "str:ratata" "mz:URL" "s:BLOCK";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
ruuu: ratata1
|
||||
--- request
|
||||
GET /ratata?x=tututu
|
||||
--- error_code: 412
|
||||
=== TEST 1.5.1: HEADER_VAR_X
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule id:4241 "str:ratata" "mz:$HEADERS_VAR_X:ruuu|$URL_X:^/fufu" "s:BLOCK";
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
set $naxsi_flag_post_acton 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
# BasicRule id:4241 "str:ratata" "mz:URL" "s:BLOCK";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
ruuu: ratata1
|
||||
--- request
|
||||
GET /fufu?x=tututu
|
||||
--- error_code: 412
|
||||
=== TEST 1.5.2: HEADER_VAR_X
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule id:4241 "str:ratata" "mz:$HEADERS_VAR_X:ruuu|$URL_X:^/fufu" "s:BLOCK";
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
set $naxsi_flag_post_acton 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
# BasicRule id:4241 "str:ratata" "mz:URL" "s:BLOCK";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
ruuu: ratata1
|
||||
--- request
|
||||
GET /fuf?x=tututu
|
||||
--- error_code: 404
|
||||
=== TEST 1.6.0: URL + URL wl
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule id:4241 "str:ratata" "mz:URL" "s:BLOCK";
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
set $naxsi_flag_post_acton 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
BasicRule wl:4241 "mz:URL";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request
|
||||
GET /ratata
|
||||
--- error_code: 404
|
||||
=== TEST 1.6.1: URL + URL wl
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule id:4241 "str:ratata" "mz:URL" "s:BLOCK";
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
set $naxsi_flag_post_acton 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
BasicRule wl:4241 "mz:BODY";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST >= 8" ALLOW;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request
|
||||
GET /ratata
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,150 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1 : Enable libinjection s:DROP on named var
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "d:libinj_xss" "s:DROP" "mz:$ARGS_VAR:ruuu" id:41231;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?ruuu=a'%20onmouseover='alert(1) HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
=== TEST 1.1 : Enable libinjection s:DROP on (bad) named var
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "d:libinj_xss" "s:DROP" "mz:$ARGS_VAR:ruuuu" id:41231;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?ruuu=a'%20onmouseover='alert(1) HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
=== TEST 1.2 : Enable libinjection s:DROP on (bad) named var
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "d:libinj_xss" "s:DROP" "mz:$ARGS_VAR:ruu" id:41231;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?ruuu=a'%20onmouseover='alert(1) HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 200
|
||||
=== TEST 2.1 : Enable libinjection s:$FOOBAR on named var
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "d:libinj_xss" "s:$FOOBAR:8" "mz:$ARGS_VAR_X:^fuu[0-9]+$" id:41231;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
CheckRule "$FOOBAR >= 8" DROP;
|
||||
DeniedUrl "/RequestDenied";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /?fuu4242424=a'%20onmouseover='alert(1) HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 3.0 : Enable libinjection (sql) s:DROP on named var+url
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "d:libinj_sql" "s:$FOOBAR:8" "mz:$ARGS_VAR_X:^fuu[0-9]+$|$URL_X:^/foobar/$" id:41231;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
CheckRule "$FOOBAR >= 8" DROP;
|
||||
DeniedUrl "/RequestDenied";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /foobar/?fuu4242424=1'%20OR%20'1'='1 HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 412
|
||||
=== TEST 3.0 : Enable libinjection (sql) s:DROP on named var+url (not a valid sqli)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "d:libinj_sql" "s:$FOOBAR:8" "mz:$ARGS_VAR_X:^fuu[0-9]+$|$URL_X:^/foobar/$" id:41231;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
CheckRule "$FOOBAR >= 8" DROP;
|
||||
DeniedUrl "/RequestDenied";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"GET /foobar/?fuu4242424=1'%20OR%20\"1\"= HTTP/1.0
|
||||
|
||||
"
|
||||
--- error_code: 404
|
||||
|
||||
+186
@@ -0,0 +1,186 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
log_level('error');
|
||||
#1.3 : +2 tests
|
||||
plan tests => blocks() * 2 + 4;
|
||||
no_root_location();
|
||||
#no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1.0 : learning + block score, NAXSI_FMT
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule "str:," "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /x,y?uuu=b,c"
|
||||
--- error_code: 404
|
||||
--- error_log eval
|
||||
qr@NAXSI_FMT: ip=127\.0\.0\.1&server=localhost&uri=%2Fx%2Cy&config=learning&rid=[^&]+&cscore0=\$SQL&score0=8&zone0=URL&id0=1015&var_name0=&zone1=ARGS&id1=1015&var_name1=uuu@
|
||||
|
||||
=== TEST 1.1 : learning + drop score, NAXSI_FMT
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule "str:," "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /x,y?uuu=b,c"
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@NAXSI_FMT: ip=127\.0\.0\.1&server=localhost&uri=%2Fx%2Cy&config=learning-drop&rid=[^&]+&cscore0=\$SQL&score0=8&zone0=URL&id0=1015&var_name0=&zone1=ARGS&id1=1015&var_name1=uuu@
|
||||
|
||||
|
||||
=== TEST 1.2 : no-learning + block score, NAXSI_FMT
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule "str:," "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /x,y?uuu=b,c
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@NAXSI_FMT: ip=127\.0\.0\.1&server=localhost&uri=%2Fx%2Cy&config=block&rid=[^&]+&cscore0=\$SQL&score0=8&zone0=URL&id0=1015&var_name0=&zone1=ARGS&id1=1015&var_name1=uuu, client: 127\.0\.0\.1, server: localhost,@
|
||||
|
||||
|
||||
=== TEST 1.3 : learning + block score + naxsi_extensive_log, NAXSI_EXLOG and NAXSI_FMT
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule "str:," "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /x,y?uuu=b,c
|
||||
--- error_code: 404
|
||||
--- error_log eval
|
||||
[qr@NAXSI_FMT: ip=127\.0\.0\.1&server=localhost&uri=%2Fx%2Cy&config=learning&rid=[^&]+&cscore0=\$SQL&score0=8&zone0=URL&id0=1015&var_name0=&zone1=ARGS&id1=1015&var_name1=uuu@,
|
||||
qr@NAXSI_EXLOG: ip=127\.0\.0\.1&server=localhost&rid=[^&]+&uri=%2Fx%2Cy&id=1015&zone=URL&var_name=&content=%2Fx%2Cy@,
|
||||
qr@NAXSI_EXLOG: ip=127\.0\.0\.1&server=localhost&rid=[^&]+&uri=%2Fx%2Cy&id=1015&zone=ARGS&var_name=uuu&content=b%2Cc@
|
||||
]
|
||||
|
||||
|
||||
=== TEST 1.4 : learning + no-block score + naxsi_extensive_log, NAXSI_EXLOG only
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule "str:," "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
|
||||
--- config
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /x,y?uuu=bc
|
||||
--- error_code: 404
|
||||
--- error_log eval
|
||||
qr@NAXSI_EXLOG: ip=127\.0\.0\.1&server=localhost&rid=[^&]+&uri=%2Fx%2Cy&id=1015&zone=URL&var_name=&content=%2Fx%2Cy, client: 127\.0\.0\.1,@
|
||||
--- no_error_log
|
||||
NAXSI_FMT
|
||||
|
||||
=== TEST 1.6 : learning + block-score + naxsi_extensive_log, NAXSI_EXLOG only
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule "str:foo" "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request eval
|
||||
[["GET /", "afoo"x256, "?f", "ufoo"x256, "=1", "Afoo"x256]]
|
||||
--- error_code: 404
|
||||
--- error_log eval
|
||||
[qr@NAXSI_FMT: ip=127\.0\.0\.1&server=localhost&uri=%2F[afo]+\.\.\.&config=learning&rid=[^&]+&cscore0=\$SQL&score0=3072&zone0=URL&id0=1015&var_name0=&zone1=ARGS&id1=1015&var_name1=[afuo]+...&zone2=ARGS\|NAME&id2=1015&var_name2=[aufo]+...,@]
|
||||
|
||||
=== TEST 1.7 : learning + block-score + no naxsi_extensive_log, NAXSI_FMT only
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
MainRule "str:foo" "msg:, in stuff" "mz:BODY|URL|ARGS|$HEADERS_VAR:Cookie" "s:$SQL:4" id:1015;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request eval
|
||||
[["GET /", "afoo"x128, "?f", "ufoo"x256, "=1", "Afoo"x1024]]
|
||||
--- error_code: 404
|
||||
--- error_log eval
|
||||
[qr@NAXSI_FMT: ip=127\.0\.0\.1&server=localhost&uri=%2F[afo]+&config=learning&rid=[^&]+&cscore0=\$SQL&score0=5632&zone0=URL&id0=1015&var_name0=&zone1=ARGS&id1=1015&var_name1=[afuo]+...&zone2=ARGS\|NAME&id2=1015&var_name2=[aufo]+...,@]
|
||||
--- no_error_log
|
||||
NAXSI_EXLOG
|
||||
+333
@@ -0,0 +1,333 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
=== WL TEST 1.0: [ARGS zone WhiteList] Adding a test rule in http_config (ARGS zone) and disable rule.
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?driveOnDate=2016-11-29
|
||||
--- error_code: 200
|
||||
|
||||
=== WL TEST 1.1: testing multiple alternate matching/non-matching rules
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "rx:zz" "mz:$URL_X:/foo/|$ARGS_VAR_X:^id$" "s:DROP" id:4242001;
|
||||
MainRule negative "rx:^\d+$" "mz:$URL_X:/wp-json/wp/v2/|$ARGS_VAR_X:^id$" "s:DROP" id:4242002;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /wp-json/wp/v2/?id=a
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.2: testing multiple alternate matching/non-matching rules
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "rx:zz" "mz:$URL_X:/foo/|$ARGS_VAR_X:^id$" "s:DROP" id:4242001;
|
||||
MainRule negative "rx:^\d+$" "mz:$URL_X:/wp-json/wp/v2/|$ARGS_VAR_X:^id$" "s:DROP" id:4242002;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /wp-json/wp/v2?id=a
|
||||
--- error_code: 404
|
||||
|
||||
=== WL TEST 1.3: testing multiple alternate matching/non-matching rules
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "rx:zz" "mz:$URL_X:/wp-json/wp/v2/|$ARGS_VAR_X:^id$" "s:DROP" id:4242001;
|
||||
MainRule negative "rx:^\d+$" "mz:$URL_X:/wp-json/wp/v2/|$ARGS_VAR_X:^id$" "s:DROP" id:4242002;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /wp-json/wp/v2?id=11
|
||||
--- error_code: 404
|
||||
|
||||
=== WL TEST 1.4: testing multiple alternate matching/non-matching rules
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "rx:zz" "mz:$URL_X:/wp-json/wp/v2/|$ARGS_VAR_X:^id$" "s:DROP" id:4242001;
|
||||
MainRule "rx:^\d+$" "mz:$URL_X:/wp-json/wp/v2/|$ARGS_VAR_X:^id$" "s:DROP" id:4242002;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /wp-json/wp/v2/?id=zz
|
||||
--- error_code: 412
|
||||
|
||||
=== WL TEST 1.5: testing multiple alternate matching/non-matching rules
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "rx:zz" "mz:$URL_X:/wp-json/wp/v2/|$ARGS_VAR_X:^id$" "s:DROP" id:4242001;
|
||||
MainRule "rx:^\d+$" "mz:$URL_X:/wp-json/wp/v2/|$ARGS_VAR_X:^id$" "s:DROP" id:4242002;
|
||||
MainRule "str:iyxnlnjrf" "mz:$URL_X:^(/index.php)?/qquoteadv|ARGS|BODY" "s:DROP" "msg:base64_" id:42000526;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /qquoteadv?id=iyxnlnjrf1
|
||||
--- error_code: 412
|
||||
=== WL TEST 2.0: log + drop
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^[\d_-]+$" "mz:$ARGS_VAR:id" "s:$LOG_TEST:1" "msg:wordpress < 4.7.2 wp-json" id:42000530;
|
||||
MainRule negative "rx:^[\d_-]+$" "mz:$BODY_VAR:id" "s:$LOG_TEST:1" "msg:wordpress < 4.7.2 wp-json" id:42000529;
|
||||
MainRule negative "rx:^\d+$" "mz:$ARGS_VAR_X:^id$|$URL_X:/wp-json/wp/v2/" "s:$UWA:8" "msg:wordpress < 4.7.2 wp-json" id:42000531;
|
||||
MainRule negative "rx:^\d+$" "mz:$URL_X:/wp-json/wp/v2/|$BODY_VAR_X:^id$" "s:$UWA:8" "msg:wordpress < 4.7.2 wp-json" id:42000532;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
CheckRule "$LOG_TEST >= 1" LOG;
|
||||
CheckRule "$UWA >= 8" DROP;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /wp-json/wp/v2/posts/111
|
||||
id=1a&foo2=bar2"
|
||||
--- error_code: 412
|
||||
=== WL TEST 2.01: log + block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^[\d_-]+$" "mz:$ARGS_VAR:id" "s:$LOG_TEST:1" "msg:wordpress < 4.7.2 wp-json" id:42000530;
|
||||
MainRule negative "rx:^[\d_-]+$" "mz:$BODY_VAR:id" "s:$LOG_TEST:1" "msg:wordpress < 4.7.2 wp-json" id:42000529;
|
||||
MainRule negative "rx:^\d+$" "mz:$ARGS_VAR_X:^id$|$URL_X:/wp-json/wp/v2/" "s:$UWA:8" "msg:wordpress < 4.7.2 wp-json" id:42000531;
|
||||
MainRule negative "rx:^\d+$" "mz:$URL_X:/wp-json/wp/v2/|$BODY_VAR_X:^id$" "s:$UWA:8" "msg:wordpress < 4.7.2 wp-json" id:42000532;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
CheckRule "$LOG_TEST >= 1" LOG;
|
||||
CheckRule "$UWA >= 8" BLOCK;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /wp-json/wp/v2/posts/111
|
||||
id=1a&foo2=bar2"
|
||||
--- error_code: 412
|
||||
=== WL TEST 3.0: false-positive on virtual-patch with empty var name
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "rx:FOOBAR" "mz:$URL:/wp-includes/js/plupload/plupload.flash.swf|ARGS" "msg:Wordpress PlUpload XSS" "s:$UWA:8,$XSS_UWA:1" id:42000485;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
CheckRule "$LOG_TEST >= 1" LOG;
|
||||
CheckRule "$UWA >= 8" BLOCK;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=bui&FOOBAR
|
||||
--- error_code: 200
|
||||
=== WL TEST 3.0: false-positive on virtual-patch with empty var name
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "rx:FOOBAR" "mz:$URL:/wp-includes/js/plupload/plupload.flash.swf|ARGS" "msg:Wordpress PlUpload XSS" "s:$UWA:8,$XSS_UWA:1" id:42000485;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
CheckRule "$LOG_TEST >= 1" LOG;
|
||||
CheckRule "$UWA >= 8" BLOCK;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /wp-includes/js/plupload/plupload.flash.swf?a=bui&FOOBAR
|
||||
--- error_code: 412
|
||||
=== WL TEST 3.01: false-positive on virtual-patch with empty var name
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "rx:FOOBAR" "mz:$URL:/wp-includes/js/plupload/plupload.flash.swf|ARGS" "msg:Wordpress PlUpload XSS" "s:$UWA:8,$XSS_UWA:1" id:42000485;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
CheckRule "$LOG_TEST >= 1" LOG;
|
||||
CheckRule "$UWA >= 8" BLOCK;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /wp-includes/js/plupload/plupload.flash.swf/xxx/?a=bui&FOOBAR
|
||||
--- error_code: 404
|
||||
|
||||
=== TEST 4 - regression on FILE_EXT being detected in BODY
|
||||
--- user_files
|
||||
>>> my-account/profile
|
||||
eh yo
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule negative "rx:^[\.a-z0-9_\- ]+$" "mz:FILE_EXT" "s:$UPLOAD:8" id:1502;
|
||||
MainRule "rx:\.ph|\.asp|\.hta|\.htp" "mz:FILE_EXT" "s:$UWA:8" id:123456;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
BasicRule wl:1000,1001,1002,1005,1007,1010,1011,1015,1016,1100,1101,1200,1315 "mz:$HEADERS_VAR:cookie";
|
||||
BasicRule wl:1310,1311 "mz:$URL_X:^/my-account/profile|BODY|NAME";
|
||||
BasicRule wl:17,1010,1011,1015,1200 "mz:$URL_X:^/my-account/profile|$BODY_VAR_X:^sportactivities\[[0-9]\]\.";
|
||||
BasicRule wl:17,1010,1011,1015,1200 "mz:$URL_X:^/my-account/profile|$BODY_VAR_X:^addresses\[[0-9]\]\.";
|
||||
BasicRule wl:1009,1101 "mz:$URL_X:^/my-account/profile|$BODY_VAR_X:^return";
|
||||
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
LibInjectionSql;
|
||||
LibInjectionXss;
|
||||
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 5" BLOCK;
|
||||
CheckRule "$UPLOAD >= 5" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$UWA >= 8" DROP;
|
||||
CheckRule "$EVADE >= 8" BLOCK;
|
||||
CheckRule "$LOG >= 1" LOG;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"POST /my-account/profile HTTP/1.1\r
|
||||
Host: 127.0.0.1\r
|
||||
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0\r
|
||||
Accept: */*\r
|
||||
Accept-Language: en-US,en;q=0.5\r
|
||||
Accept-Encoding: gzip, deflate\r
|
||||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8\r
|
||||
X-Requested-With: XMLHttpRequest\r
|
||||
Content-Length: 2772\r
|
||||
Origin: https://127.0.0.1\r
|
||||
Connection: close\r
|
||||
Referer: http://127.0.0.1/my-account/profile/\r
|
||||
Cookie: t2s-p=ca0ac96b-6177-4e4a-f554-3f0a10469d9e; _gcl_au=1.1.1782048568.1605605979; gtm_nbpv=8; gtm_cookieConsent=1; __trossion=1605605980_1800_1__caa5d2de-ec72-4c61-b1c4-96bf4b22f5da%3A1605605980_1605607565_8_; __troRUID=caa5d2de-ec72-4c61-b1c4-96bf4b22f5da; __troSYNC=1; _pin_unauth=dWlkPU1EUTBZVFZqTXpNdE1EQTNOeTAwTURNd0xXSmlORGd0TTJZeU1EWmlaVGsxT1RCag; JSESSIONID=D426452D0BFCCAD4D384E972D7770861.Agassi; miniCartCount=0; _ga=GA1.2.243283519.1605605987; _gid=GA1.2.266115569.1605605987; _fbp=fb.1.1605605989339.1901530086; acceleratorSecureGUID=a21d40c7cdb55b323a686b37facfded200814ecf; customerFavoriteStore=SOME%2B-%2BPREMILHAT%7C%5B%7B%22closingTime2%22%3A%2219%3A00%22%2C%22weekDay%22%3A%22lundi%22%2C%22closed%22%3Afalse%2C%22closingTime1%22%3A%2212%3A00%22%2C%22openingTime2%22%3A%2214%3A00%22%2C%22openingTime1%22%3A%2209%3A30%22%7D%2C%7B%22closingTime2%22%3A%2219%3A00%22%2C%22weekDay%22%3A%22mardi%22%2C%22closed%22%3Afalse%2C%22closingTime1%22%3A%2212%3A00%22%2C%22openingTime2%22%3A%2214%3A00%22%2C%22openingTime1%22%3A%2209%3A30%22%7D%2C%7B%22closingTime2%22%3A%2219%3A00%22%2C%22weekDay%22%3A%22mercredi%22%2C%22closed%22%3Afalse%2C%22closingTime1%22%3A%2212%3A00%22%2C%22openingTime2%22%3A%2214%3A00%22%2C%22openingTime1%22%3A%2209%3A30%22%7D%2C%7B%22closingTime2%22%3A%2219%3A00%22%2C%22weekDay%22%3A%22jeudi%22%2C%22closed%22%3Afalse%2C%22closingTime1%22%3A%2212%3A00%22%2C%22openingTime2%22%3A%2214%3A00%22%2C%22openingTime1%22%3A%2209%3A30%22%7D%2C%7B%22closingTime2%22%3A%2219%3A00%22%2C%22weekDay%22%3A%22vendredi%22%2C%22closed%22%3Afalse%2C%22closingTime1%22%3A%2212%3A00%22%2C%22openingTime2%22%3A%2214%3A00%22%2C%22openingTime1%22%3A%2209%3A30%22%7D%2C%7B%22weekDay%22%3A%22samedi%22%2C%22closed%22%3Afalse%2C%22closingTime1%22%3A%2219%3A00%22%2C%22openingTime1%22%3A%2209%3A30%22%7D%2C%7B%22closingTime2%22%3A%22%22%2C%22weekDay%22%3A%22dimanche%22%2C%22closed%22%3Atrue%2C%22closingTime1%22%3A%22%22%2C%22openingTime2%22%3A%22%22%2C%22openingTime1%22%3A%22%22%7D%5D%7C%2FAllier-03%2FAAAAAA%C3%87ON-Pr%C3%A9milhat-03410%2FSOME-PREMILHAT%2F00574_000%2F; isFidelity=false; CLICKANDCOLLECT-customerInformations=c29vb29vb29vb0BhYWFhYWEuY29t|Test+Test%2CTest|MTExMTExMTExMTExMQ==|; isNewCustomer=true; t2s-rank=rank1; _dc_gtm_UA-52322712-6=1; _uetsid=d060e34028b811eb8d3ef174562c91c3; _uetvid=d060d20028b811eb98dc9b58b7dbeb20\r
|
||||
\r
|
||||
title=mr&firstName=Test+Test&lastName=Test&phoneNumber=1111111111&phoneCountry.isocode=FR&email=sooooooooo%40aaaaaa.com&addresses%5B0%5D.id=9189547245591&addresses%5B0%5D.defaultAddress=true&addresses%5B0%5D.lastName=Test&addresses%5B0%5D.firstName=Test+Test&addresses%5B0%5D.postalCode=75013&addresses%5B0%5D.town=PARIS&addresses%5B0%5D.line1=6+ALLEE+PARIS+IVRY&addresses%5B0%5D.country.isocode=FR&addresses%5B0%5D.addressPhoneCountry.isocode=FR&addresses%5B0%5D.phone=0755911324&addresses%5B0%5D.billingAddress=true&child-count=0&sportActivities%5B0%5D.name=Course+%C3%A0+pied&sportActivities%5B0%5D.code=4&sportActivities%5B0%5D.id=&sportActivities%5B0%5D.me=&sportActivities%5B0%5D.myChildren=&sportActivities%5B1%5D.name=Cycles+(V%C3%A9lo%2C+VTT%2C+%E2%80%A6)&sportActivities%5B1%5D.code=1&sportActivities%5B1%5D.id=&sportActivities%5B1%5D.me=&sportActivities%5B1%5D.myChildren=&sportActivities%5B2%5D.name=Danse%2C+gymnastique%2C+fitness&sportActivities%5B2%5D.code=3&sportActivities%5B2%5D.id=&sportActivities%5B2%5D.me=&sportActivities%5B2%5D.myChildren=&sportActivities%5B3%5D.name=Musculation&sportActivities%5B3%5D.code=5&sportActivities%5B3%5D.id=&sportActivities%5B3%5D.me=&sportActivities%5B3%5D.myChildren=&sportActivities%5B4%5D.name=Randonn%C3%A9es&sportActivities%5B4%5D.code=10&sportActivities%5B4%5D.id=&sportActivities%5B4%5D.me=&sportActivities%5B4%5D.myChildren=&sportActivities%5B5%5D.name=Roller&sportActivities%5B5%5D.code=2&sportActivities%5B5%5D.id=&sportActivities%5B5%5D.me=&sportActivities%5B5%5D.myChildren=&sportActivities%5B6%5D.name=Ski&sportActivities%5B6%5D.code=14&sportActivities%5B6%5D.id=&sportActivities%5B6%5D.me=&sportActivities%5B6%5D.myChildren=&sportActivities%5B7%5D.name=Sport+d'eau+(Natation%2C+surf%2C+voile%2C+%E2%80%A6)&sportActivities%5B7%5D.code=12&sportActivities%5B7%5D.id=&sportActivities%5B7%5D.me=&sportActivities%5B7%5D.myChildren=&sportActivities%5B8%5D.name=Sports+collectifs+(Foot%2C+rugby%2C+basket%2C+%E2%80%A6)&sportActivities%5B8%5D.code=7&sportActivities%5B8%5D.id=&sportActivities%5B8%5D.me=&sportActivities%5B8%5D.myChildren=&sportActivities%5B9%5D.name=Sports+de+combat+(Judo%2C+karat%C3%A9%2C+aikido%2C+%E2%80%A6)&sportActivities%5B9%5D.code=13&sportActivities%5B9%5D.id=&sportActivities%5B9%5D.me=&sportActivities%5B9%5D.myChildren=&sportActivities%5B10%5D.name=Sports+de+raquette&sportActivities%5B10%5D.code=8&sportActivities%5B10%5D.id=&sportActivities%5B10%5D.me=&sportActivities%5B10%5D.myChildren=&sportActivities%5B11%5D.name=Autres&sportActivities%5B11%5D.code=6&sportActivities%5B11%5D.id=&sportActivities%5B11%5D.me=&sportActivities%5B11%5D.myChildren=&birthdate=12%2F11%2F1999&isWebNewsletterSubscribed=false&isSmsNewsletterSubscribed=false&CSRFToken=e87a083d-9743-4d47-8d60-d25e5f00e15e\r
|
||||
"
|
||||
--- error_code: 200
|
||||
|
||||
+114
@@ -0,0 +1,114 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1: rule target body|name
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
BasicRule id:100054 "msg:Weird binary content" "rx:[^-0-9a-z_+.\[\]]" "mz:BODY|NAME" "s:$TEST_LOG:8";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST_LOG >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
9p7jslna,ire(ul\)v`2q8u]h)bfuzpcgsa_3`s\twfw)gy)\%3Fc=]@&foo2=bar2"
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1: rule target body|name
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
BasicRule id:100054 "msg:Weird binary content" "rx:[^-0-9a-z_+.\[\]]" "mz:BODY|NAME" "s:$TEST_LOG:8";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST_LOG >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
9p7jslna,ire(ul\)v`2q8u]h)bfuzpcgsa_3`s\twfw)gy)\%3Fc=ww&foo2=bar2"
|
||||
--- error_code: 412
|
||||
|
||||
|
||||
=== TEST 1: rule target body|name
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
BasicRule id:100054 "msg:Weird binary content" "rx:[^-0-9a-z_+.\[\]]" "mz:BODY|NAME" "s:$TEST_LOG:8";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST_LOG >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
ww=9p7jslna,ire(ul\)v`2q8u]h)bfuzpcgsa_3`s\twfw)gy)\%3Fc&foo2=bar2"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
+66
@@ -0,0 +1,66 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1: Basic GET request with no rules, drop
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
LibInjectionXss;
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
LibInjectionSql;
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=buibui
|
||||
--- error_code: 412
|
||||
=== TEST 1.1: Basic GET request with no rules, whitelist the special rule.
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
BasicRule wl:19;
|
||||
LearningMode;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
LibInjectionXss;
|
||||
CheckRule "$LIBINJECTION_XSS >= 8" BLOCK;
|
||||
LibInjectionSql;
|
||||
CheckRule "$LIBINJECTION_SQL >= 8" BLOCK;
|
||||
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=buibui
|
||||
--- error_code: 200
|
||||
+135
@@ -0,0 +1,135 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 2.0: utf8 overlong
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST_LOG >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
ww=%2F%C0%AE%2E%2F&foo2=bar2"
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 2.1: utf8 overlong
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST_LOG >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
ww=%c0%80"
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 2.2: valid utf8
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST_LOG >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /
|
||||
ww=%61%73%64%c3%a9%c3%a9%c3%a9%c3%a9%c3%a9%71%c3%b9%c3%b9%c3%b9%c3%a2%c3%a2"
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 2.3: valid utf8
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$TEST_LOG >= 8" DROP;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
error_page 405 = $uri;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- raw_request eval
|
||||
"POST /index.html HTTP/1.1\r
|
||||
Host: 127.0.0.1\r
|
||||
Connection: Close\r
|
||||
Content-Type: application/json\r
|
||||
Content-Length: 69\r
|
||||
\r
|
||||
{\"BANK_NAME\":\"建设银行\",\"NAME\":\"山西测试有限责任公司\"}
|
||||
"
|
||||
--- error_code: 200
|
||||
+332
@@ -0,0 +1,332 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
repeat_each(1);
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
__DATA__
|
||||
=== TEST 1: IgnoreIP defined
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "1.1.1.1";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=buibui
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.1: IgnoreIP request
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "1.1.1.1";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=buibui
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.2.1: IgnoreIP request with X-Forwarded-For allow without real_ip config (ipv4)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "1.1.1.1";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 1.1.1.1
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.2.2: IgnoreIP request with X-Forwarded-For allow with real_ip config (ipv4)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
set_real_ip_from 127.0.0.1;
|
||||
real_ip_header X-Forwarded-For;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "1.1.1.1";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 1.1.1.1
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.3.1: IgnoreIP request with X-Forwarded-For allow without reaL_ip config (ipv6)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "2001:4860:4860::8844";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2001:4860:4860::8844
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.3.2: IgnoreIP request with X-Forwarded-For allow with real_ip config (ipv6)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
set_real_ip_from 127.0.0.1;
|
||||
set_real_ip_from ::1/128;
|
||||
real_ip_header X-Forwarded-For;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "2001:4860:4860::8844";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2001:4860:4860::8844
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.4: IgnoreIP request with X-Forwarded-For deny (ipv4)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "1.1.1.1";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2.2.2.2
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.5: IgnoreIP request with X-Forwarded-For deny (ipv6)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "2001:4860:4860::8844";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2001:4860:4860::8888
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.6: Multiple IgnoreIP defined
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "1.1.1.1";
|
||||
IgnoreIP "1.2.3.4";
|
||||
IgnoreIP "2.3.4.1";
|
||||
IgnoreIP "2606:4700:4700::1111";
|
||||
IgnoreIP "2606:4700:4700::1001";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=buibui
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.7: Verify IgnoreIP (IPv4) works
|
||||
--- user_files
|
||||
>>> foobar
|
||||
foobar text
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:/foobar" "mz:URL" "s:$TRAVERSAL:4" id:123456;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "127.0.0.1";
|
||||
#IgnoreIP "2606:4700:4700::1001"; # IPv6 can't be tested.
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foobar
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.8: IgnoreIP request inheritance
|
||||
--- user_files
|
||||
>>> foobar
|
||||
foobar text
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "127.0.0.1";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
|
||||
location /foobar {
|
||||
BasicRule wl:10;
|
||||
}
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foobar?a=update/table
|
||||
--- curl
|
||||
--- curl_options: --interface 127.0.0.1
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.9: IgnoreIP internal rules
|
||||
--- user_files
|
||||
>>> foobar
|
||||
foobar text
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreIP "127.0.0.1";
|
||||
DeniedUrl "/RequestDenied";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
PUT /foobar
|
||||
--- error_code: 405
|
||||
+358
@@ -0,0 +1,358 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
repeat_each(1);
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
__DATA__
|
||||
=== TEST 1: IgnoreCIDR defined (no file)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "1.1.1.0/24";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=buibui
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.1: IgnoreCIDR request (no file)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "1.1.1.0/24";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /?a=buibui
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.2.1: IgnoreCIDR request with X-Forwarded-For allow without real_ip config (no file)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "1.1.1.0/24";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 1.1.1.1
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.2.2: IgnoreCIDR request with X-Forwarded-For allow with real_ip config (no file)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
set_real_ip_from 127.0.0.1;
|
||||
real_ip_header X-Forwarded-For;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "1.1.1.0/24";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 1.1.1.1
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.3: IgnoreCIDR request with X-Forwarded-For deny (no file)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "1.1.1.0/24";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2.2.2.2
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.4: Verify IgnoreCIDR works
|
||||
--- user_files
|
||||
>>> foobar
|
||||
foobar text
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:/foobar" "mz:URL" "s:$TRAVERSAL:4" id:123456;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "127.0.0.0/24";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foobar
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST 1.5: Verify IgnoreCIDR x.x.x.x./32 is converted to IgnoreIP
|
||||
--- user_files
|
||||
>>> foobar
|
||||
foobar text
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:/foobar" "mz:URL" "s:$TRAVERSAL:4" id:123456;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "127.0.0.1/32";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foobar
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.6.1: IgnoreCIDR request with X-Forwarded-For allow without real_ip config (ipv6)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "2001:4860:4860::/112";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2001:4860:4860::8888
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.6.2: IgnoreCIDR request with X-Forwarded-For allow with real_ip config (ipv6)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
set_real_ip_from 127.0.0.1;
|
||||
set_real_ip_from ::1/128;
|
||||
real_ip_header X-Forwarded-For;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "2001:4860:4860::/112";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2001:4860:4860::8888
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.7.1: Verify IgnoreCIDR 2001:4860:4860::8888/128 is converted to IgnoreIP without real_ip config
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "2001:4860:4860::8888/128";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2001:4860:4860::8888
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 412
|
||||
|
||||
=== TEST 1.7.2: Verify IgnoreCIDR 2001:4860:4860::8888/128 is converted to IgnoreIP with real_ip config
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
set_real_ip_from 127.0.0.1;
|
||||
set_real_ip_from ::1/128;
|
||||
real_ip_header X-Forwarded-For;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "2001:4860:4860::8888/128";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
X-Forwarded-For: 2001:4860:4860::8888
|
||||
--- request
|
||||
GET /?a=<>
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.8: IgnoreCIDR request inheritance
|
||||
--- user_files
|
||||
>>> foobar
|
||||
foobar text
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "127.0.0.0/24";
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
|
||||
location /foobar {
|
||||
BasicRule wl:10;
|
||||
}
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
GET /foobar?a=update/table
|
||||
--- curl
|
||||
--- curl_options: --interface 127.0.0.1
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST 1.9: IgnoreCIDR internal rules
|
||||
--- user_files
|
||||
>>> foobar
|
||||
foobar text
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
IgnoreCIDR "127.0.0.0/24";
|
||||
DeniedUrl "/RequestDenied";
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request
|
||||
PUT /foobar
|
||||
--- error_code: 405
|
||||
+290
@@ -0,0 +1,290 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
log_level('error');
|
||||
|
||||
plan tests => repeat_each(1) * (blocks() * 2);
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
check_accum_error_log();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1: JSON log quote escape
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /%2F%22a?b=<>%5C%5C"
|
||||
--- error_code: 412
|
||||
--- no_error_log
|
||||
"server":"localhost","rid":
|
||||
|
||||
=== TEST 1.1: JSON log backslash escape
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /%5C%5C%5C%5Ca?b=<>%5C%5C"
|
||||
--- error_code: 412
|
||||
--- no_error_log
|
||||
"server":"localhost","rid":
|
||||
|
||||
=== TEST 1.2: JSON log backslash and quote escape
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /%2F%22\\a?b=<>\\"
|
||||
--- error_code: 412
|
||||
--- no_error_log
|
||||
"server":"localhost","rid":
|
||||
|
||||
=== TEST 1.3: Truncated JSON log
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /a?b=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
--- error_code: 404
|
||||
--- no_error_log
|
||||
"server":"localhost","rid":
|
||||
|
||||
=== TEST 1.4: Truncated JSON log escaped quote
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /a?b=\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
--- error_code: 412
|
||||
--- no_error_log
|
||||
"server":"localhost","rid":
|
||||
|
||||
|
||||
=== TEST 1.5: Truncated JSON log escaped backslash
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /a?b=\\aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
--- error_code: 412
|
||||
--- no_error_log
|
||||
"server":"localhost","rid":
|
||||
|
||||
|
||||
=== TEST 1.6: Truncated JSON log escaped quote and backslash
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /a?b=\"\\aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
--- error_code: 412
|
||||
--- no_error_log
|
||||
"server":"localhost","rid":
|
||||
|
||||
=== TEST 1.7: Truncated JSON log + extended + escaped quote and backslash
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /a?b=\"\\aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@{"ip":"127\.0\.0\.1","server":"[a-z\d.]+","rid":"[a-f\d]+","uri":"\/a","id":1001,"zone":"ARGS","var_name":"b","content":"\\"\\\\[ab\.]+"}, client: 127\.0\.0\.1,@
|
||||
|
||||
|
||||
=== TEST 1.8: JSON log + extended + escaped quote and backslash
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
set $naxsi_extensive_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /a?b=\"\\dasdasdasdadsa"
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@{"ip":"127\.0\.0\.1","server":"[a-z\d.]+","rid":"[a-f\d]+","uri":"\/a","id":1001,"zone":"ARGS","var_name":"b","content":"\\"\\\\dasdasdasdadsa"}, client: 127\.0\.0\.1,@
|
||||
|
||||
=== TEST 1.9: JSON log + equal symbol
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
set $naxsi_json_log 1;
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
# return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /cgi-bin/luci/;stok=/locale"
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@{"ip":"127\.0\.0\.1","server":"[a-z\d.]+","uri":"\/cgi-bin\/luci\/%3Bstok=\/locale","config":"block","rid":"[a-f\d]+","cscore0":"\$SQL","score0":4,"cscore1":"\$XSS","score1":8,"zone0":"URL","id0":1008,"var_name0":""}, client: 127\.0\.0\.1,@
|
||||
@@ -0,0 +1,96 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
use Env;
|
||||
|
||||
plan tests => repeat_each(1) * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
__DATA__
|
||||
=== Load All Rules
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
include $TEST_NGINX_NAXSI_BLOCKING_RULES/*;
|
||||
--- config
|
||||
location / {
|
||||
include $TEST_NGINX_NAXSI_WHITELISTS_RULES/*;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$UWA >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== Whitelist robots.txt
|
||||
--- user_files
|
||||
>>> robots.txt
|
||||
User-agent: *
|
||||
Allow: /
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
include $TEST_NGINX_NAXSI_BLOCKING_RULES/*;
|
||||
MainRule wl:20000003 "mz:$URL:/robots.txt|URL";
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$UWA >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /"
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== PHP easter eggs
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
include $TEST_NGINX_NAXSI_BLOCKING_RULES/*;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
CheckRule "$UWA >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- request eval
|
||||
"GET /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000"
|
||||
--- error_code: 412
|
||||
|
||||
+527
@@ -0,0 +1,527 @@
|
||||
#vi:filetype=perl
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * 2 * blocks();
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
|
||||
|
||||
__DATA__
|
||||
=== TEST 1: Basic GET request
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 $naxsi_attack_family;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_family;
|
||||
}
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
--- response_body:
|
||||
|
||||
|
||||
=== TEST 2: One tag
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 $naxsi_attack_family;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_family;
|
||||
}
|
||||
--- request
|
||||
GET /?a=--select
|
||||
--- error_code: 412
|
||||
--- response_body: $SQL
|
||||
|
||||
|
||||
=== TEST 2: Two tags
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 $naxsi_attack_family;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_family;
|
||||
}
|
||||
--- request
|
||||
GET /?a=--[]
|
||||
--- error_code: 412
|
||||
--- response_body: $SQL,$XSS
|
||||
|
||||
|
||||
=== TEST 3: Others tag
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 $naxsi_attack_family;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_family;
|
||||
}
|
||||
--- request
|
||||
POST /
|
||||
--- error_code: 412
|
||||
--- response_body: $INTERNAL
|
||||
|
||||
|
||||
=== TEST 4: Custom tag
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
MainRule "str:abc" "msg:foobar test pattern" "mz:ARGS" "s:$XYZ:5" id:2000;
|
||||
MainRule "str:xyz" "msg:foobar test pattern" "mz:ARGS" "s:$XYZ:5" id:2001;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$XYZ >= 5" BLOCK;
|
||||
return 200 $naxsi_attack_family;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_family;
|
||||
}
|
||||
--- request
|
||||
GET /?a=abc&b=xyz
|
||||
--- error_code: 412
|
||||
--- response_body: $XYZ
|
||||
|
||||
|
||||
=== TEST 5: Learning mode Pass
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 $naxsi_attack_action;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_action;
|
||||
}
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
--- response_body: $LEARNING-PASS
|
||||
|
||||
|
||||
=== TEST 6: Learning mode Block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 $naxsi_attack_action;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_action;
|
||||
}
|
||||
--- request
|
||||
GET /?a=--select
|
||||
--- error_code: 200
|
||||
--- response_body: $LEARNING-BLOCK
|
||||
|
||||
|
||||
=== TEST 7: Pass
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 $naxsi_attack_action;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_action;
|
||||
}
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
--- response_body: $PASS
|
||||
|
||||
|
||||
=== TEST 8: Block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 $naxsi_attack_action;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 $naxsi_attack_action;
|
||||
}
|
||||
--- request
|
||||
GET /?a=--select
|
||||
--- error_code: 412
|
||||
--- response_body: $BLOCK
|
||||
|
||||
|
||||
=== TEST 9: Both variables - Block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 "[$naxsi_attack_family - $naxsi_attack_action]";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "[$naxsi_attack_family - $naxsi_attack_action]";
|
||||
}
|
||||
--- request
|
||||
GET /?a=--select
|
||||
--- error_code: 412
|
||||
--- response_body: [$SQL - $BLOCK]
|
||||
|
||||
|
||||
=== TEST 10: Both variables - Learning (would) Block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 "[$naxsi_attack_family - $naxsi_attack_action]";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "[$naxsi_attack_family - $naxsi_attack_action]";
|
||||
}
|
||||
--- request
|
||||
GET /?a=--select
|
||||
--- error_code: 200
|
||||
--- response_body: [$SQL - $LEARNING-BLOCK]
|
||||
|
||||
|
||||
=== TEST 11: Both variables - Pass
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 "[$naxsi_attack_family - $naxsi_attack_action]";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "[$naxsi_attack_family - $naxsi_attack_action]";
|
||||
}
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
--- response_body: [ - $PASS]
|
||||
|
||||
|
||||
=== TEST 12: Both variables - Learning Pass
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 "[$naxsi_attack_family - $naxsi_attack_action]";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "[$naxsi_attack_family - $naxsi_attack_action]";
|
||||
}
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
--- response_body: [ - $LEARNING-PASS]
|
||||
|
||||
|
||||
=== TEST 13.1: Vars - naxsi_server, naxsi_uri, naxsi_learning, naxsi_block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 "$naxsi_server $naxsi_uri $naxsi_learning $naxsi_block";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_server $naxsi_uri $naxsi_learning $naxsi_block";
|
||||
}
|
||||
--- request
|
||||
GET /bla
|
||||
--- error_code: 200
|
||||
--- response_body: localhost /bla 1 0
|
||||
|
||||
|
||||
=== TEST 13.2: Vars - naxsi_server, naxsi_uri, naxsi_learning, naxsi_block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 "$naxsi_server $naxsi_uri $naxsi_learning $naxsi_block";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_server $naxsi_uri $naxsi_learning $naxsi_block";
|
||||
}
|
||||
--- request
|
||||
GET /bla?a=--select
|
||||
--- error_code: 200
|
||||
--- response_body: localhost /bla 1 1
|
||||
|
||||
|
||||
=== TEST 13.3: Vars - naxsi_server, naxsi_uri, naxsi_learning, naxsi_block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 "$naxsi_server $naxsi_uri $naxsi_learning $naxsi_block";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_server $naxsi_uri $naxsi_learning $naxsi_block";
|
||||
}
|
||||
--- request
|
||||
GET /bla
|
||||
--- error_code: 200
|
||||
--- response_body: localhost /bla 0 0
|
||||
|
||||
|
||||
=== TEST 13.4: Vars - naxsi_server, naxsi_uri, naxsi_learning, naxsi_block
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 "$naxsi_server $naxsi_uri $naxsi_learning $naxsi_block";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_server $naxsi_uri $naxsi_learning $naxsi_block";
|
||||
}
|
||||
--- request
|
||||
GET /bla?a=--select
|
||||
--- error_code: 412
|
||||
--- response_body: localhost /RequestDenied 0 1
|
||||
|
||||
|
||||
=== TEST 14: Vars - naxsi_total_processed, naxsi_total_blocked - HTF test that?
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
return 200 "$naxsi_total_processed $naxsi_total_blocked";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_total_processed $naxsi_total_blocked";
|
||||
}
|
||||
--- request
|
||||
GET /bla?a=--select
|
||||
--- error_code: 412
|
||||
--- response_body: 0 0
|
||||
|
||||
|
||||
=== TEST 14.1: Vars - naxsi_score
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 "$naxsi_score";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_score";
|
||||
}
|
||||
--- request
|
||||
GET /bla?a=--select
|
||||
--- error_code: 412
|
||||
--- response_body: $SQL:8
|
||||
|
||||
|
||||
=== TEST 14.2: Vars - naxsi_score
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 "$naxsi_score";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_score";
|
||||
}
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /select--?a=../..
|
||||
"
|
||||
--- error_code: 200
|
||||
--- response_body: $INTERNAL,$SQL:8,$TRAVERSAL:8
|
||||
|
||||
|
||||
=== TEST 15.1: Vars - naxsi_match
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
LearningMode;
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 "$naxsi_match";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_match";
|
||||
}
|
||||
--- request eval
|
||||
use URI::Escape;
|
||||
"POST /select--?a=../..
|
||||
"
|
||||
--- error_code: 200
|
||||
--- response_body: 1000:URL:-,1007:URL:-,1200:ARGS:a,16:BODY:-
|
||||
|
||||
|
||||
=== TEST 16.1: Vars - naxsi_request_id
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
map $naxsi_request_id $naxsi_req_format {
|
||||
"~^[0-9a-f]{32}$" "Ok";
|
||||
default "BAD!";
|
||||
}
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
return 200 "$naxsi_req_format";
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412 "$naxsi_req_format";
|
||||
}
|
||||
--- request
|
||||
GET /?a=--select
|
||||
--- error_code: 412
|
||||
--- response_body: Ok
|
||||
@@ -0,0 +1,248 @@
|
||||
#vi:filetype=perl
|
||||
# This File is used for broken tests.
|
||||
|
||||
use lib 'lib';
|
||||
use Test::Nginx::Socket;
|
||||
|
||||
plan tests => repeat_each(1) * (blocks() + 5);
|
||||
no_root_location();
|
||||
no_long_string();
|
||||
$ENV{TEST_NGINX_SERVROOT} = server_root();
|
||||
run_tests();
|
||||
__DATA__
|
||||
|
||||
=== TEST: Illegal Host (0.0.0.0)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: 0.0.0.0
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@config=drop&rid=[^&]+&zone0=HEADERS&id0=21&var_name0=, client: 127\.0\.0\.1,@
|
||||
|
||||
=== TEST: Illegal Host (0.1.0.6)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: 0.1.0.6
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@config=drop&rid=[^&]+&zone0=HEADERS&id0=21&var_name0=, client: 127\.0\.0\.1,@
|
||||
|
||||
=== TEST: Illegal Host (255.255.255.255)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: 255.255.255.255
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@config=drop&rid=[^&]+&zone0=HEADERS&id0=21&var_name0=, client: 127\.0\.0\.1,@
|
||||
|
||||
=== TEST: Illegal Host (--dddd)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: --dddd
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@config=drop&rid=[^&]+&zone0=HEADERS&id0=21&var_name0=, client: 127\.0\.0\.1,@
|
||||
|
||||
=== TEST: Illegal Host ([ipaddr])
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: [ipaddr]
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 412
|
||||
--- error_log eval
|
||||
qr@config=drop&rid=[^&]+&zone0=HEADERS&id0=21&var_name0=, client: 127\.0\.0\.1,@
|
||||
|
||||
=== TEST: Legal Host (127.0.0.1)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: 127.0.0.1
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST: Legal Host (localhost)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: localhost
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
|
||||
=== TEST: Legal Host (local.host)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: local.host
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
|
||||
|
||||
=== TEST: Punycode Host (www.xn--80ak6aa92e.com)
|
||||
--- main_config
|
||||
load_module $TEST_NGINX_NAXSI_MODULE_SO;
|
||||
--- http_config
|
||||
include $TEST_NGINX_NAXSI_RULES;
|
||||
--- config
|
||||
location / {
|
||||
SecRulesEnabled;
|
||||
DeniedUrl "/RequestDenied";
|
||||
CheckRule "$SQL >= 8" BLOCK;
|
||||
CheckRule "$RFI >= 8" BLOCK;
|
||||
CheckRule "$TRAVERSAL >= 4" BLOCK;
|
||||
CheckRule "$XSS >= 8" BLOCK;
|
||||
root $TEST_NGINX_SERVROOT/html/;
|
||||
index index.html index.htm;
|
||||
}
|
||||
location /RequestDenied {
|
||||
return 412;
|
||||
}
|
||||
--- more_headers
|
||||
Host: www.xn--80ak6aa92e.com
|
||||
--- request
|
||||
GET /
|
||||
--- error_code: 200
|
||||
Reference in New Issue
Block a user