-
Notifications
You must be signed in to change notification settings - Fork 60
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #19 from RuiSiang/waf-dev
Waf dev
- Loading branch information
Showing
32 changed files
with
1,053 additions
and
92 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| window.powSolver = require('../dist/service/pow/solver.js').Solver; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,146 @@ | ||
| import fs from 'fs' | ||
| import path from 'path' | ||
| import config from '../util/config-parser' | ||
| import { ParameterizedContext } from 'koa' | ||
|
|
||
| interface Rule { | ||
| reg: RegExp | ||
| type: number | ||
| cmt: string | ||
| } | ||
|
|
||
| interface _Rule { | ||
| id: number | ||
| reg: string | ||
| type: number | ||
| cmt: string | ||
| } | ||
|
|
||
| class Waf { | ||
| private static instance: Waf | ||
| public static getInstance(): Waf { | ||
| if (!Waf.instance) { | ||
| Waf.instance = new Waf() | ||
| } | ||
| return Waf.instance | ||
| } | ||
|
|
||
| constructor() { | ||
| this.load() | ||
| } | ||
|
|
||
| private types: { | ||
| [key: string]: string | ||
| } = {} | ||
|
|
||
| private rules: { | ||
| [key: string]: Rule | ||
| } = {} | ||
|
|
||
| private entries: { [key: string]: RegExp } = {} | ||
|
|
||
| private load = () => { | ||
| this.types = JSON.parse( | ||
| fs.readFileSync(path.join(process.cwd(), 'wafTypes.json')).toString() | ||
| ) | ||
| const rulesJson = JSON.parse( | ||
| fs.readFileSync(path.join(process.cwd(), 'wafRules.json')).toString() | ||
| ) | ||
|
|
||
| for (let key in this.types) { | ||
| this.types[this.types[key]] = key | ||
| } | ||
| rulesJson.forEach((rule: _Rule) => { | ||
| this.rules[rule.id] = { | ||
| reg: new RegExp(rule.reg), | ||
| type: rule.type, | ||
| cmt: rule.cmt, | ||
| } | ||
| this.entries[rule.id] = new RegExp(rule.reg) | ||
| }) | ||
| } | ||
|
|
||
| private parseNumString = (numString: string) => { | ||
| const substrings = numString.split(',') | ||
| let numArr: number[] = [] | ||
| substrings.forEach(function (item) { | ||
| if (!!item) { | ||
| const tmpArr = item.split('-') | ||
| if (tmpArr.length == 2) { | ||
| const low = parseInt(tmpArr[0]) | ||
| const high = parseInt(tmpArr[1]) | ||
| for (let i = low; i <= high; i++) { | ||
| numArr.push(i) | ||
| } | ||
| } else { | ||
| numArr.push(parseInt(tmpArr[0])) | ||
| } | ||
| } | ||
| }) | ||
| return numArr | ||
| } | ||
|
|
||
| private detect = async (test: string, excludes: number[]) => { | ||
| for (let key in this.entries) { | ||
| if (!excludes.includes(parseInt(key))) { | ||
| if (this.entries[key].test(test) === true) { | ||
| return key | ||
| } | ||
| } | ||
| } | ||
| return 0 | ||
| } | ||
|
|
||
| public scan = async (ctx: ParameterizedContext) => { | ||
| if (!!config.waf) { | ||
| const urlExcludeRules = this.parseNumString(config.waf_url_exclude_rules) | ||
| const urlResult = await this.detect(ctx.url, urlExcludeRules) | ||
| if (!!urlResult) { | ||
| return { | ||
| id: urlResult, | ||
| type: this.types[this.rules[urlResult].type], | ||
| cmt: this.rules[urlResult].cmt, | ||
| location: 'url', | ||
| } | ||
| } | ||
| const headerExcludeRules = this.parseNumString( | ||
| config.waf_header_exclude_rules | ||
| ) | ||
| const headerResult = await this.detect( | ||
| JSON.stringify(ctx.headers), | ||
| headerExcludeRules | ||
| ) | ||
| if (!!headerResult) { | ||
| return { | ||
| id: headerResult, | ||
| type: this.types[this.rules[headerResult].type], | ||
| cmt: this.rules[headerResult].cmt, | ||
| location: 'header', | ||
| } | ||
| } | ||
| const bodyExcludeRules = this.parseNumString( | ||
| config.waf_body_exclude_rules | ||
| ) | ||
| const bodyResult = await this.detect( | ||
| JSON.stringify(ctx.request.body), | ||
| bodyExcludeRules | ||
| ) | ||
| if (!!bodyResult) { | ||
| return { | ||
| id: bodyResult, | ||
| type: this.types[this.rules[bodyResult].type], | ||
| cmt: this.rules[bodyResult].cmt, | ||
| location: 'body', | ||
| } | ||
| } | ||
| } | ||
| return null | ||
| } | ||
| public test = async (test: string, excludes: number[]) => { | ||
| if (process.env.NODE_ENV === 'test') { | ||
| return await this.detect(test, excludes) | ||
| } | ||
| return 0 | ||
| } | ||
| } | ||
| export default Waf |
Oops, something went wrong.