Skip to content

11 args_Mod

star edited this page Jan 7, 2018 · 3 revisions

args_Mod GET请求参数规则模块

(对应配置文件:conf_json/args_Mod.json)

该模块是整个访问控制规则的 第11步 用于配置GET请求参数的访问控制

[
    {
        "state": "on",
        # 该条规则开关(on/off)
        "hostname": ["*",""],
        # host匹配规则;第一个参数:匹配内容,第二个:匹配方式,字符串等于(该条规则是匹配任意字符串)
        "args_data": ["\\.\\./","jio"],
        # args_data匹配规则;第一个参数:匹配内存,第二个:匹配方式,正则匹配
        "action": "deny"
        # 执行动作:拒绝(allow/deny/log)
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["\\:\\$","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["\\$\\{","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["select.+(from|limit)","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["(?:(union(.*?)select))","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["having|rongjitest","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["sleep\\((\\s*)(\\d*)(\\s*)\\)","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["benchmark\\((.*)\\,(.*)\\)","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["base64_decode\\(","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["(?:from\\W+information_schema\\W)","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["(?:(?:current_)user|database|schema|connection_id)\\s*\\(","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["(?:etc\\/\\W*passwd)","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["into(\\s+)+(?:dump|out)file\\s*","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["group\\s+by.+\\(","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\(","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["xwork\\.MethodAccessor","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\\:\\/","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["java\\.lang","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["\\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\\[","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["\\<(iframe|script|body|img|layer|div|meta|style|base|object|input)","jio"],
        "action": "deny"
    },
    {
        "state": "on",
        "hostname": ["*",""],
        "args_data": ["(onmouseover|onerror|onload)\\=\t","jio"],
        "action": "deny"
    },
    ... # 下一条规则
]
Clone this wiki locally