Nginx 的 WAF 规则 LuaJIT 中危险版

local sh = ngx.shared.ipCache
local robotIp = 'rb:' .. waf.ip
local c, f = sh:get(robotIp)

-- 如果是静态页面且没有进行滑动旋转验证码验证则返回
if not (waf.isQueryString or waf.reqContentLength > 0) and f ~= 2 then
    return false
end

if not c then
    sh:set(robotIp, 1, 60, 1)  -- 设置1分钟也就是60秒访问计数时间段
else
    if f == 2 then
        return waf.checkRobot(waf)     -- 启动机器人滑动旋转验证码验证
    end
    sh:incr(robotIp, 1)
    if c + 1 >= 360 then
        sh:set(robotIp, c + 1, 1800, 2)  -- 达到了60秒内请求超过360次的阈值，进入机器人验证模式
        return true, robotIp, true
    end
end

return false

local check = waf.plugins.weakPwdDetection.check
local toLower = waf.toLower
local has = waf.contains

local form = waf.form
local uri = toLower(waf.uri)
if form and (has(uri, "login") or has(uri, "logon") or has(uri, "signin")) then
    local f = form["FORM"]
    if f then
        for k, v in pairs(f) do
            k = toLower(k)
            if (k == "pass" or has(k, "pwd") or has(k, "passwd") or has(k, "password")) and check(v) then
                return true, form["RAW"], false
            end
        end
    end
end

return false

local m, d = waf.plugins.fileLeakDetection.check()
if m then
    return true, d, true
end
return false

if waf.reqContentLength>8388608 then
    return true,"reqBody length is "..waf.reqContentLength ,true
end
return false

local rgx = waf.rgxMatch

local function rMatch(v)
    local m = rgx(v, "(?:][^\\]]+$|][^\\]]+\\[)", "jos")
    if m then
        return m, v
    end
    return false
end

local form = waf.form
if form then
    for k, v in pairs(form["FORM"]) do
        if type(v) == "table" then
            return true, k.."="..table.concat(v, ","), true
        end
        local m, d = rMatch(k)
        if m then
            return m, d, true
        end
    end
end

local queryString = waf.queryString
if queryString then
    for k, v in pairs(queryString) do
        if type(v) == "table" then
            return true, k.."="..table.concat(v, ","), true
        end
        local m, d = rMatch(k)
        if m then
            return m, d, true
        end
    end
end

local cookies = waf.cookies
if cookies then
    for k, v in pairs(cookies) do
        if type(v) == "table" then
            return true, k.."="..table.concat(v, ","), true
        end
        local m, d = rMatch(k)
        if m then
            return m, d, true
        end
    end
end
return false

local m, d = waf.plugins.scannerDetection.check()
if m then
    return true, d, true
end
return false