From 1ba05ec0bdda1a5eacb6dba722c1f2b5e7f55ea3 Mon Sep 17 00:00:00 2001 From: ryan Date: Sun, 19 Jul 2026 12:46:23 +0800 Subject: [PATCH] =?UTF-8?q?fix(waf):=20=E9=81=BF=E5=85=8D=20SQL=20?= =?UTF-8?q?=E7=89=B9=E5=BE=81=20/*=20*/=20=E8=AF=AF=E5=8C=B9=E9=85=8D=20Ac?= =?UTF-8?q?cept:=20*/*?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 开启 SQL 注入防护时不再把正常 Accept 头当成攻击。 --- internal/apps/agent/nginx/waf_runtime.lua | 3 ++- internal/apps/agent/nginx/waf_runtime_spec.lua | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/internal/apps/agent/nginx/waf_runtime.lua b/internal/apps/agent/nginx/waf_runtime.lua index 4759dc8d..e5586891 100644 --- a/internal/apps/agent/nginx/waf_runtime.lua +++ b/internal/apps/agent/nginx/waf_runtime.lua @@ -502,7 +502,8 @@ local file_inclusion_patterns = { local sql_patterns = { "union select", " or 1=1", "' or '", "\" or \"", "sleep(", "benchmark(", "information_schema", "xp_cmdshell", "load_file(", " into outfile", - "/*", "*/", "@@version", + -- Avoid bare "/*" / "*/": they match normal Accept: */* headers. + "/**/", "/*!", "*/--", "@@version", } local command_patterns = { ";wget", ";curl", "|bash", "|sh", "`id`", "$(id)", "&&", "||", diff --git a/internal/apps/agent/nginx/waf_runtime_spec.lua b/internal/apps/agent/nginx/waf_runtime_spec.lua index 940aa249..5a28ff7a 100644 --- a/internal/apps/agent/nginx/waf_runtime_spec.lua +++ b/internal/apps/agent/nginx/waf_runtime_spec.lua @@ -717,6 +717,14 @@ local function test_security_check_path_and_sql() rule_groups = { rule(1, false, security_graph({ sql_injection = true })) }, bindings = { binding("sec-site", { 1 }) }, }) + reset_request("sec-site", nil, "/") + ngx.req.get_headers = function() + return { Accept = "*/*" } + end + decision, err = runtime.debug_execute_graph(runtime.debug_active_rules("sec-site")[1].graph) + assert_equal(err, nil, "accept header execute err") + assert_equal(decision and decision.kind or "nil", "allow", "Accept */* must not trip SQL") + reset_request("sec-site", nil, "/") ngx.var.args = "q=1'+union+select+1--" ngx.req.get_uri_args = function()