tcjlj/OpenFlare
1
0
Fork 0
mirror of https://github.com/Rain-kl/OpenFlare.git synced 2026-10-11 09:46:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(waf): 新增安全防护节点 security_check

Browse Source 
基础特征检测九项可开关；默认开启路径穿越与文件包含；命中任意规则走 false。
This commit is contained in:
ryan
2026-07-19 12:33:13 +08:00
parent db89f68547
commit b75f985815
18 changed files with 486 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/apps/openflare/waf/graph_compile_test.go
+24
View File
@@ -42,6 +42,30 @@ func TestCompileRuleGraph(t *testing.T) {
}
}
func TestCompileSecurityCheckConfig(t *testing.T) {
graph := RuleGraph{SchemaVersion: RuleGraphSchemaVersion, Nodes: []RuleNode{
{ID: "start", Type: RuleNodeStart, Config: rawConfig(`{}`)},
{ID: "sec", Type: RuleNodeSecurityCheck, Config: rawConfig(`{"path_traversal":true,"file_inclusion":true,"sql_injection":false}`)},
{ID: "allow", Type: RuleNodeAllow, Config: rawConfig(`{}`)},
{ID: "block", Type: RuleNodeBlock, Config: rawConfig(`{"status_code":403}`)},
}, Edges: []RuleEdge{
{ID: "e1", Source: "start", SourceHandle: "next", Target: "sec"},
{ID: "e2", Source: "sec", SourceHandle: "true", Target: "allow"},
{ID: "e3", Source: "sec", SourceHandle: "false", Target: "block"},
}}
compiled, err := CompileRuleGraph(graph)
if err != nil {
t.Fatalf("CompileRuleGraph() error = %v", err)
}
cfg, ok := compiled.Nodes["sec"].Config.(SecurityCheckConfig)
if !ok {
t.Fatalf("config type = %T", compiled.Nodes["sec"].Config)
}
if !cfg.PathTraversal || !cfg.FileInclusion || cfg.SQLInjection {
t.Fatalf("unexpected config %#v", cfg)
}
}
func TestCompileUACheckConfigNormalizesListsAndMatchMode(t *testing.T) {
graph := RuleGraph{SchemaVersion: RuleGraphSchemaVersion, Nodes: []RuleNode{
{ID: "start", Type: RuleNodeStart, Config: rawConfig(`{}`)},