mirror of
https://github.com/Safe3/uusec-waf.git
synced 2025-10-04 06:51:54 +08:00
e66cca6014
### Feature Updates **Interface & Management** - Redesigned main program and management interface with improved aesthetics and usability, supports UI language switching (English/Chinese) - Added Rule Collections functionality: Create custom rule templates for batch configuration - Introduced whitelist rules that terminate further rule matching upon success - UUSEC WAF Rules API intelligent suggestions during advanced rule editing:ml-citation - New plugin management supporting hot-reloaded plugins to extend WAF capabilities **Protocol & Optimization** - Supports streaming responses for continuous data push (e.g., LLM stream outputs) - Enables Host header modification during proxying for upstream service access - Search engine validation: `waf.searchEngineValid(dns,ip,ua)` prevents high-frequency rules from affecting SEO indexing - Interception log report generation (HTML/PDF exports) - Automatic rotation of UUSEC WAF error/access logs to prevent performance issues **Security & Infrastructure** - Expanded free SSL certificate support: HTTP-01 & DNS-01 verification across 50+ domain providers - Customizable advanced WAF settings: HTTP2, GZIP, HTTP Caching, SSL protocols, etc - Cluster configuration: Manage UUSEC WAF nodes and ML servers via web UI
35 lines
No EOL
1.5 KiB
Lua
35 lines
No EOL
1.5 KiB
Lua
--[[
|
|
Rule name: IIS error detection
|
|
Filtering stage: Response body
|
|
Threat level: Low
|
|
Rule description: The error message returned by IIS may leak sensitive server information
|
|
--]]
|
|
|
|
|
|
local rgx = waf.rgxMatch
|
|
local rb = waf.respBody
|
|
|
|
local m = rgx(rb, "[a-z]:\\x5cinetpub\\b", "jo")
|
|
if m then
|
|
return m, rb, true
|
|
end
|
|
|
|
if waf.status == 500 then
|
|
local m = rgx(rb, "Microsoft OLE DB Provider for SQL Server(?:</font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| \\(0x80040e31\\)<br>Timeout expired<br>)|<h1>internal server error</h1>.*?<h2>part of the server has crashed or it has a configuration error\\.</h2>|cannot connect to the server: timed out", "jo")
|
|
if m then
|
|
return m, rb, true
|
|
end
|
|
local m = rgx(rb, "\\b(?:A(?:DODB\\.Command\\b.{0,100}?\\b(?:Application uses a value of the wrong type for the current operation\\b|error')| trappable error occurred in an external object\\. The script cannot continue running\\b)|Microsoft VBScript (?:compilation (?:\\(0x8|error)|runtime (?:Error|\\(0x8))\\b|Object required: '|error '800)|<b>Version Information:</b>(?: |\\s)(?:Microsoft \\.NET Framework|ASP\\.NET) Version:|>error 'ASP\\b|An Error Has Occurred|>Syntax error in string in query expression|/[Ee]rror[Mm]essage\\.aspx?\\?[Ee]rror\\b", "jo")
|
|
if m then
|
|
return m, rb, true
|
|
end
|
|
end
|
|
|
|
if waf.status == 404 then
|
|
local m = rgx(rb, "\\bServer Error in.{0,50}?\\bApplication\\b", "jo")
|
|
if m then
|
|
return m, rb, true
|
|
end
|
|
end
|
|
|
|
return false |