opensource/SamWaf
3
0
Fork 0
mirror of https://gitee.com/samwaf/SamWaf.git synced 2026-10-31 02:01:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: asset logic

Browse Source
This commit is contained in:
samwaf
2025-03-25 10:32:25 +08:00
parent 5791935e96
commit f98b84302b
3 changed files with 62 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
utils/http_check.go
+11 -9
View File
@@ -17,6 +17,14 @@ func IsStaticAssist(res *http.Response, contentType string) bool {
}
// 检查请求的Accept头，判断是否为资源类型请求
if res.Request != nil {
// 检查Sec-Fetch-Dest头，这是一个更明确的指示
secFetchDest := res.Request.Header.Get("Sec-Fetch-Dest")
if secFetchDest == "image" || secFetchDest == "font" ||
secFetchDest == "audio" || secFetchDest == "video" ||
secFetchDest == "style" || secFetchDest == "script" {
return true
}
acceptHeader := res.Request.Header.Get("Accept")
if acceptHeader != "" {
// 检查Accept头是否主要请求图片或其他资源类型
@@ -24,15 +32,9 @@ func IsStaticAssist(res *http.Response, contentType string) bool {
strings.Contains(acceptHeader, "font/") ||
strings.Contains(acceptHeader, "audio/") ||
strings.Contains(acceptHeader, "video/")
return isResourceRequest
}
// 检查Sec-Fetch-Dest头，这是一个更明确的指示
secFetchDest := res.Request.Header.Get("Sec-Fetch-Dest")
if secFetchDest == "image" || secFetchDest == "font" ||
secFetchDest == "audio" || secFetchDest == "video" ||
secFetchDest == "style" {
return true
if isResourceRequest {
return true
}
}
}
//如果检测资源后发现还存在，那么进行判断处理
wafenginecore/content_encoding.go
+2 -4
View File
@@ -24,8 +24,7 @@ func (waf *WafEngine) compressContent(res *http.Response, isStaticAssist bool, i
// 如果是静态资源响应或资源类型请求，直接返回原始内容
if isStaticAssist {
zlog.Debug("静态资源或资源类型请求，跳过编码转换")
return inputBytes, nil
return inputBytes, errors.New("静态资源或资源类型请求，跳过编码转换")
}
// 首先检查Content-Type头中是否明确指定了字符集
@@ -87,8 +86,7 @@ func (waf *WafEngine) getOrgContent(resp *http.Response, isStaticAssist bool) (c
// 如果是静态资源响应或资源类型请求，直接返回原始内容
if isStaticAssist {
zlog.Debug("静态资源或资源类型请求，跳过编码转换")
return bodyBytes, nil
return bodyBytes, errors.New("静态资源或资源类型请求，跳过编码转换")
}
// 根据内容编码处理压缩
wafenginecore/wafengine.go
+49 -50
View File
@@ -608,58 +608,57 @@ func (waf *WafEngine) modifyResponse() func(*http.Response) error {
//记录静态日志
isStaticAssist := utils.IsStaticAssist(resp, respContentType)
ldpFlag := false
// 将请求URL转为小写，用于不区分大小写的比较
lowerRequestURI := strings.ToLower(resp.Request.RequestURI)
//隐私保护（局部）
for i := 0; i < len(waf.HostTarget[host].LdpUrlLists); i++ {
// 将规则URL也转为小写
lowerRuleURL := strings.ToLower(waf.HostTarget[host].LdpUrlLists[i].Url)
if (waf.HostTarget[host].LdpUrlLists[i].CompareType == "等于" && lowerRuleURL == lowerRequestURI) ||
(waf.HostTarget[host].LdpUrlLists[i].CompareType == "前缀匹配" && strings.HasPrefix(lowerRequestURI, lowerRuleURL)) ||
(waf.HostTarget[host].LdpUrlLists[i].CompareType == "后缀匹配" && strings.HasSuffix(lowerRequestURI, lowerRuleURL)) ||
(waf.HostTarget[host].LdpUrlLists[i].CompareType == "包含匹配" && strings.Contains(lowerRequestURI, lowerRuleURL)) {
ldpFlag = true
break
}
}
//隐私保护（全局）
for i := 0; i < len(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists); i++ {
// 将全局规则URL也转为小写
lowerGlobalRuleURL := strings.ToLower(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].Url)
if (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "等于" && lowerGlobalRuleURL == lowerRequestURI) ||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "前缀匹配" && strings.HasPrefix(lowerRequestURI, lowerGlobalRuleURL)) ||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "后缀匹配" && strings.HasSuffix(lowerRequestURI, lowerGlobalRuleURL)) ||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "包含匹配" && strings.Contains(lowerRequestURI, lowerGlobalRuleURL)) {
ldpFlag = true
break
}
}
if ldpFlag == true {
orgContentBytes, responseEncodingError := waf.getOrgContent(resp, isStaticAssist)
if responseEncodingError == nil {
newPayload := []byte("" + utils.DeSenText(string(orgContentBytes)))
finalCompressBytes, _ := waf.compressContent(resp, isStaticAssist, newPayload)
resp.Body = io.NopCloser(bytes.NewBuffer(finalCompressBytes))
// head 修改追加内容
resp.ContentLength = int64(len(finalCompressBytes))
resp.Header.Set("Content-Length", strconv.FormatInt(int64(len(finalCompressBytes)), 10))
} else {
resp.Body = io.NopCloser(bytes.NewBuffer(orgContentBytes))
zlog.Warn(fmt.Sprintf("识别响应内容编码失败，隐私防护不可用 %v", responseEncodingError))
}
}
//记录响应body
if !isStaticAssist && resp.Body != nil && resp.Body != http.NoBody {
ldpFlag := false
// 将请求URL转为小写，用于不区分大小写的比较
lowerRequestURI := strings.ToLower(resp.Request.RequestURI)
//隐私保护（局部）
for i := 0; i < len(waf.HostTarget[host].LdpUrlLists); i++ {
// 将规则URL也转为小写
lowerRuleURL := strings.ToLower(waf.HostTarget[host].LdpUrlLists[i].Url)
if (waf.HostTarget[host].LdpUrlLists[i].CompareType == "等于" && lowerRuleURL == lowerRequestURI) ||
(waf.HostTarget[host].LdpUrlLists[i].CompareType == "前缀匹配" && strings.HasPrefix(lowerRequestURI, lowerRuleURL)) ||
(waf.HostTarget[host].LdpUrlLists[i].CompareType == "后缀匹配" && strings.HasSuffix(lowerRequestURI, lowerRuleURL)) ||
(waf.HostTarget[host].LdpUrlLists[i].CompareType == "包含匹配" && strings.Contains(lowerRequestURI, lowerRuleURL)) {
ldpFlag = true
break
}
}
//隐私保护（全局）
for i := 0; i < len(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists); i++ {
// 将全局规则URL也转为小写
lowerGlobalRuleURL := strings.ToLower(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].Url)
if (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "等于" && lowerGlobalRuleURL == lowerRequestURI) ||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "前缀匹配" && strings.HasPrefix(lowerRequestURI, lowerGlobalRuleURL)) ||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "后缀匹配" && strings.HasSuffix(lowerRequestURI, lowerGlobalRuleURL)) ||
(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "包含匹配" && strings.Contains(lowerRequestURI, lowerGlobalRuleURL)) {
ldpFlag = true
break
}
}
if ldpFlag == true {
orgContentBytes, responseEncodingError := waf.getOrgContent(resp, isStaticAssist)
if responseEncodingError == nil {
newPayload := []byte("" + utils.DeSenText(string(orgContentBytes)))
finalCompressBytes, _ := waf.compressContent(resp, isStaticAssist, newPayload)
resp.Body = io.NopCloser(bytes.NewBuffer(finalCompressBytes))
// head 修改追加内容
resp.ContentLength = int64(len(finalCompressBytes))
resp.Header.Set("Content-Length", strconv.FormatInt(int64(len(finalCompressBytes)), 10))
} else {
resp.Body = io.NopCloser(bytes.NewBuffer(orgContentBytes))
zlog.Warn(fmt.Sprintf("识别响应内容编码失败，隐私防护不可用 %v，请求URL: %s", responseEncodingError, r.URL.String()))
}
}
//编码转换，自动检测网页编码 resp *http.Response
orgContentBytes, responseEncodingError := waf.getOrgContent(resp, isStaticAssist)
if responseEncodingError == nil {
@@ -703,7 +702,7 @@ func (waf *WafEngine) modifyResponse() func(*http.Response) error {
} else {
resp.Body = io.NopCloser(bytes.NewBuffer(orgContentBytes))
zlog.Warn(fmt.Sprintf("识别响应内容编码失败，响应日志，敏感词替换 不可用 %v", responseEncodingError))
zlog.Warn(fmt.Sprintf("识别响应内容编码失败，响应日志，敏感词替换 不可用 %v，请求URL: %s", responseEncodingError, r.URL.String()))
}
}
zlog.Debug("TESTChanllage", weblogfrist.HOST, weblogfrist.URL)