From f98b84302be608f9e147aebbd8c8bba14da2ff6b Mon Sep 17 00:00:00 2001 From: samwaf Date: Tue, 25 Mar 2025 10:32:25 +0800 Subject: [PATCH] fix: asset logic --- utils/http_check.go | 20 ++++--- wafenginecore/content_encoding.go | 6 +- wafenginecore/wafengine.go | 99 +++++++++++++++---------------- 3 files changed, 62 insertions(+), 63 deletions(-) diff --git a/utils/http_check.go b/utils/http_check.go index 33de9ec..9e34a12 100644 --- a/utils/http_check.go +++ b/utils/http_check.go @@ -17,6 +17,14 @@ func IsStaticAssist(res *http.Response, contentType string) bool { } // 检查请求的Accept头，判断是否为资源类型请求 if res.Request != nil { + + // 检查Sec-Fetch-Dest头，这是一个更明确的指示 + secFetchDest := res.Request.Header.Get("Sec-Fetch-Dest") + if secFetchDest == "image" || secFetchDest == "font" || + secFetchDest == "audio" || secFetchDest == "video" || + secFetchDest == "style" || secFetchDest == "script" { + return true + } acceptHeader := res.Request.Header.Get("Accept") if acceptHeader != "" { // 检查Accept头是否主要请求图片或其他资源类型 @@ -24,15 +32,9 @@ func IsStaticAssist(res *http.Response, contentType string) bool { strings.Contains(acceptHeader, "font/") || strings.Contains(acceptHeader, "audio/") || strings.Contains(acceptHeader, "video/") - return isResourceRequest - } - - // 检查Sec-Fetch-Dest头，这是一个更明确的指示 - secFetchDest := res.Request.Header.Get("Sec-Fetch-Dest") - if secFetchDest == "image" || secFetchDest == "font" || - secFetchDest == "audio" || secFetchDest == "video" || - secFetchDest == "style" { - return true + if isResourceRequest { + return true + } } } //如果检测资源后发现还存在，那么进行判断处理 diff --git a/wafenginecore/content_encoding.go b/wafenginecore/content_encoding.go index 7c0ed70..5164dba 100644 --- a/wafenginecore/content_encoding.go +++ b/wafenginecore/content_encoding.go @@ -24,8 +24,7 @@ func (waf *WafEngine) compressContent(res *http.Response, isStaticAssist bool, i // 如果是静态资源响应或资源类型请求，直接返回原始内容 if isStaticAssist { - zlog.Debug("静态资源或资源类型请求，跳过编码转换") - return inputBytes, nil + return inputBytes, errors.New("静态资源或资源类型请求，跳过编码转换") } // 首先检查Content-Type头中是否明确指定了字符集 @@ -87,8 +86,7 @@ func (waf *WafEngine) getOrgContent(resp *http.Response, isStaticAssist bool) (c // 如果是静态资源响应或资源类型请求，直接返回原始内容 if isStaticAssist { - zlog.Debug("静态资源或资源类型请求，跳过编码转换") - return bodyBytes, nil + return bodyBytes, errors.New("静态资源或资源类型请求，跳过编码转换") } // 根据内容编码处理压缩 diff --git a/wafenginecore/wafengine.go b/wafenginecore/wafengine.go index 2289fec..454b854 100644 --- a/wafenginecore/wafengine.go +++ b/wafenginecore/wafengine.go @@ -608,58 +608,57 @@ func (waf *WafEngine) modifyResponse() func(*http.Response) error { //记录静态日志 isStaticAssist := utils.IsStaticAssist(resp, respContentType) - ldpFlag := false - // 将请求URL转为小写，用于不区分大小写的比较 - lowerRequestURI := strings.ToLower(resp.Request.RequestURI) - - //隐私保护（局部） - for i := 0; i < len(waf.HostTarget[host].LdpUrlLists); i++ { - // 将规则URL也转为小写 - lowerRuleURL := strings.ToLower(waf.HostTarget[host].LdpUrlLists[i].Url) - - if (waf.HostTarget[host].LdpUrlLists[i].CompareType == "等于" && lowerRuleURL == lowerRequestURI) || - (waf.HostTarget[host].LdpUrlLists[i].CompareType == "前缀匹配" && strings.HasPrefix(lowerRequestURI, lowerRuleURL)) || - (waf.HostTarget[host].LdpUrlLists[i].CompareType == "后缀匹配" && strings.HasSuffix(lowerRequestURI, lowerRuleURL)) || - (waf.HostTarget[host].LdpUrlLists[i].CompareType == "包含匹配" && strings.Contains(lowerRequestURI, lowerRuleURL)) { - - ldpFlag = true - break - } - } - //隐私保护（全局） - for i := 0; i < len(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists); i++ { - // 将全局规则URL也转为小写 - lowerGlobalRuleURL := strings.ToLower(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].Url) - - if (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "等于" && lowerGlobalRuleURL == lowerRequestURI) || - (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "前缀匹配" && strings.HasPrefix(lowerRequestURI, lowerGlobalRuleURL)) || - (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "后缀匹配" && strings.HasSuffix(lowerRequestURI, lowerGlobalRuleURL)) || - (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "包含匹配" && strings.Contains(lowerRequestURI, lowerGlobalRuleURL)) { - - ldpFlag = true - break - } - } - if ldpFlag == true { - orgContentBytes, responseEncodingError := waf.getOrgContent(resp, isStaticAssist) - if responseEncodingError == nil { - newPayload := []byte("" + utils.DeSenText(string(orgContentBytes))) - finalCompressBytes, _ := waf.compressContent(resp, isStaticAssist, newPayload) - - resp.Body = io.NopCloser(bytes.NewBuffer(finalCompressBytes)) - // head 修改追加内容 - resp.ContentLength = int64(len(finalCompressBytes)) - resp.Header.Set("Content-Length", strconv.FormatInt(int64(len(finalCompressBytes)), 10)) - } else { - resp.Body = io.NopCloser(bytes.NewBuffer(orgContentBytes)) - zlog.Warn(fmt.Sprintf("识别响应内容编码失败，隐私防护不可用 %v", responseEncodingError)) - } - - } - //记录响应body if !isStaticAssist && resp.Body != nil && resp.Body != http.NoBody { + ldpFlag := false + // 将请求URL转为小写，用于不区分大小写的比较 + lowerRequestURI := strings.ToLower(resp.Request.RequestURI) + + //隐私保护（局部） + for i := 0; i < len(waf.HostTarget[host].LdpUrlLists); i++ { + // 将规则URL也转为小写 + lowerRuleURL := strings.ToLower(waf.HostTarget[host].LdpUrlLists[i].Url) + + if (waf.HostTarget[host].LdpUrlLists[i].CompareType == "等于" && lowerRuleURL == lowerRequestURI) || + (waf.HostTarget[host].LdpUrlLists[i].CompareType == "前缀匹配" && strings.HasPrefix(lowerRequestURI, lowerRuleURL)) || + (waf.HostTarget[host].LdpUrlLists[i].CompareType == "后缀匹配" && strings.HasSuffix(lowerRequestURI, lowerRuleURL)) || + (waf.HostTarget[host].LdpUrlLists[i].CompareType == "包含匹配" && strings.Contains(lowerRequestURI, lowerRuleURL)) { + + ldpFlag = true + break + } + } + //隐私保护（全局） + for i := 0; i < len(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists); i++ { + // 将全局规则URL也转为小写 + lowerGlobalRuleURL := strings.ToLower(waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].Url) + + if (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "等于" && lowerGlobalRuleURL == lowerRequestURI) || + (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "前缀匹配" && strings.HasPrefix(lowerRequestURI, lowerGlobalRuleURL)) || + (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "后缀匹配" && strings.HasSuffix(lowerRequestURI, lowerGlobalRuleURL)) || + (waf.HostTarget[global.GWAF_GLOBAL_HOST_NAME].LdpUrlLists[i].CompareType == "包含匹配" && strings.Contains(lowerRequestURI, lowerGlobalRuleURL)) { + + ldpFlag = true + break + } + } + if ldpFlag == true { + orgContentBytes, responseEncodingError := waf.getOrgContent(resp, isStaticAssist) + if responseEncodingError == nil { + newPayload := []byte("" + utils.DeSenText(string(orgContentBytes))) + finalCompressBytes, _ := waf.compressContent(resp, isStaticAssist, newPayload) + + resp.Body = io.NopCloser(bytes.NewBuffer(finalCompressBytes)) + // head 修改追加内容 + resp.ContentLength = int64(len(finalCompressBytes)) + resp.Header.Set("Content-Length", strconv.FormatInt(int64(len(finalCompressBytes)), 10)) + } else { + resp.Body = io.NopCloser(bytes.NewBuffer(orgContentBytes)) + zlog.Warn(fmt.Sprintf("识别响应内容编码失败，隐私防护不可用 %v，请求URL: %s", responseEncodingError, r.URL.String())) + } + + } //编码转换，自动检测网页编码 resp *http.Response orgContentBytes, responseEncodingError := waf.getOrgContent(resp, isStaticAssist) if responseEncodingError == nil { @@ -703,7 +702,7 @@ func (waf *WafEngine) modifyResponse() func(*http.Response) error { } else { resp.Body = io.NopCloser(bytes.NewBuffer(orgContentBytes)) - zlog.Warn(fmt.Sprintf("识别响应内容编码失败，响应日志，敏感词替换 不可用 %v", responseEncodingError)) + zlog.Warn(fmt.Sprintf("识别响应内容编码失败，响应日志，敏感词替换 不可用 %v，请求URL: %s", responseEncodingError, r.URL.String())) } } zlog.Debug("TESTChanllage", weblogfrist.HOST, weblogfrist.URL)