mirror of
https://gitee.com/samwaf/SamWaf.git
synced 2026-09-21 04:27:38 +08:00
samwaf
24227923e8
Detection engine: - Normalize request data (body, cookies, form and JSON values, request headers) before inspection instead of only the URL query string, so encoded variants are evaluated consistently. - Extend XSS / SQLi / command-injection inspection to request bodies and to custom request headers; bodies and headers are scanned per value rather than as one blob to keep false positives low. - Add a configurable body inspection mode (body_detect_mode: observe/block/off, default observe) so the new deep checks record rather than block until an operator confirms them, plus body_detect_field_exclude to skip fields that legitimately carry rich text. - Keep false positives down on the new paths: skip structured values, require a corroborating signal before flagging body/header XSS, and leave dual-use keywords out of the fallback lists. - Path traversal is now normalized and judged on whether it escapes the site root instead of matching literally; this also clears a long-standing false positive on legitimate in-site relative paths. Adds a sensitive-file list. - Scanner detection now covers all request headers and known probe paths. Plugins: - Suspend plugin loading pending signing and admission work. The code path is retained but gated off, and shipped disabled by default. Validated against a local test corpus and a 33k real-traffic benchmark: detection improved across every category while the real-traffic false-positive count stayed flat.
41 lines
1.6 KiB
Go
41 lines
1.6 KiB
Go
package router
|
|
|
|
import (
|
|
"SamWaf/api"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
type PluginRouter struct {
|
|
}
|
|
|
|
// InitPluginRouter 插件管理路由。
|
|
//
|
|
// 【当前状态：故意不注册】wafmangeweb/localserver.go 没有调用本函数，这些接口不可达。
|
|
// 原因：add/modify 会把 JSON 里的 binary_path 直接落库并交给 LoadPlugin 执行，
|
|
// 在签名与准入控制（L0 路径收口 + L1 验签）完成之前接上等于给管理端开一个任意路径 RCE。
|
|
//
|
|
// 接上之前必须满足：
|
|
// 1. manager.PendingVerification 已置为 false（即 L0+L1 已落地）；
|
|
// 2. binary_path 改为只能从 binary_dir 已有文件中选取，不允许前端自由填写路径。
|
|
//
|
|
// 详见 SamWafTechDoc/Plan/2026-08-23-插件系统暂停加载-清单与恢复计划.md
|
|
func (receiver *PluginRouter) InitPluginRouter(group *gin.RouterGroup) {
|
|
apiInstance := api.APIGroupAPP.WafPluginApi
|
|
router := group.Group("")
|
|
|
|
// 插件管理
|
|
router.POST("/api/v1/wafplugin/list", apiInstance.GetListApi)
|
|
router.GET("/api/v1/wafplugin/detail", apiInstance.GetDetailApi)
|
|
router.POST("/api/v1/wafplugin/add", apiInstance.AddApi)
|
|
router.POST("/api/v1/wafplugin/modify", apiInstance.ModifyApi)
|
|
router.GET("/api/v1/wafplugin/del", apiInstance.DeleteApi)
|
|
router.POST("/api/v1/wafplugin/toggle", apiInstance.ToggleApi)
|
|
|
|
// 系统配置
|
|
router.GET("/api/v1/wafplugin/systemconfig/get", apiInstance.GetSystemConfigApi)
|
|
router.POST("/api/v1/wafplugin/systemconfig/update", apiInstance.UpdateSystemConfigApi)
|
|
|
|
// 插件日志
|
|
router.POST("/api/v1/wafplugin/logs", apiInstance.GetPluginLogsApi)
|
|
}
|