qing/blackbird
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refix

Browse Source
This commit is contained in:
qing committed 2026-07-29 11:52:46 +08:00
1 parent 3f9bffb9ea
commit 751866d9c1
3 files changed
+15 -14
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

dnfs/dnfs.py
+1 -1
View File
@@ -38,7 +38,7 @@ _DBV2_ADDR = '127.0.0.1'
_DBV2_PORT = 8005
# 管理员账号：删除/更新节点时豁免所有权校验（保留旧的 'admin' 以兼容历史数据）
ADMIN_USERS = ('admin', 'admin@qsont.me')
ADMIN_USERS = ('admin@qsont.me', 'qing@qsont.me')
def _call_dbv2(payload: dict, timeout: int = 10) -> dict:
"""通过 pymsg 短连接调用 dbv2 数据库服务。
gateway/_run.sh
+1
View File
@@ -1,3 +1,4 @@
#!/bin/bash
cd "$(dirname "$0")" || exit
sleep 1
exec ./build/gateway.out -i example.ini #1>/dev/null
waf/rules/local/custom.conf
+13 -13
View File
@@ -2,25 +2,25 @@
# ID 段：100000-199999
# 100001: 拦截 SQL 注入特征（UNION SELECT）
SecRule REQUEST_URI|ARGS "@rx (?i)union[\s/*]+select" \
"id:100001,phase:1,deny,status:403,log,msg:'SQL injection: UNION SELECT'"
#SecRule REQUEST_URI|ARGS "@rx (?i)union[\s/*]+select" \
# "id:100001,phase:1,deny,status:403,log,msg:'SQL injection: UNION SELECT'"
# 100002: 拦截 SQL 注释符
SecRule ARGS "@rx (?i)(--|#|/\*.*\*/)" \
"id:100002,phase:2,deny,status:403,log,msg:'SQL injection: comment'"
## 100002: 拦截 SQL 注释符
#SecRule ARGS "@rx (?i)(--|#|/\*.*\*/)" \
# "id:100002,phase:2,deny,status:403,log,msg:'SQL injection: comment'"
# 100003: 拦截 XSS 标签
SecRule ARGS|REQUEST_HEADERS "@rx (?i)<script|javascript:|onerror=|onload=" \
"id:100003,phase:2,deny,status:403,log,msg:'XSS probe'"
#SecRule ARGS|REQUEST_HEADERS "@rx (?i)<script|javascript:|onerror=|onload=" \
# "id:100003,phase:2,deny,status:403,log,msg:'XSS probe'"
# 100004: 路径遍历
SecRule REQUEST_URI|ARGS "@rx (?i)\.\./|\.\.%2f|\.\.%5c" \
"id:100004,phase:1,deny,status:403,log,msg:'Path traversal'"
#SecRule REQUEST_URI|ARGS "@rx (?i)\.\./|\.\.%2f|\.\.%5c" \
# "id:100004,phase:1,deny,status:403,log,msg:'Path traversal'"
# 100005: 命令注入常见关键字
SecRule ARGS "@rx (?i)(;|\|)&?\s*(cat|ls|id|whoami|uname|wget|curl|bash|sh)\s" \
"id:100005,phase:2,deny,status:403,log,msg:'Command injection'"
#SecRule ARGS "@rx (?i)(;|\|)&?\s*(cat|ls|id|whoami|uname|wget|curl|bash|sh)\s" \
# "id:100005,phase:2,deny,status:403,log,msg:'Command injection'"
# 100006: 已知恶意扫描器 UA
SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(nikto|sqlmap|nmap|masscan|acunetix|nessus)" \
"id:100006,phase:1,deny,status:403,log,msg:'Malicious scanner UA'"
#SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(nikto|sqlmap|nmap|masscan|acunetix|nessus)" \
# "id:100006,phase:1,deny,status:403,log,msg:'Malicious scanner UA'"