From 87538e7729bdbd4c7ed7452be1231f60625cc523 Mon Sep 17 00:00:00 2001
From: qing <1776177662@qq.com>
Date: Tue, 4 Aug 2026 21:52:15 +0800
Subject: [PATCH] =?UTF-8?q?fix(waf):=20=E8=B1=81=E5=85=8D=E6=89=A9?=
 =?UTF-8?q?=E5=B1=95=E5=88=B0=E6=89=80=E6=9C=89=E7=AC=94=E8=AE=B0=E5=86=99?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3=20(add/update/edit/delete=5Fnote)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

修正正则匹配 query 前缀问题，统一豁免笔记接口的 CRS 误报规则。
---
 waf/rules/local/exceptions.conf | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/waf/rules/local/exceptions.conf b/waf/rules/local/exceptions.conf
index 23afaff..642f8e7 100644
--- a/waf/rules/local/exceptions.conf
+++ b/waf/rules/local/exceptions.conf
@@ -6,13 +6,14 @@
 #     "id:100100,phase:1,pass,nolog,ctl:ruleRemoveById=100003"
 
 # ============================================================
-# 100100: 对 /add_note 笔记接口豁免 CRS 误报规则
+# 100100: 对笔记相关接口豁免 CRS 误报规则
 # 背景：嵌入式/技术笔记含 C 代码（if() 条件、select、sbit 等），
 #       被 CRS 的 SQLi/命令注入规则误判为攻击（942170/942230/932xxx/934xxx）。
+# 覆盖接口：/add_note、/update_note、/edit_note、/delete_note 等笔记写操作。
 # 方案：仅移除误报规则本身，其余 CRS 规则仍生效，兼顾正常提交与安全检测。
 # 若后续文章仍被误拦，把日志中新增的 rule_id 追加到 ctl:ruleRemoveById 列表。
 # ============================================================
-SecRule REQUEST_URI "@beginsWith /add_note" \
+SecRule REQUEST_URI "@rx ^/(?:add|update|edit|delete)_note" \
     "id:100100,phase:1,pass,nolog,\
     ctl:ruleRemoveById=942170,ctl:ruleRemoveById=942230,\
     ctl:ruleRemoveById=932120,ctl:ruleRemoveById=932125,ctl:ruleRemoveById=932140,ctl:ruleRemoveById=932235,ctl:ruleRemoveById=932260,\