-
Notifications
You must be signed in to change notification settings - Fork 2.6k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: review changes + moving to package + misc
- Loading branch information
1 parent
3bfe682
commit 2c001a6
Showing
5 changed files
with
131 additions
and
107 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| package waf | ||
|
|
||
| import ( | ||
| _ "embed" | ||
| "encoding/json" | ||
| "log" | ||
| "regexp" | ||
| ) | ||
|
|
||
| type WafDetector struct { | ||
| wafs map[string]waf | ||
| regexCache map[string]*regexp.Regexp | ||
| } | ||
|
|
||
| // waf represents a web application firewall definition | ||
| type waf struct { | ||
| Company string `json:"company"` | ||
| Name string `json:"name"` | ||
| Regex string `json:"regex"` | ||
| } | ||
|
|
||
| // wafData represents the root JSON structure | ||
| type wafData struct { | ||
| WAFs map[string]waf `json:"wafs"` | ||
| } | ||
|
|
||
| //go:embed regexes.json | ||
| var wafContentRegexes string | ||
|
|
||
| func NewWafDetector() *WafDetector { | ||
| var data wafData | ||
| if err := json.Unmarshal([]byte(wafContentRegexes), &data); err != nil { | ||
| log.Printf("could not unmarshal waf content regexes: %s", err) | ||
| } | ||
|
|
||
| store := &WafDetector{ | ||
| wafs: data.WAFs, | ||
| regexCache: make(map[string]*regexp.Regexp), | ||
| } | ||
|
|
||
| for id, waf := range store.wafs { | ||
| if waf.Regex == "" { | ||
| continue | ||
| } | ||
| store.regexCache[id] = regexp.MustCompile(waf.Regex) | ||
| } | ||
| return store | ||
| } | ||
|
|
||
| func (d *WafDetector) DetectWAF(content string) (string, bool) { | ||
| for id, regex := range d.regexCache { | ||
| if regex.MatchString(content) { | ||
| return id, true | ||
| } | ||
| } | ||
| return "", false | ||
| } | ||
|
|
||
| func (d *WafDetector) GetWAF(id string) (waf, bool) { | ||
| waf, ok := d.wafs[id] | ||
| return waf, ok | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| package waf | ||
|
|
||
| import "testing" | ||
|
|
||
| func TestWAFDetection(t *testing.T) { | ||
| detector := NewWafDetector() | ||
| if detector == nil { | ||
| t.Fatal("expected non-nil wafDetector") | ||
| } | ||
|
|
||
| tests := []struct { | ||
| name string | ||
| content string | ||
| expectedWAF string | ||
| shouldMatch bool | ||
| }{ | ||
| { | ||
| name: "Cloudflare WAF", | ||
| content: "Attention Required! | Cloudflare", | ||
| expectedWAF: "cloudflare", | ||
| shouldMatch: true, | ||
| }, | ||
| { | ||
| name: "ModSecurity WAF", | ||
| content: "This error was generated by Mod_Security", | ||
| expectedWAF: "modsecurity", | ||
| shouldMatch: true, | ||
| }, | ||
| { | ||
| name: "No WAF", | ||
| content: "Regular response with no WAF signature", | ||
| expectedWAF: "", | ||
| shouldMatch: false, | ||
| }, | ||
| { | ||
| name: "Wordfence WAF", | ||
| content: "Generated by Wordfence", | ||
| expectedWAF: "wordfence", | ||
| shouldMatch: true, | ||
| }, | ||
| { | ||
| name: "Sucuri WAF", | ||
| content: "Access Denied - Sucuri Website Firewall", | ||
| expectedWAF: "sucuri", | ||
| shouldMatch: true, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| waf, matched := detector.DetectWAF(tt.content) | ||
| if matched != tt.shouldMatch { | ||
| t.Errorf("expected match=%v, got match=%v", tt.shouldMatch, matched) | ||
| } | ||
| if matched && waf != tt.expectedWAF { | ||
| t.Errorf("expected WAF=%s, got WAF=%s", tt.expectedWAF, waf) | ||
| } | ||
| }) | ||
| } | ||
| } |