Skip to content

v0.5.0-beta — request WAF

Pre-release
Pre-release

Choose a tag to compare

View all tags
@WebTigers WebTigers released this 16 Jul 20:29
· 17 commits to master since this release
v0.5.0-beta
7f9f09f

Phase 5 — a curated request WAF that screens each request's content (path / query / User-Agent / method) for attack signatures. The last engine in the gate pipeline; ships log-only.

Added

  • Tigershield_Service_Waf + rules/default-waf.php — a curated, high-signal ruleset in 9 admin-togglable categories: sensitive-file & CMS probes, path traversal / LFI, command injection, null bytes, disallowed methods, scanner user-agents, and (log-only) SQLi/XSS heuristics. Literal strpos before regex, query capped at 4KB, first-match wins.
  • Wired into the gate (_wafDecision, runs last, skips assets). High-confidence categories obey waf.action (log/captcha/block); soft SQLi/XSS heuristics are hard-capped at log-only and never auto-block.
  • A new log gate verdict (observe-only): recorded to the event log, never enforced even in enforce mode.

Notes

  • v1 does not scan POST bodies (the main false-positive source) — deferred to 5.1 with a tigershield_rule custom-rule editor.
  • ~15µs/request worst case; 0 false positives on a benign test battery (legit URLs containing select/union/<b>/curl).
Assets 2
Loading