You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
str_simd.c uses number of ASCII characters table to match URI and HTTP header fields. The tables should be made customizable by a user. I.e. user should be able to describe which character sets they allow for particular HTTP message field and Tempesta FW and startup compiles the sets to the tables and use them for the SIMD processing. The filtering is very useful to prevent some types of Web attacks, e.g. SQL Injections.
Must be added separate alphabet for POST arguemnts, so XSS and HTTP parameter fragmentation attacks can be prevented by excluding < and/or * from the alphabet.
str_simd.c
uses number of ASCII characters table to match URI and HTTP header fields. The tables should be made customizable by a user. I.e. user should be able to describe which character sets they allow for particular HTTP message field and Tempesta FW and startup compiles the sets to the tables and use them for the SIMD processing. The filtering is very useful to prevent some types of Web attacks, e.g. SQL Injections.Must be added separate alphabet for POST arguemnts, so XSS and HTTP parameter fragmentation attacks can be prevented by excluding
<
and/or*
from the alphabet.The validator is very close to ModSecurity's validateByteRange.
Please update https://github.com/tempesta-tech/tempesta/wiki/Web-security and create an issue for a functional test.
The text was updated successfully, but these errors were encountered: