Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Custom characters set for URI and HTTP headers #628

Closed
krizhanovsky opened this issue Oct 31, 2016 · 1 comment
Closed

Custom characters set for URI and HTTP headers #628

krizhanovsky opened this issue Oct 31, 2016 · 1 comment

Comments

@krizhanovsky
Copy link
Contributor

krizhanovsky commented Oct 31, 2016

str_simd.c uses number of ASCII characters table to match URI and HTTP header fields. The tables should be made customizable by a user. I.e. user should be able to describe which character sets they allow for particular HTTP message field and Tempesta FW and startup compiles the sets to the tables and use them for the SIMD processing. The filtering is very useful to prevent some types of Web attacks, e.g. SQL Injections.

Must be added separate alphabet for POST arguemnts, so XSS and HTTP parameter fragmentation attacks can be prevented by excluding < and/or * from the alphabet.

The validator is very close to ModSecurity's validateByteRange.

Please update https://github.com/tempesta-tech/tempesta/wiki/Web-security and create an issue for a functional test.

@krizhanovsky
Copy link
Contributor Author

For now we do not parse POST body and just skip it, so #902 must use alphabet checking implemented in the issue to really verify POST body.

krizhanovsky added a commit to tempesta-tech/blog that referenced this issue Apr 9, 2018
krizhanovsky added a commit that referenced this issue Apr 15, 2018
Fix #628: Custom characters set for URI and HTTP headers
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants