[Suggestion] Custom rule matching targets add Attack Type
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 22.6k
- Forks
- 1.5k
- Avg merge
- 4h 30m
- Merged PRs (30d)
- 11
Description
What would you like to be added or improved?
自定义规则匹配目标增加根据攻击类型匹配，可针对单一攻击类型放行，其他条件组合使用。
Why is it needed?
在线编辑html代码过程中payload可能存在<img src="url"/>等之类的标签，命中XSS特征waf会进行拦截，白名单可针对接口地址及host放行，但这是全类型放行，是否可以增加针对单一攻击类型选择，放行某一攻击类型的请求？
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names custom rule matching targets and attack-type selection for whitelist combinations, but no files, tests, or entry points are identified. Start by locating the custom-rule matching and attack-classification paths. Done means a single attack type can be allowed while other matching conditions remain enforced, with the behavior covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend-api-design, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100