jx-sec / jxwaf Goto Github PK

local function _process_json_args(json_args,t)
        local t = t or {}
        local i =0
        for k,v in pairs(json_args) do
                if type(v) == 'table' then
                        for _k,_v in pairs(v) do

                                if type(_v) == "table" then
                                    t = _process_json_args(_v,t)

                                else
                                        if type(t[k]) == "table" then
                                                table.insert(t[k],_v)

                                        elseif type(t[k]) == "string" then
                                                local tmp = {}
                                                table.insert(tmp,t[k.."_".._k])
                                                table.insert(tmp,_v)
                                                t[k.."_".._k] = tmp

                                        else

                                        t[k] = _v
                                        end
                                end

                        end
                else
                                         if type(t[k]) == "table" then
                                                table.insert(t[k],v)
                                        elseif type(t[k]) == "string" then
                                                local tmp = {}
                                                table.insert(tmp,t[k.."_"..i])
                                                table.insert(tmp,v)
                                                t[k.."_"..i] = tmp
                                                i = i+1
                                        else

                                        t[k] = v
                                        end
                end
        end
        return t
end

local function _parse_request_uri()
    local t = ngx.req.get_uri_args()
    local _t = {}

    for k,v in pairs(t) do
        if type(v) == "table" then
            for _k,_v in pairs(t) do
                if type(_v)=="table" then
                    for _key,_value in pairs(_v) do
                        _t[_k.."-".._key] = _value
                    end
                end
            end
        else
            _t[k] = v
        end
    end
    ngx.req.set_uri_args(t)
    ngx.ctx.parse_request_uri = _t
    return _t
end

local function _parse_request_body()

	local content_type = ngx.req.get_headers()["Content-type"]
	if (type(content_type) == "table") then
    local error_info = {}
    error_info['headers'] = ngx.ctx.request_get_headers or _get_headers()
    error_info['log_type'] = "error_log"
    error_info['error_type'] = "parse_request_body"
    error_info['error_info'] = "Request contained multiple content-type headers"
    error_info['remote_addr'] = ngx.var.remote_addr
    ngx.ctx.error_log = error_info
		ngx.log(ngx.ERR,"Request contained multiple content-type headers")
		exit_code.return_exit()
	end

	if ngx.ctx.upload_request then
      ngx.ctx.parse_request_body = {}
      return {}
  end

  if  ngx.req.get_body_file() then
    local error_info = {}
    error_info['headers'] = ngx.ctx.request_get_headers or _get_headers()
    error_info['log_type'] = "error_log"
    error_info['error_type'] = "parse_request_body"
    error_info['error_info'] = "request body size larger than client_body_buffer_size, refuse request "
    error_info['remote_addr'] = ngx.var.remote_addr
    ngx.ctx.error_log = error_info
		ngx.log(ngx.ERR,"request body size larger than client_body_buffer_size, refuse request ")
		exit_code.return_error()
	end
	
	if content_type and  ngx.re.find(content_type, [=[^application/json;]=],"oij") and ngx.req.get_headers()["Content-Length"] and tonumber(ngx.req.get_headers()["Content-Length"]) ~= 0 then
	
		local json_args_raw = ngx.req.get_body_data()
		if not json_args_raw then
			ngx.ctx.parse_request_body = {}
			return {}
		end 

		local json_args,err = cjson.decode(json_args_raw)

		if json_args == nil then
      local error_info = {}
      error_info['headers'] = ngx.ctx.request_get_headers or _get_headers()
      error_info['log_type'] = "error_log"
      error_info['error_type'] = "parse_request_body"
      error_info['error_info'] = "failed to decode json args :"..err
      error_info['remote_addr'] = ngx.var.remote_addr
      ngx.ctx.error_log = error_info
      ngx.log(ngx.ERR,"failed to decode json args :",err)
      exit_code.return_error()
		end
		local t = {}
		t = _process_json_args(json_args)
		ngx.ctx.parse_request_body = t 
		return t 
	end

	local post_args,err = ngx.req.get_post_args(210)
	if not post_args then
    local error_info = {}
    error_info['headers'] = ngx.ctx.request_get_headers or _get_headers()
    error_info['log_type'] = "error_log"
    error_info['error_type'] = "parse_request_body"
    error_info['error_info'] = "failed to get post args: "..err
    error_info['remote_addr'] = ngx.var.remote_addr
    ngx.ctx.error_log = error_info
		ngx.log(ngx.ERR,"failed to get post args: ", err)
		exit_code.return_error()
	end
	if #_table_keys(post_args) > 200 then
    local error_info = {}
    error_info['headers'] = ngx.ctx.request_get_headers or _get_headers()
    error_info['log_type'] = "error_log"
    error_info['error_type'] = "parse_request_body"
    error_info['error_info'] = "post args count error,is attack!"
    error_info['remote_addr'] = ngx.var.remote_addr
    ngx.ctx.error_log = error_info
		ngx.log(ngx.ERR,"post args count error,is attack!")
		exit_code.return_error()
	end
	local json_check = cjson.decode(ngx.req.get_body_data())
	if json_check then
		local _tmp = {}
		_tmp = _process_json_args(json_check)
		ngx.ctx.parse_request_body = _tmp
		return _tmp
	end




local _t = {}
for _k, _v in pairs(post_args) do
    if type(_v) == "table" then
        for _key, _value in pairs(_v) do
            _t[_k .. "_" .. _key] = _value
        end

    else
        _t[_k] = _v

    end
end


	ngx.ctx.parse_request_body = _t
	return _t
end

local cjson = require "cjson.safe"

local function split(str, dv)

    local resultStrList = {}

    local ok, e = pcall(function()
        string.gsub(str, '[^&]+', function(w)
            table.insert(resultStrList, w)
        end)
    end)

    if not ok then
        return str
    end

    local rs = {}
    for _k, _v in pairs(resultStrList) do

        local i
        b = string.gsub(_v, '[^=]+', function(w)
            if i == nil then
                rs[w] = nil
            else
                rs[i] = w
            end
            i = w
        end)

    end
    local r = {}

    for _key, _value in pairs(rs) do
        for _, _d in pairs(dv) do
            if _key == _d then
                _value = "****"
            end
            r[_key] = _value
        end
    end
    local _t = ""
    for _k, _v in pairs(r) do
        _t = _t .. _k .. "=" .. _v .. "&"
    end
    if _t == "" then
        return str
    end
    return _t
end

function serialize(obj)
    local lua = ""
    local t = type(obj)
    if t == "number" then
        lua = lua .. obj
    elseif t == "boolean" then
        lua = lua .. tostring(obj)
    elseif t == "string" then
        lua = lua .. string.format("%q", obj)
    elseif t == "table" then
        lua = lua .. "{"
        for k, v in pairs(obj) do
            lua = lua .. serialize(k) .. ":" .. serialize(v) .. ","
        end
        local metatable = getmetatable(obj)
        if metatable ~= nil and type(metatable.__index) == "table" then
            for k, v in pairs(metatable.__index) do
                lua = lua .. serialize(k) .. ":" .. serialize(v) .. ","
            end
        end
        lua = lua .. "}"
    elseif t == "nil" then
        return nil
    else
        error("can not serialize a " .. t .. " type.")
    end
    return lua
end

local function decodetable(t, dv)
    local _t = t or {}
    for _k, _v in pairs(t) do
        for _key, _value in pairs(dv) do

            if _value == _k then
                _v = "***"
            end

        end
        if type(_v) ~= "table" then
                _t[_k] = _v
                return _t


            else
                decodetable(_v, dv)
            end
    end

end

local function desensitization(body)
    local dv = { "password" ,"order_id"}
    local rs = rs or {}
    local json_body, err = cjson.decode(body)

    if json_body ~= nil then
        for _k, _v in pairs(json_body) do

            for _, value in pairs(dv) do
                if value == _k then
                    _v = "***"

                elseif type(_v) == 'table' then

                    dt = decodetable(_v, dv)
                    rs[_k] = dt
                end

                rs[_k] = _v
            end
        end

        _tmp = serialize(rs)
        return _tmp


    else

        _t = split(body, dv)
        return _t
    end

end