Charles Lewis

nobody care

will it be faster? Because ngx.var.request_uri give the same value so I wonder it.

args block can be bypassed because of the lack of error handle

3

get_post_args 和 get_uri_args 默认只取前100个参数。 如果攻击者提交100个无用参数，再接上注入的参数，将绕过waf。 漏洞证明python脚本： ``` import requests args='a=1'+'&a=1'*99 sqli='b=select*from' r1 = requests.get('http://127.0.0.1/?'+sqli) print r1.url print r1.status_code #返回403 r2 = requests.get('http://127.0.0.1/?'+args+'&'+sqli) print r2.url print r2.status_code #返回200 ``` 官方建议是使用以下代码拒绝参数过多的请求 ```...

this.config is undefine