了解为什么 amazon waf 阻止请求

发布于 2025-01-13 05:24:29 字数 1249 浏览 6 评论 0原文

我的网络应用程序有一个接受 html 的表单。

浏览器发送带有 json 正文和以下格式的 HTTP/PUT ajax 调用：

{
    "de": "",
    "en": "<p>Evil Corp will process the Data that is strictly necessary\\nand reserves the right to delete or anonymize immediately any Data that\\nis not necessary.</p>\\n<p>from</p>",
    "es": "",
    "fr": "",
    "it": ""
  },
  "notes": {
    "de": "",
    "en": "",
    "es": "",
    "fr": "",
    "it": ""
  }
}

当内容包含以下字符串时，我的 AWS WAF 出现问题：

<p>Evil Corp will process the Data that is strictly necessary
and reserves the right to delete or anonymize immediately any Data that
is not necessary.</p>
<p>from</p>

WAF 返回 403 错误并且请求被拒绝。

如果内容包含其他字符串，我没有问题，例如：

<p>Evil Corp will process the Data that is strictly necessary
and reserves the right to delete or anonymize immediately any Data that
is not necessary.</p>
<p>hello world</p>

两者都被认为是我的应用程序的有效内容。

WAF 配置如下：AWS Classic WAF 的“AWS WAF 的网络安全云托管规则 -HighSecurity OWASP Set-”。

我想了解：

阻止请求的规则是什么？
为什么此内容被认为是危险的？
我可以将我的请求转换为 AWS WAF 可接受的方式吗？
我可以配置 AWS WAF 以使其接受此类内容吗？

原文

My web application has a form which accepts html.

The browser sends an HTTP/PUT ajax call with a json body and this format:

{
    "de": "",
    "en": "<p>Evil Corp will process the Data that is strictly necessary\\nand reserves the right to delete or anonymize immediately any Data that\\nis not necessary.</p>\\n<p>from</p>",
    "es": "",
    "fr": "",
    "it": ""
  },
  "notes": {
    "de": "",
    "en": "",
    "es": "",
    "fr": "",
    "it": ""
  }
}

I have a problem with the AWS WAF, when the content contains the following string:

<p>Evil Corp will process the Data that is strictly necessary
and reserves the right to delete or anonymize immediately any Data that
is not necessary.</p>
<p>from</p>

The WAF returns 403 error and the request is rejected.

I have no problem if the content contains other strings, such as:

<p>Evil Corp will process the Data that is strictly necessary
and reserves the right to delete or anonymize immediately any Data that
is not necessary.</p>
<p>hello world</p>

Both are considered valid contents for my application.

The WAF is configured as follows: AWS Classic WAF's "Cyber Security Cloud Managed Rules for AWS WAF -HighSecurity OWASP Set-".

I'd like to understand: