Plack::Middleware::Security::Common - A simple security filter for Plack with common rules.
version v0.12.0
use Plack::Builder; # import rules use Plack::Middleware::Security::Common; builder { enable "Security::Common", rules => [ archive_extensions, # block .tar, .zip etc cgi_bin, # block /cgi-bin script_extensions, # block .php, .asp etc unexpected_content, # block GET with body params ... ]; ... };
This is an extension of Plack::Middleware::Security::Simple that provides common filtering rules.
Most of these rules don't directly improve the security of your web application: they simply block common exploit scanners from getting past the PSGI layer.
Note that they cannot block any exploits of proxies that are in front of your PSGI application.
See "EXPORTS" for a list of rules.
You can create exceptions to the rules by adding qualifiers, for example, you want to block requests for archives, except in a /downloads folder, you could use something like
builder { enable "Security::Common", rules => [ -and => [ -notany => [ PATH_INFO => qr{^/downloads/} ], -any => [ archive_extensions ], ], ... ]; ... };
Note that the rules return an array of matches, so when qualifying them you will need to put them in an array reference.
This blocks requests with common archive file extensions in the path or query string.
This includes "misc_extensions" plus filename suffixes associated with backup files, e.g. example.com-database.zip.
Added in v0.8.0.
This blocks requests that refer to the cgi-bin directory in the path or query string, or a cgi_wrapper script.
cgi-bin
cgi_wrapper
This blocks requests that refer to directories with common CMS applications, libraries, or web servers.
This blocks requests for file extensions associated with common document formats, e.g. Office documents or spreadsheets.
This does not include audio, video or image files.
If you provide downloads for specific files, then you may need to add exceptions for this rule based on the file type and path.
Added in v0.9.2.
This blocks all requests that refer to dot-files or .., except for the /.well-known/ path.
..
This blocks paths associated with Exchange servers.
This blocks requests with fake extensions, usually done with image extensions, e.g. /some/path;.jpg.
Added in v0.5.1.
This blocks requests that attept to inject a header in the response. e.g. GET /%20HTTP/1.1%0d%0aX-Auth:%20accepted%0d%0a.
GET /%20HTTP/1.1%0d%0aX-Auth:%20accepted%0d%0a
Any path with an HTTP protocol suffix or newline plus carriage return will be rejected.
Added in v0.7.0.
This blocks all requests where the HTTP referer is an IP4 or IP6 address.
Added in v0.5.0.
This blocks requests with miscellenious extensions in the path or query string.
This includes common extensions and suffixes for backups, includes or configuration files.
This blocks requests with non-printable characters in the path.
This blocks requests with nulls or escape chatacters in the path or query string.
This blocks requests that have non-web protocols like file, dns, jndi, unix, ldap or php in the path, query string or referer.
file
dns
jndi
unix
ldap
php
This blocks POST or PUT requests with no content.
This was added in v0.4.1.
This blocks requests that refer to actual scripts or source code file extension, such as .php or .asp. It will also block requests that refer to these scripts in the query string.
.php
.asp
This block requests that inject scripts using data-URLs.
This blocks requests that refer to system or metadata directories in the path or query string.
This blocks requests with content bodies using methods that don't normally have content bodies, such as GET or HEAD.
Note that web sites which do not differentiate between query and body parameters can be caught out by this. An attacker can hit these website with GET requests that have parameters that exploit security holes in the request body. The request would appear as a normal GET request in most logs.
This blocks requests using WebDAV-related methods.
This blocks requests for WordPress-related pages.
The development version is on github at https://github.com/robrwo/Plack-Middleware-Security-Simple and may be cloned from git://github.com/robrwo/Plack-Middleware-Security-Simple.git
Please report any bugs or feature requests on the bugtracker website https://github.com/robrwo/Plack-Middleware-Security-Simple/issues
When submitting a bug or request, please include a test-file or a patch to an existing test-file that illustrates the bug or desired feature.
Suggestions for new rules or improving the existing rules are welcome.
Robert Rothenberg <rrwo@cpan.org>
This software is Copyright (c) 2014,2018-2024 by Robert Rothenberg.
This is free software, licensed under:
The Artistic License 2.0 (GPL Compatible)
To install Plack::Middleware::Security::Simple, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Plack::Middleware::Security::Simple
CPAN shell
perl -MCPAN -e shell install Plack::Middleware::Security::Simple
For more information on module installation, please visit the detailed CPAN module installation guide.