feat: 升级 Openresty 版本到 1.21.4.3-3-3 (#1639)

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/acl.json

@@ -0,0 +1,4 @@
+{
+  "rules": [
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/args.json

@@ -0,0 +1,157 @@
+{
+  "rules": [
+    {
+      "state": "on",
+      "name": "sqlInject1",
+      "rule": "select.+(from|limit)",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject2",
+      "rule": "(?:(union(.*?)select))",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject3",
+      "rule": "having|rongjitest",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject4",
+      "rule": "sleep\\((\\s*)(\\d*)(\\s*)\\)",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject5",
+      "rule": "benchmark\\((.*)\\,(.*)\\)",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject6",
+      "rule": "group\\s+by.+\\(",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject7",
+      "rule": "(?:from\\W+information_schema\\W)",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject8",
+      "rule": "(?:(?:current_)user|database|schema|connection_id)\\s*\\(",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject9",
+      "rule": "into(\\s+)+(?:dump|out)file\\s*",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject10",
+      "rule": "\\s+(or|xor|and)\\s+.*(=|<|>|'|\")",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "args1",
+      "rule": "xwork.MethodAccessor",
+      "type": "args",
+      "description": "Struts 恶意参数过滤"
+    },
+    {
+      "state": "on",
+      "name": "args2",
+      "rule": "xwork\\.MethodAccessor",
+      "type": "args",
+      "description": "Struts 恶意参数过滤"
+    },
+    {
+      "state": "on",
+      "name": "oneWordTrojan1",
+      "rule": "(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\(",
+      "type": "oneWordTrojan"
+    },
+    {
+      "state": "on",
+      "name": "oneWordTrojan2",
+      "rule": "\\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\\[",
+      "type": "oneWordTrojan"
+    },
+    {
+      "state": "on",
+      "name": "protocolFilter1",
+      "rule": "(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\\:\\/",
+      "type": "protocolFilter",
+      "description": "协议过滤"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter1",
+      "rule": "(?:etc\\/\\W*passwd)",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter2",
+      "rule": "java\\.lang",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter3",
+      "rule": "(?:etc\\/\\W*shadow)",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter4",
+      "rule": "(?:bin\\/\\W*sh)",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "xss1",
+      "rule": "\\<(iframe|script|body|img|layer|div|meta|style|base|object|input)",
+      "type": "xss"
+    },
+    {
+      "state": "on",
+      "name": "xss2",
+      "rule": "(onmouseover|onerror|onload)\\=",
+      "type": "xss"
+    },
+    {
+      "state": "on",
+      "name": "xss3",
+      "rule": "base64_decode\\(",
+      "type": "xss"
+    },
+    {
+      "state": "on",
+      "name": "webshell1",
+      "rule": "/shell?cd+/tmp;\\s*rm+-rf\\+\\*;\\s*wget",
+      "type": "webshell"
+    },
+    {
+      "state": "on",
+      "name": "phpExec1",
+      "rule": "/systembc/password.php",
+      "type": "phpExec"
+    },
+    {
+      "state": "on",
+      "name": "scannerFilter1",
+      "rule": "(Acunetix-Aspect|Acunetix-Aspect-Password|Acunetix-Aspect-Queries|X-WIPP|X-RequestManager-Memo|X-Request-Memo|X-Scan-Memo)",
+      "type": "scannerFilter"
+    }
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/cdn.json

@@ -0,0 +1,48 @@
+{
+  "rules": [
+    {
+      "rule": "x-forwarded-for"
+    },
+    {
+      "rule": "x-real-ip"
+    },
+    {
+      "rule": "x-forwarded"
+    },
+    {
+      "rule": "forwarded-for"
+    },
+    {
+      "rule": "forwarded"
+    },
+    {
+      "rule": "true-client-ip"
+    },
+    {
+      "rule": "client-ip"
+    },
+    {
+      "rule": "ali-cdn-real-ip"
+    },
+    {
+      "rule": "cdn-src-ip"
+    },
+    {
+      "rule": "cdn-real-ip"
+    },
+    {
+      "rule": "cf-connecting-ip"
+    },
+    {
+      "rule": "x-cluster-client-ip"
+    },
+    {
+      "rule": "wl-proxy-client-ip"
+    },
+    {
+      "rule": "proxy-client-ip"
+    }
+  ],
+  "type": "headers",
+  "header": "x-real-ip"
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/cookie.json

@@ -0,0 +1,138 @@
+{
+  "rules": [
+    {
+      "state": "on",
+      "name": "dirFilter1",
+      "rule": "\\.\\./",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter2",
+      "rule": "\\:\\$",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter3",
+      "rule": "\\$\\{",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter4",
+      "rule": "(?:etc\\/\\W*passwd)",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter5",
+      "rule": "java\\.lang",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject1",
+      "rule": "select.+(from|limit)",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject2",
+      "rule": "(?:(union(.*?)select))",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject3",
+      "rule": "having|rongjitest",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject4",
+      "rule": "sleep\\((\\s*)(\\d*)(\\s*)\\)",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject5",
+      "rule": "benchmark\\((.*)\\,(.*)\\)",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject6",
+      "rule": "group\\s+by.+\\(",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject7",
+      "rule": "(?:from\\W+information_schema\\W)",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject8",
+      "rule": "(?:(?:current_)user|database|schema|connection_id)\\s*\\(",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject9",
+      "rule": "into(\\s+)+(?:dump|out)file\\s*",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "sqlInject10",
+      "rule": "\\s+(or|xor|and)\\s+.*(=|<|>|'|\")",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "name": "args1",
+      "rule": "xwork.MethodAccessor",
+      "type": "args",
+      "description": "Struts 恶意参数过滤"
+    },
+    {
+      "state": "on",
+      "name": "args2",
+      "rule": "xwork\\.MethodAccessor",
+      "type": "args",
+      "description": "Struts 恶意参数过滤"
+    },
+    {
+      "state": "on",
+      "name": "oneWordTrojan1",
+      "rule": "(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\(",
+      "type": "oneWordTrojan"
+    },
+    {
+      "state": "on",
+      "name": "oneWordTrojan2",
+      "rule": "\\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\\[",
+      "type": "oneWordTrojan"
+    },
+    {
+      "state": "on",
+      "name": "protocolFilter1",
+      "rule": "(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\\:\\/",
+      "type": "protocolFilter"
+    },
+    {
+      "state":"on",
+      "name":"scannerFilter1",
+      "rule":"(CustomCookie|acunetixCookie)",
+      "type": "scannerFilter"
+    },
+    {
+      "state": "on",
+      "name": "xss1",
+      "rule": "base64_decode\\(",
+      "type": "xss"
+    }
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/defaultUaBlack.json

@@ -0,0 +1,10 @@
+{
+  "rules": [
+    {
+      "state": "on",
+      "name": "uaBlock1",
+      "rule": "HTTrack|Apache-HttpClient|harvest|audit|dirbuster|pangolin|nmap|sqln|hydra|Parser|libwww|BBBike|sqlmap|w3af|owasp|Nikto|fimap|havij|zmeu|BabyKrokodil|netsparker|httperf| SF/",
+      "type": "scannerFilter"
+    }
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/defaultUrlBlack.json

@@ -0,0 +1,196 @@
+{
+  "rules": [
+    {
+      "state": "on",
+      "rule": "\\.(htaccess|mysql_history|bash_history|DS_Store|git|idea|user\\.ini)",
+      "name": "dirFilter1",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "rule": "\\.(bak|inc|old|mdb|sql|backup|java|class)$",
+      "name": "dirFilter2",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "rule": "^/(vhost|bbs|host|wwwroot|www|site|root|backup|data|ftp|db|admin|website|web).*\\.(rar|sql|zip|tar\\.gz|tar)$",
+      "name": "dirFilter3",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "rule": "java\\.lang",
+      "name": "dirFilter4",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter5",
+      "rule": "(?:etc\\/\\W*passwd)",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "name": "dirFilter6",
+      "rule": "(?:bin\\/\\W*sh)",
+      "type": "dirFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/(hack|shell|spy|phpspy)\\.php$",
+      "name": "phpExec1",
+      "type": "phpExec"
+    },
+    {
+      "state": "on",
+      "rule": "/(attachments|upimg|images|css|uploadfiles|html|uploads|templets|static|template|data|inc|forumdata|upload|includes|cache|avatar)/(\\\\w+).(php|jsp)",
+      "name": "phpExec2",
+      "type": "phpExec"
+    },
+    {
+      "state": "on",
+      "rule": "(?:phpMyAdmin2|phpMyAdmin|phpmyadmin|dbadmin|pma|myadmin|admin|mysql)/scripts/setup%.php",
+      "name": "phpExec3",
+      "type": "phpExec"
+    },
+    {
+      "state": "on",
+      "rule": "(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\(",
+      "name": "oneWordTrojan1",
+      "type": "oneWordTrojan"
+    },
+    {
+      "state": "on",
+      "rule": "(?:(union(.*?)select))",
+      "name": "sqlInject1",
+      "type": "sqlInject"
+    },
+    {
+      "state": "on",
+      "rule": "(phpmyadmin|jmx-console|jmxinvokerservlet)",
+      "name": "appFilter1",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "wp-includes/wlwmanifest.xml",
+      "name": "appFilter2",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "<php>die(@md5(HelloThinkCMF))</php>",
+      "name": "appFilter3",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/boaform/admin/formLogin",
+      "name": "appFilter4",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/password_change.cgi",
+      "name": "appFilter5",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/service/extdirect",
+      "name": "appFilter6",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/api/jsonws/invoke",
+      "name": "appFilter7",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/jars/upload",
+      "name": "appFilter8",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/example/tree/a/search",
+      "name": "appFilter9",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/actuator/gateway/routes/hacktest",
+      "name": "appFilter10",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/api/v1/method.callAnon/getPasswordPolicy",
+      "name": "appFilter11",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/functionRouter",
+      "name": "appFilter12",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/uploadfiles/apache.php.jpeg",
+      "name": "appFilter14",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/xxx/..;/admin/",
+      "name": "appFilter15",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/dvwa/js/dvwaPage.js",
+      "name": "appFilter16",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/api/index.php/v1/config/application",
+      "name": "appFilter17",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/WEB-INF/web.xml",
+      "name": "appFilter18",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/rest/tinymce/1/macro/preview",
+      "name": "appFilter19",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/pages/doenterpagevariables.action",
+      "name": "appFilter20",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/service/rest/beta/repositories/go/group",
+      "name": "appFilter21",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "rule": "/dvwa/js/add_event_listeners.js",
+      "name": "appFilter22",
+      "type": "appFilter"
+    }
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/fileExt.json

@@ -0,0 +1,34 @@
+{
+  "rules": [
+    {
+      "state": "on",
+      "rule": "php",
+      "name": "php",
+      "type": "fileExt"
+    },
+    {
+      "state": "on",
+      "rule": "jsp",
+      "name": "jsp",
+      "type": "fileExt"
+    },
+    {
+      "state": "on",
+      "rule": "asp",
+      "name": "asp",
+      "type": "fileExt"
+    },
+    {
+      "state": "on",
+      "rule": "exe",
+      "name": "exe",
+      "type": "fileExt"
+    },
+    {
+      "state": "on",
+      "rule": "sh",
+      "name": "sh",
+      "type": "fileExt"
+    }
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/header.json

@@ -0,0 +1,28 @@
+{
+  "rules": [
+    {
+      "state": "on",
+      "name": "appFilter1",
+      "rule": "TomcatBypass|Command|Base64",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "name": "appFilter2",
+      "rule": "j\\S*ndi\\S*:\\S*(?:dap|dns)\\S+",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "name": "appFilter3",
+      "rule": "(?:etc\\/\\W*passwd)",
+      "type": "appFilter"
+    },
+    {
+      "state": "on",
+      "name": "scannerFilter1",
+      "rule": "(/acunetix-wvs-test-for-some-inexistent-file|netsparker|acunetix_wvs_security_test|AppScan|XSS@HERE)",
+      "type": "scannerFilter"
+    }
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/ipBlack.json

@@ -0,0 +1,4 @@
+{
+  "rules": [
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/ipWhite.json

@@ -0,0 +1,4 @@
+{
+  "rules": [
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/methodWhite.json

@@ -0,0 +1,130 @@
+{
+  "rules": [
+    {
+      "state": "on",
+      "rule": "GET",
+      "name": "GET",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "POST",
+      "name": "POST",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "PUT",
+      "name": "PUT",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "DELETE",
+      "name": "DELETE",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "PATCH",
+      "name": "PATCH",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "HEAD",
+      "name": "HEAD",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "OPTIONS",
+      "name": "OPTIONS",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "TRACE",
+      "name": "TRACE",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "CONNECT",
+      "name": "CONNECT",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "PROPFIND",
+      "name": "PROPFIND",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "PROPPATCH",
+      "name": "PROPPATCH",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "MKCOL",
+      "name": "MKCOL",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "COPY",
+      "name": "COPY",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "MOVE",
+      "name": "MOVE",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "LOCK",
+      "name": "LOCK",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "UNLOCK",
+      "name": "UNLOCK",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "LINK",
+      "name": "LINK",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "UNLINK",
+      "name": "UNLINK",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "WRAPPED",
+      "name": "WRAPPED",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "PROPFIND",
+      "name": "PROPFIND",
+      "type": "httpMethod"
+    },
+    {
+      "state": "on",
+      "rule": "SRARCH",
+      "name": "SRARCH",
+      "type": "httpMethod"
+    }
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/post.json

@@ -0,0 +1,121 @@
+{
+    "rules": [
+        {
+            "state": "on",
+            "name": "sqlInject1",
+            "rule": "select.+(from|limit)",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "sqlInject2",
+            "rule": "(?:(union(.*?)select))",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "sqlInject3",
+            "rule": "having|rongjitest",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "sqlInject4",
+            "rule": "sleep\\((\\s*)(\\d*)(\\s*)\\)",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "sqlInject5",
+            "rule": "benchmark\\((.*)\\,(.*)\\)",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "sqlInject6",
+            "rule": "group\\s+by.+\\(",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "sqlInject7",
+            "rule": "(?:from\\W+information_schema\\W)",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "sqlInject8",
+            "rule": "(?:(?:current_)user|database|schema|connection_id)\\s*\\(",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "sqlInject9",
+            "rule": "into(\\s+)+(?:dump|out)file\\s*",
+            "type": "sqlInject"
+        },
+        {
+            "state": "on",
+            "name": "args1",
+            "rule": "xwork.MethodAccessor",
+            "type": "args",
+            "description": "Struts 恶意参数过滤"
+        },
+        {
+            "state": "on",
+            "name": "args2",
+            "rule": "xwork\\.MethodAccessor",
+            "type": "args",
+            "description": "Struts 恶意参数过滤"
+        },
+        {
+            "state": "on",
+            "name": "oneWordTrojan1",
+            "rule": "(?:define|eval|file_get_contents|include|require|require_once|shell_exec|phpinfo|system|passthru|preg_\\w+|execute|echo|print|print_r|var_dump|(fp)open|alert|showmodaldialog)\\(",
+            "type": "oneWordTrojan"
+        },
+        {
+            "state": "on",
+            "name": "protocolFilter1",
+            "rule": "(gopher|doc|php|glob|file|phar|zlib|ftp|ldap|dict|ogg|data)\\:\\/",
+            "type": "protocolFilter",
+            "description": "协议过滤"
+        },
+        {
+            "state": "on",
+            "name": "oneWordTrojan2",
+            "rule": "\\$_(GET|post|cookie|files|session|env|phplib|GLOBALS|SERVER)\\[",
+            "type": "oneWordTrojan"
+        },
+        {
+            "state": "on",
+            "name": "xss1",
+            "rule": "\\<(iframe|script|body|img|layer|div|meta|style|base|object|input)",
+            "type": "xss"
+        },
+        {
+            "state": "on",
+            "name": "xss2",
+            "rule": "(onmouseover|onerror|onload)\\=",
+            "type": "xss"
+        },
+        {
+            "state": "on",
+            "name": "xss3",
+            "rule": "base64_decode\\(",
+            "type": "xss"
+        },
+        {
+            "state": "on",
+            "name": "dirFilter1",
+            "rule": "(?:etc\\/\\W*passwd)",
+            "type": "dirFilter"
+        },
+        {
+            "state": "on",
+            "name": "dirFilter2",
+            "rule": "java\\.lang",
+            "type": "dirFilter"
+        }
+    ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/uaBlack.json

@@ -0,0 +1,4 @@
+{
+  "rules": [
+  ]
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/uaWhite.json

@@ -0,0 +1,3 @@
+{
+  "rules": []
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/urlBlack.json

@@ -0,0 +1,3 @@
+{
+  "rules": []
+}

apps/openresty/1.21.4.3-3-3-focal/1pwaf/data/rules/urlWhite.json

@@ -0,0 +1,3 @@
+{
+  "rules": []
+}