module WafFacade

Overview

Shared chrome + helpers for the branded block pages. Kept in a module so the top-level route table stays readable and nothing leaks into the global scope.

Defined in:

mazes/waf_facade_xss.cr

Constant Summary

CRS_RULES = {/script/i => 5, /onerror/i => 5, /onload/i => 5, /onmouseover/i => 5, /onclick/i => 5, /javascript:/i => 4, /\balert\b/i => 3, /\beval\b/i => 3, /<\/?\w/ => 1}

OWASP CRS-style anomaly scoring: only the "famous" tokens carry a score, so a payload assembled from low/zero-score primitives stays under the threshold.

Class Method Summary

• .akamai_block(rid : String) : String
• .aws_block(rid : String) : String
• .cloudflare_block(reflected : String, ray : String) : String

  NOTE reflected is inserted RAW on purpose — this block page is the sink.

• .crs_score(input : String) : Int32
• .f5_block(rid : String) : String
• .incapsula_block(rid : String) : String
• .modsecurity_block(rid : String, score : Int32) : String
• .ray_id(seed : String) : String

  Cloudflare-style lowercase hex ray id, derived deterministically from the request so the same payload always yields the same id (handy in specs).

• .support_id(seed : String) : String

  F5 ASM support ids look like a long decimal string.

Class Method Detail