是否存在阻止被入侵的URL请求的导轨或机架式宝石？

Question

My Rails application frequently receives bogus traffic from hackers scanning for vulnerabilities, hitting URLs like /vb/showthread.php%3C/a . These show up as noise in our logs and I would like to filter them out or handle these in some way (such as alerting someone to the scanning attempts).

Is there a Rails or Rack gem that already does this, or are there similar libraries in other frameworks that do the same thing?

Answer 1

机架式攻击中间件gem足以根据请求的任何属性来阻止请求，并提供了用于处理恶意流量的其他高级功能，例如请求限制，阻止列表和请求日志记录。

Answer 2

I'm not sure if this really answer your question by I think a custom filter will be better instead of a general gem.

I've added a before filter on my applicaton_controller to handle weird request, then you can alert and do what you want.

class ApplicationController < ....
  before_action :filter_hacks #first filter

private
  def filter_hacks
    if request.format.to_s == 'php'
      #do something: email, save report, anything
      head(:ok) and return false
    elsif #add other filters

    end
  end

I'm sure it could be improved, but you have full control of what you want to block and what to do when that happens.

Answer 3

This is a great use case for middleware. You can store a list of known bad routes and use whatever logic you'd like to intercept and handle the request before it makes it through to your app. I would read up more on how to use Rack middleware in the Rails guides .

But it could be accomplished with something similar to this:

class FilterBadRequest
  BAD_PATHS = [
    "/vb/showthread.php%3C/a"
  ]

  def initialize(app)
    @app = app
  end

  def call(env)
    req = Rack::Request.new(env)

    bad_request = BAD_PATHS.find { |bad_path| req.fullpath ~= bad_path }

    if bad_request
      raise ActionController::BadRequest
    else
      @app.call(env)
    end
  end
end

This raises an ActionController::BadRequest exception, but you can redirect or do whatever else makes sense within the context of your application. You'll need to make sure to register the middleware within your application config file inside the config block like by calling config.middleware.use FilterBadRequest