truncated query args in ngx.var.request_uri

gunigovski · 2019-09-05T05:36:31+00:00

Hi, I am working on nginx server that uses Lua for rewriting requests. I need to redirect rewritten url without it trying once more...

truncated query args in ngx.var.request_uri

gunigovski

Hi,

I was testing our brand new WAF system today and have noticed some obviously malicious requests to be able to get through - with URLs which looks like:

"/bad-request?q=qwert')) UNION SELECT '1', '2', '3', '4', '5', '6', '7', '8' FROM sqlite_master--"

However, only the small part of such URLs was printed in access.log file - like only "/bad-request?q=" - nothing else.

It wasn't hard to fix to make sure that WAF would always receive a complete URL - here is a small snippet:


  local request_url = string.gsub( ngx.var.request_uri, "?.*", "");

  local request_url_args = ngx.var.args;

  if request_url_args and #request_url_args ~= 0 then

    request_url = request_url .. "?" .. request_url_args;

  end

However, I just curious - have anyone observed anything similar before? Like - truncated query args in ngx.var.request_uri ?