baidu / openrasp

🔥Open source RASP solution

OpenRASP

Introduction

Unlike perimeter control solutions like WAF, OpenRASP directly integrates its protection engine into the application server by instrumentation. It can monitor various events including database queries, file operations and network requests etc.

When an attack happens, WAF matches the malicious request with its signatures and blocks it. OpenRASP takes a different approach by hooking sensitive functions and examines/blocks the inputs fed into them. As a result, this examination is context-aware and in-place. It brings in the following benefits:

1. Only successful attacks can trigger alarms, resulting in lower false positive and higher detection rate;
2. Detailed stack trace is logged, which makes the forensic analysis easier;
3. Insusceptible to malformed protocol.

Quick Start

See detailed installation instructions here

We also provide a few test cases that are corresponding to OWASP TOP 10 attacks, download here

FAQ

1. List of supported web application servers

We've fully tested OpenRASP on the following application servers for Linux platforms:

• Java
  • Tomcat 6-9
  • JBoss 4.X
  • Jetty 7-9
  • Resin 3-4
  • SpringBoot 1-2
  • IBM WebSphpere 8.5, 9.0
  • WebLogic 10.3.6, 12.2.1
• PHP
  • 5.3-5.6, 7.0-7.4

The support of other web application servers will also be soon included in the coming releases.

2. Performance impact on application servers

We ran multiple intense and long-lasting stress tests prior to release. Even in the worst-case scenario (where the hook point got continuously triggered) the server's performance was only reduced by 1~4%

3. Integration with existing SIEM or SOC

OpenRASP logs alarms in JSON format, which can be easily picked up by Logstash, rsyslog or Flume.

4. How to develop a new plugin?

A plugin receives a callback when an event occurs. It then determines if the current behavior is malicious or not and blocks the associated request if necessary.

Detailed plugin development instructions can be found here

Contact

Technical support:

• RASP QQ group #2: 595568655
• RASP QQ group #1 (full): 259318664
• OpenRASP Google Group

Business inquires, comments and security reports:

• General email: openrasp-support # baidu.com

openrasp's Issues

支持 wildfly

目前不支持 wildfly ，后期会支持，支持wildfly 主要需要支持 undertow和netty

已经1.0-SNAPSHOT版本了？

下代码下来一看已经1.0-SNAPSHOT，什么时候发布1.0release啊？

Upcoming Changes

Is there any place where I can view the code that is under development and contribute in testing the new code change that is done

Add basic english translation

List of pages to translate:

1. Landing page
2. Documents
3. Codebase (mostly comments)
4. 【DONE】Javascript plugin (alarm messages)
5. Vulnerable testcases

JDK 11 兼容性问题解决

JDK 9 之后 classloader 和反射机制发生变化，需要额外支持

OpenRASP is correctly installed but it does not block the test cases

I installed OpenRASP on a fresh copy of Tomcat 8.5.6 and I also installed the tests (vuln.war). It looks like the setup was successful as:

• I can see the OpenRASP logo in the Tomcat log
• I can see the "X-Protected-By: OpenRASP" and "X-Request-ID: ..." headers in any curl request
  However, the tests are not blocked, I can see for example 001 and 004 go through happily.

Steps:

• install a fresh copy of Tomcat
• deploy the vuln.war app
• start Tomcat using catalina.sh,
• see vulnerabilities 001 and 004 exploited
• stop tomcat
• install OpenRASP
• start tomcat
• see the OpenRASP logo in the tomcat log
• see the "X-Protected-By: OpenRASP" and "X-Request-ID: ..." headers in any curl request
• see vulnerabilities 001 and 004 exploited <== NOT EXPECTED!!!
  After a successful OpenRASP installation, I expect the vulnerability to be blocked and to see the blocking page.

Environment information:

• OS: Ubuntu 14.04.5 LTS \n \l
• Application server: Apache Tomcat 8.5.6 / 8.5.34 (tried both)
• Java version: 1.8.0_171
• OpenRASP version: 0.42 (also tried 0.40)

Please advise.

XSS

I have copied the xss-demo.js code in plugin.js. I injected <script> tag - it didn't throw security exception - basically it didn't block the request. Please have a look at it. If there is something wrong, I am doing - please let me the steps to follow so that I can stop xss

数据库连接池支持

由QQ群用户Aven提供，C3P0数据库连接池例子，待测试

TestDB.zip

打好的war包，改下扩展名

pool.war

评估恢复 weblogic 支持的可行性

WebLogic 存在较多问题，比如自定义拦截页面功能，有时候拦截无法生效，所以在0.20里去掉了 WebLogic 服务器支持。

类似的问题还有很多，需要仔细评估

支持 XML 注入检测？

由QQ群用户 @叶落 反馈，7.0的container版本有xml注入教程。我们目前不支持这个检测

文档链接失效

https://rasp.baidu.com/doc/install/manual/tomcat.html

请参考这篇文章 对应的链接404了 https://rasp.baidu.com/doc/setup/log/config.html

java 版本 alarm.log 默认不带日期的问题

log4j 默认写日志不带日期，只有在需要 rotate 的时候，才会产生一个有日期的历史日志。Java 下面大多日志框架都是这样的，比如 tomcat 的 logs。

不过这样确实容易产生误解，可以考虑下其他日志框架。

php7支持多久发布

bytebuddy 调研工作

由QQ群用户 @阿远 反馈，bytebuddy比javassist简单清晰，bytebuddy的底层是asm写的，非常高效

我们这边认为hook效率对RASP帮助可能不大，需要进一步研究确认

docker 部署方案

由QQ群用户巫师反馈

需要支持的docker集群管理工具

• mesos
• k8s

问题

1. 有时候更新了插件，RASP 里面不会更新
   • 可能跟docker版本有关？测试 docker 1.2 没问题，貌似 1.1 版本有问题，还未验证
2. docker 部署影响不好控制
   • 增加一个开关，控制是否整合RASP到docker镜像
3. 如何融入发布环节，现在每次重新发布rasp就没了

sql注入hook不全的问题

测试发现，对于以下的sql注入漏洞，是无法检测的：

	String username = request.getParameter("username");
	String order = request.getParameter("order");
	String sql= "select host,user from user where user=? order by host "+order;
	//System.out.println(sql);
	PreparedStatement preState = conn.prepareStatement(sql);
	preState.setString(1, username);
	ResultSet rs = preState.executeQuery();

其根源在于未hook预编译相关的方法。
对于mysql来说可以通过以下方式来解决：
添加SQLConnectionHook类（这里只覆盖了mysql，其他的请官方补充吧）

public class SQLConnectionHook extends AbstractClassHook {
    private String type;
    private String[] exceptions;
    /**
     * (none-javadoc)
     *
     * @see com.fuxi.javaagent.hook.AbstractClassHook#getType()
     */
    @Override
    public String getType() {
        return "sql";
    }
    @Override
    public boolean isClassMatched(String className) {
        /* MySQL */
        if ("com/mysql/jdbc/ConnectionImpl".equals(className)
                || "com/mysql/cj/jdbc/ConnectionImpl".equals(className)) {
            this.type = "mysql";
            this.exceptions = new String[]{"java/sql/SQLException"};
            return true;
        }
        /* SQLite */
 
        /* Oracle */
 
        /* SQL Server */
 
        /* PostgreSQL */
 
        return false;
    }
    @Override
    protected MethodVisitor hookMethod(int access, String name, String desc, String signature, String[] exceptions, MethodVisitor mv) {
        boolean hook = false;
        if (name.equals("prepareStatement") && Arrays.equals(exceptions, this.exceptions)) {
            if (desc.equals("(Ljava/lang/String;)Ljava/sql/PreparedStatement;")
                    ) {
                hook = true;
            }
        } 
        return hook ? new AdviceAdapter(Opcodes.ASM5, mv, access, name, desc) {
            @Override
            protected void onMethodEnter() {
                push(type);
                loadArg(0);
                invokeStatic(Type.getType(HookHandler.class),
                        new Method("checkSQL", "(Ljava/lang/String;Ljava/lang/String;)V"));
            }
        } : mv;
    }
}

有没有对resin容器的支持？

除了Tomcat，Jetty，JBoss，SpringBoot，有没有对resin容器的支持？
支持的话，有文档吗？

"realpath" 参数潜在的风险

如果因为磁盘问题，javaagent在获取realpath时候，可能出先IO延迟。这最终可能阻塞当前请求

Test Envirornment

Is there any test environment or sandbox where we can test the capabilities of openRasp features of whatever code is there in github / code under development

[OpenRASP] Failed to initialize, will continue without security protection

Bug report

To help us debug your issue please explain:

• What you were trying to do (and why)
• What happened
• What you expected to happen
• Step-by-step reproduction instructions

And please include the following information:

• Operating system type and architecture
• Application server type and version
  • For Java based web application servers, provide JDK version
• OpenRASP version

Feature Request

Please replace this section with:

• a detailed description of your proposed feature
• the motivation for the feature
• what alternatives to the feature you have considered

增加对 DB2 的支持

request.setCharacterEncoding 编码问题

有些情况下，用户可能会先设置请求参数编码，再获取参数，比如这段代码:

request.setCharacterEncoding("utf-8");
String xss = request.getParameter("xss");

当某个JS检测插件调用了 context.parameter 去获取参数，就会导致 Java 以默认的 ISO-8859-1 编码去解码，并缓存这个解码结果

之后应用如果调用 request.setCharacterEncoding 将不会产生任何效果，使用 request.getParameter 获取的值也只会是之前缓存过的、解码错误的数据

解决方案

1. 请用户手动设置编码（最简单）
2. OpenRASP 挂钩 request.setCharacterEncoding 函数，当用户调用这个函数，就修改缓存里的数据，重新编码
3. OpenRASP 不主动调用 request.getParameter 函数，当用户调用过之后，context.parameter 才返回数据；否则返回空哈希

PHP7.2 下测试用例拦截后log中没有相关记录信息，这样正常么？

手动在PHP7.2环境下安装上了openrasp，且测试用例也能正常拦截。后查看日志发现日志文件中【plugin】【policy】有相关日志文件产生，但是alarm等文件中没有日志。请问这是正常的么？

Add basic support of Websphere

增加 Undertow 支持

请问这里传给doCheck方法的参数为什么是EMPTY_MAP呢，这不是没检测吗？

openrasp/agent/java/src/main/java/com/fuxi/javaagent/HookHandler.java

Line 224 in 6b9b417

doCheck(CheckParameter.Type.REQUEST, EMPTY_MAP);

下载地址能不能加上下载文件的hash校验值。

比如在 https://github.com/baidu/openrasp/releases/tag/v0.24
加上asc文件，或者sha256.

增加 HSQLDB 支持 - Webgoat 问题

由QQ群用户 @叶落 反馈，我们无法拦截 webgoat 里的SQL注入攻击。

经过检查，webgoat 里使用的是 HSQLDB，我们没有对应的 hook 点。

rhino jdk8u162 兼容性问题

在最新的 jdk8u162 上运行 openrasp，会出现这个错误；OpenJDK 1.7u171 (发布于 2018.02) 也存在这个问题。

临时解决方案是降级到 jdk8 update 144 或者更低版本
http://www.oracle.com/technetwork/java/javase/downloads/java-archive-javase8-2177648.html?printOnly=1

现在QA资源紧张，PHP版本还没有测试完成，所以要下下个版本发布

具体错误

堆栈信息

java.util.MissingResourceException: Can't find bundle for base name org.mozilla.javascript.resources.Messages, locale en_US
	at java.util.ResourceBundle.throwMissingResourceException(ResourceBundle.java:1573)
	at java.util.ResourceBundle.getBundleImpl(ResourceBundle.java:1396)
	at java.util.ResourceBundle.getBundle(ResourceBundle.java:854)
	at org.mozilla.javascript.ScriptRuntime$DefaultMessageProvider.getMessage(ScriptRuntime.java:4096)
	at org.mozilla.javascript.ScriptRuntime.getMessage(ScriptRuntime.java:4080)
	at org.mozilla.javascript.ScriptRuntime.getMessage1(ScriptRuntime.java:4034)

Kibana 6.X 面板支持

由 QQ群用户 @shangl 反馈。在 Kibana-6.2.2 下面，我们的配置面板显示不正常：

原始配置下载地址

https://rasp.baidu.com/doc/install/siem/kibana.html

XXE - 增加 SAXReader 支持

由QQ群用户 慢跑状态 提出

增加 URL 过滤功能，支持白名单和黑名单两种配置方式

根据QQ群用户 @johnny 反馈，我的tomcat webapp目录下有多个war包，rasp配置在tomcat上 会监控整个tomcat里所有站点，能不能只设置监控个别站点

暂定方案

增加两个配置，都是根据前缀配置，e.g

# 只检测以下路径
url_include=/app1/,/app2/,/app3/

# 不检测以下路径
url_exclude=/app1/whatever,/app2/somewhere

预计 v1.0 RC1 加入支持

sql-connection 基线检测hook点不全

一些连接池,还有javax的datasource连接方式，不走SQLDriverManagerHook，看了下源码，应该找到每个sql的驱动类，然后一一适配链接

关于SSRF检测建议

在源码中看到对于SSRF检测算法，感觉比较复杂并且不能完全覆盖SSRF攻击，例如八进制的主机地址、直接十进制的主机地址(http://192.168.0.1 >>> http://3232235521/)、短地址（http://dwz.cn/11SMa >>> http://127.0.0.1）。我个人认为直接使用DNS解析，把任何域名或地址统一解析成地址，从地址上进行过滤拦截更合适些。

PHP support release date

Hi,

I'd like to know if you have any release date supporting PHP, as I saw in a wiki the release would be soon but I also see that is going to work with php 5.2-5.6 what about 7? Is it in your roadmap?

Thanks!!

spring boot 项目如何验证openrasp是否有效

我已经将openrasp集成到我的项目中，spring boot项目 jar包启动模式，已经成功启动openrasp，但是我用扫描漏洞工具 还是扫描出多个跨域攻击及OPTION攻击？ 请问OpenRasp是否能有效防止这些攻击呢。因为扫描结果跟没有引入openRASP一样。请问如何验证是否集成成功？

ajax: 根据请求类型来决定返回 html、json 还是 xml

由QQ群用户 @有多少爱可以胡来 反馈，当ajax请求被拦截，希望主页面能跳转。

暂定方案

如果是浏览器发出的非攻击请求，除非是误报了，否则不会触发跳转；如果是真实攻击，那主页面是否跳转都所谓了。

我们增加三个配置项目，当返回类型为 json/xml 时，输出特定的响应数据；其他情况下输出 html

block.json={"error":true, "reason": "Request blocked by OpenRASP", "request_id": "$REQUEST_ID$"}
block.xml=<?xml version="1.0"?><doc><error>true</error><reason>Request blocked by OpenRASP</reason><request_id>$REQUEST_ID$</request_id></doc>
block.html=</script><script>location.href="https://rasp.baidu.com/blocked2/?request_id=$REQUEST_ID$"</script>

另外在输出的时候，需要将 $REQUEST_ID$ 替换为当前的 request_id

排除对部分域名的报警检测

使用的PHP环境，包含多个域名，其中一个域名使用weiphp，在正常使用中需要file write到缓存的目录中，所以在splunk里查看就看到很多此类警告信息，能否过滤掉单独域名的类型检测那？

getWriter 和 getOutputStream 兼容性问题

Rasp 在拦截之后，响应拦截页面的过程的时候，会尝试调用 getWriter 或 getOutputStream 来重定向拦截页面，当 getWriter 和 getOutputStream 二者之一被调用，之后用户代码再调用另一个就会抛异常。如果在处理异常的过程中又调用 getWriter 或 getOutputStream 出现异常，则会出现死循环。

  // 请求发生异常则调用该方法，处理错误
   public handleError(HttpServletResponse response, Exception e) {
       LOGGER.error(e.getMessage());
       response.getWriter().println("error");// 此处因为获取过 Writer 所以又会抛出异常，又会回到该方法
   }

日志样例：

11:53:26.834 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.842 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.850 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.858 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.866 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.874 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.882 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.890 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.898 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.906 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.915 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.923 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.932 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.940 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.949 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.957 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.965 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.974 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.983 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:26.991 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:27.000 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:27.009 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:27.018 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:27.027 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:27.035 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response
11:53:27.044 [http-nio-7001-exec-3] WARN  L WARN - Resolved exception caused by Handler execution: java.lang.IllegalStateException: getWriter() has already been called for this response

修复方案：

  // 请求发生异常则调用该方法，处理错误
   public handleError(HttpServletResponse response, Exception e) {
       try {
           LOGGER.error(e.getMessage());
           response.getWriter().println("error");// 此处因为获取过 Writer 所以又会抛出异常，又会回到该方法
       } catch(Exception e) {
           LOGGER.error(e.getMessage());
           // to do some thing
       } 
   }

Plan for Struts, Spring, Hibernate, WebService - Rest and SOAP Support

What is the plan to include support for third party software like - Struts, Spring, Hibernate, Web-service - Rest and SOAP

宝塔面板 + PHP 7.2 无法自动安装的问题

下载地址 http://www.bt.cn/

无法定位可以修改的 ini，错误信息:

OpenRASP Installer for PHP servers - Copyright 2017-2018 Baidu Inc.
For more details visit: https://rasp.baidu.com/doc/install/software.html

[INFO]: openrasp.root_dir => /opt/rasp
***********************************************************
 1. Check whether required PHP extensions are installed
***********************************************************
***********************************************************
 2. Installing OpenRASP PHP extension
***********************************************************
[INFO]: Successfully copied 'openrasp.so' to '/usr/local/lib/php/extensions/no-debug-non-zts-20170718'
***********************************************************
 3. Updating php.ini
***********************************************************
[ERROR]: Cannot find appropriate php.ini file.

tomcat <= 7.0.55 javaassisst annotation 错误

tomcat 7.0.55 + jdk 1.7u67 + windows 下面，会产生这个错误

SEVERE: Unable to process Jar entry [javassist/ByteArrayClassPath.class] from Jar [jar:file:/C:/Users/X/Desktop/apache-tomcat-7.0.55/rasp/rasp-engine.jar!/] for annotations
java.io.EOFException
	at java.io.DataInputStream.readUnsignedShort(DataInputStream.java:340)
	at org.apache.tomcat.util.bcel.classfile.Utility.swallowMethodParameters(Utility.java:796)
	at org.apache.tomcat.util.bcel.classfile.Attribute.readAttribute(Attribute.java:171)
	at org.apache.tomcat.util.bcel.classfile.FieldOrMethod.<init>(FieldOrMethod.java:57)
	at org.apache.tomcat.util.bcel.classfile.Method.<init>(Method.java:71)
	at org.apache.tomcat.util.bcel.classfile.ClassParser.readMethods(ClassParser.java:267)
	at org.apache.tomcat.util.bcel.classfile.ClassParser.parse(ClassParser.java:127)
	at org.apache.catalina.startup.ContextConfig.processAnnotationsStream(ContextConfig.java:2058)
	at org.apache.catalina.startup.ContextConfig.processAnnotationsJar(ContextConfig.java:1934)
	at org.apache.catalina.startup.ContextConfig.processAnnotationsUrl(ContextConfig.java:1900)
	at org.apache.catalina.startup.ContextConfig.processAnnotations(ContextConfig.java:1885)
	at org.apache.catalina.startup.ContextConfig.webConfig(ContextConfig.java:1317)

测试 tomcat 7.0.88 没有问题。目前看这个是 tomcat 自己的问题，jboss-javassist/javassist#29

tomcat 静态资源缓存特性

问题描述

tomcat 会缓存用户访问过的静态资源，当文件小于10MB，tomcat 会缓存这个文件的内容；当文件超过10MB，tomcat会缓存文件描述符以提高性能

这带来一个bug，再次访问相同静态资源，将无法触发 openrasp readFile hook 点

解决方案

调整hook点，当匹配上某些扩展名时，就调用 readFile hook 点

增加 Flume + OpenRASP 配置文档

增加 MongoDB 支持

类库支持

PHP，

• MongoClient (deprecated)
• MongoDB

Java，

• org.mongodb.mongodb-driver

攻击方式支持

• Type confusion，e.g username[$ne]=1
• 测试 nosqlmap 是否正常拦截

ssrf规则bug

如下图所示，在测试ssrf过程中，url=file:///etc/passwd，不会被openrasp拦截。在规则中看到对file做了检测，怎么回事

express, koa, node, ...

It would be great to have support for the Node.js ecosystem so express, koa, Node.js core and more should be supported (and also Apache, Nginx, Caddy server, IIS, ...).

How can we help here with the implementation?

bwapp 拦截效果测试

http://www.itsecgames.com/
https://sourceforge.net/projects/bwapp/

关于sql Hook问题

openrasp version 0.24

这两天刚开学习openrasp，写了个plugin test：

var plugin = new RASP('lk_test')
function checkSQL(params, context) {
    var result = {
    action: 'ignore',
    message: '无风险',
    confidence: 90
}
plugin.log(params.server, params.query)
    return result
}
plugin.register('sql', checkSQL)
plugin.log('初始化成功')

得到的结果里只有[lk_test] mysql select @@session.tx_read_only, 没见到具体的数据库表读写，这是为什么呢？

Support user-defined HTTP header

User can optionally add the following headers:

• X-Frame-Options: deny/sameorigin
• X-Content-Type-Options: nosniff
• X-XSS-Protection: 1; mode=block
• X-Referrer-Policy: no-referrer/no-referrer-when-downgrade/same-origin/origin/strict-origin/origin-when-cross-origin/strict-origin-when-cross-origin/unsafe-url
• X-Download-Options: noopen

And the following dangerous headers (May break application, pending decision)

• Strict-Transport-Security
• Access-Control-Allow-Origin
• Content-Security-Policy

Reference:

• https://www.netsparker.com/whitepaper-http-security-headers/