diff --git a/internal/proxy/validator.go b/internal/proxy/validator.go index 6ea6f96..5379486 100644 --- a/internal/proxy/validator.go +++ b/internal/proxy/validator.go @@ -188,6 +188,7 @@ func (m *Validator) encodeFormData() (e error) { for k, v := range form.Value { m.requestArgs.Add(k, v[0]) + rlog(m.Ctx).Trace().Msg("parsed form value " + k + " - " + v[0]) } // TODO - with go1.21.0 we can use: @@ -217,7 +218,7 @@ func (m *Validator) isArgsWhitelisted() (_ bool) { if len(declinedKeys) != 0 { if zerolog.GlobalLevel() < zerolog.InfoLevel { for key := range declinedKeys { - rlog(m.Ctx).Debug().Msg("Invalid key detected - " + futils.UnsafeString(key)) + rlog(m.Ctx).Debug().Msg("Invalid args-key detected - " + futils.UnsafeString(key)) } } @@ -233,6 +234,9 @@ func (m *Validator) isQueryWhitelisted() (ok bool) { return true } - _, ok = queryWhitelist[futils.UnsafeString(query)] + if _, ok = queryWhitelist[futils.UnsafeString(query)]; !ok { + rlog(m.Ctx).Debug().Msg("Invalid query-key detected - " + futils.UnsafeString(query)) + } + return } diff --git a/internal/proxy/whitelist.go b/internal/proxy/whitelist.go index dafe2cc..b35eef9 100644 --- a/internal/proxy/whitelist.go +++ b/internal/proxy/whitelist.go @@ -10,6 +10,7 @@ package proxy // } var postArgsWhitelist = map[string]interface{}{ + // POST api.php "action": nil, "code": nil, "filter": nil, @@ -19,6 +20,43 @@ var postArgsWhitelist = map[string]interface{}{ "perPage": nil, "query": nil, "rm": nil, + + // POST func.php - most used + "sort": nil, + "xpage": nil, + "finish": nil, + "search": nil, + "current": nil, + + // POST func.php + "2fa": nil, + "announce": nil, + "csrf": nil, + "csrf_token": nil, + "data": nil, + "deviceId": nil, + "do": nil, + "fa2code": nil, + "g-recaptcha-response": nil, + "info": nil, + "key": nil, + "login": nil, + "mail": nil, + "mes": nil, + "newPasswd": nil, + "oldPasswd": nil, + "order0column": nil, + "order0dir": nil, + "passwd": nil, + "recaptcha": nil, + "reset": nil, + "rid": nil, + "searchvalue": nil, + "url": nil, + "v": nil, + "vk": nil, + "w": nil, + "width": nil, } var queryWhitelist = map[string]interface{}{