Skip to content

Commit fd409b9

Browse files
authored
waf: update transforms list (#1042)
1 parent 13072bd commit fd409b9

1 file changed

Lines changed: 38 additions & 7 deletions

File tree

crowdsec-docs/docs/appsec/rules_syntax.md

Lines changed: 38 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -214,9 +214,7 @@ rules:
214214
Match provides the pattern to match the target against. You can combine it with a [`transform`](#transform).
215215

216216
- _(mandatory)_ `match` containing both:
217-
218217
- _(mandatory)_ `type` indicates the matching method, one of:
219-
220218
- `regex`: matches _target_ against value (_value_ is a RE2 regexp)
221219
- `equals`: _target_ is a string equal to _value_
222220
- `startsWith`: _target_ starts with _value_
@@ -259,14 +257,47 @@ Optional operations applied to the target before matching:
259257

260258
- `lowercase`
261259
- `uppercase`
262-
- `b64decode` : base64 decode
263260
- `length` : transform _target_ to a number representing the string's length
264-
- `urldecode` : URL decode
265-
- `trim` : remove leading and trailing spaces
266-
- `normalizepath` : normalize the path (remove double slashes, etc)
267-
- `htmlEntitydecode` : decode HTML entities
268261
- `count` : number of times the _target_ appears
269262

263+
**Trim:**
264+
265+
- `trim` : remove leading and trailing spaces
266+
- `trim_left` : remove leading spaces
267+
- `trim_right` : remove trailing spaces
268+
269+
**Decoding:**
270+
271+
- `htmlentitydecode` : decode HTML entities
272+
- `js_decode` : decode JavaScript escape sequences
273+
- `css_decode` : decode CSS escape sequences
274+
- `urldecode` : URL decode
275+
- `hexdecode` : hex decode
276+
- `cmdline` : decode common command-line obfuscation techniques
277+
278+
**Base64:**
279+
280+
- `b64decode` : strict base64 decode
281+
- `b64decode_lenient` : lenient base64 decode (no padding required, decodes up to first invalid character, skips whitespaces and dots)
282+
- `b64encode` : base64 encode
283+
284+
**Path normalization:**
285+
286+
- `normalize_path` (or `normalizepath`) : normalize the path (remove double slashes, etc)
287+
- `normalize_path_win` (or `normalizepathwin`) : normalize the path for Windows (handles backslashes)
288+
289+
**Whitespace and nulls:**
290+
291+
- `remove_whitespaces` : remove all whitespace characters
292+
- `compress_whitespaces` : compress multiple whitespace characters into one
293+
- `remove_nulls` : remove null bytes
294+
- `replace_nulls` : replace null bytes with spaces
295+
296+
**Comments:**
297+
298+
- `remove_comments` : remove common comment sequences (e.g. `/* ... */`, `//`, `#`, `--`)
299+
- `replace_comments` : replace comment sequences with a space
300+
270301
```yaml {5-6}
271302
name: crowdsecurity/example-rule
272303
rules:

0 commit comments

Comments
 (0)