<?php
/**
 * User defined WAF rules example file.
 * To apply these rules rename this file ot userRules.php
 * The format of this file is:
 * return [
 *   'filter section name'=>[
 *       ["rule type", 
 *           "where to look in the request", 
 *           "WAF rule", 
 *           [optional php array containing example attacks for unit testing] 
 *       ],
 *   ],
 * ];
 * 
 * Filter section name can be anything. It's for separate your rules.
 * 
 * Available rule types: plain, regex.
 * Available request check locations: 
 *      EV_CONNECT      : connection time filtering
 *      EV_RCV_REQ_STR  : filter the request string
 *      EV_RCV_HEAD     : filter in the request header
 *      EV_RCV_BODY     : filter in the request body
 *      EV_CLOSE        : filter after connection closed
 * 
 * These check locations can be combined by | like: EV_RCV_REQ_STR|EV_RCV_BODY
 * 
 * WAF rules can be plain text match or PCRE regular expressions, which must 
 * not include delimiter. The delimiter used internally is #.
 */
return [
    'userFilters'=>[
//        ["plain",'EV_RCV_REQ_STR',"../administrator",[]],
//        ['regex', 'EV_RCV_REQ_STR|EV_RCV_BODY', "(?i:(?:\A|[^\d])0x[a-f\d]{3,}[a-f\d]*)+", [
//                "user='0xa1a234a'0xa23",
//                "/vulnerabilities/sqli/?id=dadasdasdsa'0xa1a234a'0xa23&Submit=Submit"
//            ]],
    ],
];
?>