# Funny ngy\_lua outcome

**URL:** <https://www.ruby-forum.com/t/funny-ngy-lua-outcome/213096>\
**Category:** NGINX\
**Created:** [October 23, 2011, 4:20pm UTC](https://www.ruby-forum.com/t/funny-ngy-lua-outcome/213096 "2011-10-23T16:20:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [October 23, 2011, 4:20pm UTC](https://www.ruby-forum.com/t/funny-ngy-lua-outcome/213096/1 "2011-10-23T16:20:30Z")

</div>

SETUP  
_ **CONF FILE** _  
server {  
location @proxy {  
access\_by\_lua\_file ‘/etc/nginx/firewall.lua’;  
proxy\_cache [proxy.capture360.net](http://proxy.capture360.net);  
proxy\_pass [http://127.0.0.1:8080](http://127.0.0.1:8080);  
include /etc/nginx/proxy.default;  
}  
location /error\_docs {  
internal;  
alias /usr/share/nginx/html;

```
sub_filter '<!-- SubTag -->' '$host';
sub_filter_once off;

```

}  
location @pretty\_urls {  
# – Several rewrite X Y break lines

```
rewrite_by_lua 'ngx.exec("@proxy");';

```

}  
location / {  
try\_files $uri $uri/ @pretty\_urls;  
}  
location ~ .+.php$ {  
location ~ .._/._.php$ { return 400; }  
rewrite\_by\_lua ‘ngx.exec(“@proxy”);’;  
}  
}

_ **FIREWALL.LUA** _  
– F. Check “GET” Args  
if ngx.var.request\_method == “GET” then  
local args = ngx.req.get\_uri\_args()  
for key, val in pairs(args) do  
if type(val) == “table” then  
my\_arg = table.concat(val, " ")  
else  
my\_arg = val  
end  
if my\_arg and my\_arg ~= “” and type(my\_arg) ~= “boolean” then  
rule\_id = regex\_rules.check()  
if rule\_id then  
ngx.log(ngx.INFO, "Firewall Match: Rule " … rule\_id … " on  
POST: " … my\_arg)  
ngx.exit(ngx.HTTP\_BAD\_REQUEST)  
end  
end  
end  
end

– G. Check “POST” Args  
if ngx.var.request\_method == “POST” then  
ngx.req.read\_body()  
local args = ngx.req.get\_post\_args()  
for key, val in pairs(args) do  
if type(val) == “table” then  
my\_arg = table.concat(val, " ")  
else  
my\_arg = val  
end  
if my\_arg and my\_arg ~= “” and type(my\_arg) ~= “boolean” then  
rule\_id = regex\_rules.check()  
if rule\_id then  
ngx.log(ngx.INFO, "Firewall Match: Rule " … rule\_id … " on  
POST: " … my\_arg)  
ngx.exit(ngx.HTTP\_BAD\_REQUEST)  
end  
end  
end  
ngx.req.discard\_body()  
end

_ **REGEX\_RULES.LUA** _  
module(“regex\_rules”, package.seeall)  
function check()  
– 00  
local query\_string = “//”  
local query\_match = ngx.re.match(my\_arg, query\_string, “io”)  
– generic attacks  
– 9  
if query\_match then  
return “00”  
end  
– 01  
local query\_string =  
“(?:"[^"]_[^-]?\>)|(?:[^\\w\\s]\\s_\/\>)|(?:\>")”  
local query\_match = ngx.re.match(my\_arg, query\_string, “io”)  
– finds html breaking injections including whitespace attacks –  
xss – csrf  
– 4  
if query\_match then  
return “01”  
end  
…

ISSUES

1. A googlebot visit while testing a post string designed to be  
blocked “language=vbscript” is also blocked as the googlebot request  
is also tested against the same string.

2. Despite the “return id” line, the regex rules are run to the end.  
I.E., if there is a match on Rule 02, the rest are still run anyway  
and only after the last is evaluated is the 400 error returned.

3. The log from “ngx.log” does not seem to be produced.

COMMENTARY  
Abridged debug log with commentary here: [http://pastebin.com/A0cXpHwg](http://pastebin.com/A0cXpHwg)  
(Lost the one with thegooglebot issue)

Issue 1 seems to be a variable scope issue with “my\_arg” but when I  
use"local" regex\_rules.check() gets fed a blank.

Could the log thing be a level issue? I.E. “ngx.INFO” is too low??

Thanks