relayd block bad request

[CiotBSD]

Hi, all

With relayd, how can I block this request :

/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>

or:

/?XDEBUG_SESSION_START=phpstorm

[jggimi]

I haven't used relayd in about 8 years, but something like:

block url "/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>" label "URL blocked"
block url "/?XDEBUG_SESSION_START=phpstorm" label "URL blocked"

might possibly work. Have you been through the FILTER RULES section of the relayd.conf(5) man page?

[CiotBSD]

NO, this pass.
I attempt too, with block query or block path without any success!

Even, as:

block query "XDEBUG_SESSION_START" value "phpstorm" label "blocked"
block request query "*" value "*" label "blocked"

etc.

Why I attempt?
Because, I delivery only static; and to try if possible.

[CiotBSD]

OK, tonight, I found how to do:

block quick query "a" value "fetch"         label '<em>Blocked!</em>'
block quick query "XDEBUG_SESSION_START"    label '<em>Blocked!</em>'

So, simply!


----

How can I block all methods other than GET, HEAD?!
Do I specify block method for all of them?

[bsdun]

Something like this:

http protocol getonly {
return error
pass quick method GET
block label "Forbidden Method"
}