Aturan (Rules)

Aturan berbasis data, bukan if-else yang tersebar. Setiap rule punya ID stabil, kategori, matcher, severity, skor, dan bendera immediate_ban.

Jenis matcher

Matcher	Kegunaan
exact	URI/path sama persis.
prefix	Path diawali nilai tertentu.
contains	Substring berisiko tinggi.
regex	Pola kompleks; wajib lolos guard ReDoS.
query_contains	Payload di query string.
decoded_contains	Pada semua varian hasil decode.
body_contains / body_regex	Di body request (jika inspection.body.enabled).

Semua matcher juga memeriksa varian hasil decode (decodedVariants), sehingga serangan ter-encode (%2e%2e, %2egit, encode ganda) tetap terdeteksi.

Rule default

Rule ID	Target
sensitive.env / .decoded / .variants	/.env & varian encode.
sensitive.git / .config / .credentials	.git probing.
sensitive.aws / .credentials	Kredensial AWS.
sensitive.wpconfig / sensitive.joomla	wp-config, configuration.php.
sensitive.composer / .lock / sensitive.phpunit	Metadata composer/phpunit.
backup.php	.php.bak/.old/.save/.swp/.tmp/....
traversal.generic / .backslash / traversal.proc / .etcpasswd	../, ..\, /proc/self/environ, /etc/passwd.
rce.phpinput / rce.prepend	php://input, auto_prepend_file.
rce.ini_directives / rce.ini_disable_functions	allow_url_include, disable_functions.
rce.call_user_func / rce.thinkphp / .invokefunction	ThinkPHP RCE.
rce.system_calls / .passthru / .proc_open	shell_exec, passthru, proc_open.
exec.static_dirs / .uploads_php / .hidden_php	.php di folder statis/uploads/dot-dir.
cms.xmlrpc	/xmlrpc.php.
debug.wordpress	/wp-content/debug.log.
honeypot.*	Path umpan scanner.
payload.query.traversal	../../ di query.

Rule pack Injection (default ON)

Menambahkan rule ber-confidence tinggi untuk payload injection — menutup celah single-shot probe & sqlmap. Rule body memerlukan inspection.body.enabled.

Rule ID	Target	Severity
payload.sqli.union / .union.query	union … select (body / query)	high
payload.sqli.time / .error	sleep(, benchmark(, extractvalue( (body)	high
payload.xss.script / .script.query / .handler / .javascript / .svg	<script, onload=, javascript: (body/query)	medium
payload.lfi.file / .data	file://, data:// (body)	medium
payload.lfi.phpscheme	php://input di body	critical (immediate ban)
payload.rce.base64	base64_encode(, eval(, assert( (body)	medium
payload.cmd.invoke	system(, exec(, popen(, proc_open( (body)	high

Sebagian besar ber-skor medium (band challenge) agar pengguna sah yang tidak sengaja mengirim teks mirip payload hanya di-challenge, bukan diblokir permanen.

Rule pack WordPress (opsional, default off)

SHIELD_RULES_PACK_WORDPRESS=true menambah: wp.gravitysmtp, wp.litespeed / .debug, wp.admin_ajax, wp.php.plugins_deep, wp.php.plugin_risk_files.

Menambah / menyesuaikan rule

Di config/shield.php:

'rules' => [
    ['id' => 'sensitive.env', 'enabled' => false, 'score' => 20],  // override/disable
    ['id' => 'custom.my_probe', 'category' => 'custom',
     'matcher' => 'contains', 'value' => '/secret-endpoint',
     'severity' => 'high', 'score' => 20, 'immediate_ban' => true],
    'packs' => ['wordpress' => false, 'injection' => true],
],

Guard ReDoS

Rule regex divalidasi saat dimuat terhadap payload gagal; pola catastrophic backtracking ditolak (InvalidConfigException). Gunakan contains/decoded_contains bila memungkinkan.