@abtnode/router-provider 1.16.38-beta-20250204-120121-1a6a1e63 → 1.16.38-beta-20250206-084543-4d7b4331

package/lib/nginx/includes/security/crs4/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf

@@ -208,6 +208,7 @@ SecRule REQUEST_FILENAME "@endsWith /api/gql" \
    chain"
    SecRule REQUEST_METHOD "@pm POST" \
        "ctl:ruleRemoveByTag=attack-rce,\
+        ctl:ruleRemoveById=930120,\
         ctl:ruleRemoveById=921110"
 
 # Disable some rules for websocket endpoint for blocklet server and service
@@ -237,6 +238,7 @@ SecRule REQUEST_HEADERS:tus-resumable "@rx ^1\.0\.0$" \
             "t:none,\
             ctl:ruleRemoveById=920420"
 
+# Fix: did space connect and restore false positive
 SecRule REQUEST_FILENAME "@rx (?:/connect-to-did-space|/restore)$" \
    "id:1009,\
    phase:1,\
@@ -246,6 +248,7 @@ SecRule REQUEST_FILENAME "@rx (?:/connect-to-did-space|/restore)$" \
    SecRule REQUEST_METHOD "@pm GET" \
        "ctl:ruleRemoveById=934110"
 
+# Fix: did wallet backup false positive
 SecRule REQUEST_FILENAME "@endsWith /app-records.txt" \
    "id:1010,\
    phase:1,\
@@ -254,8 +257,10 @@ SecRule REQUEST_FILENAME "@endsWith /app-records.txt" \
    chain"
    SecRule REQUEST_METHOD "@pm PUT" \
        "ctl:ruleRemoveById=942550,\
+        ctl:ruleRemoveById=942151,\
         ctl:ruleRemoveById=934110"
 
+# Fix: did resolver false positive
 SecRule REQUEST_FILENAME "@contains /.well-known/did-resolver/resolve" \
    "id:1011,\
    phase:1,\
@@ -265,7 +270,8 @@ SecRule REQUEST_FILENAME "@contains /.well-known/did-resolver/resolve" \
    SecRule REQUEST_METHOD "@pm GET" \
        "ctl:ruleRemoveById=920440"
 
-SecRule REQUEST_FILENAME "@endsWith /.well-known/service/connect" \
+# Fix: did connect false positive
+SecRule REQUEST_FILENAME "@contains /.well-known/service/connect" \
    "id:1012,\
    phase:1,\
    pass,\
@@ -274,7 +280,7 @@ SecRule REQUEST_FILENAME "@endsWith /.well-known/service/connect" \
    SecRule REQUEST_METHOD "@pm GET" \
        "ctl:ruleRemoveById=930120"
 
-# Allow dockerfile assets with dynamic hash
+# Fix: dockerfile assets from discuss-kit false positive
 SecRule REQUEST_FILENAME "@rx /.blocklet/proxy/[^/]+/assets/dockerfile-[A-Za-z0-9]{8}\.js$" \
    "id:1013,\
    phase:1,\
@@ -283,3 +289,23 @@ SecRule REQUEST_FILENAME "@rx /.blocklet/proxy/[^/]+/assets/dockerfile-[A-Za-z0-
    chain"
    SecRule REQUEST_METHOD "@pm GET" \
        "ctl:ruleRemoveById=930130"
+
+# Fix oauth callback scope false positive
+SecRule REQUEST_FILENAME "@contains /.well-known/service/oauth/callback" \
+   "id:1014,\
+   phase:1,\
+   pass,\
+   nolog,\
+   chain"
+   SecRule REQUEST_METHOD "@pm GET" \
+       "ctl:ruleRemoveById=930120"
+
+# Fix did-space upload false positive
+SecRule REQUEST_FILENAME "@contains /api/space/" \
+   "id:1015,\
+   phase:1,\
+   pass,\
+   nolog,\
+   chain"
+   SecRule REQUEST_METHOD "@pm PUT PATCH" \
+       "ctl:ruleRemoveByTag=attack-rce"

package/lib/nginx/index.js

@@ -105,6 +105,7 @@ class NginxProvider extends BaseProvider {
     this.logDir = path.join(this.configDir, 'log');
     this.accessLog = path.join(this.logDir, 'access.log');
     this.errorLog = path.join(this.logDir, 'error.log');
+    this.securityLog = path.join(this.logDir, 'modsecurity.log');
     this.tmpDir = path.join(this.configDir, 'tmp');
     this.certDir = path.join(this.configDir, 'certs');
     this.cacheDir = path.join(this.configDir, 'cache');
@@ -330,7 +331,7 @@ class NginxProvider extends BaseProvider {
     }
 
     logger.info('start rotate nginx log files');
-    const files = [this.accessLog, this.errorLog];
+    const files = [this.accessLog, this.errorLog, this.securityLog];
     const rotateTasks = files.map(
       (file) => rotateNginxLogFile({ file, nginxPid: nginxStatus.pid, cwd: this.logDir, retain })
       // eslint-disable-next-line function-paren-newline
@@ -981,7 +982,7 @@ class NginxProvider extends BaseProvider {
     return {
       access: this.accessLog,
       error: this.errorLog,
-      security: path.join(this.logDir, 'modsecurity.log'),
+      security: this.securityLog,
     };
   }
 

package/lib/nginx/templates/security/modsecurity.conf.js

@@ -226,18 +226,13 @@ SecDataDir ${tmpDir}
 #
 #SecUploadFileMode 0600
 
-
-# -- Debug log configuration -------------------------------------------------
-SecDebugLog ${logDir}/modsecurity-debug.log
-SecDebugLogLevel ${logLevel}
-
 # -- Audit log configuration -------------------------------------------------
-SecAuditEngine RelevantOnly
+${logLevel > 0 ? `SecAuditEngine RelevantOnly
 SecAuditLogRelevantStatus "^(?:5|4(?!04))"
 SecAuditLogParts ABIJDEFHZ
 SecAuditLogType Serial
 SecAuditLogFormat Native
-SecAuditLog ${logDir}/modsecurity.log
+SecAuditLog ${logDir}/modsecurity.log` : ''}
 
 SecArgumentSeparator &
 SecCookieFormat 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abtnode/router-provider",
-  "version": "1.16.38-beta-20250204-120121-1a6a1e63",
+  "version": "1.16.38-beta-20250206-084543-4d7b4331",
   "description": "Routing engine implementations for abt node",
   "author": "polunzh <polunzh@gmail.com>",
   "homepage": "https://github.com/ArcBlock/blocklet-server#readme",
@@ -32,10 +32,10 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/constant": "1.16.38-beta-20250204-120121-1a6a1e63",
-    "@abtnode/logger": "1.16.38-beta-20250204-120121-1a6a1e63",
-    "@abtnode/router-templates": "1.16.38-beta-20250204-120121-1a6a1e63",
-    "@abtnode/util": "1.16.38-beta-20250204-120121-1a6a1e63",
+    "@abtnode/constant": "1.16.38-beta-20250206-084543-4d7b4331",
+    "@abtnode/logger": "1.16.38-beta-20250206-084543-4d7b4331",
+    "@abtnode/router-templates": "1.16.38-beta-20250206-084543-4d7b4331",
+    "@abtnode/util": "1.16.38-beta-20250206-084543-4d7b4331",
     "@arcblock/http-proxy": "^1.19.1",
     "@arcblock/is-valid-domain": "^1.0.5",
     "axios": "^1.7.9",
@@ -60,5 +60,5 @@
     "bluebird": "^3.7.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "bd7ce8614076a35769233dd2278216a30c3075c3"
+  "gitHead": "933b2c2856240f2d78b3a392f8a3b4e8584860f0"
 }