@abtnode/router-provider 1.16.43-beta-20250427-232837-e671de06 → 1.16.43-beta-20250430-124448-4edc5502

package/lib/nginx/includes/security/crs4/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf

@@ -207,9 +207,7 @@ SecRule REQUEST_FILENAME "@endsWith /api/gql" \
    nolog,\
    chain"
    SecRule REQUEST_METHOD "@pm POST" \
-       "ctl:ruleRemoveByTag=attack-rce,\
-        ctl:ruleRemoveById=930120,\
-        ctl:ruleRemoveById=921110"
+       "ctl:ruleEngine=Off"
 
 # Disable some rules for websocket endpoint for blocklet server and service
 SecRule REQUEST_FILENAME "@endsWith /websocket" \
@@ -257,9 +255,7 @@ SecRule REQUEST_FILENAME "@endsWith /app-records.txt" \
    nolog,\
    chain"
    SecRule REQUEST_METHOD "@pm PUT" \
-       "ctl:ruleRemoveById=942550,\
-        ctl:ruleRemoveById=942151,\
-        ctl:ruleRemoveById=934110"
+       "ctl:ruleEngine=Off"
 
 # Fix: did resolver false positive
 SecRule REQUEST_FILENAME "@contains /.well-known/did-resolver/resolve" \
@@ -309,10 +305,7 @@ SecRule REQUEST_FILENAME "@contains /api/space/" \
    nolog,\
    chain"
    SecRule REQUEST_METHOD "@pm PUT PATCH DELETE POST" \
-       "ctl:ruleRemoveByTag=attack-rce,\
-        ctl:ruleRemoveByTag=attack-xss,\
-        ctl:ruleRemoveByTag=attack-protocol,\
-        ctl:ruleRemoveByTag=language-php"
+       "ctl:ruleEngine=Off"
 
 # Fix: blocklet store upload false positive
 SecRule REQUEST_FILENAME "@endsWith /api/blocklets/upload" \
@@ -366,3 +359,33 @@ SecRule REQUEST_FILENAME "@endsWith /profile.vcf" \
    chain"
    SecRule REQUEST_METHOD "@pm GET" \
        "ctl:ruleRemoveById=930130"
+
+# Fix: pages-kit data-source false positive
+SecRule REQUEST_FILENAME "@contains /api/data-sources/" \
+   "id:1021,\
+   phase:1,\
+   pass,\
+   nolog,\
+   chain"
+   SecRule REQUEST_METHOD "@pm POST PUT" \
+       "ctl:ruleEngine=Off"
+
+# Fix: payment-kit webhook false positive
+SecRule REQUEST_FILENAME "@endsWith /api/integrations/stripe/webhook" \
+   "id:1022,\
+   phase:1,\
+   pass,\
+   nolog,\
+   chain"
+   SecRule REQUEST_METHOD "@pm POST" \
+       "ctl:ruleEngine=Off"
+
+# Fix: discuss-kit bookmark false positive
+SecRule REQUEST_FILENAME "@endsWith /api/comments" \
+   "id:1023,\
+   phase:1,\
+   pass,\
+   nolog,\
+   chain"
+   SecRule REQUEST_METHOD "@pm POST" \
+       "ctl:ruleRemoveById=921110"

package/lib/nginx/index.js

@@ -209,12 +209,15 @@ class NginxProvider extends BaseProvider {
         conf.nginx.http._add('server_tokens', 'off');
         this._addCommonResHeaders(conf.nginx.http, commonHeaders);
         this._addExposeServices(conf, services);
-        if (requestLimit && requestLimit.enabled) {
+
+        if (requestLimit) {
           this.requestLimit = requestLimit;
           this.addRequestLimiting(conf.nginx.http, requestLimit);
         }
-        if (blockPolicy && blockPolicy?.enabled) {
-          this.updateBlacklist(blockPolicy.blacklist);
+        if (blockPolicy) {
+          this.updateBlacklist(blockPolicy.enabled ? blockPolicy.blacklist : []);
+        } else {
+          this.updateBlacklist([]);
         }
         this.updateProxyPolicy(proxyPolicy);
 
@@ -835,7 +838,10 @@ class NginxProvider extends BaseProvider {
   _getLastLocation(server) {
     const location = server.location.length ? server.location[server.location.length - 1] : server.location;
     if (location && this.requestLimit?.enabled && !location.toString().includes('limit_req')) {
-      location._add('limit_req', `zone=ip_rate_limit burst=${this.requestLimit.burst} delay=10`);
+      location._add(
+        'limit_req',
+        `zone=ip_rate_limit burst=${this.requestLimit.burst} ${this.requestLimit.burstDelay > 0 ? `delay=${this.requestLimit.burstDelay}` : 'nodelay'}`
+      );
       location._add('limit_req', `zone=global_rate_limit burst=${this.requestLimit.burstGlobal} nodelay`);
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abtnode/router-provider",
-  "version": "1.16.43-beta-20250427-232837-e671de06",
+  "version": "1.16.43-beta-20250430-124448-4edc5502",
   "description": "Routing engine implementations for abt node",
   "author": "polunzh <polunzh@gmail.com>",
   "homepage": "https://github.com/ArcBlock/blocklet-server#readme",
@@ -32,10 +32,10 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/constant": "1.16.43-beta-20250427-232837-e671de06",
-    "@abtnode/logger": "1.16.43-beta-20250427-232837-e671de06",
-    "@abtnode/router-templates": "1.16.43-beta-20250427-232837-e671de06",
-    "@abtnode/util": "1.16.43-beta-20250427-232837-e671de06",
+    "@abtnode/constant": "1.16.43-beta-20250430-124448-4edc5502",
+    "@abtnode/logger": "1.16.43-beta-20250430-124448-4edc5502",
+    "@abtnode/router-templates": "1.16.43-beta-20250430-124448-4edc5502",
+    "@abtnode/util": "1.16.43-beta-20250430-124448-4edc5502",
     "@arcblock/http-proxy": "^1.19.1",
     "@arcblock/is-valid-domain": "^1.0.5",
     "axios": "^1.7.9",
@@ -61,5 +61,5 @@
     "bluebird": "^3.7.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "3644f271b67d5ebaa7a8b852173860a005f1d057"
+  "gitHead": "9b59264b5dc2c9450161be5a0ee4cdb981687cd7"
 }