feat(waf): CRS-Regel-Beschreibungen als Tooltip — v1.2.81
~250 CRS-Regeln (Setup, Scanner, Protocol, IP-Reputation, LFI, RFI, RCE, PHP/Node.js/Java Injection, XSS, SQLi, Session-Fixation, Data-Leakage). Rule-ID-Tag in Alerts-Tabelle + Ausnahmen-Liste zeigt Tooltip bei Hover. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
351
management-ui/src/pages/WAF/crsRules.ts
Normal file
351
management-ui/src/pages/WAF/crsRules.ts
Normal file
@@ -0,0 +1,351 @@
|
||||
/**
|
||||
* OWASP Core Rule Set (CRS) v4.x — rule descriptions.
|
||||
* Source: https://coreruleset.org / CRS GitHub
|
||||
* Static map: rule_id → short description (EN).
|
||||
* New rules added per CRS release; update this file when upgrading CRS.
|
||||
*/
|
||||
export const CRS_RULES: Record<number, string> = {
|
||||
// ── 900xxx Setup ───────────────────────────────────────────────────────
|
||||
900000: 'CRS: Set paranoia level',
|
||||
900001: 'CRS: Set anomaly thresholds',
|
||||
900110: 'CRS: Anomaly scoring threshold configuration',
|
||||
900200: 'CRS: Allowed HTTP versions',
|
||||
900220: 'CRS: Allowed request content types',
|
||||
|
||||
// ── 901xxx Initialization ──────────────────────────────────────────────
|
||||
901001: 'CRS: Version check — unsupported CRS version',
|
||||
901100: 'CRS: Anomaly scoring initialization',
|
||||
|
||||
// ── 903xxx / 905xxx Protocol enforcement ──────────────────────────────
|
||||
903100: 'Protocol enforcement: missing Host header',
|
||||
905100: 'Protocol enforcement: HTTP/0.9 request',
|
||||
|
||||
// ── 910xxx IP reputation ───────────────────────────────────────────────
|
||||
910100: 'IP reputation: client IP in GeoIP blocklist',
|
||||
910110: 'IP reputation: client IP in DNSBL blocklist',
|
||||
910120: 'IP reputation: Sqli/XSS IP reputation',
|
||||
910130: 'IP reputation: Spamhaus DROP list',
|
||||
910150: 'IP reputation: project Honeypot',
|
||||
910160: 'IP reputation: project Honeypot — comment spammer',
|
||||
910170: 'IP reputation: project Honeypot — suspicious IP',
|
||||
910180: 'IP reputation: known scanners/hacking tool IP',
|
||||
|
||||
// ── 911xxx Method enforcement ──────────────────────────────────────────
|
||||
911100: 'Method not allowed for this resource',
|
||||
|
||||
// ── 912xxx DoS / rate limiting ─────────────────────────────────────────
|
||||
912120: 'DoS: too many requests from single IP',
|
||||
|
||||
// ── 913xxx Scanner detection ───────────────────────────────────────────
|
||||
913100: 'Scanner: security scanner User-Agent detected',
|
||||
913101: 'Scanner: scripting/generic HTTP client User-Agent',
|
||||
913102: 'Scanner: web crawler/bot User-Agent',
|
||||
913110: 'Scanner: request header associated with security scanner',
|
||||
913120: 'Scanner: request filename/argument associated with scanner',
|
||||
|
||||
// ── 920xxx Protocol enforcement (request) ─────────────────────────────
|
||||
920100: 'Protocol: invalid HTTP request line',
|
||||
920120: 'Protocol: attempted multipart/form-data bypass',
|
||||
920121: 'Protocol: attempted multipart/form-data bypass (2)',
|
||||
920130: 'Protocol: failed to parse request body',
|
||||
920140: 'Protocol: multipart request body failed strict validation',
|
||||
920160: 'Protocol: Content-Length HTTP header is not numeric',
|
||||
920170: 'Protocol: GET/HEAD request with body content',
|
||||
920171: 'Protocol: GET/HEAD request with Transfer-Encoding',
|
||||
920180: 'Protocol: POST request missing Content-Length or Transfer-Encoding',
|
||||
920181: 'Protocol: Content-Length and Transfer-Encoding headers present',
|
||||
920190: 'Protocol: range header contains an invalid last byte value',
|
||||
920200: 'Protocol: range header contains too many fields',
|
||||
920201: 'Protocol: range header contains too many fields for PDF request',
|
||||
920210: 'Protocol: multiple/conflicting connection header data',
|
||||
920220: 'Protocol: URL encoding abuse attack attempt',
|
||||
920230: 'Protocol: multiple URL encoding detected',
|
||||
920240: 'Protocol: URL encoding abuse in request headers',
|
||||
920250: 'Protocol: UTF8 encoding abuse attack attempt',
|
||||
920260: 'Protocol: Unicode full/half width abuse attack attempt',
|
||||
920270: 'Protocol: invalid character in request (null character)',
|
||||
920271: 'Protocol: invalid character in request (non-printable)',
|
||||
920272: 'Protocol: invalid character in request (outside printable ASCII)',
|
||||
920273: 'Protocol: invalid character in request (outside very strict range)',
|
||||
920274: 'Protocol: invalid character in request headers (outside very strict range)',
|
||||
920280: 'Protocol: request missing Host header',
|
||||
920290: 'Protocol: empty Host header',
|
||||
920300: 'Protocol: request missing Accept header',
|
||||
920310: 'Protocol: request has empty Accept header',
|
||||
920311: 'Protocol: request has empty Accept header (2)',
|
||||
920320: 'Protocol: request missing User-Agent header',
|
||||
920330: 'Protocol: empty User-Agent header',
|
||||
920340: 'Protocol: request with content but no Content-Type header',
|
||||
920341: 'Protocol: request with content requires Content-Type header',
|
||||
920350: 'Protocol: Host header is a numeric IP address',
|
||||
920360: 'Protocol: argument name too long',
|
||||
920370: 'Protocol: argument value too long',
|
||||
920380: 'Protocol: too many arguments in request',
|
||||
920390: 'Protocol: total arguments size exceeded',
|
||||
920400: 'Protocol: uploaded file too large',
|
||||
920410: 'Protocol: total uploaded files size too large',
|
||||
920420: 'Protocol: request content type is not allowed',
|
||||
920430: 'Protocol: HTTP protocol version not allowed',
|
||||
920440: 'Protocol: URL file extension restricted by policy',
|
||||
920450: 'Protocol: HTTP header is restricted by policy',
|
||||
920460: 'Protocol: abnormal escape character in request',
|
||||
920470: 'Protocol: illegal Content-Type header',
|
||||
920480: 'Protocol: request Content-Type charset restricted',
|
||||
920500: 'Protocol: attempt to access a backup or working file',
|
||||
920510: 'Protocol: file extension blocked for security reasons',
|
||||
920520: 'Protocol: missing or invalid "nonce" value in request',
|
||||
|
||||
// ── 921xxx HTTP request smuggling ─────────────────────────────────────
|
||||
921100: 'Request smuggling: HTTP request smuggling attack',
|
||||
921110: 'Request smuggling: HTTP request smuggling in request headers',
|
||||
921120: 'Request smuggling: HTTP response splitting attack',
|
||||
921130: 'Request smuggling: HTTP response splitting attack (2)',
|
||||
921140: 'Request smuggling: HTTP header injection via headers',
|
||||
921150: 'Request smuggling: HTTP header injection via parameters (CR/LF)',
|
||||
921151: 'Request smuggling: HTTP header injection via parameters (CR/LF, 2)',
|
||||
921160: 'Request smuggling: HTTP splitting (CR/LF and header-name found)',
|
||||
921170: 'Request smuggling: HTTP parameter pollution',
|
||||
921180: 'Request smuggling: HTTP parameter pollution (matched var found)',
|
||||
|
||||
// ── 922xxx File upload ─────────────────────────────────────────────────
|
||||
922100: 'File upload: multipart bypass in Content-Disposition',
|
||||
922110: 'File upload: multipart bypass in Content-Type',
|
||||
922120: 'File upload: filename contains null character',
|
||||
922130: 'File upload: filename contains newline',
|
||||
|
||||
// ── 930xxx LFI — local file inclusion ─────────────────────────────────
|
||||
930100: 'LFI: path traversal attack (/../)',
|
||||
930110: 'LFI: path traversal attack (/../) with special chars',
|
||||
930120: 'LFI: OS file access attempt',
|
||||
930130: 'LFI: restricted file access attempt',
|
||||
|
||||
// ── 931xxx RFI — remote file inclusion ───────────────────────────────
|
||||
931100: 'RFI: possible remote file inclusion (URL parameter)',
|
||||
931110: 'RFI: common RFI vulnerable parameter name + off-domain URL',
|
||||
931120: 'RFI: possible remote file inclusion (trailing question mark)',
|
||||
931130: 'RFI: possible remote file inclusion (off-domain reference)',
|
||||
|
||||
// ── 932xxx RCE — remote code execution ───────────────────────────────
|
||||
932100: 'RCE: Unix command injection',
|
||||
932105: 'RCE: Unix command injection (2)',
|
||||
932106: 'RCE: Unix command injection (3)',
|
||||
932110: 'RCE: Windows command injection',
|
||||
932115: 'RCE: Windows command injection (2)',
|
||||
932120: 'RCE: Windows PowerShell command',
|
||||
932130: 'RCE: Unix shell expression found',
|
||||
932140: 'RCE: Windows FOR/IF command',
|
||||
932150: 'RCE: Direct Unix command execution',
|
||||
932160: 'RCE: Unix shell code found',
|
||||
932170: 'RCE: Shellshock (CVE-2014-6271)',
|
||||
932171: 'RCE: Shellshock (CVE-2014-6271, 2)',
|
||||
932180: 'RCE: restricted file upload attempted',
|
||||
932190: 'RCE: generic code injection attempt',
|
||||
932200: 'RCE: Unix shell bypass technique',
|
||||
932205: 'RCE: Unix shell bypass technique (2)',
|
||||
932206: 'RCE: Unix shell bypass technique (3)',
|
||||
932210: 'RCE: Unix shell bypass via env variable',
|
||||
932220: 'RCE: Unix shell injection via backtick',
|
||||
932230: 'RCE: Unix shell bypass with extended glob',
|
||||
932235: 'RCE: Unix shell bypass (5)',
|
||||
932236: 'RCE: Unix shell bypass (6)',
|
||||
932237: 'RCE: Unix shell bypass (7)',
|
||||
932239: 'RCE: Unix shell bypass (8)',
|
||||
932240: 'RCE: Unix shell expression (2)',
|
||||
932250: 'RCE: Unix file read via redirection',
|
||||
932260: 'RCE: Unix command injection (9)',
|
||||
|
||||
// ── 933xxx PHP injection ───────────────────────────────────────────────
|
||||
933100: 'PHP injection: PHP opening tag found',
|
||||
933110: 'PHP injection: PHP script file upload',
|
||||
933111: 'PHP injection: PHP script file upload (2)',
|
||||
933120: 'PHP injection: PHP configuration directive',
|
||||
933130: 'PHP injection: PHP variables found',
|
||||
933131: 'PHP injection: PHP variables found (2)',
|
||||
933140: 'PHP injection: PHP I/O stream found',
|
||||
933150: 'PHP injection: high-risk PHP function name found',
|
||||
933151: 'PHP injection: medium-risk PHP function name found',
|
||||
933160: 'PHP injection: high-risk PHP function call found',
|
||||
933161: 'PHP injection: low-risk PHP function call found',
|
||||
933170: 'PHP injection: PHP object injection',
|
||||
933180: 'PHP injection: variable function call found',
|
||||
933190: 'PHP injection: PHP closing tag found',
|
||||
933200: 'PHP injection: wrapper scheme detected',
|
||||
933210: 'PHP injection: variable function call found (2)',
|
||||
|
||||
// ── 934xxx Node.js injection ───────────────────────────────────────────
|
||||
934100: 'Node.js injection: server-side request forgery attempt',
|
||||
|
||||
// ── 941xxx XSS — cross-site scripting ─────────────────────────────────
|
||||
941100: 'XSS: XSS attack detected via libinjection',
|
||||
941101: 'XSS: XSS attack detected via libinjection (2)',
|
||||
941110: 'XSS: XSS filter — category 1 (script tag)',
|
||||
941120: 'XSS: XSS filter — category 2 (event handler)',
|
||||
941130: 'XSS: XSS filter — category 3 (attribute name)',
|
||||
941140: 'XSS: XSS filter — category 4 (javascript: URI)',
|
||||
941150: 'XSS: XSS filter — category 5 (disallowed HTML)',
|
||||
941160: 'XSS: NoScript XSS InjectionChecker — HTML injection',
|
||||
941170: 'XSS: NoScript XSS InjectionChecker — attribute injection',
|
||||
941180: 'XSS: Node-validator blocklist keywords',
|
||||
941190: 'XSS: IE XSS filters — attack detected (1)',
|
||||
941200: 'XSS: IE XSS filters — attack detected (2)',
|
||||
941210: 'XSS: IE XSS filters — attack detected (3)',
|
||||
941220: 'XSS: IE XSS filters — attack detected (4)',
|
||||
941230: 'XSS: IE XSS filters — attack detected (5)',
|
||||
941240: 'XSS: IE XSS filters — attack detected (6)',
|
||||
941250: 'XSS: IE XSS filters — attack detected (7)',
|
||||
941260: 'XSS: IE XSS filters — attack detected (8)',
|
||||
941270: 'XSS: IE XSS filters — attack detected (9)',
|
||||
941280: 'XSS: IE XSS filters — attack detected (10)',
|
||||
941290: 'XSS: IE XSS filters — attack detected (11)',
|
||||
941300: 'XSS: IE XSS filters — attack detected (12)',
|
||||
941310: 'XSS: US-ASCII malformed encoding XSS filter',
|
||||
941320: 'XSS: possible XSS attack — HTML tag handler',
|
||||
941330: 'XSS: IE XSS filters — attack detected (13)',
|
||||
941340: 'XSS: IE XSS filters — attack detected (14)',
|
||||
941350: 'XSS: UTF-7 encoding XSS — attack detected',
|
||||
941360: 'XSS: JSFuck/Hieroglyphy obfuscated JavaScript',
|
||||
941370: 'XSS: JavaScript global variable found',
|
||||
941380: 'XSS: AngularJS client-side template injection',
|
||||
941390: 'XSS: XSS filter — category 10 (JS global variable)',
|
||||
|
||||
// ── 942xxx SQLi — SQL injection ────────────────────────────────────────
|
||||
942100: 'SQLi: SQL injection attack detected via libinjection',
|
||||
942101: 'SQLi: SQL injection attack detected via libinjection (2)',
|
||||
942110: 'SQLi: SQL injection attack: common injection testing detected',
|
||||
942120: 'SQLi: SQL injection attack: SQL operator detected',
|
||||
942130: 'SQLi: SQL injection attack: SQL tautology detected',
|
||||
942140: 'SQLi: SQL injection attack: common DB names detected',
|
||||
942150: 'SQLi: SQL injection attack',
|
||||
942151: 'SQLi: SQL injection attack (2)',
|
||||
942152: 'SQLi: SQL injection attack (3)',
|
||||
942160: 'SQLi: blind SQL injection test using sleep()/benchmark()',
|
||||
942170: 'SQLi: SQL benchmark and sleep injection attempts',
|
||||
942180: 'SQLi: basic SQL authentication bypass (1)',
|
||||
942190: 'SQLi: SQL code execution and information gathering',
|
||||
942200: 'SQLi: MySQL comment/space-obfuscated injections and backtick',
|
||||
942210: 'SQLi: chained SQL injection (1)',
|
||||
942220: 'SQLi: integer overflow attack',
|
||||
942230: 'SQLi: conditional SQL injection attempts',
|
||||
942240: 'SQLi: MySQL charset switch and MSSQL DoS',
|
||||
942250: 'SQLi: MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections',
|
||||
942251: 'SQLi: HAVING injection',
|
||||
942260: 'SQLi: basic SQL authentication bypass (2)',
|
||||
942270: 'SQLi: basic SQL injection — MySQL/Oracle/MSSQL',
|
||||
942280: 'SQLi: Postgres pg_sleep injection, waitfor delay',
|
||||
942290: 'SQLi: MongoDB SQL injection attempt',
|
||||
942300: 'SQLi: MySQL comments, conditions and ch(a)r injections',
|
||||
942310: 'SQLi: chained SQL injection (2)',
|
||||
942320: 'SQLi: MySQL and PostgreSQL stored procedure injections',
|
||||
942330: 'SQLi: classic SQL injection probings detected (1)',
|
||||
942340: 'SQLi: basic SQL authentication bypass (3)',
|
||||
942350: 'SQLi: MySQL UDF injection and other data/structure manipulation',
|
||||
942360: 'SQLi: concatenated basic SQL injection and SQLLFI attacks',
|
||||
942361: 'SQLi: basic SQL injection based on keyword ALTER or UNION',
|
||||
942370: 'SQLi: classic SQL injection probings detected (2)',
|
||||
942380: 'SQLi: SQL injection attack',
|
||||
942390: 'SQLi: SQL injection attack (2)',
|
||||
942400: 'SQLi: SQL injection attack (3)',
|
||||
942410: 'SQLi: SQL injection attack (4)',
|
||||
942420: 'SQLi: restricted SQL character anomaly detection (cookies)',
|
||||
942421: 'SQLi: restricted SQL character anomaly detection (cookies, 2)',
|
||||
942430: 'SQLi: restricted SQL character anomaly detection (args)',
|
||||
942431: 'SQLi: restricted SQL character anomaly detection (args, 2)',
|
||||
942432: 'SQLi: restricted SQL character anomaly detection (args, 3)',
|
||||
942440: 'SQLi: SQL comment sequence detected',
|
||||
942450: 'SQLi: SQL hex encoding identified',
|
||||
942460: 'SQLi: meta-character anomaly detection alert',
|
||||
942470: 'SQLi: SQL injection attack (5)',
|
||||
942480: 'SQLi: SQL injection attack (6)',
|
||||
942490: 'SQLi: classic SQL injection probings detected (3)',
|
||||
942500: 'SQLi: MySQL inline comment detected',
|
||||
942510: 'SQLi: SQLi bypass attempt via ticks',
|
||||
942511: 'SQLi: SQLi bypass attempt using ticks (2)',
|
||||
942520: 'SQLi: SQL injection attack (7)',
|
||||
942521: 'SQLi: SQL injection attack (8)',
|
||||
942530: 'SQLi: SQL injection attack (9)',
|
||||
942540: 'SQLi: SQL injection attack (10)',
|
||||
942550: 'SQLi: MySQL injection detected',
|
||||
|
||||
// ── 943xxx Session fixation ────────────────────────────────────────────
|
||||
943100: 'Session fixation: possible session fixation attack (cookie values)',
|
||||
943110: 'Session fixation: possible session fixation attack (referrer off-domain)',
|
||||
943120: 'Session fixation: possible session fixation attack (no referrer)',
|
||||
|
||||
// ── 944xxx Java attacks ────────────────────────────────────────────────
|
||||
944100: 'Java: remote command execution via Apache Struts, Oracle WebLogic',
|
||||
944110: 'Java: remote command execution via Java keywords',
|
||||
944120: 'Java: remote command execution — Java deserialization',
|
||||
944130: 'Java: suspicious Java class detected',
|
||||
944200: 'Java: magic bytes indicative of Java serialization',
|
||||
944210: 'Java: Java serialization deserialization gadget (1)',
|
||||
944240: 'Java: remote code execution — Java serialization',
|
||||
944250: 'Java: restricted Java method detected',
|
||||
|
||||
// ── 949xxx Anomaly scoring ─────────────────────────────────────────────
|
||||
949110: 'Anomaly score exceeded: inbound anomaly score (blocking)',
|
||||
949111: 'Anomaly score exceeded: inbound anomaly score (PL2)',
|
||||
|
||||
// ── 950xxx–959xxx Data leakage (response) ─────────────────────────────
|
||||
950100: 'Data leakage: server-side include attack',
|
||||
950130: 'Data leakage: server-side include attack (2)',
|
||||
951100: 'Data leakage: SQL error leakage — MySQL error string',
|
||||
951110: 'Data leakage: SQL error leakage — PostgreSQL error string',
|
||||
951120: 'Data leakage: SQL error leakage — Oracle error string',
|
||||
951130: 'Data leakage: SQL error leakage — MSSQL error string',
|
||||
951140: 'Data leakage: SQL error leakage — MSSQL error string (2)',
|
||||
951150: 'Data leakage: SQL error leakage — MSSQL error string (3)',
|
||||
951160: 'Data leakage: SQL error leakage — SQL syntax error string',
|
||||
951170: 'Data leakage: SQL error leakage — JBoss error string',
|
||||
951180: 'Data leakage: SQL error leakage — Java/EJB error string',
|
||||
951190: 'Data leakage: SQL error leakage — Microsoft Access error string',
|
||||
951200: 'Data leakage: SQL error leakage — Microsoft Access error string (2)',
|
||||
951210: 'Data leakage: SQL error leakage — Oracle error string (2)',
|
||||
951220: 'Data leakage: SQL error leakage — DB2 error string',
|
||||
951230: 'Data leakage: SQL error leakage — EMC error string',
|
||||
951240: 'Data leakage: SQL error leakage — SAP ASE error string',
|
||||
951250: 'Data leakage: SQL error leakage — Sybase error string',
|
||||
951260: 'Data leakage: SQL error leakage — Informix error string',
|
||||
952100: 'Data leakage: Unix shell error leakage',
|
||||
952110: 'Data leakage: Unix shell error leakage (2)',
|
||||
953100: 'Data leakage: PHP error leakage',
|
||||
953110: 'Data leakage: PHP error leakage (2)',
|
||||
953120: 'Data leakage: PHP error leakage (3)',
|
||||
954100: 'Data leakage: IIS information leakage',
|
||||
954110: 'Data leakage: IIS information leakage (2)',
|
||||
954120: 'Data leakage: IIS information leakage (3)',
|
||||
954130: 'Data leakage: IIS information leakage (4)',
|
||||
|
||||
// ── 980xxx Correlation ─────────────────────────────────────────────────
|
||||
980130: 'Correlation: inbound + outbound anomaly score',
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the description for a given rule ID, or a fallback if unknown.
|
||||
*/
|
||||
export function getRuleDescription(ruleId: number): string {
|
||||
return CRS_RULES[ruleId] ?? `Rule ${ruleId} — no description available`
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the rule category name from the rule ID prefix.
|
||||
*/
|
||||
export function getRuleCategory(ruleId: number): string {
|
||||
const prefix = Math.floor(ruleId / 100)
|
||||
const categories: Record<number, string> = {
|
||||
9000: 'CRS Setup', 9001: 'Initialization',
|
||||
9031: 'Scanner', 9050: 'Protocol',
|
||||
9100: 'IP Reputation', 9111: 'Method Enforcement',
|
||||
9121: 'DoS Protection', 9131: 'Scanner Detection',
|
||||
9201: 'Protocol Enforcement', 9211: 'HTTP Smuggling',
|
||||
9221: 'File Upload',
|
||||
9301: 'LFI', 9311: 'RFI', 9321: 'RCE',
|
||||
9331: 'PHP Injection', 9341: 'Node.js Injection',
|
||||
9411: 'XSS', 9421: 'SQL Injection',
|
||||
9431: 'Session Fixation', 9441: 'Java Attack',
|
||||
9491: 'Anomaly Score',
|
||||
9501: 'Response — Data Leakage', 9511: 'Response — SQL Error',
|
||||
9521: 'Response — Unix Shell', 9531: 'Response — PHP Error',
|
||||
9541: 'Response — IIS Error', 9801: 'Correlation',
|
||||
}
|
||||
return categories[prefix] ?? `Category ${Math.floor(ruleId / 1000) * 1000}`
|
||||
}
|
||||
@@ -14,6 +14,7 @@ import apiClient, { isEnvelope } from '../../api/client'
|
||||
import PageHeader from '../../components/PageHeader'
|
||||
import DataTable from '../../components/DataTable'
|
||||
import { useAuthStore } from '../../stores/auth'
|
||||
import { getRuleDescription } from './crsRules'
|
||||
|
||||
const { Text } = Typography
|
||||
|
||||
@@ -201,7 +202,9 @@ function ConfigDrawer({ domainName, domainId, onClose }: ConfigDrawerProps) {
|
||||
padding: '6px 10px', background: '#F8FAFC',
|
||||
border: '1px solid #E2E8F0', borderRadius: 6,
|
||||
}}>
|
||||
<Tag style={{ fontFamily: 'monospace', flexShrink: 0 }}>{ruleId}</Tag>
|
||||
<Tooltip title={getRuleDescription(Number(ruleId))} placement="topLeft">
|
||||
<Tag style={{ fontFamily: 'monospace', flexShrink: 0, cursor: 'help' }}>{ruleId}</Tag>
|
||||
</Tooltip>
|
||||
<Text style={{ fontSize: 12, color: '#475569', flex: 1 }}>
|
||||
{cfg?.exclusion_notes?.[ruleId] || <em style={{ color: '#94A3B8' }}>{t('waf.config.noNote')}</em>}
|
||||
</Text>
|
||||
@@ -371,7 +374,11 @@ function AlertsTab({ domainId }: { domainId?: number }) {
|
||||
{ title: t('waf.alerts.col.uri'), dataIndex: 'uri', key: 'uri', ellipsis: true,
|
||||
render: (v: string) => <Text style={{ fontSize: 11, fontFamily: 'monospace' }}>{v}</Text> },
|
||||
{ title: t('waf.alerts.col.ruleId'), dataIndex: 'rule_id', key: 'rule_id', width: 90,
|
||||
render: (v: number) => <Tag style={{ fontFamily: 'monospace' }}>{v}</Tag> },
|
||||
render: (v: number) => (
|
||||
<Tooltip title={getRuleDescription(v)} placement="topLeft">
|
||||
<Tag style={{ fontFamily: 'monospace', cursor: 'help' }}>{v}</Tag>
|
||||
</Tooltip>
|
||||
) },
|
||||
{ title: t('waf.alerts.col.severity'), dataIndex: 'severity', key: 'severity', width: 90,
|
||||
render: (v: string) => <Tag color={severityColor(v)}>{v || '—'}</Tag> },
|
||||
{ title: t('waf.alerts.col.msg'), dataIndex: 'rule_msg', key: 'rule_msg', ellipsis: true,
|
||||
|
||||
Reference in New Issue
Block a user