Module waf 

WAF-lite heuristic filtering (DW-051).

A lightweight, pattern-matching web application filter that inspects the request path, query string, selected headers, and body (when JSON or form-urlencoded) for common SQL-injection, XSS, and path-traversal signatures. This is NOT a full WAF — it is a first-line traffic filter that rejects obvious attack signatures before authentication or rate limiting.

Request-path position

The WAF check runs AFTER the route method allowlist and BEFORE the route limits (DW-027): a content filter that should reject malicious requests before any resource is spent on auth or rate limiting. It inspects the ORIGINAL request (before path rewrite / transforms).

Inspection targets

• Path: the original request URI path (after routing match, before rewrite).
• Query string: the raw query string.
• Headers: User-Agent, Referer, Cookie, X-Forwarded-For.
• Body: when the content type is application/json or application/x-www-form-urlencoded, up to max_body_inspect_bytes.

Match result

A WafMatch carries the filter category, the pattern that matched, the inspection target, and a truncated value preview (max 64 chars — never the full payload, which could be huge or sensitive). In dry_run mode the match is logged and the request continues; otherwise a 403 waf_blocked error envelope is returned.

Structs

BodyInspectionResult

The outcome of body inspection: either a match was found (and the body is reconstructed for forwarding), or no match was found. The reconstructed body is a concrete type so the caller can continue the request path regardless of the original body’s type.

CompiledCrsRule

A compiled CRS rule: the compiled regex, metadata, and the resolved target set. Built once per config generation.

CrsGeneration

A compiled CRS WAF generation: the rule set, exclusions, and anomaly threshold. Built once per config generation.

CrsResult

The result of CRS evaluation: the total anomaly score and the list of matching rule IDs (for logging).

WafGeneration

A compiled WAF generation: the regex sets for each enabled filter category, plus any custom patterns. Built once per config generation and reused across requests.

WafMatch

A WAF match result: the filter, pattern, target, and a truncated value preview for logging. The preview is capped at 64 chars and never carries the full payload (which could be huge or sensitive).

Enums

WafBody

A body that replays buffered bytes (inspected by the WAF) then streams the remaining original body. When the entire body fit within the inspection cap, rest is None and the body is fully buffered.

WafFilter

The filter category a matched pattern belongs to.

WafTarget

The inspection target where a match was found.

Functions

crs_from_gateway

Build a CRS generation from the gateway config (if the global WAF is enabled). Convenience wrapper for the proxy path.

inspect_body

Inspect the request body for WAF signatures. Buffers up to max_body_inspect_bytes from the body, runs the pattern match on the buffered slice, and returns the reconstructed body for forwarding. When the body exceeds the cap, only the prefix is inspected (a malicious payload beyond the cap is not caught — the trade-off for a bounded inspection cost).

should_inspect_body

The headers that signal a body worth inspecting: JSON or form-urlencoded content types.