Update Paser Log

Author: vncloudsco

.gitignore

@@ -33,3 +33,8 @@ yarn-error.log*
 # typescript
 *.tsbuildinfo
 next-env.d.ts
+log.txt
+lib/__tests__/*
+*.md
+*.mdx
+test-*

lib/rule-generator.ts

@@ -1,6 +1,12 @@
-import { ParsedLog } from './log-parser';
+import { ParsedLog } from "./log-parser";
 
-export type WhitelistLevel = 'global' | 'hostname' | 'uri' | 'method' | 'ip' | 'combined';
+export type WhitelistLevel =
+  | "global"
+  | "hostname"
+  | "uri"
+  | "method"
+  | "ip"
+  | "combined";
 
 export interface WhitelistRule {
   level: WhitelistLevel;
@@ -15,127 +21,134 @@ export interface WhitelistRule {
 
 export function generateWhitelistRules(parsedLog: ParsedLog): WhitelistRule[] {
   const rules: WhitelistRule[] = [];
-  const ruleId = parsedLog.ruleId || '0';
+  const ruleId = parsedLog.ruleId || "0";
 
   // 1. Global whitelist - Disable rule completely (most permissive)
   rules.push({
-    level: 'global',
-    description: 'Disable rule globally (most permissive)',
-    descriptionKey: 'descGlobal',
-    rule: `SecRuleRemoveById ${ruleId}`
+    level: "global",
+    description: "Disable rule globally (most permissive)",
+    descriptionKey: "descGlobal",
+    rule: `SecRuleRemoveById ${ruleId}`,
   });
 
   // 2. Hostname-based whitelist
   if (parsedLog.hostname) {
+    const escapedHostname = escapeModSecString(parsedLog.hostname);
     rules.push({
-      level: 'hostname',
+      level: "hostname",
       description: `Disable rule for hostname: ${parsedLog.hostname}`,
-      descriptionKey: 'descHostname',
+      descriptionKey: "descHostname",
       hostname: parsedLog.hostname,
-      rule: `SecRule REQUEST_HEADERS:Host "@streq ${parsedLog.hostname}" \\
+      rule: `SecRule REQUEST_HEADERS:Host "@rx ^${escapedHostname}$" \\
     "id:${generateCustomId()},\\
     phase:1,\\
     pass,\\
     nolog,\\
-    ctl:ruleRemoveById=${ruleId}"`
+    ctl:ruleRemoveById=${ruleId}"`,
     });
   }
 
   // 3. URI-based whitelist
   if (parsedLog.uri) {
+    const escapedUri = escapeModSecString(parsedLog.uri);
     rules.push({
-      level: 'uri',
+      level: "uri",
       description: `Disable rule for URI: ${parsedLog.uri}`,
-      descriptionKey: 'descUri',
+      descriptionKey: "descUri",
       uri: parsedLog.uri,
-      rule: `SecRule REQUEST_URI "@streq ${parsedLog.uri}" \\
+      rule: `SecRule REQUEST_URI "@rx ^${escapedUri}" \\
     "id:${generateCustomId()},\\
     phase:1,\\
     pass,\\
     nolog,\\
-    ctl:ruleRemoveById=${ruleId}"`
+    ctl:ruleRemoveById=${ruleId}"`,
     });
   }
 
   // 4. Request Method-based whitelist
   if (parsedLog.requestMethod) {
     rules.push({
-      level: 'method',
+      level: "method",
       description: `Disable rule for method: ${parsedLog.requestMethod}`,
-      descriptionKey: 'descMethod',
+      descriptionKey: "descMethod",
       method: parsedLog.requestMethod,
-      rule: `SecRule REQUEST_METHOD "@streq ${parsedLog.requestMethod}" \\
+      rule: `SecRule REQUEST_METHOD "@rx ^${parsedLog.requestMethod}$" \\
     "id:${generateCustomId()},\\
     phase:1,\\
     pass,\\
     nolog,\\
-    ctl:ruleRemoveById=${ruleId}"`
+    ctl:ruleRemoveById=${ruleId}"`,
     });
   }
 
   // 5. IP-based whitelist
   if (parsedLog.clientIp) {
     rules.push({
-      level: 'ip',
+      level: "ip",
       description: `Disable rule for IP: ${parsedLog.clientIp}`,
-      descriptionKey: 'descIp',
+      descriptionKey: "descIp",
       ip: parsedLog.clientIp,
       rule: `SecRule REMOTE_ADDR "@ipMatch ${parsedLog.clientIp}" \\
     "id:${generateCustomId()},\\
     phase:1,\\
     pass,\\
     nolog,\\
-    ctl:ruleRemoveById=${ruleId}"`
+    ctl:ruleRemoveById=${ruleId}"`,
     });
   }
 
   // 6. Combined whitelist - Hostname + URI (recommended)
   if (parsedLog.hostname && parsedLog.uri) {
+    const escapedHostname = escapeModSecString(parsedLog.hostname);
+    const escapedUri = escapeModSecString(parsedLog.uri);
     rules.push({
-      level: 'combined',
+      level: "combined",
       description: `Disable rule for hostname + URI (recommended)`,
-      descriptionKey: 'descCombinedHostUri',
+      descriptionKey: "descCombinedHostUri",
       hostname: parsedLog.hostname,
       uri: parsedLog.uri,
-      rule: `SecRule REQUEST_HEADERS:Host "@streq ${parsedLog.hostname}" \\
+      rule: `SecRule REQUEST_HEADERS:Host "@rx ^${escapedHostname}$" \\
     "id:${generateCustomId()},\\
     phase:1,\\
     pass,\\
     nolog,\\
     chain"
-SecRule REQUEST_URI "@streq ${parsedLog.uri}" \\
-    "ctl:ruleRemoveById=${ruleId}"`
+    SecRule REQUEST_URI "@rx ^${escapedUri}" \\
+        "ctl:ruleRemoveById=${ruleId}"`,
     });
   }
 
   // 7. Combined whitelist - Hostname + URI + Method (most restrictive)
   if (parsedLog.hostname && parsedLog.uri && parsedLog.requestMethod) {
+    const escapedHostname = escapeModSecString(parsedLog.hostname);
+    const escapedUri = escapeModSecString(parsedLog.uri);
     rules.push({
-      level: 'combined',
+      level: "combined",
       description: `Disable rule for hostname + URI + method (most restrictive)`,
-      descriptionKey: 'descCombinedHostUriMethod',
+      descriptionKey: "descCombinedHostUriMethod",
       hostname: parsedLog.hostname,
       uri: parsedLog.uri,
       method: parsedLog.requestMethod,
-      rule: `SecRule REQUEST_HEADERS:Host "@streq ${parsedLog.hostname}" \\
+      rule: `SecRule REQUEST_HEADERS:Host "@rx ^${escapedHostname}$" \\
     "id:${generateCustomId()},\\
     phase:1,\\
     pass,\\
     nolog,\\
     chain"
-SecRule REQUEST_URI "@streq ${parsedLog.uri}" \\
-    "chain"
-SecRule REQUEST_METHOD "@streq ${parsedLog.requestMethod}" \\
-    "ctl:ruleRemoveById=${ruleId}"`
+    SecRule REQUEST_URI "@rx ^${escapedUri}" \\
+        "chain"
+    SecRule REQUEST_METHOD "@rx ^${parsedLog.requestMethod}$" \\
+        "ctl:ruleRemoveById=${ruleId}"`,
     });
   }
 
   // 8. Combined whitelist - IP + URI
   if (parsedLog.clientIp && parsedLog.uri) {
+    const escapedUri = escapeModSecString(parsedLog.uri);
     rules.push({
-      level: 'combined',
+      level: "combined",
       description: `Disable rule for IP + URI`,
-      descriptionKey: 'descCombinedIpUri',
+      descriptionKey: "descCombinedIpUri",
       ip: parsedLog.clientIp,
       uri: parsedLog.uri,
       rule: `SecRule REMOTE_ADDR "@ipMatch ${parsedLog.clientIp}" \\
@@ -144,14 +157,20 @@ SecRule REQUEST_METHOD "@streq ${parsedLog.requestMethod}" \\
     pass,\\
     nolog,\\
     chain"
-SecRule REQUEST_URI "@streq ${parsedLog.uri}" \\
-    "ctl:ruleRemoveById=${ruleId}"`
+    SecRule REQUEST_URI "@rx ^${escapedUri}" \\
+        "ctl:ruleRemoveById=${ruleId}"`,
     });
   }
 
   return rules;
 }
 
+// Escape special regex characters for ModSecurity
+function escapeModSecString(str: string): string {
+  // Escape special regex characters
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // Generate a custom rule ID in range 88,000,000 - 89,999,999
 // This range ensures no conflicts with existing ModSecurity rules
 const MIN_CUSTOM_ID = 88000000;