consider spam requests probing for version 2.3's security problems
Massimo Melina committed
Jun 10, 2024 at 01:01 UTC
828396538a4c7a72c67d1b3d178ff6e0de4045d6
1 file changed
+3
-2
src/log.ts
+3
-2
@@ -76,8 +76,9 @@ export const logMw: Koa.Middleware = async (ctx, next) => {
76
ctx.state.completed = Promise.race([ once(ctx.res, 'finish'), once(ctx.res, 'close') ])
77
await next()
78
console.debug(ctx.status, ctx.method, ctx.originalUrl)
79
- if (ctx.status === HTTP_NOT_FOUND && !logSpam.get()
80
- && /wlwmanifest.xml$|robots.txt$|\.(php)$|cgi/.test(ctx.path)) {
79
+ if (!logSpam.get()
80
+ && (ctx.querystring.includes('{.exec|')
81
+ || ctx.status === HTTP_NOT_FOUND && /wlwmanifest.xml$|robots.txt$|\.(php)$|cgi/.test(ctx.path))) {
82
events.emit('spam', ctx)
83
return
84
}