# SPDX-License-Identifier: AGPL-3.0-only
# GENERATED by bin/gen-http-lists.py — edit the data file and
# regenerate, never this file.
#
# An XSS probe in the query string (raw tags, javascript:,
# alert()…).
# Data from the CrowdSec hub (MIT). Matched in the query string only,
# case-insensitively, whatever the status: a request that SUCCEEDED
# with one of these in it is the worst case, not the innocent one.
parser: http-xss-probe
log: http
prefilter_any:
  - "<img"
  - "<svg"
  - "<script"
  - "<div"
  - "<a"
  - "<embed"
  - "<style"
  - "javascript:"
  - "alert("
  - "prompt("
  - "<br"
  - "<input"
  - "<table"
  - "<object"
  - "<body"
  - "<p"
  - "<meta"
  - "<frameset"
  - "%3Cimg"
  - "%3Cscript"
  - "%3Cdiv"
  - "%3Ca"
  - "%3Cembed"
  - "%3Cstyle"
  - "javascript%3A"
  - "alert%28"
  - "prompt%28"
  - "%3Cbr"
  - "%3Cinput"
  - "%3Ctable"
  - "%3Cobject"
  - "%3Cbody"
  - "%3Cp"
  - "%3Cmeta"
  - "%3Cframeset"
  - "%3Csvg"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*)\?(?P<query>[^ "]*(?i:<img|<svg|<script|<div|<a|<embed|<style|javascript:|alert\(|prompt\(|<br|<input|<table|<object|<body|<p|<meta|<frameset|%3Cimg|%3Cscript|%3Cdiv|%3Ca|%3Cembed|%3Cstyle|javascript%3A|alert%28|prompt%28|%3Cbr|%3Cinput|%3Ctable|%3Cobject|%3Cbody|%3Cp|%3Cmeta|%3Cframeset|%3Csvg)[^ "]*) [^"]*" \d{3} \d+ "[^"]*" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
