Web Application Firewall:Protected objects and protected object groups

Cloud service parameters

SDK-based traffic mirroring parameters

Key-value parsing

JSON data parsing

Based on RFC 7159, the JSON parsing module parses and restructures JSON data — including key-value objects, arrays, strings, and numbers — with syntax validation, type conversion, nested structure processing, and Unicode decoding. This improves WAF's ability to detect malicious content hidden in JSON payloads.

• Input: {"Hello":"World"}

• Output: key: Hello, value: World

XML data parsing

In compliance with the W3C XML specification, the XML parsing module parses elements, attributes, text content, CDATA sections, and processing instructions, with syntax validation, entity reference resolution, and namespace processing. This enhances WAF rule accuracy for XML payloads.

• Input: <Hello attr="desc"><![CDATA[World]]></Hello>

• Output: key: Hello, value: World; key2: Hello.attr, value2: desc

Form data parsing

Based on RFC 1866, the form parsing module parses application/x-www-form-urlencoded data — including key-value parameters, array parameters, file upload fields, and nested structures — with URL decoding and character set handling.

• Input: Hello=World

• Output: key: Hello, value: World

Multipart data parsing

In compliance with RFC 2046, the Multipart parsing module parses multipart/form-data — including file fields, text fields, boundary delimiters, and nested structures — with boundary detection and encoding conversion.

• Input:

  ------WebKitFormBoundary7MA4YWxkTrZu0gW
  Content-Disposition: form-data; name="Hello"
  
  World
  ------WebKitFormBoundary7MA4YWxkTrZu0gW--

• Output: key: Hello, value: World

GraphQL parsing

In compliance with the GraphQL specification, this module parses queries, variable definitions, arguments, and directives — including field selections, query parameters, variable substitutions, aliases, and nested queries — across URL parameters, JSON payloads, raw GraphQL queries, and multipart file upload formats.

• Input: HelloWorld{ desc(Hello:"World"){ Hello } }

• Output: key: Hello, value: World

Decoding

Base64 decoding

Implements the RFC 4648 Base64 decoding algorithm using the standard character set (A–Z, a–z, 0–9, +, /) and the padding character (=), with character validation, padding handling, and byte alignment.

• Input: SGVsbG8gV29scmQh

• Output: Hello World!

HTML entity decoding

Based on the HTML 5.2 specification (W3C Recommendation), decodes numeric character references (&#x;) and named character entities (&).

• Input: Hello World!

• Output: Hello World!

PHP deserialization

Implements the reverse operation of PHP's serialize() function, parsing type identifiers (such as i, s, a, and O), length metadata, and recursive data structures.

• Input: payload=O:5:"Hello":1:{s:4:"desc";s:6:"World!";}

• Output: key: payload.Hello.desc, value: World!

Java deserialization

Based on the Java serialization protocol, implements the reverse operation of ObjectInputStream, parsing class descriptors, field metadata, and object state information in compliance with the JVM serialization specification.

• Input: rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABdAAFSGVsbG90AAZXb3JsZCF4

• Output: extracted Java class: java.util.HashMap

UTF-7 decoding

Based on RFC 2152, processes UTF-7 encoding markers (+/−) and Base64-encoded Unicode character sequences. Suitable for email systems and MIME message transmission scenarios.

• Input: +/v8 +AEgAZQBsAGwAbwAgAFcAbwByAGwAZAAh-

• Output: Hello World!

Unicode decoding

Based on the Unicode standard (ISO/IEC 10646, Unicode 15.0), parses \uXXXX four-byte hexadecimal notation and the \u{XXXXXX} extended format.

• Input: \u0048\u0065\u006c\u006c\u006f\u0020\u0057\u006f\u0072\u006c\u0064\u0021

• Output: Hello World!

URL decoding

Based on RFC 3986, implements the reverse conversion of Percent-Encoding for reserved characters, non-ASCII characters, and special characters in URIs, following the application/x-www-form-urlencoded MIME type specification.

• Input: Hello%20World%21

• Output: Hello World!

Hex decoding

Based on RFC 4648, converts hexadecimal strings to binary data using Big-Endian byte order and the standard hexadecimal character set (0–9, A–F, a–f).

• Input: \x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x21

• Output: Hello World!

Octal decoding

Converts backslash-prefixed octal digits (such as \123) to their corresponding characters using the ASCII lookup table. Supports the standard octal range of 0–377 (0–255 in decimal) and can parse octal escape sequences in mixed text.

• Input: \110\145\154\154\157\040\127\157\162\154\144\041

• Output: Hello World!

Decompression

Gzip decompression

Based on RFC 1952, uses the DEFLATE decompression algorithm with header parsing (magic number 0x1f8b, compression method, flags), CRC32 checksum, and support for stream processing, multi-member files, and error recovery.

• Input: binary file data 1f 8b 08 00 11 39 00 69 00 ff 01 0c 00 f3 ff 48 65 6c 6c 6f 20 57 6f 72 6c 64 21 a3 1c 29 1c 0c 00 00 00 (shown in hexadecimal)

• Output: Hello World!

Preprocessing

Comment stripping

Based on the ANSI SQL standard and MySQL extended syntax, identifies and removes single-line comments (--), multi-line comments (/* */), and MySQL conditional comment syntax (/*! ... */). Removing comments improves WAF accuracy in detecting malicious SQL and reduces the risk of rule bypass via comment injection.

• Input: /*!40101 SET */@OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT ;

• Output: @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT ;

Whitespace compression

Detects and compresses consecutive whitespace characters into a single space, normalizing leading, trailing, and intermediate whitespace for consistent text formatting.

• Input: Hello World!

• Output: Hello World!