}
String parameter = surfaceLocation.getParameter();
String path = surfaceLocation.getPath();
WafRule rule = new WafRule();
rule.setIsNormalRule(false);
rule.setWafRuleDirective(directive);
rule.setNativeId(currentId.toString());
//CSRF is handled on a by-url basis in its own tag
if (GenericVulnerability.CWE_CROSS_SITE_REQUEST_FORGERY.equals(vulnType)) {
rule.setVulnerabilityDesc("CSRF");
rule.setRule("<csrf_urls>" + path + "</csrf_urls>");
return rule;
}
// Possibly turn on Response Scrubbing if CCN or SSN might be present
if (GenericVulnerability.CWE_INFORMATION_EXPOSURE.equals(vulnType) ||
GenericVulnerability.CWE_PRIVACY_VIOLATION.equals(vulnType)) {
for (Finding finding : vulnerability.getFindings()) {
if (finding != null && finding.getChannelVulnerability() != null &&
finding.getChannelVulnerability().getName()!= null &&
(finding.getChannelVulnerability().getName().contains("Credit Card") ||
finding.getChannelVulnerability().getName().contains("Social Security"))) {
rule.setRule("Response Scrubbing");
return rule;
}
}
return null;
}
// Possibly turn on Illegal methods
// TODO improve detection of these vulns
if (GenericVulnerability.CWE_GENERIC_INJECTION.equals(vulnType) ||
GenericVulnerability.CWE_DEBUG_CODE.equals(vulnType)) {
for (Finding finding : vulnerability.getFindings()) {
if (finding != null && finding.getChannelVulnerability() != null &&
finding.getChannelVulnerability().getName()!= null &&
finding.getChannelVulnerability().getName().contains("HTTP Method")) {
rule.setRule("Illegal Method");
return rule;
}
}
return null;
}
// The general case: set the path, parameter, and type
if (path != null && (parameter != null || GenericVulnerability.CWE_FILE_UPLOAD.equals(vulnType))) {
rule.setParameter(parameter);
rule.setPath(path);
rule.setRule("BIG-IP");
rule.setVulnerabilityDesc(vulnType);
return rule;
}
return null;
}