Backend WAF Implementation — Web Application Firewall for Backend APIs

// Application-level WAF middleware
class ApplicationWAF {
  constructor() {
    this.rules = [
      this.sqlInjectionRule(),
      this.xssRule(),
      this.pathTraversalRule(),
      this.commandInjectionRule(),
      this.scannerDetectionRule()
    ];
  }

  sqlInjectionRule() {
    const patterns = [
      /('|")\s*(OR|AND)\s*('|")\s*=/i,
      /UNION\s+ALL\s+SELECT/i,
      /SELECT\s+.*\s+FROM/i,
      /DROP\s+TABLE/i,
      /--\s*$/m,
      /;\s*DROP/i,
      /exec\s*\(/i,
      /xp_cmdshell/i
    ];
    return {
      name: 'SQL Injection',
      check: (input) => patterns.some(p => p.test(input)),
      severity: 'critical',
      action: 'block'
    };
  }

  xssRule() {
    const patterns = [
      /<script[\s>]/i,
      /onerror\s*=/i,
      /onload\s*=/i,
      /javascript\s*:/i,
      /<iframe[\s>]/i,
      /<img[\s>][^>]*onerror/i,
      /document\.cookie/i,
      /eval\s*\(/i
    ];
    return {
      name: 'XSS',
      check: (input) => patterns.some(p => p.test(input)),
      severity: 'high',
      action: 'block'
    };
  }

  pathTraversalRule() {
    const patterns = [
      /\.\.\//, /\.\.\\/,
      /\/etc\/passwd/,
      /\/windows\/system32/i,
      /%2e%2e%2f/i,
      /%c0%ae%c0%ae%c0%af/i
    ];
    return {
      name: 'Path Traversal',
      check: (input) => patterns.some(p => p.test(input)),
      severity: 'high',
      action: 'block'
    };
  }

  commandInjectionRule() {
    const patterns = [
      /;\s*(ls|cat|rm|whoami|id|pwd)/i,
      /\|.*(bash|sh|cmd|powershell)/i,
      /`.*`/,
      /\$\(.*\)/,
      /&\s*(nslookup|ping|curl|wget)/i
    ];
    return {
      name: 'Command Injection',
      check: (input) => patterns.some(p => p.test(input)),
      severity: 'critical',
      action: 'block'
    };
  }

  scannerDetectionRule() {
    const patterns = [
      /(nikto|nmap|sqlmap|dirbuster|gobuster)/i,
      /(acunetix|nessus|openvas)/i,
      /' OR '1'='1/i,
      /waitfor\s+delay/i,
      /pg_sleep/i
    ];
    return {
      name: 'Scanner Detection',
      check: (input) => patterns.some(p => p.test(input)),
      severity: 'high',
      action: 'block'
    };
  }

  inspect(req, res, next) {
    const toCheck = [
      req.query, req.body, req.params,
      req.headers['user-agent'],
      req.headers.referer,
      req.url
    ].filter(Boolean);

    for (const input of toCheck) {
      const str = typeof input === 'string' ? input : JSON.stringify(input);
      for (const rule of this.rules) {
        if (rule.check(str)) {
          logger.warn(`WAF blocked request: ${rule.name}`, {
            ip: req.ip,
            path: req.path,
            rule: rule.name
          });
          return res.status(403).json({
            error: 'BLOCKED',
            message: 'Request blocked by security rules',
            rule: rule.name
          });
        }
      }
    }
    next();
  }
}