module

WafFacade

Shared chrome + helpers for the branded block pages. Kept in a module so the top-level route table stays readable and nothing leaks into the global scope.

Constants

CRS_RULES = {/script/i => 5, /onerror/i => 5, /onload/i => 5, /onmouseover/i => 5, /onclick/i => 5, /javascript:/i => 4, /\balert\b/i => 3, /\beval\b/i => 3, /<\/?\w/ => 1}

OWASP CRS-style anomaly scoring: only the &quot;famous&quot; tokens carry a score, so a payload assembled from low/zero-score primitives stays under the threshold.

Class methods

akamai_block(rid : String) : String
Source
aws_block(rid : String) : String
Source
cloudflare_block(reflected : String, ray : String) : String

NOTE: reflected is inserted RAW on purpose — this block page is the sink.

Source
crs_score(input : String) : Int32
Source
f5_block(rid : String) : String
Source
incapsula_block(rid : String) : String
Source
modsecurity_block(rid : String, score : Int32) : String
Source
ray_id(seed : String) : String

Cloudflare-style lowercase hex ray id, derived deterministically from the request so the same payload always yields the same id (handy in specs).

Source
support_id(seed : String) : String

F5 ASM support ids look like a long decimal string.

Source