Last Updated on 2026-08-14 by william
cloudfalre 好強，透過 DNS 做橘雲之後，還可額外設定 WAF(web application firewall)，但是我還是搞不懂 waf 幹嘛的，於是就問了 gemini AI。
gemini ai 告訴我可以做兩件事，一是阻擋 XSS 攻擊，另一個是阻擋 SQL 注入攻擊。
XSS 設定如下
點選”編輯運算式”
點選”編輯運算式”
點選後輸入以下邏輯
(http.request.uri.query contains "<script") or (http.request.uri.query contains "javascript:") or (http.request.uri.query contains "onload=") or (http.request.uri.query contains "onerror=") or (
(lower(http.request.uri.query) contains "<script") or
(lower(http.request.uri.query) contains "%3cscript") or
(lower(http.request.uri.query) contains "javascript:") or
(lower(http.request.uri.query) contains "%3ajavascript:")
)SQL 設定如下
點選”編輯運算式”
點選後輸入以下邏輯
(http.request.uri.query contains "union" and http.request.uri.query contains "select") or (http.request.uri.query contains "or" and http.request.uri.query contains "1=1") or (http.request.uri.query contains "waitfor" and http.request.uri.query contains "delay") or (http.request.uri.query contains "sysdatabases") or (http.request.uri.query contains "information_schema")
簡單測試，輸入以下連結，就會被擋下來
https://xxx.com/test=<script>alert('XSS')</script>
搶先發佈留言