id: http-block-command-injection-markers
name: Block command injection markers
protocol: http
description: Rejects obvious shell metacharacters and command-substitution markers.
category: http
family: web-hardening
tags:
- command-injection
- web
- block
action: block
summary: Rejects obvious shell metacharacters and command-substitution markers.
behavior: Scans URL and body for shell-style injection markers, logs the first hit,
  and drops the client connection.
source_url: https://docs.mitmproxy.org/stable/addons/examples/
code: |
  import logging

  from mitmproxy import http

  BLOCKED_MARKERS = (";", "&&", "||", "$(", "`", "|sh", "|bash")


  def request(flow: http.HTTPFlow) -> None:
      body = flow.request.get_text(strict=False)
      haystack = "\n".join(
          [flow.request.pretty_url, body]
      ).lower()
      for marker in BLOCKED_MARKERS:
          if marker in haystack:
              logging.warning(
                  "[http-block-command-injection-markers] blocked marker=%r url=%s",
                  marker,
                  flow.request.pretty_url,
              )
              flow.kill()
              return