id: http-block-sqli-markers
name: Block obvious SQLi markers
protocol: http
description: Stops common SQL injection probes before they reach the app.
category: http
family: web-hardening
tags:
- sqli
- web
- block
action: block
summary: Stops common SQL injection probes before they reach the app.
behavior: Matches a short list of high-signal SQLi markers in path, query, and body,
  then serves a blank HTML page and logs the hit.
source_url: https://docs.mitmproxy.org/stable/addons/examples/
code: |
  import logging

  from mitmproxy import http

  BLOCKED_MARKERS = (
      "' or 1=1",
      '" or 1=1',
      "union select",
      "sleep(",
      "information_schema",
      "--",
  )


  def request(flow: http.HTTPFlow) -> None:
      body = flow.request.get_text(strict=False)
      haystack = "\n".join(
          [flow.request.path, str(flow.request.query), body]
      ).lower()
      for marker in BLOCKED_MARKERS:
          if marker in haystack:
              logging.warning(
                  "[http-block-sqli-markers] blocked marker=%r url=%s",
                  marker,
                  flow.request.pretty_url,
              )
              flow.response = http.Response.make(
                  200,
                  b"",
                  {"content-type": "text/html; charset=utf-8"},
              )
              return