waf_run_self_tests

Instructions

Implementation Reference

• src/waf_mcp/server.py:105-108 (handler)

  The MCP tool handler registered via @mcp.tool decorator. Calls WAFEngine.test_detection() which runs built-in test cases.

  @mcp.tool
  def waf_run_self_tests() -> List[Dict[str, Any]]:
      """运行内置 SQLi/XSS/命令注入/路径遍历样例，用于快速验证引擎是否检出攻击。"""
      return _get_engine().test_detection()

• src/waf_mcp/server.py:105-107 (registration)

  Registration of the tool via the @mcp.tool decorator on FastMCP instance.

  @mcp.tool
  def waf_run_self_tests() -> List[Dict[str, Any]]:
      """运行内置 SQLi/XSS/命令注入/路径遍历样例，用于快速验证引擎是否检出攻击。"""

• src/waf_mcp/waf_engine.py:151-213 (helper)

  The WAFEngine.test_detection() helper method. Runs 4 built-in test cases (SQLi, XSS, CMDi, LFI) against the engine and returns detection results.

  def test_detection(self) -> List[Dict]:
      """测试WAF引擎检测能力"""
      test_cases = [
          {
              "name": "SQL注入测试",
              "request": {
                  "url": "http://example.com/login?id=1' OR '1'='1",
                  "method": "GET",
                  "headers": {"User-Agent": "Mozilla/5.0"},
                  "body": "",
                  "query_string": "id=1' OR '1'='1"
              },
              "expected": "sqli"
          },
          {
              "name": "XSS攻击测试",
              "request": {
                  "url": "http://example.com/search?q=<script>alert('xss')</script>",
                  "method": "GET",
                  "headers": {},
                  "body": "",
                  "query_string": "q=<script>alert('xss')</script>"
              },
              "expected": "xss"
          },
          {
              "name": "命令注入测试",
              "request": {
                  "url": "http://example.com/ping?host=127.0.0.1;cat /etc/passwd",
                  "method": "GET",
                  "headers": {},
                  "body": "",
                  "query_string": "host=127.0.0.1;cat /etc/passwd"
              },
              "expected": "cmdi"
          },
          {
              "name": "路径遍历测试",
              "request": {
                  "url": "http://example.com/file?path=../../../etc/passwd",
                  "method": "GET",
                  "headers": {},
                  "body": "",
                  "query_string": "path=../../../etc/passwd"
              },
              "expected": "lfi"
          }
      ]
      
      results = []
      for test in test_cases:
          alerts = self.check_request(test["request"])
          detected = len(alerts) > 0
          
          results.append({
              "test_name": test["name"],
              "expected": test["expected"],
              "detected": detected,
              "alert_count": len(alerts),
              "alerts": alerts if detected else []
          })
      
      return results