.htaccess安assembly置

这里是我编译的.htaccess的安全性。你看到有什么问题需要纠正吗？

这里有什么可能会搞砸一个合法的网站吗？

我是否涵盖了所有的基础知识？

RewriteEngine on Options +SymLinksIfOwnerMatch Options -Indexes # disable the server signature ServerSignature Off <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / # mysql related RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR] RewriteCond %{QUERY_STRING} (order).*(by).*(\%[0-9A-Z]{0,2}) [NC,OR] RewriteCond %{QUERY_STRING} (waitfor|delay|shutdown).*(nowait) [NC,OR] RewriteCond %{QUERY_STRING} (union|and|\^).*(select).*(ascii\(|bin\(|benchmark\(|cast\(|char\(|charset\(|collation\(|concat\(|concat_ws\(|table_schema) [NC,OR] RewriteCond %{QUERY_STRING} (union|and|\^).*(select).*(conv\(|convert\(|count\(|database\(|decode\(|diff\(|distinct\(|elt\(}encode\(|encrypt\(|extract\() [NC,OR] RewriteCond %{QUERY_STRING} (union|and|\^).*(select).*(field\(|floor\(|format\(|from|hex\(|if\(|in\(|information_schema|insert\(|instr\(|interval\(|lcase\() [NC,OR] RewriteCond %{QUERY_STRING} (union|and|\^).*(select).*(left\(|length\(|load_file\(|locate\(|lock\(|log\(|lower\(|lpad\(|ltrim\(|max\(|md5\(|mid\() [NC,OR] RewriteCond %{QUERY_STRING} (union|and|\^).*(select).*(mod\(|now\(|null\(|ord\(|password\(|position\(|quote\(|rand\(|repeat\(|replace\(|reverse\() [NC,OR] RewriteCond %{QUERY_STRING} (union|and|\^).*(select).*(right\(|rlike\(|row_count\(|rpad\(|rtrim\(|_set\(|schema\(|sha1\(|sha2\(|sleep\(|soundex\() [NC,OR] RewriteCond %{QUERY_STRING} (union|and|\^).*(select).*(space\(|strcmp\(|substr\(|substr_index\(|substring\(|sum\(|time\(|trim\(|truncate\(|ucase\() [NC,OR] RewriteCond %{QUERY_STRING} (union|and|\^).*(select).*(unhex\(|upper\(|_user\(|user\(|values\(|varchar\(|version\(|xor\() [NC,OR] # cookies RewriteCond %{HTTP_COOKIE} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR] RewriteCond %{HTTP_COOKIE} (eval\%28|eval\%2528|eval\(|information_schema) [NC,OR] RewriteCond %{HTTP_COOKIE} union([^a]*a)+ll([^s]*s)+elect [NC,OR] RewriteCond %{HTTP_COOKIE} (union|and|\^).*(select).*(ascii\(|bin\(|benchmark\(|cast\(|char\(|charset\(|collation\(|concat\(|concat_ws\(|table_schema) [NC,OR] RewriteCond %{HTTP_COOKIE} (union|and|\^).*(select).*(conv\(|convert\(|count\(|database\(|decode\(|diff\(|distinct\(|elt\(}encode\(|encrypt\(|extract\() [NC,OR] RewriteCond %{HTTP_COOKIE} (union|and|\^).*(select).*(field\(|floor\(|format\(|from|hex\(|if\(|in\(|information_schema|insert\(|instr\(|interval\(|lcase\() [NC,OR] RewriteCond %{HTTP_COOKIE} (union|and|\^).*(select).*(left\(|length\(|load_file\(|locate\(|lock\(|log\(|lower\(|lpad\(|ltrim\(|max\(|md5\(|mid\() [NC,OR] RewriteCond %{HTTP_COOKIE} (union|and|\^).*(select).*(mod\(|now\(|null\(|ord\(|password\(|position\(|quote\(|rand\(|repeat\(|replace\(|reverse\() [NC,OR] RewriteCond %{HTTP_COOKIE} (union|and|\^).*(select).*(right\(|rlike\(|row_count\(|rpad\(|rtrim\(|_set\(|schema\(|sha1\(|sha2\(|sleep\(|soundex\() [NC,OR] RewriteCond %{HTTP_COOKIE} (union|and|\^).*(select).*(space\(|strcmp\(|substr\(|substr_index\(|substring\(|sum\(|time\(|trim\(|truncate\(|ucase\() [NC,OR] RewriteCond %{HTTP_COOKIE} (union|and|\^).*(select).*(unhex\(|upper\(|_user\(|user\(|values\(|varchar\(|version\(|xor\() [NC,OR] # LFI and session hijacking RewriteCond %{QUERY_STRING} \=(\.\./\.\.//?)+ [OR] RewriteCond %{QUERY_STRING} \=(\.\.//\./?)+ [OR] RewriteCond %{QUERY_STRING} \=(\.\.\\\.\./?)+ [OR] RewriteCond %{QUERY_STRING} \=(\.\.\\\\\./?)+ [OR] RewriteCond %{QUERY_STRING} \/tmp\/sess_ [NC,OR] RewriteCond %{QUERY_STRING} php:\/\/filter\/read=convert\.base64-(en|de)code\/ [NC,OR] # BAD UAS RewriteCond %{HTTP_USER_AGENT} @nonymouse|ADSARobot|amzn_assoc|Anarchie|ASPSeek|Atomz|^[^?]*addresses\.com|Advanced\ Email\ Extractor|ah-ha|aktuelles|almaden|Art-Online|AspiWeb|ASSORT|ATHENS|attach|attache|autoemailspider|BackWeb|Bandit|BatchFTP|bdfetch|big.brother|BlackWidow|bmclient|Boston\ Project|Bot\ mailto:[email protected]|BravoBrian\ SpiderEngine\ MarcoPolo|Buddy|Bullseye|bumblebee|capture|CherryPicker|ChinaClaw|CICC|clipping|Crescent\ Internet\ ToolPack|cURL|Custo|cyberalert|Deweb|diagem|Digger|Digimarc|DIIbot|DirectUpdate|DISCo|Download\ Accelerator|Download\ Demon|Download\ Wonder|Downloader|Drip|DSurf15a|DTS.Agent|EasyDL|eCatch|echo\ extense|ecollector|efp@gmx\.net|EirGrabber|EmailCollector|Email\ Extractor|EmailSiphon|EmailWolf|Express\ WebPictures|ExtractorPro|EyeNetIE|fastlwspider|FavOrg|Favorites\ Sweeper|Fetch\ API\ Request|FEZhead|FileHound|FlashGet|FlickBot|fluffy|frontpage|GalaxyBot|Generic|Getleft|GetRight|GetSmart|GetWeb!|GetWebPage|gigabaz|Girafabot|Go!Zilla|Go-Ahead-Got-It|GornKer|Grabber|GrabNet|Grafula|Green\ Research|Harvest|hhjhj@yahoo|hloader|HMView|HomePageSearch|HTTP\ agent|HTTPConnect|httpdown|http\ generic|HTTrack|^[^?]*iaea\.org|IBM_Planetwide|^[^?]*\.ideography\.co\.uk|Image\ Stripper|Image\ Sucker|imagefetch|IncyWincy|Indy\ Library|informant|Ingelin|InterGET|Internet\ Ninja|InternetLinkAgent|InternetSeer\.com|Iria|Irvine|iOpus|IPiumBot\ laurion(dot)com|Jakarta|JBH*Agent|JetCar|JustView|Kapere|KWebGet|Lachesis|larbin|LeechFTP|LexiBot|lftp|libwww|likse|Link*Sleuth|LINKS\ ARoMATIZED|LinkWalker|LWP|lwp-trivial|Magnet|Mac\ Finder|Mag-Net|Mass\ Downloader|MemoWeb|MCspider|Microsoft\ URL\ Control|MIDown\ tool|minibot\(NaverRobot\)|Mirror|Missigua\ Locator|Mister\ PiX|MMMtoCrawl\/UrlDispatcherLLL|MSProxy|multithreaddb|nationaldirectory|Navroad|NearSite|NetAnts|NetCarta|netfactual|netcraft|NetMechanic|netprospector|NetResearchServer|NetSpider|Net\ Vampire|NetZIP|NEWT|nicerspro|NPBot|Octopus|Offline\ Explorer|Offline\ Navigator|OpaL|Openfind|OpenTextSiteCrawler|OutWit|PackRat|PageGrabber|Papa\ Foto|pavuk|pcBrowser|PersonaPilot|PingALink|Pockey|Program\ Shareware|psbot|PSurf|puf|Pump|PushSite|QRVA|QuepasaCreep|RealDownload|Reaper|Recorder|ReGet|replacer|RepoMonkey|Robozilla|Rover|RPT-HTTPClient|Rsync|SearchExpress|searchhippo|searchterms\.it|Second\ Street\ Research|Shai|sitecheck|SiteMapper|SiteSnagger|SlySearch|SmartDownload|snagger|SpaceBison|Spegla|SpiderBot|SqWorm|Star\ Downloader|Stripper|Sucker|SuperBot|SuperHTTP|Surfbot|SurfWalker|Szukacz|tAkeOut|tarspider|Teleport\ Pro|Telesoft|Templeton|traffixer|TrueRobot|TuringOS|TurnitinBot|TV33_Mercator|UIowaCrawler|URL_Spider_Pro|UtilMind|Vacuum|vagabondo|vayala|visibilitygap|vobsub|VoidEYE|vspider|w3mir|web\.by\.mail|Web\ Data\ Extractor|Web\ Downloader|Web\ Image\ Collector|Web\ Sucker|WebAuto|webbandit|Webclipping|webcollector|webcollage|WebCopier|webcraft@bea|WebDAV|webdevil|webdownloader|Webdup|WebEmailExtractor|WebFetch|WebGo\ IS|WebHook|Webinator|WebLeacher|WebMiner|WebMirror|webmole|WebReaper|WebSauger|WEBsaver|Website\ eXtractor|Website\ Quester|WebSnake|Webster|WebStripper|websucker|webvac|webwalk|webweasel|WebWhacker|WebZIP|Wget|whizbang|WhosTalking|Widow|WISEbot|WUMPUS|Wweb|WWWOFFLE|Wysigot|Xaldon\ WebSpider|XGET|x-Tractor|Zeus.* [OR] # SHELLS RewriteCond %{REQUEST_URI} .*((php|my)?shell|remview.*|phpremoteview.*|sshphp.*|pcom|nstview.*|c99|r57|webadmin.*|phpget.*|phpwriter.*|fileditor.*|locus7.*|storm7.*)\.(p?s?x?htm?l?|txt|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?|sql|xml) [NC,OR] RewriteCond %{REQUEST_METHOD} (GET|POST) [NC] RewriteCond %{QUERY_STRING} ^(.*)=/home(.+)?/(.*)/(.*)$ [OR] RewriteCond %{QUERY_STRING} ^work_dir=.*$ [OR] RewriteCond %{QUERY_STRING} ^command=.*&output.*$ [OR] RewriteCond %{QUERY_STRING} ^nts_[a-z0-9_]{0,10}=.*$ [OR] RewriteCond %{QUERY_STRING} ^c=(t|setup|codes)$ [OR] RewriteCond %{QUERY_STRING} ^act=((about|cmd|selfremove|chbd|trojan|backc|massbrowsersploit|exploits|grablogins|upload.*)|((chmod|f)&f=.*))$ [OR] RewriteCond %{QUERY_STRING} ^act=(ls|search|fsbuff|encoder|tools|processes|ftpquickbrute|security|sql|eval|update|feedback|cmd|gofile|mkfile)&d=.*$ [OR] RewriteCond %{QUERY_STRING} ^&?c=(l?v?i?&d=|v&fnot=|setup&ref=|l&r=|d&d=|tree&d|t&d=|e&d=|i&d=|codes|md5crack).*$ [OR] RewriteCond %{QUERY_STRING} ^(.*)([-_a-z]{1,15})=(ls|cd|cat|rm|mv|vim|chmod|chdir|mkdir|rmdir|pwd|clear|whoami|uname|tar|zip|unzip|tar|gzip|gunzip|grep|more|ln|umask|telnet|ssh|ftp|head|tail|which|mkmode|touch|logname|edit_file|search_text|find_text|php_eval|download_file|ftp_file_down|ftp_file_up|ftp_brute|mail_file|mysql|mysql_dump|db_query)([^a-zA-Z0-9].+)*$ [OR] RewriteCond %{QUERY_STRING} ^(.*)(wget|shell_exec|passthru|system|exec|popen|proc_open)(.*)$ # if expose_php is set to on RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC] # others RewriteCond %{REQUEST_METHOD} (GET|POST) [NC] RewriteCond %{QUERY_STRING} ^(.*)(%20SELECT%20|%20INSERT%20|CHAR\(|%20UPDATE%20|%20REPLACE%20)(.*)$ [NC] RewriteCond %{REQUEST_METHOD} (GET|POST) [NC] RewriteCond %{QUERY_STRING} ^(.*)(%3C|<)/?script(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=)?javascript(%3A|:)(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)document\.location\.href(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)ftp(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)ht%20tp(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)htt%20p(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http%20(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)h%20ttp(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)base64_encode(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)GLOBALS(=|[|%[0-9A-Z]{0,2})(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)_REQUEST(=|[|%[0-9A-Z]{0,2})(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)_vti(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)MSOffice(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)/etc/passwd(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)//(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)ShellAdresi.TXT(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)\[evil_root\]?(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)\.\./\.\./\.\./(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)/proc/self/environ(.*)$ RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR] RewriteCond %{QUERY_STRING} http:.*\/.*\/ [OR] RewriteCond %{QUERY_STRING} ..*\/ [OR] RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR] RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR] RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) RewriteCond %{QUERY_STRING} [^az](declare|char|set|cast|convert|delete|drop|exec|insert|meta|script|select|truncate|update)[^az] [NC] # Block out any script trying to set a mosConfig value through the URL RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR] # Block out any script trying to base64_encode crap to send via URL RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR] # Block out any script trying to set a mosConfig value through the URL RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR] # Block out any script trying to base64_encode crap to send via URL RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR] # Block out any script that includes a <script> tag in URL RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR] # Block out any script trying to set a PHP GLOBALS variable via URL RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR] # Block out any script trying to modify a _REQUEST variable via URL RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) # Send all blocked request to homepage with 403 Forbidden error! RewriteRule ^(.*)$ - [F,L] RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR] RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR] RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|).* [NC,OR] RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|).* [NC,OR] RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^$ [OR] RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|scan).* [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|).* [NC,OR] RewriteCond %{QUERY_STRING} ^.*(;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR] RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR] #RewriteCond %{QUERY_STRING} ^.*\.[A-Za-z0-9].* [NC,OR] RewriteCond %{QUERY_STRING} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|).* [NC] RewriteCond %{REQUEST_METHOD} (GET) [NC] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)https(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)https%3a(%3A|:)(/|%2F){2}(.*)$ [NC,OR] RewriteCond %{QUERY_STRING} ^(.*)(%3D|=|%3A|%09)http(%3A|:)(/|%2F){2}(.*)$ [NC] RewriteRule .* - [F] # Anti XSS protection RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR] RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR] RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR] RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR] RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) RewriteRule ^(.*)$ index_error.php [F,L] RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] # Anti cross site tracing - protection RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F] RewriteCond %{QUERY_STRING} ^(.*)base64_encode(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)GLOBALS(=|[|%[0-9A-Z]{0,2})(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)_REQUEST(=|[|%[0-9A-Z]{0,2})(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)_vti(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)MSOffice(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)/etc/passwd(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)//(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)ShellAdresi.TXT(.*)$ [OR] RewriteCond %{REQUEST_URI} ^(.*)\[evil_root\]?(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)\.\./\.\./\.\./(.*)$ [OR] RewriteCond %{QUERY_STRING} ^(.*)/proc/self/environ(.*)$ RewriteRule .* - [F] # Send all blocked request to homepage with 403 Forbidden error! RewriteRule .* - [F] # ########## End - Rewrite rules to block out some common exploits <FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$"> Order Allow,Deny Deny from all </FilesMatch> <FilesMatch "(\.htaccess|\.htpasswd)$"> Order Allow,Deny Deny from all </FilesMatch> # add whatever configuration files here that are hosted on your server that you want blocked <FilesMatch "^(php\.ini|php5\.ini)$"> Order allow,deny Deny from all </FilesMatch> # deny all .htaccess, .DS_Store $hÃ® and ._* (resource fork) files <Files ~ "^\.([Hh][Tt]|[Dd][Ss]_[Ss]|[_])"> Order allow,deny Deny from all Satisfy All </Files> # deny access to all .log and .comment files <Files ~ "^.*\.([Ll][Oo][Gg]|[cC][oO][mM][mM][eE][nN][tT])"> Order allow,deny Deny from all Satisfy All </Files>

最大的问题是：

这太大了，太复杂了。
这给你一个错误的安全感。
它会阻止合法用户。

1的问题是，它会导致你的服务器负载过重，处理所有的请求规则，当规则这么复杂时，即使是最微小的变化也会有很大的后果。非常大也使得很难知道整个事情。

2.（错误的安全感）的问题是，在编写服务器端代码时，你会less花点心思，否则你将会更慢地升级应用程序，因为你有这个RewriteRule保护。更多关于为什么这是一个错误的安全感以后。

我相信我不必告诉你为什么阻止合法用户是一个问题。

举一些例子：

下面的代码片段中的第二个FilesMatch是多余的。所有可能被第二个阻挡的东西已经被第一个阻挡：

 <FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$"> Order Allow,Deny Deny from all </FilesMatch> <FilesMatch "(\.htaccess|\.htpasswd)$"> Order Allow,Deny Deny from all </FilesMatch>

这两个FilesMatch也冗余匹配.htaccess文件与这次不区分大小写。

第二个也是多余的：

 RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK) RewriteRule .* - [F] # Anti cross site tracing - protection RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F]

有些行是逐字重复的。这个：

 RewriteCond %{REQUEST_METHOD} (GET|POST) [NC]

在第一个RewriteRule之前出现三次。

你有许多RewriteCond指令，其后面有[OR] ，但并不是所有的都有这个选项。据我统计，你有79个RewriteCond ，其中10个在你的第一个RewriteRule之前没有[OR] 。跟踪什么是可以允许的，什么不会在这里超出我的心智能力。

在没有[OR]情况下添加一个新规则，或者在RewriteRule之前添加一个规则，并忘记向先前的RewriteCond添加一个[OR]可以改变所有其他RewriteCond在它到下一个RewriteRule之前和之后的逻辑。

在安全性方面，这里的一些规则是可靠的，其中一些规则甚至包括在默认的Apacheconfiguration文件中（这可能使得它们在.htaccess中是冗余的）。但其中许多是基于黑名单关键字，这是行不通的。

SQL注入攻击可以在任何用户控制的参数中发生。您检查了%{QUERY_STRING}和%{HTTP_COOKIE}中与SQL相关的关键字列表，但是您错过了%{REQUEST_URI} ， %{HTTP_USER_AGENT} ， %{HTTP_REFERER} ， %{HTTP_FORWARDED} ， %{HTTP_HOST} ， %{HTTP_PROXY_CONNECTION}和%{HTTP_ACCEPT} 。这不是一个完整的用户控制参数列表，攻击者可以愉快地添加他们想要的任何头文件。

这种黑名单根本上是有缺陷的。如果您将查询string的一部分作为SQL运行，那么您的问题比这个.htaccess文件要大得多。总会有一个你错过的关键字或一种关键字编码的方式，这样你就错过了。

以下片段就是这样一个例子：

 h%20ttp:// ht%20tp:// htt%20p:// http%20://

攻击者可以在查询string中放置一个URL编码的空间，它仍然会被正确parsing和请求。但是你错过了所有这些组合：

 %20http:// h%20ttp%20:// ht%20tp%20:// htt%20p%20:// ht%20t%20p%20:// h%20t%20t%20p%20://

由于基本上有无数的“坏”string，试图枚举它们在.htaccess文件中是徒劳的。

有SQL注入和XSSdevise精确的逃避这种过滤。

阻止合法用户非常容易。查询string可以被各种各样的人附加。这个例子来自我的Google阅读器帐户，并添加到链接，我点击查看原始博客条目：

 ?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+DilbertDailyStrip+(Dilbert+Daily+Strip)&utm_content=Google+Reader

如果该RSS源已被称为“铸造沙发”，并链接到您的网站，你会服务我一个403.因为关键字“铸”出现在查询string，即使我是一个合法的用户，我被阻止。

这种模式：

 ^(.*)//(.*)$

很可能最终会与您自己发送到您网站的人员匹配：

 RewriteCond %{HTTP_COOKIE} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]

意味着你永远不能在你的任何cookies中使用撇号或回车或斜线。

TL; DR

不要这样做。这是一个坏主意。

在您的应用程序中添加安全性并尝试mod_ 安全性。

这是不值得的时间和精力; 混淆，转义，以及其他任何代码技巧总是可以打败一个简单的黑名单。

这一次最好花在保护应用程序上。但是，如果您对来自Web服务器层的这种方法感兴趣，则应该考虑让自己的规则了解Web应用程序的正常行为，并阻止与此行为有任何偏差。

而且，mod_security可能比mod_rewrite规则的斜塔更保守一些;）