Changelog

Copy Markdown View Source

All notable changes to this project will be documented in this file.

0.1.1

  • Percent-decode path segments before the UTF-8 / null-byte check, so requests like /file%00.png are blocked. Adapters leave %00 encoded in path_info; Phoenix decodes it later.

0.1.0

  • Initial release: Rbtz.WAF plug — halts scanner probes with an early plain 404 before the router. Rules: invalid UTF-8 / null-byte segments, dot segments (except /.well-known/*), scanner extensions (.php, .asp, .jsp, .cgi, and variants), and wp-* / wordpress / phpmyadmin / cgi-bin first segments. Supports :allow_prefixes to exempt routes that serve arbitrary external paths.