雷池 WAF 社区版的更新速度是真快啊，几乎一周一个小版本，俩月一个大版本，攻城狮们真的狠啊，没法测了。
废话不多说，前两天看到了 这篇文章，对雷池的“动态防护”功能挺感兴趣，特地来试试。
本文以测评为主，不再阐述部署过程，介绍一下我这里的测试环境：
VM1：1Panel 部署 OpenResty，部署项目 Anyeの导航 ，IP(192.168.0.220)
VM2：部署雷池 WAF 社区版，添加站点，开启“动态防护”，IP(192.168.0.225)
通常，我会采用这种方式来复刻一个主题，最常用的就是直接从浏览器开发人员工具中扒取出页面的 html,css,js 等文件，来重制主题。
开启了雷池动态防护的页面，会有一个解密的过程，其实也就是 js 执行的过程
这个过程极大的延长了页面的加载时间，大致是 3s 左右。
页面打开后，对于元素发现页面构建相同，代表页面并没有因为加密而产生变形
可见页面已加密，不过加密也导致 索引 页面严重增大🤣，看看后期有没有希望继续优化。
加密了 js 文件尝试了一下，每次返回的js加密结果都不相同。
很明显是进行了混淆，不过经过文本对比后发现了端倪。
这里贴出完整 js 代码
// 源js文件
/*! * Lazy Load - JavaScript plugin for lazy loading images * * Copyright (c) 2007-2017 Mika Tuupola * * Licensed under the MIT license: * http://www.opensource.org/licenses/mit-license.php * * Project home: * https://appelsiini.net/projects/lazyload * * Version: 2.0.0-beta.2 * */
(function(root, factory) {
if (typeof exports === "object") {
module.exports = factory(root);
} else if (typeof define === "function" && define.amd) {
define([], factory(root));
} else {
root.LazyLoad = factory(root);
}
}
)(typeof global !== "undefined" ? global : this.window || this.global, function(root) {
"use strict";
const defaults = {
src: "data-src",
srcset: "data-srcset",
selector: ".lazyload"
};
/** * Merge two or more objects. Returns a new object. * @private * @param {Boolean} deep If true, do a deep (or recursive) merge [optional] * @param {Object} objects The objects to merge together * @returns {Object} Merged values of defaults and options */
const extend = function() {
let extended = {};
let deep = false;
let i = 0;
let length = arguments.length;
/* Check if a deep merge */
if (Object.prototype.toString.call(arguments[0]) === "[object Boolean]") {
deep = arguments[0];
i++;
}
/* Merge the object into the extended object */
let merge = function(obj) {
for (let prop in obj) {
if (Object.prototype.hasOwnProperty.call(obj, prop)) {
/* If deep merge and property is an object, merge properties */
if (deep && Object.prototype.toString.call(obj[prop]) === "[object Object]") {
extended[prop] = extend(true, extended[prop], obj[prop]);
} else {
extended[prop] = obj[prop];
}
}
}
};
/* Loop through each object and conduct a merge */
for (; i < length; i++) {
let obj = arguments[i];
merge(obj);
}
return extended;
};
function LazyLoad(images, options) {
this.settings = extend(defaults, options || {});
this.images = images || document.querySelectorAll(this.settings.selector);
this.observer = null;
this.init();
}
LazyLoad.prototype = {
init: function() {
/* Without observers load everything and bail out early. */
if (!root.IntersectionObserver) {
this.loadImages();
return;
}
let self = this;
let observerConfig = {
root: null,
rootMargin: "0px",
threshold: [0]
};
this.observer = new IntersectionObserver(function(entries) {
entries.forEach(function(entry) {
if (entry.intersectionRatio > 0) {
self.observer.unobserve(entry.target);
self.loadImage(entry.target);
}
});
}
,observerConfig);
this.images.forEach(function(image) {
self.observer.observe(image);
});
},
loadAndDestroy: function() {
if (!this.settings) {
return;
}
this.loadImages();
this.destroy();
},
loadImage: function(image) {
image.onerror = function() {
image.onerror = null;
image.src = image.srcset = image.dataset.original;
}
;
let src = image.getAttribute(this.settings.src);
let srcset = image.getAttribute(this.settings.srcset);
if ("img" === image.tagName.toLowerCase()) {
if (src) {
image.dataset.original = image.src;
image.src = src;
}
if (srcset) {
image.srcset = srcset;
}
} else {
image.style.backgroundImage = "url(" + src + ")";
}
},
loadImages: function() {
if (!this.settings) {
return;
}
let self = this;
this.images.forEach(function(image) {
self.loadImage(image);
});
},
destroy: function() {
if (!this.settings) {
return;
}
this.observer.disconnect();
this.settings = null;
}
};
root.lazyload = function(images, options) {
return new LazyLoad(images,options);
}
;
if (root.jQuery) {
const $ = root.jQuery;
$.fn.lazyload = function(options) {
options = options || {};
options.attribute = options.attribute || "data-src";
new LazyLoad($.makeArray(this),options);
return this;
}
;
}
return LazyLoad;
});
// 动态防护加密后的js文件
function vgo8rYXzpS() {
var YIhUo91Nlh = 99.6174697329428;
while (YIhUo91Nlh < 6) {
YIhUo91Nlh++
}
var kJsBQ2iTCw = 77.7991427720637;
while (kJsBQ2iTCw < 8) {
kJsBQ2iTCw++
}
var Uv8SujYUUJ = 54.122410119766634;
62.94717341414315 + 14.215159769026501;
"eCDkWHqKcu";
20.29250300507593 + 96.90578776550426;
var hKDl2Z6IyR = 2.1154780179250436;
while (hKDl2Z6IyR < 9) {
hKDl2Z6IyR++
}
var jJJdYPyWC8 = 96.35369160356686;
while (jJJdYPyWC8 < 10) {
jJJdYPyWC8++
}
var q1lUq8lALI = 79.3826780702858;
var KSm4kSmK5Q = 16.811363665066132;
while (KSm4kSmK5Q < 5) {
KSm4kSmK5Q++
}
while (q1lUq8lALI < 5) {
q1lUq8lALI++
}
var k8jxtioSu1 = 46.12863667479478;
if (k8jxtioSu1 < 50)
VdgkMuAloP("dbKMKN3DiD");
else
VdgkMuAloP("Z_GUlDIf7g");
32.61116098968565 + 39.92340222133316;
var WOIqRFoBWI = 35.570788142150256;
while (WOIqRFoBWI < 10) {
WOIqRFoBWI++
}
var REP52ajkkB = 68.57029249635578;
while (REP52ajkkB < 9) {
REP52ajkkB++
}
var UvGT8ugsmm = 77.45257249038768;
var c_XLMPoMhw = 70.0508383263844;
var oXNng_nyI3 = 61.714023740614785;
"f3dzUmlSrt";
while (oXNng_nyI3 < 8) {
oXNng_nyI3++
}
"oiou9de1Yg";
"jdpOma9ApF";
var NeReO5OH2M = 63.89278655453103;
while (NeReO5OH2M < 8) {
NeReO5OH2M++
}
var _p_ydR_UZY = 83.88263735619535;
var F85mcn2g_m = 17.165604886412726;
while (F85mcn2g_m < 10) {
F85mcn2g_m++
}
24.428701219017995 + 36.33105120927406;
var E_btPRjrmk = 95.02151619364821;
var No5m6438qj = 4.1049208686863246;
while (No5m6438qj < 9) {
No5m6438qj++
}
while (E_btPRjrmk < 6) {
E_btPRjrmk++
}
var NW66eJHW18 = 80.32092123501981;
if (NW66eJHW18 < 50)
VdgkMuAloP("wVsjIS9XQo");
else
VdgkMuAloP("GoLW5hTcVj");
43.682142399473555 + 22.477837399452866;
var UNuZiogsXq = 70.37483244640134;
while (UNuZiogsXq < 6) {
UNuZiogsXq++
}
var JyjoRvjvV4 = 60.33084553561216;
"PPLO3pqrCR";
function VdgkMuAloP() {
"CCutBlYuiL";
"MgmL5Sv_33";
19.82880014765916 + 66.83450544153038;
var eH8bW0LeRO = 91.84505170089825;
var GGEb99P0LW = 92.75726773787632;
"eM_DBnNLNQ";
"LTExkL39fU";
var ayFeMZ7J9o = 4.08422739984733;
var rvzNYoM37B = 42.468405912837106;
while (rvzNYoM37B < 6) {
rvzNYoM37B++
}
"YLovxab17O";
var dpUNCcw57i = 4.9146145098517575;
while (dpUNCcw57i < 10) {
dpUNCcw57i++
}
var ZjzssshCHy = 22.711581319339555;
"lsyj2Pu6bi";
"mAdio22F97";
95.9152148251555 + 18.563789346616783;
"Kisq7F_TOW";
var EO9rGZSTTK = 53.3184198670574;
while (EO9rGZSTTK < 6) {
EO9rGZSTTK++
}
var Lfrg2SayBj = 96.40296951052316;
var SR4gkdmFPm = 24.691037844119176;
while (SR4gkdmFPm < 7) {
SR4gkdmFPm++
}
"njAS_NShim";
"DIoi_JwNCk";
var qZALlgtAos = 65.84687374547939;
while (qZALlgtAos < 5) {
qZALlgtAos++
}
"i8UnwEQqP2";
var mkzN8inJtT = 89.67717243925355;
"EXgVlnAkaM";
var HGgVbs9bD5 = 56.50704313244045;
var myQFrz2kY4 = 54.55344568694437;
while (myQFrz2kY4 < 8) {
myQFrz2kY4++
}
var VcC388Sonl = 78.22901590625897;
while (VcC388Sonl < 5) {
VcC388Sonl++
}
var EDQM5T4i5x = 58.12080899105871;
while (EDQM5T4i5x < 8) {
EDQM5T4i5x++
}
var lS3HRC8N0e = 42.29800294748819;
while (lS3HRC8N0e < 5) {
lS3HRC8N0e++
}
}
}
(function(that, a) {
var checkF = new RegExp("\\w *\\(\\){.+}");
"Saz5menkPn";
var checkR = new RegExp("(\\[x|u](\\w){2,4})+");
var checkFunction = function checkFunction1() {
if (checkR.test(checkFunction.toString())) {
f2([2, 15, 12])
}
;return '\x63\x68\x65\x63\x6b\x46\x75\x6e\x63\x74\x69\x6f\x6e'
};
var f1 = function f1(a) {
a.push[a];
f2(a)
};
var f2 = function f2(a) {
a.push[a];
f1(a)
};
if (!checkF.test(checkFunction.toString())) {
f2([])
} else if (checkR.test(checkFunction.toString())) {
f2([1, 3, 7])
}
;"ISXAG9bapu";
var KOaO2Jk15j = 13.366279497772231;
KOaO2Jk15j = 65.44109390187671;
return a(that);
function f5OTtZ1pUr() {
"PFAZrkUkjJ";
"yohosCBZku";
"czcc_QG98P";
var Y7ZMWHKbB5 = 54.61165307973092;
while (Y7ZMWHKbB5 < 7) {
Y7ZMWHKbB5++
}
"RAAE3i3HNJ";
var yYJU5WMbNs = 81.78463513401672;
var Dsj0YbE3nh = 60.12962678573978;
while (Dsj0YbE3nh < 8) {
Dsj0YbE3nh++
}
"OrNvH3Vm8U";
var FcVeaK_8CJ = 70.65213865609662;
var V10P1fXl1e = 93.28700416475893;
while (V10P1fXl1e < 7) {
V10P1fXl1e++
}
var _jQaUeEOlz = 50.09958863458343;
while (_jQaUeEOlz < 6) {
_jQaUeEOlz++
}
"mkyDT6LuXp";
"i_d0Jej01W";
93.1178573977863 + 65.0171586053574;
"MdcdXdZD8e";
var FvwOTr68cW = 63.96686898919228;
while (FvwOTr68cW < 5) {
FvwOTr68cW++
}
12.007514883700402 + 67.83201664204582;
var lVk87OnDY0 = 10.352772574019035;
while (lVk87OnDY0 < 10) {
lVk87OnDY0++
}
"ZIxYt7RDz5";
var HOjmKYxZYn = 73.07394273998264;
var xf5LYnXM_h = 34.42670716048105;
while (xf5LYnXM_h < 7) {
xf5LYnXM_h++
}
25.31980979829108 + 70.92299314386324;
53.64987099085665 + 15.95767193794893;
81.04615728361688 + 53.03190420900158;
"xMyhHs6tqa";
var CicbLkYxKL = 71.43209809856342;
while (CicbLkYxKL < 9) {
CicbLkYxKL++
}
81.82768180662697 + 44.54696909044475;
"a7S1hc6l6e";
40.02457556515699 + 50.13884740950273
}
}
)(this, function(that) {
var EfanXdEsAo = 45.044183852209066;
var YiD8rJkjM4 = 60.40560906974519;
while (YiD8rJkjM4 < 9) {
YiD8rJkjM4++
}
var SFXCSJnYT5 = 5.6590674829357;
function DROWk3baLH() {
var zJ2eGCAqG6 = 88.73517894514487;
while (zJ2eGCAqG6 < 7) {
zJ2eGCAqG6++
}
"fVZRgjskF7";
var imVKfLWElR = 98.4392536479853;
var JRZm9ZRXt9 = 65.52198475056669;
"B07bldh2rt";
94.61531928891331 + 21.79165407508193;
"H7umcmyF_g";
var kUwyNiUzjX = 48.5975080540464;
while (kUwyNiUzjX < 5) {
kUwyNiUzjX++
}
var G5q4i5ptYT = 17.20767169078439;
while (G5q4i5ptYT < 9) {
G5q4i5ptYT++
}
"S0RQAJX7ZD";
var sbwEsBL3on = 31.621188048769;
var Rbqnn2M5lo = 1.6814855430946412;
var wXdYUzqLKS = 53.13735728383625;
var iIMDA_Qowp = 87.59602310423611;
55.899852486295956 + 23.463153124052145;
49.64055650210554 + 21.699124979927305
}
});
(function(root, factory) {
if (typeof exports === "object") {
module.exports = factory(root)
} else if (typeof define === "function" && define.amd) {
define([], factory(root))
} else {
root.LazyLoad = factory(root)
}
20.075305793669145 + 96.72088665263502;
function mCbgSrID5z() {
var ymZDdeQQne = 84.05118287547904;
while (ymZDdeQQne < 8) {
ymZDdeQQne++
}
"oeSlUltLf7";
var vRcSMA7HZy = 95.63940228416716;
while (vRcSMA7HZy < 5) {
vRcSMA7HZy++
}
42.847416356461686 + 64.228599747433;
var S4X325xZd0 = 36.8477478357082;
var OjdsnE6IgU = 54.6819719737484;
while (OjdsnE6IgU < 7) {
OjdsnE6IgU++
}
var tsdIhKV6Tu = 21.849203694513204;
"IBEZHnHB9P";
var W1xUDNOclb = 97.45176245010938;
var qBhKSMePxI = 53.918246237085604;
while (qBhKSMePxI < 8) {
qBhKSMePxI++
}
var tG5h3fCZpA = 8.9527278684316;
1.8795339533222326 + 85.30147367116075;
3.4838274267666733 + 52.70631782675951;
var sglVSvKjZv = 13.453736652916252;
while (sglVSvKjZv < 9) {
sglVSvKjZv++
}
var bzJ8IfE03K = 72.4963090140686;
var IzYpLOgN6D = 1.7126081902147487;
86.90125410102027 + 60.096220564929666;
55.32420449194843 + 93.21714769547813;
15.44123941754805 + 88.74042551968007;
"ayjAX7QOFR";
"nsviM21tO7";
"RGvq8LBnOO";
2.5365166268296333 + 58.41895276641477;
var NwT9TZgChj = 3.2736264569624316;
"ZVRMQfyCrJ";
"fwutOlKiEI";
var Ejy2yBkKAt = 51.83509013431559;
while (Ejy2yBkKAt < 7) {
Ejy2yBkKAt++
}
92.07691206149254 + 13.437580090223227;
"qdd7jYm20k";
var j2KtWorODN = 42.14264503067741;
2.478519996620122 + 58.627727544483704
}
}
)(typeof global !== "undefined" ? global : this.window || this.global, function(root) {
"use strict";
var defaults = {
src: "data-src",
srcset: "data-srcset",
selector: ".lazyload"
};
var extend = function extend1() {
var extended = {};
var deep = false;
var i = 0;
var length = arguments.length;
if (Object.prototype.toString.call(arguments[0]) === "[object Boolean]") {
deep = arguments[0];
i++
}
var merge = function merge(obj) {
for (var prop in obj) {
if (Object.prototype.hasOwnProperty.call(obj, prop)) {
if (deep && Object.prototype.toString.call(obj[prop]) === "[object Object]") {
extended[prop] = extend(true, extended[prop], obj[prop])
} else {
extended[prop] = obj[prop]
}
}
}
};
for (; i < length; i++) {
var obj = arguments[i];
merge(obj)
}
return extended
};
function LazyLoad(images, options) {
this.settings = extend(defaults, options || {});
this.images = images || document.querySelectorAll(this.settings.selector);
this.observer = null;
this.init()
}
LazyLoad.prototype = {
init: function init() {
if (!root.IntersectionObserver) {
this.loadImages();
return
}
var self = this;
var observerConfig = {
root: null,
rootMargin: "0px",
threshold: [0]
};
this.observer = new IntersectionObserver(function(entries) {
entries.forEach(function(entry) {
if (entry.intersectionRatio > 0) {
self.observer.unobserve(entry.target);
self.loadImage(entry.target)
}
})
}
,observerConfig);
this.images.forEach(function(image) {
self.observer.observe(image)
})
},
loadAndDestroy: function loadAndDestroy() {
if (!this.settings) {
return
}
this.loadImages();
this.destroy()
},
loadImage: function loadImage(image) {
image.onerror = function() {
image.onerror = null;
image.src = image.srcset = image.dataset.original
}
;
var src = image.getAttribute(this.settings.src);
var srcset = image.getAttribute(this.settings.srcset);
if ("img" === image.tagName.toLowerCase()) {
if (src) {
image.dataset.original = image.src;
image.src = src
}
if (srcset) {
image.srcset = srcset
}
} else {
image.style.backgroundImage = "url(" + src + ")"
}
},
loadImages: function loadImages() {
if (!this.settings) {
return
}
var self = this;
this.images.forEach(function(image) {
self.loadImage(image)
})
},
destroy: function destroy() {
if (!this.settings) {
return
}
this.observer.disconnect();
this.settings = null
}
};
root.lazyload = function(images, options) {
return new LazyLoad(images,options)
}
;
if (root.jQuery) {
var $ = root.jQuery;
$.fn.lazyload = function(options) {
options = options || {};
options.attribute = options.attribute || "data-src";
new LazyLoad($.makeArray(this),options);
return this
}
}
98.21293314139757 + 7.022202427695869;
return LazyLoad;
var zb5YrDEzX8 = 49.67145292566205;
function EMQ2TiywJ2() {
"kDDG4hcurX";
"LmMQDl5Guf";
"H1d2hSNdZu";
"vR3uU0dztV";
"BYg6Cwwew1";
"Z7Cgb85The";
var vqCn2LKHiQ = 79.8849526204871;
while (vqCn2LKHiQ < 6) {
vqCn2LKHiQ++
}
"HzKhtzFo0S";
var Ruo3QF3HKv = 57.10873587557603;
while (Ruo3QF3HKv < 8) {
Ruo3QF3HKv++
}
var NIVPEUabT_ = 25.838978101412078;
var pmvJIgXrA7 = 41.71629707156116;
while (pmvJIgXrA7 < 7) {
pmvJIgXrA7++
}
var cTqhNJmnqp = 7.679109504729966;
var Xkldnu7eiS = 89.26080892492617;
while (Xkldnu7eiS < 8) {
Xkldnu7eiS++
}
var Iq6adjqOVj = 86.04734679658776;
while (Iq6adjqOVj < 7) {
Iq6adjqOVj++
}
var TyC7F0mXPj = 57.405394830228786;
while (TyC7F0mXPj < 7) {
TyC7F0mXPj++
}
var q7oS54FoCf = 19.715578974920984;
6.354381716758419 + 48.514464467999424;
var JPOOCo51Cg = 94.50513995137923;
18.85838453981073 + 55.22787281970704;
"rUww9Es4UQ"
}
});
可见该加密方式采用了：
变量名和函数名替换：将原有的变量名和函数名替换为难以理解的字符或字符串，例如vgo8rYXzpS
、YIhUo91Nlh
等。
字符串混淆：将代码中的字符串通过某些算法转换为难以阅读的形式。
控制流改变：通过添加无意义的循环、条件判断等，改变代码的控制流，使得代码执行过程变得复杂。
代码拆分：将代码拆分为多个部分，并通过某些机制动态地组合执行。
可见还是较为容易反混淆的，期待后期加强。
根据 官方文档 所述，动态防护还是为了可以更好地阻止爬虫和攻击自动化程序的分析，那么就尝试编写一段python代码来进行 HTML 内容爬取测试。
比如爬取 本站导航站，这里使用 Microsoft 的 playwright 库
import asyncio
from playwright.async_api import async_playwright
async def scrape_data():
async with async_playwright() as p:
browser = await p.chromium.launch(headless=True)
page = await browser.new_page()
# 加载页面
await page.goto('http://192.168.0.220')
# 等待页面加载完成
await page.wait_for_load_state('networkidle')
# 提取链接、图标和描述
items = await page.query_selector_all('.list-item.block')
data = []
for item in items:
link = await item.query_selector('a.list-content')
if link:
href = await link.get_attribute('href')
title = await link.query_selector('.list-title')
desc = await link.query_selector('.list-desc')
img = await item.query_selector('img')
data.append({
'link': href,
'title': await title.inner_text() if title else None,
'desc': await desc.inner_text() if desc else None,
'icon': await img.get_attribute('src') if img else None,
})
await browser.close()
return data
# 运行
async def main():
data = await scrape_data()
for entry in data:
print(entry)
asyncio.run(main())
源站执行爬取后输出：
雷池防护后：
效果明显，不过，感觉还是有绕过的空间呀？试试浏览器有头模式？
import asyncio
from playwright.async_api import async_playwright
async def scrape_data():
async with async_playwright() as p:
# 指定浏览器路径并启用有头模式
browser = await p.chromium.launch(
headless=False, # 设置为 False 以显示浏览器窗口
executable_path="C:\\Users\\Anye\\AppData\\Local\\Chromium\\Application\\chrome.exe"
)
page = await browser.new_page()
# 加载本地服务器上的页面
await page.goto('http://192.168.0.225/')
# 手动处理人机验证
print("请手动处理页面上的人机验证...")
await page.wait_for_selector('.list-item.block', timeout=0) # 等待页面加载完成，没有超时限制
# 提取链接、图标和描述
items = await page.query_selector_all('.list-item.block')
data = []
for item in items:
link = await item.query_selector('a.list-content')
if link:
href = await link.get_attribute('href')
title = await link.query_selector('.list-title')
desc = await link.query_selector('.list-desc')
img = await item.query_selector('img')
data.append({
'link': href,
'title': await title.inner_text() if title else None,
'desc': await desc.inner_text() if desc else None,
'icon': await img.get_attribute('src') if img else None,
})
await browser.close()
return data
# 运行
async def main():
data = await scrape_data()
for entry in data:
print(entry)
asyncio.run(main())
结果：成功获取内容
既然这样，那岂不是等待解密后就可以获取内容了，那么等待5秒试试？
import asyncio
from playwright.async_api import async_playwright
async def scrape_data():
async with async_playwright() as p:
browser = await p.chromium.launch(headless=True)
page = await browser.new_page()
# 加载页面
await page.goto('http://192.168.0.225')
# 等待页面加载完成
await page.wait_for_load_state('networkidle')
# 等待5秒
await page.wait_for_timeout(5000)
# 提取链接、图标和描述
items = await page.query_selector_all('.list-item.block')
data = []
for item in items:
link = await item.query_selector('a.list-content')
if link:
href = await link.get_attribute('href')
title = await link.query_selector('.list-title')
desc = await link.query_selector('.list-desc')
img = await item.query_selector('img')
data.append({
'link': href,
'title': await title.inner_text() if title else None,
'desc': await desc.inner_text() if desc else None,
'icon': await img.get_attribute('src') if img else None,
})
await browser.close()
return data
# 运行
async def main():
data = await scrape_data()
for entry in data:
print(entry)
asyncio.run(main())
成功获取。
雷池开发别打我，HTML 确实不太好加密
不过目前来讲确实可以拦截大部分爬虫的爬取，正常爬虫不会长时间等待页面加载，也不会用有头模式。
经测试，开启 人机验证 后，是可以有效拦截爬虫获取内容。
不过还是希望雷池开发大大可以继续研究研究如何加强“动态防护”的算法😘。
不让黑客，越雷池一步。
本次测试为内部测试环境，请勿用于黑客攻击行为。后期雷池也会加强加密算法，保护 WEB 安全。