Suricata的官方规则库emerging-all.rules中针对xss的检测规则有哪些

在 Suricata 的官方规则库 `emerging-all.rules` 中，有多个针对 XSS（跨站脚本攻击）的检测规则，包括：

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible XSS Attempt in GET parameter"; flow:to_server,established; content:"GET"; http_method; content:"?"; http_uri; content:"<"; http_uri; content:">"; http_uri; pcre:"/(([\%3C|\%3E|\x3C|\x3E]+)|(%3C|%3E|<|>)).*?((script|%73%63%72%69%70%74|%3C|%253C|%253c|%3c|%3E|%253E|%253e|%3e|%22|%27|%253B|%253b|%3B|%28|%29|%2528|%2529|%26|%2526|%2522|%253D|%253d|=)(\s|%20)*([\%3C|\%3E|\x3C|\x3E]+|(%3C|%3E|<|>)))/Ui"; classtype:web-application-attack; sid:2001212; rev:9;)

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible XSS Attack in URI"; flow:to_server,established; content:"GET"; http_method; content:"/"; http_uri; content:">"; http_uri; pcre:"/(([\%3C|\%3E|\x3C|\x3E]+)|(%3C|%3E|<|>)).*?((script|%73%63%72%69%70%74|%3C|%253C|%253c|%3c|%3E|%253E|%253e|%3e|%22|%27|%253B|%253b|%3B|%28|%29|%2528|%2529|%26|%2526|%2522|%253D|%253d|=)(\s|%20)*([\%3C|\%3E|\x3C|\x3E]+|(%3C|%3E|<|>)))/Ui"; classtype:web-application-attack; sid:2001213; rev:7;)

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible XSS Attack in URI"; flow:to_server,established; content:"GET"; http_method; content:"/"; http_uri; content:"<"; http_uri; pcre:"/(^\/$|\/([^\?\s]*?)(\?.*)?$)/U"; pcre:"/(([\%3C|\%3E|\x3C|\x3E]+)|(%3C|%3E|<|>)).*?((script|%73%63%72%69%70%74|%3C|%253C|%253c|%3c|%3E|%253E|%253e|%3e|%22|%27|%253B|%253b|%3B|%28|%29|%2528|%2529|%26|%2526|%2522|%253D|%253d|=)(\s|%20)*([\%3C|\%3E|\x3C|\x3E]+|(%3C|%3E|<|>)))/Ui"; classtype:web-application-attack; sid:2001214; rev:7;)

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible XSS Attack in URI"; flow:to_server,established; content:"GET"; http_method; content:"/"; http_uri; content:"<"; http_uri; pcre:"/(^\/$|\/([^\?\s]*?)(\?.*)?$)/U"; pcre:"/(%3C|%3E|<|>).*?(script|%73%63%72%69%70%74|%3C|%253C|%253c|%3c|%3E|%253E|%253e|%3e|%22|%27|%253B|%253b|%3B|%28|%29|%2528|%2529|%26|%2526|%2522|%253D|%253d|=)/Ui"; classtype:web-application-attack; sid:2001215; rev:7;)

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible XSS Attack in URI"; flow:to_server,established; content:"POST"; http_method; content:"/"; http_uri; content:"<"; http_uri; pcre:"/(^\/$|\/([^\?\s]*?)(\?.*)?$)/U"; pcre:"/(([\%3C|\%3E|\x3C|\x3E]+)|(%3C|%3E|<|>)).*?((script|%73%63%72%69%70%74|%3C|%253C|%253c|%3c|%3E|%253E|%253e|%3e|%22|%27|%253B|%253b|%3B|%28|%29|%2528|%2529|%26|%2526|%2522|%253D|%253d|=)(\s|%20)*([\%3C|\%3E|\x3C|\x3E]+|(%3C|%3E|<|>)))/Ui"; classtype:web-application-attack; sid:2001216; rev:7;)

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible XSS Attack in URI"; flow:to_server,established; content:"POST"; http_method; content:"/"; http_uri; content:"<"; http_uri; pcre:"/(^\/$|\/([^\?\s]*?)(\?.*)?$)/U"; pcre:"/(%3C|%3E|<|>).*?(script|%73%63%72%69%70%74|%3C|%253C|%253c|%3c|%3E|%253E|%253e|%3e|%22|%27|%253B|%253b|%3B|%28|%29|%2528|%2529|%26|%2526|%2522|%253D|%253d|=)/Ui"; classtype:web-application-attack; sid:2001217; rev:7;)

这些规则主要是基于 HTTP 协议的，检测 HTTP 请求和响应中是否包含可能构成 XSS 攻击的特征，例如 `<script>` 标签、`%3C` 和 `%3E` 等字符编码等。当这些特征被检测到时，Suricata 会发出警报（alert）。其中，`sid` 和 `rev` 字段分别表示规则的唯一标识和版本号。