Examples
The seed fragments below are copied from the compiler-tested category fixtures. They illustrate the rule language. Fragments belong inside the corresponding top-level collection, rather than being complete rulesets.
SQL union-select
The SQL detector recognizes the sql-union-select sequence, permits comments, and resets that sequence at a semicolon. Its sql-keywords lexicon supplies Union, Select and the other word classes. Both objects are from clearplane-sql-injection.
{"id": "sql-keywords", "tokenizer": "Sql", "entries": {
"union": ["Union"], "select": ["Select"], "all": ["All"], "distinct": ["Distinct"], "or": ["Boolean"], "and": ["Boolean"], "like": ["Like"],
"sleep": ["DelayFunction"], "benchmark": ["DelayFunction"], "pg_sleep": ["DelayFunction"], "waitfor": ["Waitfor"], "delay": ["Delay"],
"drop": ["StackedVerb"], "delete": ["StackedVerb"], "insert": ["StackedVerb"], "update": ["StackedVerb"], "exec": ["StackedVerb"], "execute": ["StackedVerb"], "create": ["StackedVerb"], "alter": ["StackedVerb"]}}
{"id": "sql-injection", "tokenizer": "Sql", "mode": "Patterns", "lexicon": "sql-keywords", "options": {"contexts": ["AsIs", "FoldQuotes"], "versionedCommentDigits": 6},
"patterns": [
{"reason": "sql-stacked-statement", "skip": ["Comment"], "sequence": [{"class": ["Semicolon"]}, {"class": ["StackedVerb"]}]},
{"reason": "sql-union-select", "skip": ["Comment"], "reset": ["Semicolon"], "sequence": [{"class": ["Union"]}, {"class": ["Union", "All", "Distinct", "LeftParenthesis"], "repeat": "*"}, {"class": ["Select"]}]},
{"reason": "sql-time-delay", "skip": ["Comment"], "sequence": [{"class": ["DelayFunction"]}, {"class": ["LeftParenthesis"]}]},
{"reason": "sql-time-delay", "skip": ["Comment"], "sequence": [{"class": ["Waitfor"]}, {"class": ["Delay"]}]},
{"reason": "sql-boolean-tautology", "skip": ["Comment", "LeftParenthesis", "RightParenthesis"],
"sequence": [{"class": ["Boolean"]}, {"class": ["Word", "Number", "String"], "capture": "l"}, {"class": ["Equal", "Like"]}, {"class": ["Word", "Number", "String"], "capture": "r"}],
"where": [{"same": ["l", "r"]}]},
{"reason": "sql-boolean-tautology", "skip": ["Comment", "LeftParenthesis", "RightParenthesis"], "sequence": [{"class": ["Boolean"]}, {"class": ["Number"]}, {"class": ["Comparison"]}, {"class": ["Number"]}]}
]}
A rule calls this detector with operator: { "kind": "Detect", "value": "sql-injection" }. For example, the seed’s metadata rule matches 1 UNION/**/SELECT secret FROM accounts after its configured transformations.
XSS event-handler attribute
This pattern from the clearplane-xss HTML detector recognizes an attribute whose name starts with on, has at least three characters and has a value. <img src=x onerror=alert(1)> exercises it.
{"reason": "xss-event-handler", "sequence": [{"class": ["Attribute"], "where": [{"field": "name", "prefix": "on", "minLength": 3}, {"field": "hasValue", "nonBlank": true}]}]}
Command substitution
This pattern from clearplane-command-injection recognizes a non-blank shell substitution such as $(id). It runs in the Shell tokenizer’s Command context.
{"reason": "command-substitution", "sequence": [{"class": ["Substitution"], "where": [{"field": "nonBlank", "nonBlank": true}]}]}
Path traversal
This complete rule from clearplane-path-traversal uses bounded SafeRegex after decoding and normalization. Its reason is path-traversal-sequence; ../private/example matches.
{
"id": 1930100, "revision": 1, "message": "Path traversal attempt in request metadata", "description": "Clearplane deterministic built-in request inspection rule.",
"category": "path-traversal", "severity": "Critical", "score": 5, "paranoiaLevel": 1, "action": "Score", "tags": ["attack-lfi", "attack-path-traversal"],
"provenance": {"kind": "ClearplaneOriginal", "source": "Clearplane", "license": "Proprietary", "sourceVersion": "1.0.0", "sourceRuleId": "GK-1930100"},
"inspectionStage": "RequestMetadata",
"conditions": [{"targets": [{"target": "RawPath"}, {"target": "NormalizedPath"}, {"target": "QueryValue"}], "transformations": ["UriDecode", "UriDecode", "HtmlEntityDecode", "UnicodeNormalize", "RemoveNulls", "Lowercase"], "scope": "AllFields",
"operator": {"kind": "SafeRegex", "value": "\\.\\.[/\\\\]"}, "reasonCode": "path-traversal-sequence"}],
"diagnosticMetadata": {"detectorRevision": "2"}
}
Protocol anomaly
This rule from clearplane-protocol scores the application-visible upgrade-h2c anomaly. It matches a fact emitted by protocol inspection, rather than parsing the Upgrade header itself.
{
"id": 1920107, "revision": 1, "message": "Application-visible HTTP protocol anomaly: upgrade-h2c", "description": "Clearplane deterministic built-in request inspection rule.",
"category": "protocol", "severity": "Critical", "score": 5, "paranoiaLevel": 1, "action": "Score", "tags": ["attack-protocol"],
"provenance": {"kind": "ClearplaneOriginal", "source": "Clearplane", "license": "Proprietary", "sourceVersion": "1.0.0", "sourceRuleId": "GK-1920107"},
"inspectionStage": "RequestMetadata",
"conditions": [{"targets": [{"target": "ProtocolAnomaly"}], "transformations": [], "scope": "AllFields", "operator": {"kind": "Equal", "value": "upgrade-h2c"}, "reasonCode": "upgrade-h2c"}],
"diagnosticMetadata": {"detectorRevision": "2"}
}
Challenge a login path
This complete local ruleset requests a challenge for /login. Its configured score remains valid for Critical severity, but the Challenge action adds zero to the transaction’s score. Enable bot challenges on the HTTPS route and publish to Prevention before eligible requests can be challenged. Existing clearance and normal WAF blocking still apply.
{
"rulesetId": "local",
"version": "1.0.0",
"schemaVersion": 1,
"kind": "Application",
"minimumClearplaneVersion": "1.0.0-alpha4",
"releasedAt": "2026-09-12T00:00:00+00:00",
"provenance": {
"source": "Operator",
"license": "Proprietary"
},
"profiles": [
{
"id": "standard",
"revision": 1,
"name": "Standard",
"ruleIds": [
2
],
"limits": {}
},
{
"id": "management",
"revision": 1,
"name": "Management",
"ruleIds": [
2
],
"limits": {}
}
],
"rules": [
{
"id": 2,
"revision": 1,
"message": "Custom inspection example",
"description": "A small example for the WAF rule language reference.",
"category": "custom",
"severity": "Critical",
"score": 5,
"paranoiaLevel": 1,
"action": "Challenge",
"provenance": {
"kind": "ClearplaneOriginal",
"source": "Operator",
"license": "Proprietary"
},
"inspectionStage": "RequestMetadata",
"conditions": [
{
"targets": [
{
"target": "NormalizedPath"
}
],
"operator": {
"kind": "Equal",
"value": "/login"
}
}
]
}
],
"integrityTests": [
{
"id": "login",
"profileId": "standard",
"method": "GET",
"path": "/login",
"fields": [],
"expectedMatchedRuleIds": [
2
]
},
{
"id": "other-path",
"profileId": "management",
"path": "/account",
"fields": [],
"expectedMatchedRuleIds": []
}
]
}
Exclude a WordPress editor field
This Exclusion ruleset removes only the content query field from rule 1941100 in clearplane-xss, for POST requests whose normalized path starts with /wp-admin/. It does not exempt other rules or body fields. Adapt the target and field to the traffic your editor actually sends, and opt the route's WAF policy into the exclusion ruleset. Exclusion definitions are shown for release authors; Custom rules publishes the local Application ruleset.
The embedded vector verifies suppression on the selected path. Embedded exclusion vectors must expect at least one suppressed rule; test an outside path separately to confirm it remains protected.
{
"rulesetId": "wordpress-editor",
"version": "2026_09_19_10_00",
"schemaVersion": 1,
"kind": "Exclusion",
"minimumClearplaneVersion": "1.0.0-alpha4",
"releasedAt": "2026-09-12T00:00:00+00:00",
"provenance": {
"source": "Operator",
"license": "Proprietary"
},
"profiles": [],
"rules": [],
"exclusions": [
{
"id": "editor-html",
"rulesetId": "clearplane-xss",
"ruleId": 1941100,
"target": "QueryValue",
"name": {
"exact": "content"
},
"pathPrefix": "/wp-admin/",
"methods": [
"POST"
]
}
],
"integrityTests": [
{
"id": "editor-content",
"profileId": "standard",
"rulesetId": "clearplane-xss",
"method": "POST",
"path": "/wp-admin/post.php",
"fields": [
{
"target": "QueryValue",
"name": "content",
"value": "<img src=x onerror=alert(1)>"
}
],
"expectedMatchedRuleIds": [],
"expectedSuppressedRuleIds": [
1941100
]
}
]
}