diff --git a/internal/waf/rule.go b/internal/waf/rule.go
index 9633dbe..7af5fda 100644
--- a/internal/waf/rule.go
+++ b/internal/waf/rule.go
@@ -384,13 +384,16 @@ func (this *Rule) Test(value interface{}) bool {
 		return !utils.MatchStringCache(this.reg, types.String(value))
 	case RuleOperatorContains:
 		if types.IsSlice(value) {
-			ok := false
-			lists.Each(value, func(k int, v interface{}) {
-				if types.String(v) == this.Value {
-					ok = true
-				}
-			})
-			return ok
+			_, isBytes := value.([]byte)
+			if !isBytes {
+				ok := false
+				lists.Each(value, func(k int, v interface{}) {
+					if types.String(v) == this.Value {
+						ok = true
+					}
+				})
+				return ok
+			}
 		}
 		if types.IsMap(value) {
 			lowerValue := ""