Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit a6b287e

Browse files
authored
Merge pull request #3225 from airween/v3/mpinvcharreqbody
feat: Check if the MP header contains invalid character
2 parents 718d121 + 6388d88 commit a6b287e

File tree

2 files changed

+63
-0
lines changed

2 files changed

+63
-0
lines changed

‎src/request_body_processor/multipart.cc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -916,6 +916,18 @@ int Multipart::process_part_header(std::string *error, int offset) {
916916
return false;
917917
}
918918

919+
/* check if multipart header contains any invalid characters */
920+
for (const auto& ch : header_name) {
921+
if (ch < 33 || ch > 126) {
922+
ms_dbg_a(m_transaction, 1,
923+
"Multipart: Invalid part header " \
924+
"(contains invalid character).");
925+
error->assign("Multipart: Invalid part header "\
926+
"(contains invalid character).");
927+
return false;
928+
}
929+
}
930+
919931
/* extract the value value */
920932
data++;
921933
i++;

‎test/test-cases/regression/request-body-parser-multipart.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3294,5 +3294,56 @@
32943294
"SecRequestBodyAccess On",
32953295
"SecRule ARGS:namea \"@streq 111\" \"phase:2,deny,id:500096\""
32963296
]
3297+
},
3298+
{
3299+
"enabled":1,
3300+
"version_min":300000,
3301+
"title":"multipart parser (invalid part header - contains invalid character)",
3302+
"client":{
3303+
"ip":"200.249.12.31",
3304+
"port":123
3305+
},
3306+
"server":{
3307+
"ip":"200.249.12.31",
3308+
"port":80
3309+
},
3310+
"request":{
3311+
"headers":{
3312+
"Host":"localhost",
3313+
"User-Agent":"curl/7.38.0",
3314+
"Accept":"*/*",
3315+
"Content-Length":"330",
3316+
"Content-Type":"multipart/form-data; boundary=a",
3317+
"Expect":"100-continue"
3318+
},
3319+
"uri":"/",
3320+
"method":"POST",
3321+
"body":[
3322+
"--a\r",
3323+
"\u000eContent-Disposition\u000e: form-data; name=\"file\"; filename=\"1.jsp\"\r",
3324+
"Content-Disposition: form-data; name=\"post\";\r",
3325+
"\r",
3326+
"<%out.print(123)%>\r",
3327+
"--a--\r"
3328+
]
3329+
},
3330+
"response":{
3331+
"headers":{
3332+
"Date":"2015年7月13日 20:02:41 GMT",
3333+
"Last-Modified":"2014年10月26日 22:33:37 GMT",
3334+
"Content-Type":"text/html"
3335+
},
3336+
"body":[
3337+
"no need."
3338+
]
3339+
},
3340+
"expected":{
3341+
"http_code":403,
3342+
"debug_log":"Multipart: Invalid part header \\(contains invalid character\\)"
3343+
},
3344+
"rules":[
3345+
"SecruleEngine On",
3346+
"SecRule REQBODY_PROCESSOR_ERROR \"@eq 1\" \"phase:2,deny,status:403,id:500077\""
3347+
]
32973348
}
32983349
]

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /