Commit f034a34

authored

Merge pull request #2799 from martinhsv/v2/master

Adjust parser activation rules in modsecurity.conf-recommended

2 parents 51a30d7 + bb37285 commit f034a34Copy full SHA for f034a34

File tree

-5

lines changed

-5

lines changed

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,8 @@`
`1`	`1`	`DD mmm YYYY - 2.9.x (to be released)`
`2`	`2`	`-------------------`
`3`	`3`
	`4`	`+ * Adjust parser activation rules in modsecurity.conf-recommended`
	`5`	`+ [Issue #2799 - @terjanq, @martinhsv]`
`4`	`6`	`* Multipart parsing fixes and new MULTIPART_PART_HEADERS collection`
`5`	`7`	`[Issue #2797 - @terjanq, @martinhsv]`
`6`	`8`	`* Limit rsub null termination to where necessary`

Lines changed: 3 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -19,21 +19,21 @@ SecRequestBodyAccess On`
`19`	`19`	`# Enable XML request body parser.`
`20`	`20`	`# Initiate XML Processor in case of xml content-type`
`21`	`21`	`#`
`22`		`-SecRule REQUEST_HEADERS:Content-Type "(?:application(?:/soap\+\|/)\|text/)xml" \`
	`22`	`+SecRule REQUEST_HEADERS:Content-Type "^(?:application(?:/soap\+\|/)\|text/)xml" \`
`23`	`23`	`"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"`
`24`	`24`
`25`	`25`	`# Enable JSON request body parser.`
`26`	`26`	`# Initiate JSON Processor in case of JSON content-type; change accordingly`
`27`	`27`	`# if your application does not use 'application/json'`
`28`	`28`	`#`
`29`		`-SecRule REQUEST_HEADERS:Content-Type "application/json" \`
	`29`	`+SecRule REQUEST_HEADERS:Content-Type "^application/json" \`
`30`	`30`	`"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"`
`31`	`31`
`32`	`32`	`# Sample rule to enable JSON request body parser for more subtypes.`
`33`	`33`	`# Uncomment or adapt this rule if you want to engage the JSON`
`34`	`34`	`# Processor for "+json" subtypes`
`35`	`35`	`#`
`36`		`-#SecRule REQUEST_HEADERS:Content-Type "^application/.+[+]json$" \`
	`36`	`+#SecRule REQUEST_HEADERS:Content-Type "^application/[a-z0-9.-]+[+]json" \`
`37`	`37`	`# "id:'200006',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"`
`38`	`38`
`39`	`39`	`# Maximum request body size we will accept for buffering. If you support`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -394,7 +394,7 @@`
`394`	`394`	`SecXmlExternalEntity On`
`395`	`395`	`SecDebugLog $ENV{DEBUG_LOG}`
`396`	`396`	`SecDebugLogLevel 9`
`397`		`- SecRule REQUEST_HEADERS:Content-Type "^text/xml\$" "id:500029, \\`
	`397`	`+ SecRule REQUEST_HEADERS:Content-Type "^(?:application(?:/soap\+\|/)\|text/)xml" "id:500029, \\`
`398`	`398`	`phase:1,t:none,t:lowercase,nolog,pass,ctl:requestBodyProcessor=XML"`
`399`	`399`	`SecRule REQBODY_PROCESSOR "!^XML\$" nolog,pass,skipAfter:12345,id:500030`
`400`	`400`	`SecRule XML "\@validateDTD $ENV{CONF_DIR}/SoapEnvelope-bad.dtd" "id:500031 \\`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -236,7 +236,7 @@`
`236`	`236`	`SecAuditLog "$ENV{AUDIT_LOG}"`
`237`	`237`	`SecDebugLogLevel 9`
`238`	`238`	`SecRequestBodyJsonDepthLimit 3`
`239`		`- SecRule REQUEST_HEADERS:Content-Type "application/json" \\`
	`239`	`+ SecRule REQUEST_HEADERS:Content-Type "^application/json" \\`
`240`	`240`	`"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"`
`241`	`241`	`SecRule REQBODY_ERROR "!\@eq 0" "id:'200444',phase:2,log,deny,status:403,msg:'Failed to parse request body'"`
`242`	`242`	`SecRule ARGS "\@streq 25" "id:'200445',phase:2,log,deny,status:403"`

Comments

(0)