github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-29 19:24:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

Allow empty arrays in JSON parser

Browse Source 
Issue #1576
This commit is contained in:
Felipe Zimmerle
2018-11-23 22:33:01 -03:00
committed by Felipe Zimmerle
parent 7af8363fd4
commit 25e5543c7f
2 changed files with 177 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

121
tests/regression/rule/15-json.t
View File

@@ -35,5 +35,126 @@
),
),
),
},
{
type => "rule",
comment => "json parser - issue #1576 - 1",
conf => qq(
SecRuleEngine On
SecRequestBodyAccess On
SecDebugLog $ENV{DEBUG_LOG}
SecDebugLogLevel 9
SecRule REQUEST_HEADERS:Content-Type "application/json" \\
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRule ARGS "bar" "id:'200441',phase:3,log"
),
match_log => {
error => [ qr/ModSecurity: Warning. Pattern match "bar" at ARGS:foo.|ModSecurity: JSON support was not enabled/s, 1 ],
debug => [ qr/ARGS:foo|ARGS:mod|ARGS:ops.ops.ops|ARGS:ops.ops.ops|ARGS:ops.ops|ARGS:ops.ops|ARGS:ops.ops.eins.eins|ARGS:ops.ops.eins.eins|ARGS:whee/, 1 ],
},
match_response => {
status => qr/^200$/,
},
request => new HTTP::Request(
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
[
"Content-Type" => "application/json",
],
normalize_raw_request_data(
q(
{
"foo":"bar",
"mod":"sec",
"ops":[
[
"um",
"um e meio"
],
"dois",
"tres",
{
"eins":[
"zwei",
"drei"
]
}
],
"whee":"lhebs"
}
),
),
),
},
{
type => "rule",
comment => "json parser - issue #1576 - 2",
conf => qq(
SecRuleEngine On
SecRequestBodyAccess On
SecDebugLog $ENV{DEBUG_LOG}
SecDebugLogLevel 9
SecRule REQUEST_HEADERS:Content-Type "application/json" \\
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRule ARGS "um" "id:'200441',phase:3,log"
),
match_log => {
error => [ qr/ModSecurity: Warning. Pattern match "um" at ARGS:array.array|ModSecurity: JSON support was not enabled/s, 1 ],
debug => [ qr/ARGS:array.array|ARGS:array.array/, 1 ],
},
match_response => {
status => qr/^200$/,
},
request => new HTTP::Request(
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
[
"Content-Type" => "application/json",
],
normalize_raw_request_data(
q(
[
"um",
"um e meio"
]
),
),
),
},
{
type => "rule",
comment => "json parser - issue #1576 - 3",
conf => qq(
SecRuleEngine On
SecRequestBodyAccess On
SecDebugLog $ENV{DEBUG_LOG}
SecDebugLogLevel 9
SecRule REQUEST_HEADERS:Content-Type "application/json" \\
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRule ARGS "seis" "id:'200441',phase:3,log"
),
match_log => {
error => [ qr/ModSecurity: Warning. Pattern match "seis" at ARGS:array.array.cinco.|ModSecurity: JSON support was not enabled/s, 1 ],
debug => [ qr/ARGS:array.array|ARGS:array.array|ARGS:array.array.tres|ARGS:array.array.cinco/, 1 ],
},
match_response => {
status => qr/^200$/,
},
request => new HTTP::Request(
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
[
"Content-Type" => "application/json",
],
normalize_raw_request_data(
q(
[
"um",
"um e meio",
{
"tres": "quatro",
"cinco": "seis"
}
]
),
),
),
}