github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-30 11:44:32 +03:00
Code Issues Packages Projects Releases Wiki Activity

Better support for multipart

Browse Source 
ModSecurity v2.x parser was ported into 3.x branch.

All the multipart related variables should be workbale.
This commit is contained in:
Felipe Zimmerle
2016-06-08 21:48:02 -03:00
parent 9e5cf2de8e
commit 2e3da7ea24
23 changed files with 4117 additions and 596 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
test/test-cases/regression/request-body-parser-multipart-crlf.json Normal file
View File

@@ -0,0 +1,67 @@
[
{
"enabled":1,
"version_min":300000,
"title":"multipart parser (final CRLF)",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Content-Length":"330",
"Content-Type":"multipart/form-data; boundary=---------------------------69343412719991675451336310646",
"Expect":"100-continue"
},
"uri":"/",
"method":"POST",
"body":[
"-----------------------------69343412719991675451336310646",
"Content-Disposition: form-data; name=\"a\"\r",
"\r",
"1\r",
"1.1\r",
"1.2\r",
"1.3\r",
"-----------------------------69343412719991675451336310646",
"Content-Disposition: form-data; name=\"b\"\r",
"\r",
"2\r",
"2.1\r",
"2.2\r",
"2.3\r",
"-----------------------------69343412719991675451336310646--"
]
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"Target value: \"Adding request argument (BODY): name \"b\", value \"22\.12\.22\.3\""
},
"rules":[
"SecRuleEngine On",
"SecRequestBodyAccess On",
"SecRule MULTIPART_STRICT_ERROR \"@eq 1\" \"phase:2,deny,id:500055\"",
"SecRule MULTIPART_UNMATCHED_BOUNDARY \"@eq 1\" \"phase:2,deny,id:500056\"",
"SecRule REQBODY_PROCESSOR_ERROR \"@eq 1\" \"phase:2,deny,id:500057\"",
"SecRule ARGS_POST \"@eq 1231\" \"phase:2,deny,id:500067\""
]
}
]

2453
test/test-cases/regression/request-body-parser-multipart.json Normal file
View File

File diff suppressed because it is too large Load Diff

8
test/test-cases/regression/variable-FILES.json
View File

@@ -23,21 +23,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
"----------------------------756b6d74fa1a8ee2--"
]
},
"response":{

12
test/test-cases/regression/variable-FILES_COMBINED_SIZE.json
View File

@@ -23,21 +23,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
"----------------------------756b6d74fa1a8ee2--"
]
},
"response":{
@@ -51,13 +51,13 @@
]
},
"expected":{
"debug_log":"Target value: \"74.000000\" \\(Variable: FILES_COMBINED_SIZE\\)"
"debug_log":"Target value: \"70\" \\(Variable: FILES_COMBINED_SIZE\\)"
},
"rules":[
"SecRuleEngine On",
"SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9",
"SecRule FILES_COMBINED_SIZE \"@gt 74.000000\" \"id:1,phase:3,pass,t:trim\""
"SecRule FILES_COMBINED_SIZE \"@gt 70\" \"id:1,phase:3,pass,t:trim\""
]
}
]

8
test/test-cases/regression/variable-FILES_NAMES.json
View File

@@ -23,21 +23,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
"----------------------------756b6d74fa1a8ee2--"
]
},
"response":{

8
test/test-cases/regression/variable-FILES_SIZES.json
View File

@@ -23,21 +23,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
"----------------------------756b6d74fa1a8ee2--"
]
},
"response":{

63
test/test-cases/regression/variable-FILES_TMP_CONTENT.json
View File

@@ -1,63 +0,0 @@
[
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: FILES_NAMES (1/1)",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Content-Length":"330",
"Content-Type":"multipart/form-data; boundary=--------------------------756b6d74fa1a8ee2",
"Expect":"100-continue"
},
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
]
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"trim: \"This is another very small test file.."
},
"rules":[
"SecRuleEngine On",
"SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9",
"SecRule FILES_TMP_CONTENT \"@contains small_text_file.txt\" \"id:1,phase:3,pass,t:trim\""
]
}
]

16
test/test-cases/regression/variable-MULTIPART_CRLF_LF_LINES.json
View File

@@ -23,21 +23,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
"----------------------------756b6d74fa1a8ee2--"
]
},
"response":{
@@ -84,21 +84,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"\r",
"Content-Type: text/plain\r",
"\r",
"This is another very small test file..\r",
"--------------------------756b6d74fa1a8ee2--\r"
"----------------------------756b6d74fa1a8ee2--\r"
]
},
"response":{

16
test/test-cases/regression/variable-MULTIPART_FILENAME.json
View File

@@ -23,21 +23,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
"----------------------------756b6d74fa1a8ee2--"
]
},
"response":{
@@ -84,21 +84,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file2.txt\"\r",
"Content-Type: text/plain\r",
"\r",
"This is another very small test file..\r",
"--------------------------756b6d74fa1a8ee2--\r"
"----------------------------756b6d74fa1a8ee2--\r"
]
},
"response":{

61
test/test-cases/regression/variable-MULTIPART_INVALID_HEADER_FOLDING.json Normal file
View File

@@ -0,0 +1,61 @@
[
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: MULTIPART_INVALID_HEADER_FOLDING",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Content-Length":"330",
"Content-Type":"multipart/form-data; boundary=-----------------------------69343412719991675451336310646",
"Expect":"100-continue"
},
"uri":"/",
"method":"POST",
"body":[
"-------------------------------69343412719991675451336310646",
"Content-Disposition: form-data;",
" name=\"a\"",
"",
"1",
"-------------------------------69343412719991675451336310646",
"Content-Disposition: form-data;",
" name=\"b\"",
"",
"2",
"-------------------------------69343412719991675451336310646--"
]
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"ARGS:a"
},
"rules":[
"SecRule MULTIPART_STRICT_ERROR \"!@eq 1\" \"phase:2,deny,status:403,id:500074\"",
"SecRule MULTIPART_HEADER_FOLDING \"!@eq 1\" \"phase:2,deny,status:403,id:500075\"",
"SecRule MULTIPART_INVALID_HEADER_FOLDING \"!@eq 0\" \"phase:2,deny,status:403,id:500076\"",
"SecRule REQBODY_PROCESSOR_ERROR \"@eq 1\" \"phase:2,deny,status:403,id:500077\"",
"SecRule ARGS \"@eq 1\" \"phase:2,deny,status:403,id:5000277\""
]
}
]

16
test/test-cases/regression/variable-MULTIPART_NAME.json
View File

@@ -23,21 +23,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
"----------------------------756b6d74fa1a8ee2--"
]
},
"response":{
@@ -84,21 +84,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata2\"; filename=\"small_text_file2.txt\"\r",
"Content-Type: text/plain\r",
"\r",
"This is another very small test file..\r",
"--------------------------756b6d74fa1a8ee2--\r"
"----------------------------756b6d74fa1a8ee2--\r"
]
},
"response":{

12
test/test-cases/regression/variable-MULTIPART_STRICT_ERROR.json
View File

@@ -267,21 +267,21 @@
"uri":"/",
"method":"POST",
"body":[
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"name\"",
"",
"test",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is a very small test file..",
"--------------------------756b6d74fa1a8ee2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"filedata\"; filename=\"small_text_file.txt\"",
"Content-Type: text/plain",
"",
"This is another very small test file..",
"--------------------------756b6d74fa1a8ee2--"
"----------------------------756b6d74fa1a8ee2--"
]
},
"response":{
@@ -295,7 +295,7 @@
]
},
"expected":{
"debug_log":"Boundary missing semicolon, setting MULTIPART_STRICT_ERROR to 1"
"debug_log":"Warning: incorrect line endings used \(LF\)"
},
"rules":[
"SecRuleEngine On",
@@ -356,7 +356,7 @@
]
},
"expected":{
"debug_log":"Multipart: Invalid quote, setting MULTIPART_STRICT_ERROR to 1"
"debug_log":"Multipart: Warning: seen data before first boundary"
},
"rules":[
"SecRuleEngine On",