github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-29 19:24:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

Support configurable limit on depth of JSON parsing

Browse Source
This commit is contained in:
Martin Vierula
2021-11-18 17:35:40 -08:00
parent 199cf5da91
commit 41918335fa
6 changed files with 135 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
tests/regression/rule/15-json.t
View File

@@ -156,5 +156,74 @@
),
),
),
},
{
type => "rule",
comment => "json parser - parsing depth not exceeded",
conf => qq(
SecRuleEngine On
SecRequestBodyAccess On
SecDebugLog $ENV{DEBUG_LOG}
SecDebugLogLevel 9
SecRequestBodyJsonDepthLimit 5
SecRule REQUEST_HEADERS:Content-Type "application/json" \\
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRule REQBODY_ERROR "!\@eq 0" "id:'200442',phase:2,log,deny,status:403,msg:'Failed to parse request body'"
),
match_log => {
debug => [ qr/key/s, 1 ],
},
match_response => {
status => qr/^200$/,
},
request => new HTTP::Request(
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
[
"Content-Type" => "application/json",
],
normalize_raw_request_data(
q(
{
"key1":{"key2":{"key3":{"key4":{"key5":"thevalue"}}}}
}
),
),
),
},
{
type => "rule",
comment => "json parser - parsing depth exceeded",
conf => qq(
SecRuleEngine On
SecRequestBodyAccess On
SecDebugLog $ENV{DEBUG_LOG}
SecAuditEngine RelevantOnly
SecAuditLog "$ENV{AUDIT_LOG}"
SecDebugLogLevel 9
SecRequestBodyJsonDepthLimit 3
SecRule REQUEST_HEADERS:Content-Type "application/json" \\
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRule REQBODY_ERROR "!\@eq 0" "id:'200443',phase:2,log,deny,status:403,msg:'Failed to parse request body'"
),
match_log => {
audit => [ qr/JSON parsing error: JSON depth limit exceeded/s, 1 ],
},
match_response => {
status => qr/^403$/,
},
request => new HTTP::Request(
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
[
"Content-Type" => "application/json",
],
normalize_raw_request_data(
q(
{
"key1":{"key2":{"key3":{"key4":{"key5":"thevalue"}}}}
}
),
),
),
}