github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 05:45:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fixed validateByteRange parsing method

Browse Source
This commit is contained in:
Ervin Hegedus 2019-02-03 13:33:05 +00:00 committed by Felipe Zimmerle
parent 3dda0ea2c6
commit 4b3e6328e3
No known key found for this signature in database
GPG Key ID: E6DFB08CE8B11277
2 changed files with 44 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/operators/validate_byte_range.cc
View File

@ -101,7 +101,7 @@ bool ValidateByteRange::init(const std::string &file,
getRange(std::string(m_param, pos + 1, m_param.length() - getRange(std::string(m_param, pos + 1, m_param.length() -
(pos + 1)), error); (pos + 1)), error);
} else { } else {
getRange(std::string(m_param, pos + 1, next_pos), error); getRange(std::string(m_param, pos + 1, next_pos - (pos + 1)), error);
} }
pos = next_pos; pos = next_pos;
} }

43
test/test-cases/regression/rule-920274.json Normal file
View File

@ -0,0 +1,43 @@
[
{
"enabled":1,
"version_min":300000,
"title":"Testing Byte ranges :: OWASP CRS id:920274",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"Test": "ThisIsATest%60"
},
"uri":"/",
"method":"GET"
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"http_code":400,
"debug_log":"Invalid character in request headers"
},
"rules":[
"SecRuleEngine On",
"SecDefaultAction \"phase:2,deny,block,status:400,log\"",
"SecRule REQUEST_HEADERS|!REQUEST_HEADERS:User-Agent|!REQUEST_HEADERS:Referer|!REQUEST_HEADERS:Cookie \"@validateByteRange 32,34,38,42-59,61,65-90,95,97-122\" \"id:920274,phase:2,block,t:none,t:urlDecodeUni,msg:'Invalid character in request headers (outside of very strict set)',logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',tag:'application-multi',tag:'language-multi',tag:'platform-multi',tag:'attack-protocol',tag:'OWASP_CRS/PROTOCOL_VIOLATION/EVASION',tag:'paranoia-level/4',ver:'OWASP_CRS/3.1.0',severity:'CRITICAL',setvar:'tx.msg=%{rule.msg}',setvar:'tx.anomaly_score_pl4=+%{tx.critical_anomaly_score}',setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/EVASION-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'\""
]
}
]