mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2026-01-13 15:07:10 +03:00
Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines (MODSEC-126).
This commit is contained in:
@@ -5804,8 +5804,8 @@ end</programlisting>
|
||||
<orderedlist continuation="restarts" inheritnum="ignore">
|
||||
<listitem>
|
||||
<para>The contents of the files should be one phrase per line. End
|
||||
of line markers will be stripped from the phrases, however,
|
||||
whitespace will not be trimmed from phrases in the file. Empty lines
|
||||
of line markers will be stripped from the phrases (LF and CRLF), and
|
||||
whitespace is trimmed from both sides of the phrases. Empty lines
|
||||
and comment lines (beginning with a '#') are ignored.</para>
|
||||
</listitem>
|
||||
|
||||
@@ -5815,6 +5815,24 @@ end</programlisting>
|
||||
path of the file containing the rule is prepended to the phrase file
|
||||
path.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>To allow easier matching of whole IP addresses, you can add
|
||||
boundary characters to the phrases. For example, use "/1.2.3.4/"
|
||||
instead of "1.2.3.4". You can then insert these characters into the
|
||||
target prior to a match:</para>
|
||||
|
||||
<programlisting format="linespecific">SecAction "phase:1,pass,nolog,setvar:tx.remote_addr=/%{REMOTE_ADDR}/"
|
||||
SecRule TX:REMOTE_ADDR "<emphasis>@pmFromFile ip-blacklist.txt</emphasis>" "deny,status:403
|
||||
|
||||
# ip-blacklist.txt contents:
|
||||
# NOTE: All IPs must be prefixed/suffixed with "/" as the rules
|
||||
# will add in this character as a boundary to ensure
|
||||
# the entire IP is matched.
|
||||
# SecAction "phase:1,pass,nolog,setvar:tx.remote_addr='/%{REMOTE_ADDR}/'"
|
||||
/1.2.3.4/
|
||||
/5.6.7.8/</programlisting>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>Example:</para>
|
||||
|
||||
Reference in New Issue
Block a user