From 60960a1f0f405ac37c00132cce13fac03ed2b2cb Mon Sep 17 00:00:00 2001 From: brenosilva Date: Mon, 23 Jul 2012 18:02:29 +0000 Subject: [PATCH] Update Reference Manual --- CHANGES | 12 ++++ doc/Reference_Manual.html | 147 +++++++++++++++++++++----------------- 2 files changed, 95 insertions(+), 64 deletions(-) diff --git a/CHANGES b/CHANGES index d8f1604a..f1c004df 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,15 @@ +23 Jul 2012 - 2.6.7 +------------------- + + * Fixed PCRE mismtach version warning message (Thanks Victor Julien). + + * Fixed explicit target replacement using SecUpdateTargetById was broken. + + * The ctl:ruleUpdateTargetById is deprecated and will be removed for future versions since + there is no safe way to use it per-request. + + * Added ctl:ruleRemoveTargetById that can be used to exclude targets to be processed per-request. + 22 Jun 2012 - 2.7.0-rc2 ------------------- diff --git a/doc/Reference_Manual.html b/doc/Reference_Manual.html index c7a72c24..ba98326b 100644 --- a/doc/Reference_Manual.html +++ b/doc/Reference_Manual.html @@ -9,26 +9,30 @@ lang="en"> - + + + +href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Special:RecentChanges&feed=rss"> +href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Special:RecentChanges&feed=atom"> SourceForge.net: Reference Manual - mod-security - - @@ -41,7 +45,7 @@ type="text/css"> var wgScript = "/apps/mediawiki/mod-security/index.php"; var wgVariantArticlePath = false; var wgActionPaths = {}; - var wgServer = "http://sourceforge.net"; + var wgServer = "https://sourceforge.net"; var wgCanonicalNamespace = ""; var wgCanonicalSpecialPageName = false; var wgNamespaceNumber = 0; @@ -50,12 +54,12 @@ type="text/css"> var wgAction = "view"; var wgArticleId = "12"; var wgIsArticle = true; - var wgUserName = null; - var wgUserGroups = null; + var wgUserName = "Brenosilva"; + var wgUserGroups = ["admin", "editor", "*", "user", "autoconfirmed"]; var wgUserLanguage = "en"; var wgContentLanguage = "en"; var wgBreakFrames = false; - var wgCurRevisionId = 502; + var wgCurRevisionId = 507; var wgVersion = "1.15.1"; var wgEnableAPI = true; var wgEnableWriteAPI = true; @@ -63,11 +67,13 @@ type="text/css"> var wgDigitTransformTable = ["", ""]; var wgRestrictionEdit = []; var wgRestrictionMove = []; + var wgAjaxWatch = {"watchMsg": "Watch", "unwatchMsg": "Unwatch", "watchingMsg": "Watching…", "unwatchingMsg": "Unwatching…"}; /*]]>*/ + @@ -2604,6 +2610,9 @@ example, lets say you want to only inspect ARGS for a particular URL: 

SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetById=958895;REQUEST_URI;REQUEST_FILENAME"
+
Note 
This ctl is deprecated and will be removed +from the code, since we cannot use it per-transaction. +

SecRuleUpdateTargetByMsg

Description: Updates the target (variable) list of the @@ -2653,18 +2662,6 @@ target to the end of the variable list as follows: "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=% {tx.0}"" -

Conditionally Appending Targets -

You could also do the same by using the ctl action. This is -useful if you want to only update the targets for a particular URL -

-
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='System Command Injection';!ARGS:email"
-
-

Conditionally Replacing Targets -

You could also replace targets using the ctl action. For -example, lets say you want to only inspect ARGS for a particular URL: -

-
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='System Command Injection';REQUEST_URI;REQUEST_FILENAME"
-

SecRuleUpdateTargetByTag

Description: Updates the target (variable) list of the @@ -2714,18 +2711,6 @@ target to the end of the variable list as follows: "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=% {tx.0}"" -

Conditionally Appending Targets -

You could also do the same by using the ctl action. This is -useful if you want to only update the targets for a particular URL -

-
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='WASCTC/WASC-31';!ARGS:email"
-
-

Conditionally Replacing Targets -

You could also replace targets using the ctl action. For -example, lets say you want to only inspect ARGS for a particular URL: -

-
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='WASCTC/WASC-31';REQUEST_URI;REQUEST_FILENAME"
-

SecServerSignature

Description: Instructs ModSecurity to change the data @@ -2932,7 +2917,7 @@ five phases of the Apache request cycle:

Below is a diagram of the standard Apache Request Cycle. In the diagram, the 5 ModSecurity processing phases are shown.

@@ -4511,9 +4496,10 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml "nolog,pass,ctl:requestBodyProcessor=XML"

  • ruleRemoveById - since this action us triggered at run time, it should be specified before the rule in which it is disabling. -
  • ruleUpdateTargetById -
  • ruleUpdateTargetByMsg -
  • ruleUpdateTargetByTag +
  • ruleUpdateTargetById - This is deprecated and will be +removed from the code. Use ruleRemoveTargetById for per-request +exceptions. +
  • ruleRemoveTargetById
  • ruleRemoveByMsg
  • encryptionEngine
  • encryptionEnforcement @@ -6247,16 +6233,16 @@ SecCookieFormat 0 - +
    Retrieved from "http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual"
    +href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual">https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual"
    @@ -6269,18 +6255,30 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Referen @@ -6290,6 +6288,24 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Referen
    @@ -6297,7 +6313,7 @@ cellspacing="0"> @@ -6306,24 +6322,24 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Main_Pa
    @@ -6348,22 +6364,25 @@ value="Search" title="Search the pages for this text" type="submit">
    @@ -6375,15 +6394,15 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Referen src="Reference_Manual_files/poweredby_mediawiki_88x31.png" alt="Powered by MediaWiki"> - +