github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 13:56:01 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adds test case for issue #1576

Browse Source
This commit is contained in:
Felipe Zimmerle 2017-11-13 22:32:55 -03:00
parent 3fb71f32d8
commit 68152d8d29
No known key found for this signature in database
GPG Key ID: E6DFB08CE8B11277
2 changed files with 144 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile.am
View File

@ -292,4 +292,4 @@ TESTS+=test/test-cases/regression/directive-sec_rule_script.json
TESTS+=test/test-cases/regression/config-update-target-by-msg.json TESTS+=test/test-cases/regression/config-update-target-by-msg.json
TESTS+=test/test-cases/regression/config-remove_by_msg.json TESTS+=test/test-cases/regression/config-remove_by_msg.json
TESTS+=test/test-cases/regression/variable-WEBAPPID.json TESTS+=test/test-cases/regression/variable-WEBAPPID.json
TESTS+=test/test-cases/regression/issue-1576.json

143
test/test-cases/regression/issue-1576.json Normal file
View File

@ -0,0 +1,143 @@
[
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "JSON array should be handled even without a key (1)",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1576",
"client":{
"ip":"200.249.12.31",
"port":123
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Content-Type": "application/json"
},
"uri":"/?key=value&key=other_value",
"method":"POST",
"body": [
"{",
" \"foo\":\"bar\",",
" \"mod\":\"sec\",",
" \"ops\": [",
" [\"um\", \"um e meio\"], ",
" \"dois\",",
" \"tres\",",
" { \"eins\": [\"zwei\", \"drei\"] }",
" ],",
" \"whee\": \"lhebs\"",
"}"
]
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"expected":{
"debug_log": "zwei\" \\(Variable: ARGS:json.ops.array_3.eins.array_0"
},
"rules":[
"SecRuleEngine On",
"SecRequestBodyAccess On",
"SecRule REQUEST_HEADERS:Content-Type \"application/json\" \"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON\"",
"SecRule ARGS \"asdf\" \"id:'200441',phase:3,log\""
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "JSON array should be handled even without a key (2)",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1576",
"client":{
"ip":"200.249.12.31",
"port":123
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Content-Type": "application/json"
},
"uri":"/?key=value&key=other_value",
"method":"POST",
"body": [
"[",
" \"one\",",
" \"two\",",
" \"three\"",
"]"
]
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"expected":{
"debug_log": "three\" \\(Variable: ARGS:json.array_2\\)"
},
"rules":[
"SecRuleEngine On",
"SecRequestBodyAccess On",
"SecRule REQUEST_HEADERS:Content-Type \"application/json\" \"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON\"",
"SecRule ARGS \"asdf\" \"id:'200441',phase:3,log\""
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "JSON array should be handled even without a key (3)",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1576",
"client":{
"ip":"200.249.12.31",
"port":123
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Content-Type": "application/json"
},
"uri":"/?key=value&key=other_value",
"method":"POST",
"body": [
"{",
" \"foo\":\"bar\",",
" \"mod\":\"sec\",",
" \"ops\": {",
" \"um\": \"um e meio\", ",
" \"dois\": \"tres\",",
" \"quatro\": \"cinco\",",
" \"seis\": {",
" \"dez\": \"onze\",",
" \"doze\": \"treze\"",
" }",
" },",
" \"whee\": \"lhebs\"",
"}"
]
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"expected":{
"debug_log": "treze\" \\(Variable: ARGS:json.ops.seis.doze\\)"
},
"rules":[
"SecRuleEngine On",
"SecRequestBodyAccess On",
"SecRule REQUEST_HEADERS:Content-Type \"application/json\" \"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON\"",
"SecRule ARGS \"asdf\" \"id:'200441',phase:3,log\""
]
}
]