github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-29 19:24:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adds support to multiple ranges in ctl:ruleRemoveById

Browse Source 
Issue #1956
This commit is contained in:
Felipe Zimmerle
2018-11-26 20:46:05 -03:00
parent e712d30c56
commit ce3abf2626
7 changed files with 265 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

192
test/test-cases/regression/issue-1956.json Normal file
View File

@@ -0,0 +1,192 @@
[
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "ctl:ruleRemoveById doesn't handle all ranges equally 1",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1956",
"gihub_issue": 1956,
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.google.com"
},
"uri": "\/test.pl?param1= test &param2=<a href=\"javascript:alert(1)\">)",
"body": "",
"method": "GET",
"http_version": 1.1
},
"response": {
"headers": "",
"body": ""
},
"expected": {
"audit_log": "",
"debug_log": "Rule id: 913104 was skipped due to a ruleRemoveById",
"error_log": ""
},
"rules": [
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913103-913105\"",
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:913104,phase:request,pass,nolog,t:none,msg:'whee'\""
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "ctl:ruleRemoveById doesn't handle all ranges equally 2",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1956",
"gihub_issue": 1956,
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.google.com"
},
"uri": "\/test.pl?param1= test &param2=<a href=\"javascript:alert(1)\">)",
"body": "",
"method": "GET",
"http_version": 1.1
},
"response": {
"headers": "",
"body": ""
},
"expected": {
"audit_log": "",
"debug_log": "Rule id: 913104 was skipped due to a ruleRemoveById",
"error_log": ""
},
"rules": [
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913104\"",
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:913104,phase:request,pass,nolog,t:none,msg:'whee'\""
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "ctl:ruleRemoveById doesn't handle all ranges equally 3",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1956",
"gihub_issue": 1956,
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.google.com"
},
"uri": "\/test.pl?param1= test &param2=<a href=\"javascript:alert(1)\">)",
"body": "",
"method": "GET",
"http_version": 1.1
},
"response": {
"headers": "",
"body": ""
},
"expected": {
"audit_log": "",
"debug_log": "Rule id: 913103 was skipped due to a ruleRemoveById",
"error_log": ""
},
"rules": [
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913103-913105\"",
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:913103,phase:request,pass,nolog,t:none,msg:'whee'\""
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "ctl:ruleRemoveById doesn't handle all ranges equally 4",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1956",
"gihub_issue": 1956,
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.google.com"
},
"uri": "\/test.pl?param1= test &param2=<a href=\"javascript:alert(1)\">)",
"body": "",
"method": "GET",
"http_version": 1.1
},
"response": {
"headers": "",
"body": ""
},
"expected": {
"audit_log": "",
"debug_log": "Rule id: 913105 was skipped due to a ruleRemoveById",
"error_log": ""
},
"rules": [
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913103-913105\"",
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:913105,phase:request,pass,nolog,t:none,msg:'whee'\""
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "ctl:ruleRemoveById doesn't handle all ranges equally 5",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1956",
"gihub_issue": 1956,
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "www.google.com"
},
"uri": "\/test.pl?param1= test &param2=<a href=\"javascript:alert(1)\">)",
"body": "",
"method": "GET",
"http_version": 1.1
},
"response": {
"headers": "",
"body": ""
},
"expected": {
"audit_log": "",
"debug_log": "Rule: 913102. Executing operator",
"error_log": ""
},
"rules": [
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:1001,phase:request,pass,nolog,t:none,ctl:ruleRemoveById=913103-913105\"",
"SecRule REQUEST_URI \"@beginsWith /test\" \"id:913102,phase:request,pass,nolog,t:none,msg:'whee'\""
]
}
]