github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-13 21:36:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

Allow 0 length JSON requests

Browse Source 
As discussed at: #1822
This commit is contained in:
Felipe Zimmerle 2018-11-29 10:37:23 -03:00
parent d29f2a8986
commit d2b14de268
No known key found for this signature in database
GPG Key ID: E6DFB08CE8B11277
3 changed files with 76 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES
View File

@ -1,6 +1,8 @@
v3.0.4 - YYYY-MMM-DD (to be released)
-------------------------------------
- Allow 0 length JSON requests.
[Issue #1822 - @allanbomsft, @zimmerle, @victorhora, @marcstern]
- Fix "make dist" target to include default configuration
[Issue #1966 - @defanator]
- Replaced log locking using mutex with fcntl lock

2
src/transaction.cc
View File

@ -734,7 +734,7 @@ int Transaction::processRequestBody() {
&error);
m_json->complete(&error);
}
if (error.empty() == false) {
if (error.empty() == false && m_requestBody.str().size() > 0) {
m_variableReqbodyError.set("1", m_variableOffset);
m_variableReqbodyProcessorError.set("1", m_variableOffset);
m_variableReqbodyErrorMsg.set("JSON parsing error: " + error,

75
test/test-cases/regression/request-body-parser-json.json
View File

@ -2,7 +2,7 @@
{
"enabled":1,
"version_min":300000,
"title":"Testing JSON request body parser 1/1",
"title":"Testing JSON request body parser 1/2",
"expected":{
"debug_log": "Target value: \"bar\" \\(Variable: ARGS:json.foo\\)"
},
@ -41,7 +41,7 @@
{
"enabled":1,
"version_min":300000,
"title":"Testing JSON request body parser 1/1",
"title":"Testing JSON request body parser 2/2",
"expected":{
"debug_log": "Target value: \"bar\" \\(Variable: ARGS:json.first_level.first_key\\)"
},
@ -79,6 +79,77 @@
"SecRule REQUEST_HEADERS:Content-Type \"application/json\" \"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON\"",
"SecRule ARGS \"bar\" \"id:'200441',phase:3,log\""
]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing JSON request body parser - issue #1822 (1/2)",
"expected":{
"debug_log": "Target value: \"0\" .Variable: REQBODY_ERROR."
},
"client":{
"ip":"200.249.12.31",
"port":123
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Content-Type": "application/json"
},
"uri":"/?key=value&key=other_value",
"method":"POST",
"body": [
]
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"rules":[
"SecRuleEngine On",
"SecRequestBodyAccess On",
"SecRule REQUEST_HEADERS:Content-Type \"application/json\" \"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON\"",
"SecRule REQBODY_ERROR \"0\" \"id:'200441',phase:3,log\""
]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing JSON request body parser - issue #1822 (2/2)",
"expected":{
"debug_log": "Target value: \"1\" .Variable: REQBODY_ERROR."
},
"client":{
"ip":"200.249.12.31",
"port":123
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
"Content-Type": "application/json"
},
"uri":"/?key=value&key=other_value",
"method":"POST",
"body": [
"a"
]
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"rules":[
"SecRuleEngine On",
"SecRequestBodyAccess On",
"SecRule REQUEST_HEADERS:Content-Type \"application/json\" \"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON\"",
"SecRule REQBODY_ERROR \"0\" \"id:'200441',phase:3,log\""
]
}
]