github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-11-18 18:30:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

Added details about interdependencies of SecXmlExternalEntity directive and @validateSchema operator

Ryan Barnett
2013-09-27 06:13:40 -07:00
parent bcb6c3c858
commit 4a8fc7a660
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Reference-Manual.mediawiki

@@ -1718,6 +1718,8 @@ In the two examples configurations shown, SecWebAppId is being used in conjuncti
'''Default:''' default is Off '''Default:''' default is Off
'''NOTE:''' You must enable this directive if you need to use the <code>@validateSchema</code> or <code>@validateDtd</code> operators.
= Processing Phases = = Processing Phases =
ModSecurity 2.x allows rules to be placed in one of the following five phases of the Apache request cycle: ModSecurity 2.x allows rules to be placed in one of the following five phases of the Apache request cycle:
*Request headers (REQUEST_HEADERS) *Request headers (REQUEST_HEADERS)
@@ -3859,6 +3861,8 @@ SecRule REQUEST_HEADERS:Content-Type ^text/xml$ "phase:1,id:180,nolog,pass,t:low
SecRule XML "@validateDTD /path/to/xml.dtd" "phase:2,id:181,deny,msg:'Failed DTD validation'" SecRule XML "@validateDTD /path/to/xml.dtd" "phase:2,id:181,deny,msg:'Failed DTD validation'"
</pre> </pre>
'''NOTE:''' You must enable the <code>SecXmlExternalEntity</code> directive.
== validateHash == == validateHash ==
'''Description:''' Validates REQUEST_URI that contains data protected by the hash engine. '''Description:''' Validates REQUEST_URI that contains data protected by the hash engine.
@@ -3880,6 +3884,8 @@ SecRule REQUEST_HEADERS:Content-Type ^text/xml$ "phase:1,id:190,nolog,pass,t:low
SecRule XML "@validateSchema /path/to/xml.xsd" "phase:2,id:191,deny,msg:'Failed DTD validation'" SecRule XML "@validateSchema /path/to/xml.xsd" "phase:2,id:191,deny,msg:'Failed DTD validation'"
</pre> </pre>
'''NOTE:''' You must enable the <code>SecXmlExternalEntity</code> directive.
== validateUrlEncoding == == validateUrlEncoding ==
'''Description''': Validates the URL-encoded characters in the provided input string. '''Description''': Validates the URL-encoded characters in the provided input string.