owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx
Nginx+libmodsecurity and work with gzip
Nobody has claimed this yet.
- Dominant language
- Perl
- Stars
- 1.9k
- Forks
- 312
- PR merge metrics
- No merged PRs in 30d
Description
Hello. I use Nginx 1.20.1 + libmodsecurity-3.0.4-4.el8 as reverse proxy. When we receive request with Content-Encoding: gzip and Content-Type: application/json - activate rule from default modsecurity.conf:
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
As I understand - we recieve data with gzip as binary content, then it send to modsecurity in binary fromat and json parser give error because data is not valid json.
I think, this is actually true for xml and any another data with compression.Is there way to work with compressed data with Modsecurity or workaround? I understand, that i can disable rule for analyze json and xml - but it's bad way, thats affect level of security.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Nginx reverse-proxy setup and the SecRule for REQBODY_ERROR in the default modsecurity.conf, reproducing the request with Content-Encoding: gzip and application/json. Trace how compressed request bodies reach libmodsecurity and define done as a confirmed supported behavior or documented workaround that preserves request-body inspection for JSON and XML.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100