owasp-modsecurity / owasp-modsecurity/ModSecurity
Add support for santization of arguments within the error log
Open
Nobody has claimed this yet.
enhancement
RIP - libmodsecurity
RIP - Type - Feature
TBF by libmodsec
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
In accordance with a recent conversation on the mailing list it seems that the action that would be expected when santiseARGS are the like is used is that it would santise this everywhere except the debug log. Currently the error log is not sanitized.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the santiseARGS setting is handled and where the error log and debug log are produced. Compare the current sanitization behavior across those paths; done means arguments are sanitized in the error log as intended while remaining available in the debug log.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100