owasp-modsecurity / owasp-modsecurity/ModSecurity

Log output for JSON/XML error msg has an extra newline in it

Open
#2,278 3 comments 0 reactions 1 assignee View on GitHub

@zimmerle is already working on this.

Since Mar 9, 2020.

3.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug

There is just a straight up newline in the error msg between XML/JSON parse error prints, example below:

ModSecurity: Access denied with code 400 (phase 2). Matched "Operator `Eq' with parameter `0' against variable `REQBODY_ERROR' (Value: `1' ) [file "/ModSecurity/modsecurity.conf"] [line "14"] [id "200002"] [rev ""] [msg "Failed to parse request body."] [data "JSON parsing error: parse error: trailing garbage\x0a"] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.129.99.196"] [uri "/F5/status"] [unique_id "158348520836.962520"] [ref "v456,1"]

Latest version etc. The reason this was obnoxious was I for the longest time thought ModSec was telling me WHAT was in the payload that was the trailing garbage, being a newline(hex \x0a) after the JSON or something lol ... which is actually valid JSON anyways according to the RFC. When really its just a message to inform you there is something wrong.

So to fix this issue please fix the error print log for json/xml parsing to not include the
[data "JSON parsing error: parse error: trailing garbage\x0a"] print statement. So fixed would look like: [data "JSON parsing error: parse error: trailing garbage"]

Fix is somewhere here, just need to strip the newline from the error var output of your 3rd party dependencies, I am C scrub so I leave it to the pros 😄

https://github.com/SpiderLabs/ModSecurity/blob/v3/master/src/transaction.cc#L839
https://github.com/SpiderLabs/ModSecurity/blob/v3/master/src/transaction.cc#L814

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.