owasp-modsecurity / owasp-modsecurity/ModSecurity
Problems with blocking if response is using compression
@zimmerle is already working on this.
Since Jan 6, 2021.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
When blocking a request, which uses output compression (for example Content-Encoding: gzip), in phase 4 (so response headers are already created by application), blocking is NOT done properly because Content-Encoding: gzip will already be send to client so it awaits compressed response - on the client side, browsers will show error similar to this (this one is from Firefox):
Content Encoding Error
To Reproduce
Problem can be easily reproduced using this PHP script and blocking rule:
<?php
@ob_start("ob_gzHandler");
header('X-test-blocking: block-me');
echo 'test';
?>
SecRule &RESPONSE_HEADERS:X-test-blocking "!@eq 0" \
"id:99999999999,\
phase:4,\
deny"
Expected behavior
modsecurity should remove or properly set the Content-Encoding header if request is blocked.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.