owasp-modsecurity / owasp-modsecurity/ModSecurity
Cannot get REQUEST_FILENAME with %3f (encoded ?) in url path
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
If the url path contains %3f, cannot get real REQUEST_FILENAME.
Logs and dumps
ModSecurity: Warning. Matched "Operator `Gt' with parameter `0' against variable `REQUEST_URI_RAW' (Value: `/path1%3fpath2?query=%3f' ) [file "..."] [line "1"] [id "1"] [rev ""] [msg ""] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "127.0.0.1"] [uri "/path1"] [unique_id "..."] [ref "v4,24t:length"]
ModSecurity: Warning. Matched "Operator `Gt' with parameter `0' against variable `REQUEST_FILENAME' (Value: `/path1' ) [file "..."] [line "2"] [id "2"] [rev ""] [msg ""] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "127.0.0.1"] [uri "/path1"] [unique_id "..."] [ref "v4,14t:length"]
To Reproduce
Test for path: /path1%3fpath2?query=%3f
Expected behavior
Return urldecoded or original filename.
Server (please complete the following information):
- ModSecurity version (and connector): ModSecurity v3.0.6
Rule Set (please complete the following information):
SecRule REQUEST_URI_RAW "@gt 0" "id:1,phase:1,t:length,pass,log,auditlog"
SecRule REQUEST_FILENAME "@gt 0" "id:2,phase:1,t:length,pass,log,auditlog"
Additional context
Add any other context about the problem here.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the request path /path1%3fpath2?query=%3f with the shown REQUEST_URI_RAW and REQUEST_FILENAME rules, then trace the handling of REQUEST_FILENAME relative to the REQUEST_URI_RAW value. Done means REQUEST_FILENAME returns the expected original or URL-decoded filename for this path, with coverage for the encoded question mark case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100