owasp-modsecurity / owasp-modsecurity/ModSecurity

Configuration directive SecUploadFileLimit is exclusive

Open
#2,766 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

3.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug

The directive SecUploadFileLimit is exclusive, so when we expect to have a maximum of 10 files, we need to put 11 as value.

To Reproduce

Steps to reproduce the behavior:

Just set to directive SecUploadFileLimit to a value 10.
Try to upload 10 files and modsecurity will block the request because the limit is reached.

Expected behavior

If the limit is set to 10, I expect to be able to upload 10 files.

Server (please complete the following information):

  • ModSecurity version (and connector): ModSecurity v3.0.6
  • WebServer: nginx-1.20.2
  • OS (and distro): Linux, Ubuntu with Docker

Rule Set (please complete the following information):

  • Running any public or commercial rule set? Public

It might be an expected behavior, but I can't find anywhere that this directive is exclusive.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Reproduce the behavior with ModSecurity v3.0.6 and nginx using SecUploadFileLimit 10, then locate the directive's implementation and related tests. Done means allowing 10 uploaded files when the configured limit is 10, with regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, nginx
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.