owasp-modsecurity / owasp-modsecurity/ModSecurity
Configuration directive SecUploadFileLimit is exclusive
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
The directive SecUploadFileLimit is exclusive, so when we expect to have a maximum of 10 files, we need to put 11 as value.
To Reproduce
Steps to reproduce the behavior:
Just set to directive SecUploadFileLimit to a value 10.
Try to upload 10 files and modsecurity will block the request because the limit is reached.
Expected behavior
If the limit is set to 10, I expect to be able to upload 10 files.
Server (please complete the following information):
- ModSecurity version (and connector): ModSecurity v3.0.6
- WebServer: nginx-1.20.2
- OS (and distro): Linux, Ubuntu with Docker
Rule Set (please complete the following information):
- Running any public or commercial rule set? Public
It might be an expected behavior, but I can't find anywhere that this directive is exclusive.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Reproduce the behavior with ModSecurity v3.0.6 and nginx using SecUploadFileLimit 10, then locate the directive's implementation and related tests. Done means allowing 10 uploaded files when the configured limit is 10, with regression coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100