owasp-modsecurity / owasp-modsecurity/ModSecurity
DOC: `SecRuleUpdateActionById` and `chain` docs are errant for both 2.x and 3.x
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
The official doc for modsecurity 2.x and 3.x for both SecRuleUpdateActionById and chain are errant. They lead to errant rule writing and/or exposing underlying modsecurity bugs. I request clarification/rewrite of at least these two sections of both 2.x and 3.x docs.
This is a cascade issue from https://github.com/coreruleset/coreruleset/issues/3080#issuecomment-1374575642. I recommend reviewing that whole issue to understand the errant docs and gaps in information.
Doc Problems
SecRuleUpdateActionByIddoesn't organize limitations/workarounds together; e.g. modsec 2.xSecRuleUpdateActionByIdon rule chains has achainworkaround (see issue above) and limitation (see issue above) and may have additional behavior/workaround changes in 3.x (I can't test 3.x)chainhas wrong language, e.g. "Non-disruptive rules" should be "Non-disruptive actions"chainhas wrong facts, e.g. "they [non-disruptive actions] will be executed if the rule that contains them matches and not only when the entire chain matches". That statement is false since it has been proven in 2.x (can't test myself in 3.x) thatsetvardoes NOT "not only when the entire chain matches".- Coordinate
chainwithSecRuleUpdateActionByIddocs so they match each other's limitations/workarounds.
Docs problems of these areas exist in both 2.x and 3.x docs; sometimes similar, sometimes identical.
I recommend adding some rule + rule update examples to demonstrate how to use them correctly on each 2.x and 3.x. The issue above has premade examples.
Below is one suggestion for the 3.x docs.
Example 3.x docs for SecRuleUpdateActionById
...It has two limitations: it cannot be used to change the ID or phase of a rule. Only the actions that
can appear only once are overwritten. The actions that are allowed to appear multiple times in a list,
will be appended to the end of the list.
Example foo bar...
then 3 paragraphs and 2 examples under that is another limitation
Note : If the target rule is a chained rule, action updates may only be made to the main (first) rule in the chain.
These need to be combined together. Perhaps something like
...It has limitations
1. it cannot be used to change the ID or phase of a rule.
2. Only the actions that can appear only once are overwritten. The actions that are allowed to appear
multiple times in a list, will be appended to the end of the list.
3. If the target rule is a chained rule, action updates may only be made to the main (first) rule in the chain.
This is a tighter restriction than modsecurity 2.x.
Example foo bar...
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the SecRuleUpdateActionById and chain sections in the ModSecurity 2.x and 3.x documentation, then read coreruleset/coreruleset#3080 and its referenced comment for the reported behavior and examples. Compare the limitations, terminology, and workarounds across both versions, and confirm that the rewritten sections and rule examples accurately describe the documented behavior.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100