owasp-modsecurity / owasp-modsecurity/ModSecurity

DOC: `SecRuleUpdateActionById` and `chain` docs are errant for both 2.x and 3.x

Open
#2,860 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2.x 3.x documentation
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

The official doc for modsecurity 2.x and 3.x for both SecRuleUpdateActionById and chain are errant. They lead to errant rule writing and/or exposing underlying modsecurity bugs. I request clarification/rewrite of at least these two sections of both 2.x and 3.x docs.

This is a cascade issue from https://github.com/coreruleset/coreruleset/issues/3080#issuecomment-1374575642. I recommend reviewing that whole issue to understand the errant docs and gaps in information.

Doc Problems
  1. SecRuleUpdateActionById doesn't organize limitations/workarounds together; e.g. modsec 2.x SecRuleUpdateActionById on rule chains has a chain workaround (see issue above) and limitation (see issue above) and may have additional behavior/workaround changes in 3.x (I can't test 3.x)
  2. chain has wrong language, e.g. "Non-disruptive rules" should be "Non-disruptive actions"
  3. chain has wrong facts, e.g. "they [non-disruptive actions] will be executed if the rule that contains them matches and not only when the entire chain matches". That statement is false since it has been proven in 2.x (can't test myself in 3.x) that setvar does NOT "not only when the entire chain matches".
  4. Coordinate chain with SecRuleUpdateActionById docs so they match each other's limitations/workarounds.

Docs problems of these areas exist in both 2.x and 3.x docs; sometimes similar, sometimes identical.
I recommend adding some rule + rule update examples to demonstrate how to use them correctly on each 2.x and 3.x. The issue above has premade examples.

Below is one suggestion for the 3.x docs.

Example 3.x docs for SecRuleUpdateActionById
...It has two limitations: it cannot be used to change the ID or phase of a rule. Only the actions that  
can appear only once are overwritten. The actions that are allowed to appear multiple times in a list,  
will be appended to the end of the list.

Example foo bar...

then 3 paragraphs and 2 examples under that is another limitation

Note : If the target rule is a chained rule, action updates may only be made to the main (first) rule in the chain.

These need to be combined together. Perhaps something like

...It has limitations

1. it cannot be used to change the ID or phase of a rule.
2. Only the actions that can appear only once are overwritten. The actions that are allowed to appear  
   multiple times in a list, will be appended to the end of the list.
3. If the target rule is a chained rule, action updates may only be made to the main (first) rule in the chain.  
   This is a tighter restriction than modsecurity 2.x.

Example foo bar...

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the SecRuleUpdateActionById and chain sections in the ModSecurity 2.x and 3.x documentation, then read coreruleset/coreruleset#3080 and its referenced comment for the reported behavior and examples. Compare the limitations, terminology, and workarounds across both versions, and confirm that the rewritten sections and rule examples accurately describe the documented behavior.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.