owasp-modsecurity / owasp-modsecurity/ModSecurity
@pmFromFile problems
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Hi, I'm running the official owasp/modsecurity-crs:nginx container with latest CRS version 4.3 and libmodsecurity3 version 3.0.12, I added this rule to my REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf file:
SecRule REQUEST_FILENAME "!@pmFromFile webapp_endpoints.data" \
"id:900998,\
phase:2,\
block,\
capture,\
t:none,\
severity:'CRITICAL',\
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
the file webapp_endpoints.data contains this content:
/index.php
/index2.php
/test.php
Expected result:
all 3 pages should load fine, but only test.php does load for some reason. I think it may be a bug because the documentation for @pmFromFile says that you can use your own boundaries in phrases, like /1.2.3.4/, but I tried that and it doesn't work. Can you reproduce or tell me if it's a modsecurity bug or i'm just doing something wrong?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the rule from REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf with the official nginx container and the webapp_endpoints.data entries. Start by tracing @pmFromFile matching and compare requests for /index.php, /index2.php, and /test.php. Done means determining whether the behavior is a ModSecurity bug or configuration/documentation issue, with a regression test or clear explanation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100