owasp-modsecurity / owasp-modsecurity/ModSecurity
Inconsistent use of SecArgumentsLimit in Recommended Rules
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
The limit SecArgumentsLimit is inconsistently used an documented.
| v2.9.8 | v3.0.13 | |
|---|---|---|
| Supported (code) | x | ? (could not find it in source code, only in recommended rules) |
| Supported (documentation) | x (2.9.7) | x (3.0.5) |
| ModSecurity Recommended Rules | - | x |
Logs and dumps
Not applicable.
To Reproduce
Not applicable.
Expected behavior
I would expect the recommended rules for v2.9.8 to also include the SecArgumentsLimit configuration, like 3.0.13.
Server (please complete the following information):
- ModSecurity version (and connector): v2.9.8
- WebServer: Not applicable.
- OS (and distro): Not applicable.
Rule Set (please complete the following information):
- Running any public or commercial rule set? ModSecurity Recommended Rules
- What is the version number? v2.9.8
Additional context
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare modsecurity.conf-recommended in v2.9.8 with the v3.0.13 version linked in the issue, then inspect the referenced apache2/apache2_config.c code to confirm SecArgumentsLimit support. Done means the v2 recommended configuration and its documentation consistently reflect the supported setting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100