owasp-modsecurity / owasp-modsecurity/ModSecurity
XML parser does not properly return values with anonymous namespaces
@victorhora is already working on this.
Since Sep 25, 2018.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
[4:20:25 PM] chaimsanders:
<soap:Envelope
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
soap:Body
OK
SOMERESULT
/soap:Body
/soap:Envelope
Valid Xpath:
//soap:Body/[local-name()='CreateCIInStockResponse']/[local-name()='Data']/text()
e.php][5] Rule 26ca2d0: SecRule "XML:///soap:Body/[local-name()='CreateCIInStockResponse']/[local-name()='Data']/text()" "!@streq test" "phase:2,log,auditlog,pass,id:165,msg:'Oh boy',xmlns:soap=http://schemas.xmlsoap.org/soap/envelope/"
[21/Oct/2015:16:27:51 --0400] [127.0.0.1/sid#262c538][rid#7fb588002970][/testsite.php][4] Registered XML namespace href "soap" prefix "http://schemas.xmlsoap.org/soap/envelope/".
[21/Oct/2015:16:27:51 --0400] [127.0.0.1/sid#262c538][rid#7fb588002970][/testsite.php][4] Rule returned 0.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.