owasp-modsecurity / owasp-modsecurity/secrules-language-tests

Broken CSS decode test case?

Open
#8 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Perl
Stars
16
Forks
18
No merged PRs in 30d

Description

https://github.com/SpiderLabs/secrules-language-tests/blob/c8cf2c588a93dce20781e597643e1b9d11aa4bba/transformations/cssDecode.json#L24-L28

The linked test case appears to be broken to me. After checking this and the actual code I'm fairly certain that the two spaces after the last null byte should be preserved sice the null byte is not a hexadecimal escape.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open transformations/cssDecode.json at lines 24-28 and compare the expected value with the CSS2 syntax reference and ModSecurity's css_decode.cc. Verify how the test represents spaces following a null byte, then update the test case if the expected output is incorrect and run the repository's test suite to confirm the corrected case passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
css, json
Domain
testing-qa
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.