puppetlabs / puppetlabs/puppetlabs-apache

apache::mod::security::content_types format change (could possibly be bug as well)

Open
#2,549 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

community
Dominant language
Puppet
Stars
356
Forks
1.1k
Avg merge
3m
Merged PRs (30d)
1

Description

https://forge.puppet.com/modules/puppetlabs/apache/reference#content_types

The format of the values of this parameter has been changed. Please see the link below and relevant snippet. Note that this could be classified as a bug since adding values in the old format does not completely work.

https://coreruleset.org/20200701/owasp-modsecurity-core-rule-set-v3-3-0-available/
'''
The format of configuration setting allowed_request_content_type has been changed to be more in line with other variables. If you had manually changed this setting, then you need to update it. Please see the example rule 900220 in the file crs-setup.conf.example. If you didn’t change this setting, you don’t need to do anything.
'''

From the example file, the default values with the new format are

|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain|

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the apache::mod::security::content_types parameter with the linked Puppet Forge documentation and the allowed_request_content_type example in crs-setup.conf.example. Done should mean the documented values use the new format and values supplied in the old format no longer fail or behave incorrectly.

Written by the indexing model from the issue text.

Assessment

Tech stack
apache
Domain
devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.