puppetlabs / puppetlabs/puppetlabs-apache
apache::mod::security::content_types format change (could possibly be bug as well)
Nobody has claimed this yet.
- Dominant language
- Puppet
- Stars
- 356
- Forks
- 1.1k
- Avg merge
- 3m
- Merged PRs (30d)
- 1
Description
https://forge.puppet.com/modules/puppetlabs/apache/reference#content_types
The format of the values of this parameter has been changed. Please see the link below and relevant snippet. Note that this could be classified as a bug since adding values in the old format does not completely work.
https://coreruleset.org/20200701/owasp-modsecurity-core-rule-set-v3-3-0-available/
'''
The format of configuration setting allowed_request_content_type has been changed to be more in line with other variables. If you had manually changed this setting, then you need to update it. Please see the example rule 900220 in the file crs-setup.conf.example. If you didn’t change this setting, you don’t need to do anything.
'''
From the example file, the default values with the new format are
|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain|
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the apache::mod::security::content_types parameter with the linked Puppet Forge documentation and the allowed_request_content_type example in crs-setup.conf.example. Done should mean the documented values use the new format and values supplied in the old format no longer fail or behave incorrectly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100