From 799e97259d58b85d484574bf1a68af9cb0f13b22 Mon Sep 17 00:00:00 2001 From: Fabien Foixet Date: Tue, 8 Oct 2024 17:45:26 +0200 Subject: [PATCH 1/3] Replace hard-coded SecRule argument limit with MODSEC_ARGUMENTS_LIMIT variable --- src/etc/modsecurity.d/modsecurity.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/etc/modsecurity.d/modsecurity.conf b/src/etc/modsecurity.d/modsecurity.conf index 682924d..9b1d118 100644 --- a/src/etc/modsecurity.d/modsecurity.conf +++ b/src/etc/modsecurity.d/modsecurity.conf @@ -43,7 +43,7 @@ SecRule REQUEST_HEADERS:Content-Type "^(?:application(?:/soap\+|/)|text/)xml" \ "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML" SecRule REQUEST_HEADERS:Content-Type "^application/json" \ "id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON" -SecRule &ARGS "@ge 1000" \ +SecRule &ARGS "@ge ${MODSEC_ARGUMENTS_LIMIT}" \ "id:'200007', phase:2,t:none,log,deny,status:400,msg:'Failed to fully parse request body due to large argument count',severity:2" SecRule REQBODY_ERROR "!@eq 0" \ "id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2" From 5bdb736363d5120f22621e51bd4b8d72c28036e3 Mon Sep 17 00:00:00 2001 From: Fabien Foixet Date: Wed, 9 Oct 2024 09:22:09 +0200 Subject: [PATCH 2/3] update modsecurity.conf hash --- .github/workflows/verifyimage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/verifyimage.yml b/.github/workflows/verifyimage.yml index 8d785e1..229bbdd 100644 --- a/.github/workflows/verifyimage.yml +++ b/.github/workflows/verifyimage.yml @@ -7,7 +7,7 @@ on: env: REPO: "owasp/modsecurity-crs" # sha256sum format: - MODSECURITY_RECOMMENDED: "ccff8ba1f12428b34ff41960d8bf773dd9f62b9a7c77755247a027cb01896d4f modsecurity.conf-recommended" + MODSECURITY_RECOMMENDED: "284b0ab56e5f13cba6a804f73dd05646b6f0a6c1a342f69838eca220344d76e5 modsecurity.conf-recommended" jobs: prepare: From 85701d3e7976e156d3613273e12bef79f0b4eeea Mon Sep 17 00:00:00 2001 From: Fabien Foixet Date: Wed, 9 Oct 2024 15:51:18 +0200 Subject: [PATCH 3/3] Revert "update modsecurity.conf hash" This reverts commit 5bdb736363d5120f22621e51bd4b8d72c28036e3. --- .github/workflows/verifyimage.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/verifyimage.yml b/.github/workflows/verifyimage.yml index 229bbdd..8d785e1 100644 --- a/.github/workflows/verifyimage.yml +++ b/.github/workflows/verifyimage.yml @@ -7,7 +7,7 @@ on: env: REPO: "owasp/modsecurity-crs" # sha256sum format: - MODSECURITY_RECOMMENDED: "284b0ab56e5f13cba6a804f73dd05646b6f0a6c1a342f69838eca220344d76e5 modsecurity.conf-recommended" + MODSECURITY_RECOMMENDED: "ccff8ba1f12428b34ff41960d8bf773dd9f62b9a7c77755247a027cb01896d4f modsecurity.conf-recommended" jobs: prepare: