diff --git a/crs-setup.conf.example b/crs-setup.conf.example index 621e2fa0a..99957c6bb 100644 --- a/crs-setup.conf.example +++ b/crs-setup.conf.example @@ -388,9 +388,9 @@ SecDefaultAction "phase:2,log,auditlog,pass" # setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'" # Content-Types that a client is allowed to send in a request. -# Default: application/x-www-form-urlencoded|multipart/form-data|multipart/related|\ -# text/xml|application/xml|application/soap+xml|application/x-amf|application/json|\ -# application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain +# Default: |application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| +# |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| +# |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain| # Uncomment this rule to change the default. #SecAction \ # "id:900220,\ @@ -398,7 +398,7 @@ SecDefaultAction "phase:2,log,auditlog,pass" # nolog,\ # pass,\ # t:none,\ -# setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|multipart/related|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain'" +# setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain|'" # Allowed HTTP versions. # Default: HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 diff --git a/rules/REQUEST-901-INITIALIZATION.conf b/rules/REQUEST-901-INITIALIZATION.conf index 255a42d10..1de9cc6cc 100644 --- a/rules/REQUEST-901-INITIALIZATION.conf +++ b/rules/REQUEST-901-INITIALIZATION.conf @@ -182,7 +182,7 @@ SecRule &TX:allowed_request_content_type "@eq 0" \ pass,\ nolog,\ ver:'OWASP_CRS/3.2.0',\ - setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|multipart/related|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain'" + setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain|'" # Default HTTP policy: allowed_request_content_type_charset (rule 900270) SecRule &TX:allowed_request_content_type_charset "@eq 0" \ diff --git a/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf b/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf index ca5cbf7f3..7bca415f3 100644 --- a/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf +++ b/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf @@ -103,7 +103,7 @@ SecRule REQUEST_FILENAME "@contains /remote.php/dav/files/" \ t:none,\ nolog,\ ver:'OWASP_CRS/3.2.0',\ - setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type}|text/vcard'" + setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |text/vcard|'" # Allow the data type 'application/octet-stream' @@ -116,7 +116,7 @@ SecRule REQUEST_METHOD "@rx ^(?:PUT|MOVE)$" \ ver:'OWASP_CRS/3.2.0',\ chain" SecRule REQUEST_FILENAME "@rx /remote\.php/dav/(?:files|uploads)/" \ - "setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type}|application/octet-stream'" + "setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |application/octet-stream|'" # Allow data types like video/mp4 @@ -290,7 +290,7 @@ SecRule REQUEST_FILENAME "@contains /remote.php/dav/addressbooks/" \ t:none,\ nolog,\ ver:'OWASP_CRS/3.2.0',\ - setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type}|text/vcard'" + setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |text/vcard|'" # Allow modifying contacts via the web interface SecRule REQUEST_METHOD "@streq PUT" \ @@ -315,7 +315,7 @@ SecRule REQUEST_FILENAME "@contains /remote.php/dav/calendars/" \ t:none,\ nolog,\ ver:'OWASP_CRS/3.2.0',\ - setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type}|text/calendar'" + setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |text/calendar|'" # [ Notes ] diff --git a/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf b/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf index b0b8f1792..7003499f6 100644 --- a/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +++ b/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf @@ -964,11 +964,10 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^[^;\s]+" \ tag:'PCI/12.1',\ ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ + setvar:'tx.content_type=|%{tx.0}|',\ chain" - SecRule TX:0 "!@rx ^%{tx.allowed_request_content_type}$" \ - "t:none,\ - ctl:forceRequestBodyVariable=On,\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" + SecRule TX:content_type "!@within %{tx.allowed_request_content_type}" \ + "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # diff --git a/tests/regression/tests/REQUEST-920-PROTOCOL-ENFORCEMENT/920420.yaml b/tests/regression/tests/REQUEST-920-PROTOCOL-ENFORCEMENT/920420.yaml index 3aab60b3e..bcb2563da 100644 --- a/tests/regression/tests/REQUEST-920-PROTOCOL-ENFORCEMENT/920420.yaml +++ b/tests/regression/tests/REQUEST-920-PROTOCOL-ENFORCEMENT/920420.yaml @@ -1,6 +1,6 @@ --- meta: - author: "csanders-git" + author: "csanders-git, Franziska Bühler" enabled: true name: "920420.yaml" description: "Description" @@ -218,4 +218,37 @@ data: "test" output: no_log_contains: "id \"920420\"" + - + test_title: 920420-10 + stages: + - + stage: + input: + dest_addr: "127.0.0.1" + port: 80 + method: "OPTIONS" + headers: + User-Agent: "ModSecurity CRS 3 Tests" + Host: "localhost" + Content-Type: "application/soap+xml" + data: "test" + output: + no_log_contains: "id \"920420\"" + - + test_title: 920420-11 + stages: + - + stage: + input: + dest_addr: "127.0.0.1" + port: 80 + method: "OPTIONS" + headers: + User-Agent: "ModSecurity CRS 3 Tests" + Host: "localhost" + Content-Type: "application" + data: "test" + output: + log_contains: "id \"920420\"" +