Skip to content

Commit dfbff09

Browse files
author
Felipe Zimmerle
committed
test case: Adds test case related to #1831 
1 parent 764a2e4 commit dfbff09

File tree

2 files changed

+201
-0
lines changed

2 files changed

+201
-0
lines changed

‎Makefile.am

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ TESTS=
8989
TESTS+=test/test-cases/regression/issue-1591.json
9090
TESTS+=test/test-cases/regression/issue-1785.json
9191
TESTS+=test/test-cases/regression/issue-1812.json
92+
TESTS+=test/test-cases/regression/issue-1831.json
9293
TESTS+=test/test-cases/regression/variable-RESPONSE_HEADERS.json
9394
TESTS+=test/test-cases/regression/config-include.json
9495
TESTS+=test/test-cases/regression/variable-WEBSERVER_ERROR_LOG.json

‎test/test-cases/regression/issue-1831.json

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
[
2+
{
3+
"enabled": 1,
4+
"version_min": 209000,
5+
"version_max": -1,
6+
"title": "Invalid actions break CRS 3.1 on rule 912160",
7+
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
8+
"client": {
9+
"ip": "200.249.12.31",
10+
"port": 2313
11+
},
12+
"server": {
13+
"ip": "200.249.12.31",
14+
"port": 80
15+
},
16+
"request": {
17+
"headers": {
18+
"Host": "net.tutsplus.com",
19+
"User-Agent": "",
20+
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
21+
"Accept-Language": "en-us,en;q=0.5",
22+
"Accept-Encoding": "gzip,deflate",
23+
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
24+
"Keep-Alive": "300",
25+
"Connection": "keep-alive",
26+
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
27+
"Pragma": "no-cache",
28+
"Cache-Control": "no-cache"
29+
},
30+
"uri": "\/test.pl?foo=£&bar=%C2%A3",
31+
"method": "GET",
32+
"http_version": 1.1,
33+
"body": ""
34+
},
35+
"response": {
36+
"headers": {
37+
"Content-Type": "text\/xml; charset=utf-8\n\r",
38+
"Content-Length": "length\n\r"
39+
}
40+
},
41+
"expected": {
42+
"debug_log": "\\\\xc2\\\\xa3"
43+
},
44+
"rules": [
45+
"SecRuleEngine On",
46+
"SecRule ARGS:foo \"^$\" \"id:1,expirevar:'ip.dos_burst_counter=%{tx.dos_burst_time_slice}'"
47+
]
48+
},
49+
{
50+
"enabled": 1,
51+
"version_min": 209000,
52+
"version_max": -1,
53+
"title": "Invalid actions break CRS 3.1 on rule 912160",
54+
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
55+
"client": {
56+
"ip": "200.249.12.31",
57+
"port": 2313
58+
},
59+
"server": {
60+
"ip": "200.249.12.31",
61+
"port": 80
62+
},
63+
"request": {
64+
"headers": {
65+
"Host": "net.tutsplus.com",
66+
"User-Agent": "",
67+
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
68+
"Accept-Language": "en-us,en;q=0.5",
69+
"Accept-Encoding": "gzip,deflate",
70+
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
71+
"Keep-Alive": "300",
72+
"Connection": "keep-alive",
73+
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
74+
"Pragma": "no-cache",
75+
"Cache-Control": "no-cache"
76+
},
77+
"uri": "\/test.pl?foo=£&bar=%C2%A3",
78+
"method": "GET",
79+
"http_version": 1.1,
80+
"body": ""
81+
},
82+
"response": {
83+
"headers": {
84+
"Content-Type": "text\/xml; charset=utf-8\n\r",
85+
"Content-Length": "length\n\r"
86+
}
87+
},
88+
"expected": {
89+
"http_code": 200
90+
},
91+
"rules": [
92+
"SecRuleEngine On",
93+
"SecRule ARGS:foo \".\" \"id:1,setvar:'ip.dos_counter=1',log",
94+
"SecRule ip.dos_counter \".\" \"id:4,log",
95+
"SecRule ARGS:foo \".\" \"id:2,setvar:'!ip.dos_counter',log",
96+
"SecRule ip.dos_counter \".\" \"id:3,log,status:123,block,deny"
97+
]
98+
},
99+
{
100+
"enabled": 1,
101+
"version_min": 209000,
102+
"version_max": -1,
103+
"title": "Invalid actions break CRS 3.1 on rule 912160",
104+
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
105+
"client": {
106+
"ip": "200.249.12.31",
107+
"port": 2313
108+
},
109+
"server": {
110+
"ip": "200.249.12.31",
111+
"port": 80
112+
},
113+
"request": {
114+
"headers": {
115+
"Host": "net.tutsplus.com",
116+
"User-Agent": "",
117+
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
118+
"Accept-Language": "en-us,en;q=0.5",
119+
"Accept-Encoding": "gzip,deflate",
120+
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
121+
"Keep-Alive": "300",
122+
"Connection": "keep-alive",
123+
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
124+
"Pragma": "no-cache",
125+
"Cache-Control": "no-cache"
126+
},
127+
"uri": "\/test.pl?foo=£&bar=%C2%A3",
128+
"method": "GET",
129+
"http_version": 1.1,
130+
"body": ""
131+
},
132+
"response": {
133+
"headers": {
134+
"Content-Type": "text\/xml; charset=utf-8\n\r",
135+
"Content-Length": "length\n\r"
136+
}
137+
},
138+
"expected": {
139+
"http_code": 200,
140+
"debug_log": "Target value: \"1\""
141+
},
142+
"rules": [
143+
"SecRuleEngine On",
144+
"SecRule ARGS:foo \".\" \"id:1,setvar:'global.alerted_970018_iisDefLoc'\"",
145+
"SecRule GLOBAL:alerted_970018_iisDefLoc \".\" \"id:4,log\""
146+
]
147+
},
148+
{
149+
"enabled": 1,
150+
"version_min": 209000,
151+
"version_max": -1,
152+
"title": "Invalid actions break CRS 3.1 on rule 912160",
153+
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
154+
"client": {
155+
"ip": "200.249.12.31",
156+
"port": 2313
157+
},
158+
"server": {
159+
"ip": "200.249.12.31",
160+
"port": 80
161+
},
162+
"request": {
163+
"headers": {
164+
"Host": "net.tutsplus.com",
165+
"User-Agent": "",
166+
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
167+
"Accept-Language": "en-us,en;q=0.5",
168+
"Accept-Encoding": "gzip,deflate",
169+
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
170+
"Keep-Alive": "300",
171+
"Connection": "keep-alive",
172+
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
173+
"Pragma": "no-cache",
174+
"Cache-Control": "no-cache"
175+
},
176+
"uri": "\/test.pl?foo=£&bar=%C2%A3",
177+
"method": "GET",
178+
"http_version": 1.1,
179+
"body": ""
180+
},
181+
"response": {
182+
"headers": {
183+
"Content-Type": "text\/xml; charset=utf-8\n\r",
184+
"Content-Length": "length\n\r"
185+
}
186+
},
187+
"expected": {
188+
"http_code": 200,
189+
"debug_log": "GLOBAL:alerted_970018_iisDefLoc with value: 1"
190+
},
191+
"rules": [
192+
"SecRuleEngine On",
193+
"SecRule ARGS \"@rx .\" \"id:954100,phase:1,block,capture,t:none,t:lowercase,msg:'Disclosure of IIS install location',logdata:'Matched Data',tag:'application-multi',tag:'language-multi',tag:'platform-iis',tag:'platform-windows',tag:'attack-disclosure',ctl:auditLogParts=+E,rev:3,ver:'OWASP_CRS/3.0.0',severity:'ERROR',chain\"",
194+
"SecRule &GLOBAL:alerted_970018_iisDefLoc \"@eq 0\" \"setvar:'global.alerted_970018_iisDefLoc',setvar:'tx.msg=%{rule.msg}',setvar:'tx.outbound_anomaly_score=+%{tx.error_anomaly_score}',setvar:'tx.anomaly_score=+%{tx.error_anomaly_score}'\""
195+
]
196+
}
197+
]
198+
199+
200+

0 commit comments

Comments
 (0)