Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit 08faa44

Browse files
lifeformslifeforms
authored
Merge pull request #1532 from airween/v3.2/ordercheck
Code cosmetics: reorder the actions of rules
2 parents 2f7f6fe + e3fe5c8 commit 08faa44

15 files changed

+26
-26
lines changed

‎rules/REQUEST-911-METHOD-ENFORCEMENT.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}" \
4040
tag:'OWASP_TOP_10/A6',\
4141
tag:'OWASP_AppSensor/RE1',\
4242
tag:'PCI/12.1',\
43-
severity:'CRITICAL',\
4443
ver:'OWASP_CRS/3.2.0',\
44+
severity:'CRITICAL',\
4545
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
4646

4747

‎rules/REQUEST-912-DOS-PROTECTION.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,11 @@ SecRule IP:DOS_BLOCK "@eq 1" \
105105
"id:912120,\
106106
phase:1,\
107107
drop,\
108+
msg:'Denial of Service (DoS) attack identified from %{tx.real_ip} (%{tx.dos_block_counter} hits since last alert)',\
108109
tag:'application-multi',\
109110
tag:'language-multi',\
110111
tag:'platform-multi',\
111112
tag:'attack-dos',\
112-
msg:'Denial of Service (DoS) attack identified from %{tx.real_ip} (%{tx.dos_block_counter} hits since last alert)',\
113113
chain"
114114
SecRule &IP:DOS_BLOCK_FLAG "@eq 0" \
115115
"setvar:'ip.dos_block_counter=+1',\

‎rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -895,6 +895,7 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^[^;\s]+" \
895895
"id:920420,\
896896
phase:2,\
897897
block,\
898+
capture,\
898899
t:none,\
899900
msg:'Request content type is not allowed by policy',\
900901
logdata:'%{MATCHED_VAR}',\
@@ -910,7 +911,6 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^[^;\s]+" \
910911
tag:'PCI/12.1',\
911912
ver:'OWASP_CRS/3.2.0',\
912913
severity:'CRITICAL',\
913-
capture,\
914914
chain"
915915
SecRule TX:0 "!@rx ^%{tx.allowed_request_content_type}$" \
916916
"t:none,\
@@ -925,6 +925,7 @@ SecRule REQUEST_HEADERS:Content-Type "@rx charset\s*=\s*([^;\s]+)" \
925925
"id:920480,\
926926
phase:1,\
927927
block,\
928+
capture,\
928929
t:none,t:lowercase,\
929930
msg:'Request content type charset is not allowed by policy',\
930931
logdata:'%{MATCHED_VAR}',\
@@ -940,7 +941,6 @@ SecRule REQUEST_HEADERS:Content-Type "@rx charset\s*=\s*([^;\s]+)" \
940941
tag:'PCI/12.1',\
941942
ver:'OWASP_CRS/3.2.0',\
942943
severity:'CRITICAL',\
943-
capture,\
944944
chain"
945945
SecRule TX:1 "!@rx ^%{tx.allowed_request_content_type_charset}$" \
946946
"t:none,\

‎rules/REQUEST-921-PROTOCOL-ATTACK.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,8 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
6868
block,\
6969
capture,\
7070
t:none,t:urlDecodeUni,t:lowercase,\
71-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
7271
msg:'HTTP Response Splitting Attack',\
72+
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
7373
tag:'application-multi',\
7474
tag:'language-multi',\
7575
tag:'platform-multi',\
@@ -89,8 +89,8 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
8989
block,\
9090
capture,\
9191
t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,\
92-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
9392
msg:'HTTP Response Splitting Attack',\
93+
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
9494
tag:'application-multi',\
9595
tag:'language-multi',\
9696
tag:'platform-multi',\

‎rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,8 +107,8 @@ SecRule REQUEST_FILENAME "@pmFromFile restricted-files.data" \
107107
block,\
108108
capture,\
109109
t:none,t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase,\
110-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
111110
msg:'Restricted File Access Attempt',\
111+
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
112112
tag:'application-multi',\
113113
tag:'language-multi',\
114114
tag:'platform-multi',\

‎rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -584,8 +584,8 @@ SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEAD
584584
block,\
585585
capture,\
586586
t:none,t:lowercase,\
587-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
588587
msg:'Restricted File Upload Attempt',\
588+
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
589589
tag:'application-multi',\
590590
tag:'language-multi',\
591591
tag:'platform-multi',\

‎rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -704,16 +704,13 @@ SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEAD
704704
# See issue #654 for discussion.
705705
#
706706
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pm ?>" \
707-
"msg:'PHP Injection Attack: PHP Closing Tag Found',\
707+
"id:933190,\
708708
phase:2,\
709-
ver:'OWASP_CRS/3.2.0',\
710-
t:none,t:urlDecodeUni,\
711-
ctl:auditLogParts=+E,\
712709
block,\
713710
capture,\
711+
t:none,t:urlDecodeUni,\
712+
msg:'PHP Injection Attack: PHP Closing Tag Found',\
714713
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
715-
id:933190,\
716-
severity:'CRITICAL',\
717714
tag:'application-multi',\
718715
tag:'language-php',\
719716
tag:'platform-multi',\
@@ -722,6 +719,9 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
722719
tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\
723720
tag:'OWASP_TOP_10/A1',\
724721
tag:'paranoia-level/3',\
722+
ctl:auditLogParts=+E,\
723+
ver:'OWASP_CRS/3.2.0',\
724+
severity:'CRITICAL',\
725725
setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\
726726
setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
727727

‎rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
5050
phase:2,\
5151
block,\
5252
capture,\
53-
multiMatch,\
5453
t:none,t:urlDecodeUni,t:base64Decode,\
5554
msg:'Node.js Injection Attack',\
5655
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
@@ -64,6 +63,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
6463
ctl:auditLogParts=+E,\
6564
ver:'OWASP_CRS/3.2.0',\
6665
severity:'CRITICAL',\
66+
multiMatch,\
6767
setvar:'tx.rce_injection_score=+%{tx.critical_anomaly_score}',\
6868
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
6969

‎rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -959,8 +959,8 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
959959
tag:'OWASP_CRS/WEB_ATTACK/XSS',\
960960
tag:'OWASP_TOP_10/A7',\
961961
tag:'CAPEC-63',\
962-
ctl:auditLogParts=+E,\
963962
tag:'paranoia-level/2',\
963+
ctl:auditLogParts=+E,\
964964
ver:'OWASP_CRS/3.2.0',\
965965
severity:'CRITICAL',\
966966
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\

‎rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1079,8 +1079,8 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU
10791079
block,\
10801080
capture,\
10811081
t:none,t:urlDecodeUni,\
1082-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
10831082
msg:'SQL Injection Attack',\
1083+
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
10841084
tag:'application-multi',\
10851085
tag:'language-multi',\
10861086
tag:'platform-multi',\

0 commit comments

Comments
 (0)