Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit 34885b6

Browse files
authored
Merge pull request #1520 from lifeforms/redis-dump-files
restricted_extensions: add .rdb (Redis dump file)
2 parents 2ec8dd8 + c5bc088 commit 34885b6

File tree

3 files changed

+107
-94
lines changed

3 files changed

+107
-94
lines changed

crs-setup.conf.example

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -417,16 +417,16 @@ SecDefaultAction "phase:2,log,auditlog,pass"
417417

418418
# Forbidden file extensions.
419419
# Guards against unintended exposure of development/configuration files.
420-
# Default: .asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/
421-
# Example: .bak/ .config/ .conf/ .db/ .ini/ .log/ .old/ .pass/ .pdb/ .sql/
420+
# Default: .asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/
421+
# Example: .bak/ .config/ .conf/ .db/ .ini/ .log/ .old/ .pass/ .pdb/ .rdb/ .sql/
422422
# Uncomment this rule to change the default.
423423
#SecAction \
424424
# "id:900240,\
425425
# phase:1,\
426426
# nolog,\
427427
# pass,\
428428
# t:none,\
429-
# setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"
429+
# setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"
430430

431431
# Forbidden request headers.
432432
# Header names should be lowercase, enclosed by /slashes/ as delimiters.

rules/REQUEST-901-INITIALIZATION.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ SecRule &TX:restricted_extensions "@eq 0" \
192192
phase:1,\
193193
pass,\
194194
nolog,\
195-
setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"
195+
setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"
196196

197197
# Default HTTP policy: restricted_headers (rule 900250)
198198
SecRule &TX:restricted_headers "@eq 0" \
Lines changed: 103 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,100 +1,113 @@
11
---
2-
meta:
3-
author: csanders-git
4-
description: None
5-
enabled: true
6-
name: 920440.yaml
7-
tests:
8-
-
9-
test_title: 920440-1
2+
meta:
3+
author: csanders-git
4+
description: None
5+
enabled: true
6+
name: 920440.yaml
7+
tests:
8+
- test_title: 920440-1
109
desc: URL file extension is restricted by policy (920440) from old modsec regressions
1110
stages:
12-
-
13-
stage:
14-
input:
15-
dest_addr: 127.0.0.1
16-
headers:
17-
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18-
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
19-
Accept-Encoding: gzip,deflate
20-
Accept-Language: en-us,en;q=0.5
21-
Host: localhost
22-
Keep-Alive: '300'
23-
Proxy-Connection: keep-alive
24-
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
25-
method: GET
26-
port: 80
27-
uri: /foo.bak
28-
version: HTTP/1.1
29-
output:
30-
log_contains: id "920440"
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
16+
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
17+
Accept-Encoding: gzip,deflate
18+
Accept-Language: en-us,en;q=0.5
19+
Host: localhost
20+
Keep-Alive: "300"
21+
Proxy-Connection: keep-alive
22+
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
23+
method: GET
24+
port: 80
25+
uri: /foo.bak
26+
version: HTTP/1.1
27+
output:
28+
log_contains: id "920440"
3129

32-
-
33-
test_title: 920440-2
30+
- test_title: 920440-2
3431
desc: URL file extension is restricted by policy (920440) from old modsec regressions
3532
stages:
36-
-
37-
stage:
38-
input:
39-
dest_addr: 127.0.0.1
40-
headers:
41-
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
42-
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
43-
Accept-Encoding: gzip,deflate
44-
Accept-Language: en-us,en;q=0.5
45-
Host: localhost
46-
Keep-Alive: '300'
47-
Proxy-Connection: keep-alive
48-
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
49-
method: GET
50-
port: 80
51-
uri: /foo.db
52-
version: HTTP/1.1
53-
output:
54-
log_contains: id "920440"
55-
-
56-
test_title: 920440-3
33+
- stage:
34+
input:
35+
dest_addr: 127.0.0.1
36+
headers:
37+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
38+
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
39+
Accept-Encoding: gzip,deflate
40+
Accept-Language: en-us,en;q=0.5
41+
Host: localhost
42+
Keep-Alive: "300"
43+
Proxy-Connection: keep-alive
44+
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
45+
method: GET
46+
port: 80
47+
uri: /foo.db
48+
version: HTTP/1.1
49+
output:
50+
log_contains: id "920440"
51+
- test_title: 920440-3
5752
desc: URL file extension is restricted by policy (920440) from old modsec regressions
5853
stages:
59-
-
60-
stage:
61-
input:
62-
dest_addr: 127.0.0.1
63-
headers:
64-
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
65-
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
66-
Accept-Encoding: gzip,deflate
67-
Accept-Language: en-us,en;q=0.5
68-
Host: localhost
69-
Keep-Alive: '300'
70-
Proxy-Connection: keep-alive
71-
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
72-
method: GET
73-
port: 80
74-
uri: /foo.old
75-
version: HTTP/1.1
76-
output:
77-
log_contains: id "920440"
78-
-
79-
test_title: 920440-4
54+
- stage:
55+
input:
56+
dest_addr: 127.0.0.1
57+
headers:
58+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
59+
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
60+
Accept-Encoding: gzip,deflate
61+
Accept-Language: en-us,en;q=0.5
62+
Host: localhost
63+
Keep-Alive: "300"
64+
Proxy-Connection: keep-alive
65+
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
66+
method: GET
67+
port: 80
68+
uri: /foo.old
69+
version: HTTP/1.1
70+
output:
71+
log_contains: id "920440"
72+
- test_title: 920440-4
8073
desc: URL file extension is restricted by policy (920440) - GH issue 1296
8174
stages:
82-
-
83-
stage:
84-
input:
85-
dest_addr: 127.0.0.1
86-
headers:
87-
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
88-
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
89-
Accept-Encoding: gzip,deflate
90-
Accept-Language: en-us,en;q=0.5
91-
Host: localhost
92-
Keep-Alive: '300'
93-
Proxy-Connection: keep-alive
94-
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
95-
method: GET
96-
port: 80
97-
uri: /foo.bar.sql
98-
version: HTTP/1.1
99-
output:
100-
log_contains: id "920440"
75+
- stage:
76+
input:
77+
dest_addr: 127.0.0.1
78+
headers:
79+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
80+
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
81+
Accept-Encoding: gzip,deflate
82+
Accept-Language: en-us,en;q=0.5
83+
Host: localhost
84+
Keep-Alive: "300"
85+
Proxy-Connection: keep-alive
86+
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
87+
method: GET
88+
port: 80
89+
uri: /foo.bar.sql
90+
version: HTTP/1.1
91+
output:
92+
log_contains: id "920440"
93+
- test_title: 920440-5
94+
desc: Redis dump file
95+
stages:
96+
- stage:
97+
input:
98+
dest_addr: 127.0.0.1
99+
headers:
100+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
101+
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
102+
Accept-Encoding: gzip,deflate
103+
Accept-Language: en-us,en;q=0.5
104+
Host: localhost
105+
Keep-Alive: "300"
106+
Proxy-Connection: keep-alive
107+
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
108+
method: GET
109+
port: 80
110+
uri: /dump.rdb
111+
version: HTTP/1.1
112+
output:
113+
log_contains: id "920440"

0 commit comments

Comments
 (0)