Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit 8565447

Browse files
dune73dune73
authored
Merge pull request #901 from fzipi/v3.1/dev-reorder
Ordering of actions
2 parents dc063e9 + e276cc6 commit 8565447

24 files changed

+1335
-1328
lines changed

‎rules/REQUEST-901-INITIALIZATION.conf‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -53,10 +53,10 @@ SecComponentSignature "OWASP_CRS/3.0.2"
5353
SecRule &TX:crs_setup_version "@eq 0" \
5454
"id:901001,\
5555
phase:1,\
56-
auditlog,\
57-
log,\
5856
deny,\
5957
status:500,\
58+
auditlog,\
59+
log,\
6060
severity:CRITICAL,\
6161
msg:'ModSecurity Core Rule Set is deployed without configuration! Please copy the crs-setup.conf.example template to crs-setup.conf, and include the crs-setup.conf file in your webserver configuration before including the CRS rules. See the INSTALL file in the CRS directory for detailed instructions.'"
6262

@@ -207,9 +207,9 @@ SecRule &TX:static_extensions "@eq 0" \
207207
SecAction \
208208
"id:901200,\
209209
phase:1,\
210-
nolog,\
211210
pass,\
212211
t:none,\
212+
nolog,\
213213
setvar:tx.anomaly_score=0,\
214214
setvar:tx.sql_injection_score=0,\
215215
setvar:tx.xss_score=0,\
@@ -235,20 +235,20 @@ SecAction \
235235
SecRule REQUEST_HEADERS:User-Agent "@rx ^.*$" \
236236
"id:901318, \
237237
phase:1, \
238+
pass, \
238239
t:none,t:sha1,t:hexEncode, \
239-
setvar:tx.ua_hash=%{matched_var}, \
240240
nolog, \
241-
pass"
241+
setvar:tx.ua_hash=%{matched_var}"
242242

243243
SecAction \
244244
"id:901321, \
245245
phase:1, \
246+
pass, \
246247
t:none, \
248+
nolog, \
247249
initcol:global=global, \
248250
initcol:ip=%{remote_addr}_%{tx.ua_hash}, \
249-
setvar:tx.real_ip=%{remote_addr}, \
250-
nolog, \
251-
pass"
251+
setvar:tx.real_ip=%{remote_addr}"
252252

253253

254254
#
@@ -290,9 +290,9 @@ SecRule UNIQUE_ID "@rx ^." \
290290
"id:901410,\
291291
phase:1,\
292292
pass,\
293-
nolog,\
294293
t:sha1,\
295294
t:hexEncode,\
295+
nolog,\
296296
setvar:TX.sampling_rnd100=%{MATCHED_VAR}"
297297

298298
SecRule DURATION "@rx (..)$" \
@@ -307,8 +307,8 @@ SecRule TX:sampling_rnd100 "@rx ^[a-f]*([0-9])[a-f]*([0-9])" \
307307
"id:901430,\
308308
phase:1,\
309309
pass,\
310-
nolog,\
311310
capture,\
311+
nolog,\
312312
setvar:TX.sampling_rnd100=%{TX.1}%{TX.2}"
313313

314314
SecRule TX:sampling_rnd100 "@rx ^0([0-9])" \
@@ -339,8 +339,8 @@ SecRule TX:sampling_rnd100 "!@lt %{tx.sampling_percentage}" \
339339
pass,\
340340
log,\
341341
noauditlog,\
342-
ctl:ruleEngine=off,\
343342
msg:'Sampling: Disable the rule engine based on sampling_percentage \
344-
%{TX.sampling_percentage} and random number %{TX.sampling_rnd100}.'"
343+
%{TX.sampling_percentage} and random number %{TX.sampling_rnd100}.', \
344+
ctl:ruleEngine=off"
345345

346346
SecMarker "END-SAMPLING"

‎rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -65,9 +65,9 @@
6565
SecRule &TX:crs_exclusions_drupal|TX:crs_exclusions_drupal "@eq 0" \
6666
"id:9001000,\
6767
phase:2,\
68+
pass,\
6869
t:none,\
6970
nolog,\
70-
pass,\
7171
skipAfter:END-DRUPAL-RULE-EXCLUSIONS"
7272

7373

@@ -101,8 +101,8 @@ SecRule &TX:crs_exclusions_drupal|TX:crs_exclusions_drupal "@eq 0" \
101101
#
102102
SecAction "id:9001100,\
103103
phase:2,\
104-
nolog,\
105104
pass,\
105+
nolog,\
106106
ctl:ruleRemoveTargetById=942450;REQUEST_COOKIES_NAMES,\
107107
ctl:ruleRemoveTargetById=942450;REQUEST_COOKIES"
108108

@@ -115,32 +115,32 @@ SecAction "id:9001100,\
115115
SecRule REQUEST_FILENAME "@endsWith /core/install.php" \
116116
"id:9001110,\
117117
phase:2,\
118-
nolog,\
119118
pass,\
119+
nolog,\
120120
ctl:ruleRemoveTargetByTag=CRS;ARGS:account[pass][pass1],\
121121
ctl:ruleRemoveTargetByTag=CRS;ARGS:account[pass][pass2]"
122122

123123
SecRule REQUEST_FILENAME "@endsWith /user/login" \
124124
"id:9001112,\
125125
phase:2,\
126+
pass,\
126127
t:none,\
127128
nolog,\
128-
pass,\
129129
ctl:ruleRemoveTargetByTag=CRS;ARGS:pass"
130130

131131
SecRule REQUEST_FILENAME "@endsWith /admin/people/create" \
132132
"id:9001114,\
133133
phase:2,\
134-
nolog,\
135134
pass,\
135+
nolog,\
136136
ctl:ruleRemoveTargetByTag=CRS;ARGS:pass[pass1],\
137137
ctl:ruleRemoveTargetByTag=CRS;ARGS:pass[pass2]"
138138

139139
SecRule REQUEST_FILENAME "@rx /user/[0-9]+/edit$" \
140140
"id:9001116,\
141141
phase:2,\
142-
nolog,\
143142
pass,\
143+
nolog,\
144144
ctl:ruleRemoveTargetByTag=CRS;ARGS:current_pass,\
145145
ctl:ruleRemoveTargetByTag=CRS;ARGS:pass[pass1],\
146146
ctl:ruleRemoveTargetByTag=CRS;ARGS:pass[pass2]"
@@ -160,15 +160,15 @@ SecRule REQUEST_FILENAME "@rx /user/[0-9]+/edit$" \
160160
SecRule REQUEST_FILENAME "@contains /admin/config/" \
161161
"id:9001122,\
162162
phase:2,\
163-
nolog,\
164163
pass,\
164+
nolog,\
165165
ctl:ruleRemoveById=942430"
166166

167167
SecRule REQUEST_FILENAME "@endsWith /admin/config/people/accounts" \
168168
"id:9001124,\
169169
phase:2,\
170-
nolog,\
171170
pass,\
171+
nolog,\
172172
ctl:ruleRemoveById=920271,\
173173
ctl:ruleRemoveById=942440,\
174174
ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_cancel_confirm_body,\
@@ -183,16 +183,16 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/people/accounts" \
183183
SecRule REQUEST_FILENAME "@endsWith /admin/config/development/configuration/single/import" \
184184
"id:9001126,\
185185
phase:2,\
186-
nolog,\
187186
pass,\
187+
nolog,\
188188
ctl:ruleRemoveById=920271,\
189189
ctl:ruleRemoveById=942440"
190190

191191
SecRule REQUEST_FILENAME "@endsWith /admin/config/development/maintenance" \
192192
"id:9001128,\
193193
phase:2,\
194-
nolog,\
195194
pass,\
195+
nolog,\
196196
ctl:ruleRemoveById=942440"
197197

198198

@@ -207,8 +207,8 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/development/maintenance" \
207207
SecRule REQUEST_FILENAME "@endsWith /contextual/render" \
208208
"id:9001140,\
209209
phase:2,\
210-
nolog,\
211210
pass,\
211+
nolog,\
212212
ctl:ruleRemoveTargetById=942130;ARGS:ids[]"
213213

214214

@@ -223,8 +223,8 @@ SecRule REQUEST_FILENAME "@endsWith /contextual/render" \
223223
#
224224
SecAction "id:9001160,\
225225
phase:2,\
226-
nolog,\
227226
pass,\
227+
nolog,\
228228
ctl:ruleRemoveTargetById=942440;ARGS:form_build_id,\
229229
ctl:ruleRemoveTargetById=942450;ARGS:form_token,\
230230
ctl:ruleRemoveTargetById=942450;ARGS:form_build_id"
@@ -240,8 +240,8 @@ SecAction "id:9001160,\
240240
SecRule REQUEST_FILENAME "@endsWith /admin/config/content/formats/manage/full_html" \
241241
"id:9001170,\
242242
phase:2,\
243-
nolog,\
244243
pass,\
244+
nolog,\
245245
ctl:ruleRemoveTargetByTag=CRS;ARGS:editor[settings][toolbar][button_groups],\
246246
ctl:ruleRemoveTargetByTag=CRS;ARGS:filters[filter_html][settings][allowed_html]"
247247

@@ -257,8 +257,8 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/content/formats/manage/full_ht
257257
SecRule REQUEST_METHOD "@streq POST" \
258258
"id:'9001180',\
259259
phase:1,\
260-
t:none,\
261260
pass,\
261+
t:none,\
262262
nolog,\
263263
noauditlog,\
264264
chain"
@@ -270,8 +270,8 @@ SecRule REQUEST_METHOD "@streq POST" \
270270
SecRule REQUEST_METHOD "@streq POST" \
271271
"id:'9001182',\
272272
phase:1,\
273-
t:none,\
274273
pass,\
274+
t:none,\
275275
nolog,\
276276
noauditlog,\
277277
chain"
@@ -287,8 +287,8 @@ SecRule REQUEST_METHOD "@streq POST" \
287287
SecRule REQUEST_METHOD "@streq POST" \
288288
"id:'9001184',\
289289
phase:1,\
290-
t:none,\
291290
pass,\
291+
t:none,\
292292
nolog,\
293293
noauditlog,\
294294
chain"
@@ -315,68 +315,68 @@ SecRule REQUEST_METHOD "@streq POST" \
315315
SecRule REQUEST_FILENAME "@endsWith /node/add/article" \
316316
"id:9001200,\
317317
phase:2,\
318-
nolog,\
319318
pass,\
319+
nolog,\
320320
ctl:ruleRemoveTargetByTag=CRS;ARGS:body[0][value],\
321321
ctl:ruleRemoveTargetById=942410;ARGS:uid[0][target_id]"
322322

323323
SecRule REQUEST_FILENAME "@endsWith /node/add/page" \
324324
"id:9001202,\
325325
phase:2,\
326-
nolog,\
327326
pass,\
327+
nolog,\
328328
ctl:ruleRemoveTargetByTag=CRS;ARGS:body[0][value],\
329329
ctl:ruleRemoveTargetById=942410;ARGS:uid[0][target_id]"
330330

331331
SecRule REQUEST_FILENAME "@rx /node/[0-9]+/edit$" \
332332
"id:9001204,\
333333
phase:2,\
334-
nolog,\
335334
pass,\
335+
nolog,\
336336
ctl:ruleRemoveTargetByTag=CRS;ARGS:body[0][value],\
337337
ctl:ruleRemoveTargetById=942410;ARGS:uid[0][target_id],\
338338
ctl:ruleRemoveTargetById=932110;ARGS:destination"
339339

340340
SecRule REQUEST_FILENAME "@endsWith /block/add" \
341341
"id:9001206,\
342342
phase:2,\
343-
nolog,\
344343
pass,\
344+
nolog,\
345345
ctl:ruleRemoveTargetByTag=CRS;ARGS:body[0][value]"
346346

347347
SecRule REQUEST_FILENAME "@endsWith /admin/structure/block/block-content/manage/basic" \
348348
"id:9001208,\
349349
phase:2,\
350-
nolog,\
351350
pass,\
351+
nolog,\
352352
ctl:ruleRemoveTargetByTag=CRS;ARGS:description"
353353

354354
SecRule REQUEST_FILENAME "@rx /editor/filter_xss/(?:full|basic)_html$" \
355355
"id:9001210,\
356356
phase:2,\
357-
nolog,\
358357
pass,\
358+
nolog,\
359359
ctl:ruleRemoveTargetByTag=CRS;ARGS:value"
360360

361361
SecRule REQUEST_FILENAME "@rx /user/[0-9]+/contact$" \
362362
"id:9001212,\
363363
phase:2,\
364-
nolog,\
365364
pass,\
365+
nolog,\
366366
ctl:ruleRemoveTargetByTag=CRS;ARGS:message[0][value]"
367367

368368
SecRule REQUEST_FILENAME "@endsWith /admin/config/development/maintenance" \
369369
"id:9001214,\
370370
phase:2,\
371-
nolog,\
372371
pass,\
372+
nolog,\
373373
ctl:ruleRemoveTargetByTag=CRS;ARGS:maintenance_mode_message"
374374

375375
SecRule REQUEST_FILENAME "@endsWith /admin/config/services/rss-publishing" \
376376
"id:9001216,\
377377
phase:2,\
378-
nolog,\
379378
pass,\
379+
nolog,\
380380
ctl:ruleRemoveTargetByTag=CRS;ARGS:feed_description"
381381

382382

0 commit comments

Comments
 (0)