Also check if Transfer-Encoding is missing

Fixes #975.

While here replace leading tab with spaces.

Author: fgsch

rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf

@@ -292,21 +292,20 @@ SecRule REQUEST_METHOD "@rx ^(?:GET|HEAD)$" \
 
 
 #
-# Require Content-Length to be provided with every POST request.
+# Require Content-Length or Transfer-Encoding to be provided with
+# every POST request.
 #
 # -=[ Rule Logic ]=-
-# This chained rule checks if the request method is POST, if so, it checks that a Content-Length
-# header is also present.
-#
-# -=[ References ]=-
-# https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.5
+# This chained rule checks if the request method is POST, if so,
+# it checks that a Content-Length or Transfer-Encoding headers are
+# also present.
 #
 SecRule REQUEST_METHOD "@rx ^POST$" \
     "id:920180,\
     phase:2,\
     block,\
     t:none,\
-    msg:'POST request missing Content-Length Header.',\
+    msg:'POST without Content-Length or Transfer-Encoding headers.',\
     logdata:'%{matched_var}',\
     tag:'application-multi',\
     tag:'language-multi',\
@@ -319,10 +318,11 @@ SecRule REQUEST_METHOD "@rx ^POST$" \
     severity:'WARNING',\
     chain"
     SecRule &REQUEST_HEADERS:Content-Length "@eq 0" \
-        "t:none,\
-        setvar:'tx.msg=%{rule.msg}',\
-        setvar:'tx.anomaly_score=+%{tx.notice_anomaly_score}',\
-        setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ-%{matched_var_name}=%{matched_var}'"
+        "chain"
+        SecRule &REQUEST_HEADERS:Transfer-Encoding "@eq 0" \
+            "setvar:'tx.msg=%{rule.msg}',\
+            setvar:'tx.anomaly_score=+%{tx.notice_anomaly_score}',\
+            setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ-%{matched_var_name}=%{matched_var}'"
 
 
 #
@@ -988,7 +988,7 @@ SecRule REQUEST_METHOD "!@rx ^(?:GET|HEAD|PROPFIND|OPTIONS)$" \
     chain"
     SecRule REQUEST_HEADERS:Content-Type "@rx ^[^;\s]+" \
         "capture,\
-	chain"
+        chain"
         SecRule TX:0 "!@rx ^%{tx.allowed_request_content_type}$" \
             "t:none,\
             ctl:forceRequestBodyVariable=On,\