Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit e276cc6

Browse files
fzipifzipi
committed
Solved conflicts from #838 merge and fixed indentation.
2 parents 6e2b1a5 + dc063e9 commit e276cc6

8 files changed

+31
-30
lines changed

‎rules/REQUEST-901-INITIALIZATION.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -232,7 +232,7 @@ SecAction \
232232
# have already been initiated.
233233
#
234234

235-
SecRule REQUEST_HEADERS:User-Agent "@rx ^(.*)$" \
235+
SecRule REQUEST_HEADERS:User-Agent "@rx ^.*$" \
236236
"id:901318, \
237237
phase:1, \
238238
pass, \

‎rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -351,7 +351,7 @@ SecRule REQUEST_FILENAME "@endsWith /admin/structure/block/block-content/manage/
351351
nolog,\
352352
ctl:ruleRemoveTargetByTag=CRS;ARGS:description"
353353

354-
SecRule REQUEST_FILENAME "@rx /editor/filter_xss/(full|basic)_html$" \
354+
SecRule REQUEST_FILENAME "@rx /editor/filter_xss/(?:full|basic)_html$" \
355355
"id:9001210,\
356356
phase:2,\
357357
pass,\

‎rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -410,7 +410,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
410410
t:none,\
411411
nolog,\
412412
chain"
413-
SecRule ARGS:action "@rx ^(save-widget|update-widget)$" \
413+
SecRule ARGS:action "@rx ^(?:save-widget|update-widget)$" \
414414
"t:none,\
415415
chain"
416416
SecRule &ARGS:action "@eq 1" \
@@ -603,7 +603,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/options.php" \
603603
# customize-base,customize&load%5B%5D=-loader,thickbox,plugin-install,
604604
# wp-util,wp-a11y,updates,shortcode,media-upload,svg-painter,
605605
# jquery-ui-accordion&ver=3f9999390861a0133beda3ee8acf152e
606-
SecRule REQUEST_FILENAME "@rx /wp-admin/load-(scripts|styles)\.php$" \
606+
SecRule REQUEST_FILENAME "@rx /wp-admin/load-(?:scripts|styles)\.php$" \
607607
"id:9002900,\
608608
phase:2,\
609609
pass,\

‎rules/REQUEST-905-COMMON-EXCEPTIONS.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ SecRule REQUEST_LINE "@streq GET /" \
3232
#
3333
# Exception for Apache internal dummy connection
3434
#
35-
SecRule REQUEST_LINE "@rx ^(GET /|OPTIONS \*) HTTP/[12]\.[01]$" \
35+
SecRule REQUEST_LINE "@rx ^(?:GET /|OPTIONS \*) HTTP/[12]\.[01]$" \
3636
"phase:1,\
3737
id:905110,\
3838
pass,\

‎rules/REQUEST-910-IP-REPUTATION.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ SecRule TX:HIGH_RISK_COUNTRY_CODES "!@rx ^$" \
7777
setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var},\
7878
setvar:ip.reput_block_flag=1,\
7979
setvar:'ip.reput_block_reason=%{rule.msg}'\
80-
expirevar:ip.reput_block_flag=%{tx.reput_block_duration}"
80+
expirevar:ip.reput_block_flag=%{tx.reput_block_duration}"
8181

8282

8383
#
@@ -166,7 +166,7 @@ SecRule TX:REAL_IP "@rbl dnsbl.httpbl.org" \
166166
chain"
167167
SecRule TX:httpbl_msg "@rx RBL lookup of .*?.dnsbl.httpbl.org succeeded at TX:checkip. (.*?): .*" \
168168
"capture,\
169-
t:none,\
169+
t:none,\
170170
setvar:tx.httpbl_msg=%{tx.1}"
171171

172172
# The following regexs are generated based off re_operators.c

‎rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -354,7 +354,7 @@ SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx (\d+)\-(\d+)\,"
354354
# -=[ References ]=-
355355
# http://www.bad-behavior.ioerror.us/documentation/how-it-works/
356356
#
357-
SecRule REQUEST_HEADERS:Connection "@rx \b(keep-alive|close),\s?(keep-alive|close)\b" \
357+
SecRule REQUEST_HEADERS:Connection "@rx \b(?:keep-alive|close),\s?(?:keep-alive|close)\b" \
358358
"id:920210,\
359359
phase:2,\
360360
block,\
@@ -384,7 +384,7 @@ SecRule REQUEST_HEADERS:Connection "@rx \b(keep-alive|close),\s?(keep-alive|clos
384384
# -=[ References ]=-
385385
# http://www.ietf.org/rfc/rfc1738.txt
386386
#
387-
SecRule REQUEST_URI "@rx \%((?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" \
387+
SecRule REQUEST_URI "@rx \%(?:(?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" \
388388
"id:920220,\
389389
phase:2,\
390390
block,\
@@ -404,7 +404,7 @@ SecRule REQUEST_URI "@rx \%((?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" \
404404
setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},\
405405
setvar:tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/EVASION-%{matched_var_name}=%{matched_var}"
406406

407-
SecRule REQUEST_HEADERS:Content-Type "@rx ^(application\/x-www-form-urlencoded|text\/xml)(?:;(?:\s?charset\s?=\s?[\w\d\-]{1,18})?)??$" \
407+
SecRule REQUEST_HEADERS:Content-Type "@rx ^(?:application\/x-www-form-urlencoded|text\/xml)(?:;(?:\s?charset\s?=\s?[\w\d\-]{1,18})?)??$" \
408408
"id:920240,\
409409
phase:2,\
410410
block,\
@@ -955,7 +955,7 @@ SecRule REQUEST_METHOD "!@rx ^(?:GET|HEAD|PROPFIND|OPTIONS)$" \
955955
ver:'OWASP_CRS/3.0.0',\
956956
severity:'CRITICAL',\
957957
chain"
958-
SecRule REQUEST_HEADERS:Content-Type "@rx ^([^;\s]+)" \
958+
SecRule REQUEST_HEADERS:Content-Type "@rx ^[^;\s]+" \
959959
"capture,\
960960
chain"
961961
SecRule TX:0 "!@rx ^%{tx.allowed_request_content_type}$" \
@@ -1045,7 +1045,7 @@ SecRule REQUEST_BASENAME "@rx \.(.*)$" \
10451045
# -=[ References ]=-
10461046
# https://access.redhat.com/security/vulnerabilities/httpoxy (Header Proxy)
10471047
#
1048-
SecRule REQUEST_HEADERS_NAMES "@rx ^(.*)$" \
1048+
SecRule REQUEST_HEADERS_NAMES "@rx ^.*$" \
10491049
"id:920450,\
10501050
phase:2,\
10511051
block,\
@@ -1100,7 +1100,8 @@ SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:2,id:920014,nolog,pass,skipAfter:END-RE
11001100
# -=[ References ]=-
11011101
# https://httpd.apache.org/security/CVE-2011-3192.txt
11021102

1103-
SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=((\d+)?\-(\d+)?\s*,?\s*){6}" \
1103+
1104+
SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=(?:(?:\d+)?\-(?:\d+)?\s*,?\s*){6}" \
11041105
"id:920200,\
11051106
phase:2,\
11061107
block,\
@@ -1145,7 +1146,7 @@ SecRule REQUEST_BASENAME "@endsWith .pdf" \
11451146
ver:'OWASP_CRS/3.0.0',\
11461147
severity:'WARNING',\
11471148
chain"
1148-
SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=((\d+)?\-(\d+)?\s*,?\s*){63}" \
1149+
SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=(?:(?:\d+)?\-(?:\d+)?\s*,?\s*){63}" \
11491150
"setvar:'tx.msg=%{rule.msg}',\
11501151
setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},\
11511152
setvar:tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ-%{matched_var_name}=%{matched_var}"
@@ -1262,22 +1263,22 @@ SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \
12621263
# PL2: This is a stricter sibling of 920120.
12631264
#
12641265
SecRule FILES_NAMES|FILES "@rx ['\";=]" \
1265-
"msg:'Attempted multipart/form-data bypass',\
1266-
severity:'CRITICAL',\
1267-
id:920121,\
1268-
ver:'OWASP_CRS/3.0.0',\
1269-
rev:'1',\
1270-
logdata:'%{matched_var}',\
1266+
"id:920121,\
12711267
phase:2,\
12721268
block,\
12731269
t:none,t:urlDecodeUni,\
1270+
msg:'Attempted multipart/form-data bypass',\
1271+
logdata:'%{matched_var}',\
12741272
tag:'application-multi',\
12751273
tag:'language-multi',\
12761274
tag:'platform-multi',\
12771275
tag:'attack-protocol',\
12781276
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ',\
12791277
tag:'CAPEC-272',\
12801278
tag:'paranoia-level/2',\
1279+
ver:'OWASP_CRS/3.0.0',\
1280+
rev:'1',\
1281+
severity:'CRITICAL',\
12811282
setvar:'tx.msg=%{rule.msg}',\
12821283
setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
12831284
setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ-%{matched_var_name}=%{matched_var}'"
@@ -1340,7 +1341,7 @@ SecRule REQUEST_BASENAME "@endsWith .pdf" \
13401341
ver:'OWASP_CRS/3.0.0',\
13411342
severity:'WARNING',\
13421343
chain"
1343-
SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=((\d+)?\-(\d+)?\s*,?\s*){6}" \
1344+
SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=(?:(?:\d+)?\-(?:\d+)?\s*,?\s*){6}" \
13441345
"setvar:'tx.msg=%{rule.msg}',\
13451346
setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},\
13461347
setvar:tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ-%{matched_var_name}=%{matched_var}"

‎rules/REQUEST-921-PROTOCOL-ATTACK.conf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:2,id:921012,nolog,pass,skipAfter:END-RE
3232
# http://projects.webappsec.org/HTTP-Request-Smuggling
3333
# http://article.gmane.org/gmane.comp.apache.mod-security.user/3299
3434
#
35-
SecRule REQUEST_HEADERS:'/(Content-Length|Transfer-Encoding)/' "@rx ," \
35+
SecRule REQUEST_HEADERS:'/(?:Content-Length|Transfer-Encoding)/' "@rx ," \
3636
"id:921100,\
3737
phase:2,\
3838
block,\
@@ -100,7 +100,7 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?:\n|\r)+(?:get|post|head|options|connect|p
100100
# [ References ]
101101
# http://projects.webappsec.org/HTTP-Response-Splitting
102102
#
103-
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\r\n]\W*?(?:content-(type|length)|set-cookie|location):" \
103+
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\r\n]\W*?(?:content-(?:type|length)|set-cookie|location):" \
104104
"id:921120,\
105105
phase:2,\
106106
block,\
@@ -157,7 +157,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
157157
# [ References ]
158158
# https://en.wikipedia.org/wiki/HTTP_header_injection
159159
#
160-
SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@rx (\n|\r)" \
160+
SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@rx [\n\r]" \
161161
"id:921140,\
162162
phase:2,\
163163
block,\
@@ -183,7 +183,7 @@ SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@rx (\n|\r)" \
183183
# Checking for GET arguments has been moved to paranoia level 2 (921151)
184184
# in order to mitigate possible false positives.
185185
#
186-
SecRule ARGS_NAMES "@rx (\n|\r)" \
186+
SecRule ARGS_NAMES "@rx [\n\r]" \
187187
"id:921150,\
188188
phase:2,\
189189
block,\
@@ -205,7 +205,7 @@ SecRule ARGS_NAMES "@rx (\n|\r)" \
205205
setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/HEADER_INJECTION-%{matched_var_name}=%{tx.0}"
206206

207207

208-
SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?:\n|\r)+(?:\s+|location|refresh|(?:set-)?cookie|(X-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))\s*:" \
208+
SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?:\n|\r)+(?:\s+|location|refresh|(?:set-)?cookie|(?:X-)?(?:forwarded-(?:for|host|server)|host|via|remote-ip|remote-addr|originating-IP))\s*:" \
209209
"id:921160,\
210210
phase:2,\
211211
block,\
@@ -241,7 +241,7 @@ SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:2,id:921014,nolog,pass,skipAfter:END-RE
241241
#
242242
# See also: rule 921140, 921150
243243
#
244-
SecRule ARGS_GET "@rx (\n|\r)" \
244+
SecRule ARGS_GET "@rx [\n\r]" \
245245
"id:921151,\
246246
phase:2,\
247247
block,\

‎rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:2,id:931012,nolog,pass,skipAfter:END-RE
3333
# http://projects.webappsec.org/Remote-File-Inclusion
3434
# http://tacticalwebappsec.blogspot.com/2009/06/generic-remote-file-inclusion-attack.html
3535
#
36-
SecRule ARGS "@rx ^(?i)(?:file|ftps?|https?):\/\/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" \
36+
SecRule ARGS "@rx ^(?i)(?:file|ftps?|https?):\/\/(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" \
3737
"id:931100, \
3838
phase:2,\
3939
block,\
@@ -55,7 +55,7 @@ SecRule ARGS "@rx ^(?i)(?:file|ftps?|https?):\/\/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{
5555
setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
5656
setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RFI-%{matched_var_name}=%{tx.0}"
5757

58-
SecRule QUERY_STRING|REQUEST_BODY "@rx (?i:(\binclude\s*\([^)]*|mosConfig_absolute_path|_CONF\[path\]|_SERVER\[DOCUMENT_ROOT\]|GALLERY_BASEDIR|path\[docroot\]|appserv_root|config\[root_dir\])=(file|ftps?|https?):\/\/)" \
58+
SecRule QUERY_STRING|REQUEST_BODY "@rx (?i:(\binclude\s*\([^)]*|mosConfig_absolute_path|_CONF\[path\]|_SERVER\[DOCUMENT_ROOT\]|GALLERY_BASEDIR|path\[docroot\]|appserv_root|config\[root_dir\])=(?:file|ftps?|https?):\/\/)" \
5959
"id:931110,\
6060
phase:2,\
6161
block,\
@@ -77,7 +77,7 @@ SecRule QUERY_STRING|REQUEST_BODY "@rx (?i:(\binclude\s*\([^)]*|mosConfig_absolu
7777
setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},\
7878
setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RFI-%{matched_var_name}=%{tx.0}"
7979

80-
SecRule ARGS "@rx ^(?i)(?:file|ftps?|https?)(.*?)\?+$" \
80+
SecRule ARGS "@rx ^(?i)(?:file|ftps?|https?).*?\?+$" \
8181
"id:931120,\
8282
phase:2,\
8383
block,\

0 commit comments

Comments
 (0)