Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit f223366

Browse files
fzipifzipi
committed
Rollback quoting skipAfter
1 parent b236f6e commit f223366

7 files changed

+20
-20
lines changed

‎rules/REQUEST-901-INITIALIZATION.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ SecRule TX:sampling_percentage "@eq 100" \
284284
phase:1,\
285285
pass,\
286286
nolog,\
287-
skipAfter:'END-SAMPLING'"
287+
skipAfter:END-SAMPLING"
288288

289289
SecRule UNIQUE_ID "@rx ^." \
290290
"id:901410,\

‎rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ SecRule &TX:crs_exclusions_drupal|TX:crs_exclusions_drupal "@eq 0" \
6868
pass,\
6969
t:none,\
7070
nolog,\
71-
skipAfter:'END-DRUPAL-RULE-EXCLUSIONS'"
71+
skipAfter:END-DRUPAL-RULE-EXCLUSIONS"
7272

7373

7474
# [ Table of Contents ]

‎rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,15 @@ SecRule &TX:crs_exclusions_wordpress|TX:crs_exclusions_wordpress "@eq 0" \
2222
pass,\
2323
t:none,\
2424
nolog,\
25-
skipAfter:'END-WORDPRESS'"
25+
skipAfter:END-WORDPRESS"
2626

2727
SecRule &TX:crs_exclusions_wordpress|TX:crs_exclusions_wordpress "@eq 0" \
2828
"id:9002001,\
2929
phase:2,\
3030
pass,\
3131
t:none,\
3232
nolog,\
33-
skipAfter:'END-WORDPRESS'"
33+
skipAfter:END-WORDPRESS"
3434

3535

3636
#
@@ -193,15 +193,15 @@ SecRule REQUEST_FILENAME "!@contains /wp-admin/" \
193193
pass,\
194194
t:none,\
195195
nolog,\
196-
skipAfter:'END-WORDPRESS-ADMIN'"
196+
skipAfter:END-WORDPRESS-ADMIN"
197197

198198
SecRule REQUEST_FILENAME "!@contains /wp-admin/" \
199199
"id:9002401,\
200200
phase:2,\
201201
pass,\
202202
t:none,\
203203
nolog,\
204-
skipAfter:'END-WORDPRESS-ADMIN'"
204+
skipAfter:END-WORDPRESS-ADMIN"
205205

206206

207207
#

‎rules/REQUEST-910-IP-REPUTATION.conf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ SecRule TX:DO_REPUT_BLOCK "@eq 1" \
4242
setvar:'tx.msg=%{rule.msg}',\
4343
severity:'CRITICAL',\
4444
chain,\
45-
skipAfter:'BEGIN-REQUEST-BLOCKING-EVAL'"
45+
skipAfter:BEGIN-REQUEST-BLOCKING-EVAL"
4646
SecRule IP:REPUT_BLOCK_FLAG "@eq 1" \
4747
"setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
4848
setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var}'"
@@ -122,7 +122,7 @@ SecRule IP:PREVIOUS_RBL_CHECK "@eq 1" \
122122
tag:'language-multi',\
123123
tag:'platform-multi',\
124124
tag:'attack-reputation-ip',\
125-
skipAfter:'END-RBL-LOOKUP'"
125+
skipAfter:END-RBL-LOOKUP"
126126

127127
#
128128
# Check Client IP against ProjectHoneypot's HTTP Blacklist
@@ -144,7 +144,7 @@ SecRule &TX:block_suspicious_ip "@eq 0" \
144144
t:none,\
145145
nolog,\
146146
chain,\
147-
skipAfter:'END-RBL-CHECK'"
147+
skipAfter:END-RBL-CHECK"
148148
SecRule &TX:block_harvester_ip "@eq 0" \
149149
"chain"
150150
SecRule &TX:block_spammer_ip "@eq 0" \
@@ -182,7 +182,7 @@ SecRule TX:block_search_ip "@eq 1" \
182182
tag:'attack-reputation-ip',\
183183
severity:'CRITICAL',\
184184
chain,\
185-
skipAfter:'END-RBL-CHECK'"
185+
skipAfter:END-RBL-CHECK"
186186
SecRule TX:httpbl_msg "@rx Search Engine" \
187187
"setvar:'tx.msg=%{rule.msg}',\
188188
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -205,7 +205,7 @@ SecRule TX:block_spammer_ip "@eq 1" \
205205
tag:'attack-reputation-ip',\
206206
severity:'CRITICAL',\
207207
chain,\
208-
skipAfter:'END-RBL-CHECK'"
208+
skipAfter:END-RBL-CHECK"
209209
SecRule TX:httpbl_msg "@rx (?i)^.*? spammer .*?$" \
210210
"setvar:'tx.msg=%{rule.msg}',\
211211
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -228,7 +228,7 @@ SecRule TX:block_suspicious_ip "@eq 1" \
228228
tag:'attack-reputation-ip',\
229229
severity:'CRITICAL',\
230230
chain,\
231-
skipAfter:'END-RBL-CHECK'"
231+
skipAfter:END-RBL-CHECK"
232232
SecRule TX:httpbl_msg "@rx (?i)^.*? suspicious .*?$" \
233233
"setvar:'tx.msg=%{rule.msg}',\
234234
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -251,7 +251,7 @@ SecRule TX:block_harvester_ip "@eq 1" \
251251
tag:'attack-reputation-ip',\
252252
severity:'CRITICAL',\
253253
chain,\
254-
skipAfter:'END-RBL-CHECK'"
254+
skipAfter:END-RBL-CHECK"
255255
SecRule TX:httpbl_msg "@rx (?i)^.*? harvester .*?$" \
256256
"setvar:'tx.msg=%{rule.msg}',\
257257
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\

‎rules/REQUEST-912-DOS-PROTECTION.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ SecRule &TX:dos_burst_time_slice "@eq 0" \
7070
t:none,\
7171
nolog,\
7272
chain,\
73-
skipAfter:'END-DOS-PROTECTION-CHECKS'"
73+
skipAfter:END-DOS-PROTECTION-CHECKS"
7474
SecRule &TX:dos_counter_threshold "@eq 0" \
7575
"chain"
7676
SecRule &TX:dos_block_timeout "@eq 0"
@@ -82,7 +82,7 @@ SecRule &TX:dos_burst_time_slice "@eq 0" \
8282
t:none,\
8383
nolog,\
8484
chain,\
85-
skipAfter:'END-DOS-PROTECTION-CHECKS'"
85+
skipAfter:END-DOS-PROTECTION-CHECKS"
8686
SecRule &TX:dos_counter_threshold "@eq 0" \
8787
"chain"
8888
SecRule &TX:dos_block_timeout "@eq 0"
@@ -152,7 +152,7 @@ SecRule IP:DOS_BLOCK "@eq 1" \
152152
tag:'language-multi',\
153153
tag:'platform-multi',\
154154
tag:'attack-dos',\
155-
skipAfter:'END-DOS-PROTECTION-CHECKS'"
155+
skipAfter:END-DOS-PROTECTION-CHECKS"
156156

157157

158158
#

‎rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -613,7 +613,7 @@ SecRule &REQUEST_HEADERS:Host "@eq 0" \
613613
setvar:'tx.msg=%{rule.msg}',\
614614
setvar:'tx.anomaly_score=+%{tx.warning_anomaly_score}',\
615615
setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER-%{matched_var_name}=%{matched_var}',\
616-
skipAfter:'END-HOST-CHECK'"
616+
skipAfter:END-HOST-CHECK"
617617

618618

619619
SecRule REQUEST_HEADERS:Host "@rx ^$" \

‎rules/RESPONSE-980-CORRELATION.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ SecRule &TX:'/LEAKAGE\\\/ERRORS/' "@ge 1" \
3131
tag:'event-correlation',\
3232
severity:'EMERGENCY',\
3333
chain,\
34-
skipAfter:'END-CORRELATION'"
34+
skipAfter:END-CORRELATION"
3535
SecRule &TX:'/WEB_ATTACK/' "@ge 1" "t:none"
3636

3737
#
@@ -47,7 +47,7 @@ SecRule &TX:'/AVAILABILITY\\\/APP_NOT_AVAIL/' "@ge 1" \
4747
severity:'ALERT',\
4848
tag:'event-correlation',\
4949
chain,\
50-
skipAfter:'END-CORRELATION'"
50+
skipAfter:END-CORRELATION"
5151
SecRule &TX:'/WEB_ATTACK/' "@ge 1" "t:none"
5252

5353
SecRule TX:INBOUND_ANOMALY_SCORE "@gt 0" \
@@ -60,7 +60,7 @@ SecRule TX:INBOUND_ANOMALY_SCORE "@gt 0" \
6060
msg:'Inbound Anomaly Score (Total Inbound Score: %{TX.INBOUND_ANOMALY_SCORE}): %{tx.inbound_tx_msg}',\
6161
tag:'event-correlation',\
6262
chain,\
63-
skipAfter:'END-CORRELATION'"
63+
skipAfter:END-CORRELATION"
6464
SecRule TX:INBOUND_ANOMALY_SCORE "@lt %{tx.inbound_anomaly_score_threshold}"
6565

6666
SecRule TX:INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \

0 commit comments

Comments
 (0)