Skip to content

Commit 15c46a4

Browse files
SebitoshSebitosh
committed
ARGS NAMES test
Signed-off-by: Sebitosh <[email protected]>
1 parent 8b9af6d commit 15c46a4

36 files changed

+1747
-15
lines changed

‎config_tests/CONF_006_TARGET_ARGS_NAMES_A-GET.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
target: ARGS_NAMES
2+
rulefile: MRTS_006_ARGS_NAMES_A-GET.conf
3+
testfile: MRTS_006_ARGS_NAMES_A-GET.yaml
4+
templates:
5+
- SecRule for TARGETS
6+
colkey:
7+
- - ''
8+
- - attack1
9+
- - attack1
10+
- attack2
11+
- - /^attack_.*$/
12+
operator:
13+
- '@contains'
14+
oparg:
15+
- attack
16+
phase:
17+
- 1
18+
- 2
19+
- 3
20+
- 4
21+
testdata:
22+
phase_methods:
23+
1: get
24+
2: get
25+
3: get
26+
4: get
27+
targets:
28+
- target: ''
29+
test:
30+
data:
31+
attack: test
32+
- target: attack1
33+
test:
34+
data:
35+
attack1: test
36+
- target: attack2
37+
test:
38+
data:
39+
attack2: test
40+
- target: /^attack_.*$/
41+
test:
42+
data:
43+
attack_foo: test

‎config_tests/CONF_006_TARGET_ARGS_NAMES_B-POST.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
target: ARGS_NAMES
2+
rulefile: MRTS_006_ARGS_NAMES_B-POST.conf
3+
testfile: MRTS_006_ARGS_NAMES_B-POST.yaml
4+
templates:
5+
- SecRule for TARGETS
6+
colkey:
7+
- - ''
8+
- - attack1
9+
- - attack1
10+
- attack2
11+
- - /^attack_.*$/
12+
operator:
13+
- '@contains'
14+
oparg:
15+
- attack
16+
phase:
17+
- 2
18+
- 3
19+
- 4
20+
testdata:
21+
phase_methods:
22+
2: post
23+
3: post
24+
4: post
25+
targets:
26+
- target: ''
27+
test:
28+
data:
29+
attack: test
30+
- target: attack1
31+
test:
32+
data:
33+
attack1: test
34+
- target: attack2
35+
test:
36+
data:
37+
attack2: test
38+
- target: /^attack_.*$/
39+
test:
40+
data:
41+
attack_foo: test

‎generated/rules/MRTS_006_ARGS_NAMES_A-GET.conf‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
SecRule ARGS_NAMES "@contains attack" \
2+
"id:100064,\
3+
phase:1,\
4+
deny,\
5+
t:none,\
6+
log,\
7+
msg:'%{MATCHED_VAR_NAME} was caught in phase:1',\
8+
ver:'MRTS/0.1'"
9+
10+
SecRule ARGS_NAMES "@contains attack" \
11+
"id:100065,\
12+
phase:2,\
13+
deny,\
14+
t:none,\
15+
log,\
16+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
17+
ver:'MRTS/0.1'"
18+
19+
SecRule ARGS_NAMES "@contains attack" \
20+
"id:100066,\
21+
phase:3,\
22+
deny,\
23+
t:none,\
24+
log,\
25+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
26+
ver:'MRTS/0.1'"
27+
28+
SecRule ARGS_NAMES "@contains attack" \
29+
"id:100067,\
30+
phase:4,\
31+
deny,\
32+
t:none,\
33+
log,\
34+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
35+
ver:'MRTS/0.1'"
36+
37+
SecRule ARGS_NAMES:attack1 "@contains attack" \
38+
"id:100068,\
39+
phase:1,\
40+
deny,\
41+
t:none,\
42+
log,\
43+
msg:'%{MATCHED_VAR_NAME} was caught in phase:1',\
44+
ver:'MRTS/0.1'"
45+
46+
SecRule ARGS_NAMES:attack1 "@contains attack" \
47+
"id:100069,\
48+
phase:2,\
49+
deny,\
50+
t:none,\
51+
log,\
52+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
53+
ver:'MRTS/0.1'"
54+
55+
SecRule ARGS_NAMES:attack1 "@contains attack" \
56+
"id:100070,\
57+
phase:3,\
58+
deny,\
59+
t:none,\
60+
log,\
61+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
62+
ver:'MRTS/0.1'"
63+
64+
SecRule ARGS_NAMES:attack1 "@contains attack" \
65+
"id:100071,\
66+
phase:4,\
67+
deny,\
68+
t:none,\
69+
log,\
70+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
71+
ver:'MRTS/0.1'"
72+
73+
SecRule ARGS_NAMES:attack1|ARGS_NAMES:attack2 "@contains attack" \
74+
"id:100072,\
75+
phase:1,\
76+
deny,\
77+
t:none,\
78+
log,\
79+
msg:'%{MATCHED_VAR_NAME} was caught in phase:1',\
80+
ver:'MRTS/0.1'"
81+
82+
SecRule ARGS_NAMES:attack1|ARGS_NAMES:attack2 "@contains attack" \
83+
"id:100073,\
84+
phase:2,\
85+
deny,\
86+
t:none,\
87+
log,\
88+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
89+
ver:'MRTS/0.1'"
90+
91+
SecRule ARGS_NAMES:attack1|ARGS_NAMES:attack2 "@contains attack" \
92+
"id:100074,\
93+
phase:3,\
94+
deny,\
95+
t:none,\
96+
log,\
97+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
98+
ver:'MRTS/0.1'"
99+
100+
SecRule ARGS_NAMES:attack1|ARGS_NAMES:attack2 "@contains attack" \
101+
"id:100075,\
102+
phase:4,\
103+
deny,\
104+
t:none,\
105+
log,\
106+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
107+
ver:'MRTS/0.1'"
108+
109+
SecRule ARGS_NAMES:/^attack_.*$/ "@contains attack" \
110+
"id:100076,\
111+
phase:1,\
112+
deny,\
113+
t:none,\
114+
log,\
115+
msg:'%{MATCHED_VAR_NAME} was caught in phase:1',\
116+
ver:'MRTS/0.1'"
117+
118+
SecRule ARGS_NAMES:/^attack_.*$/ "@contains attack" \
119+
"id:100077,\
120+
phase:2,\
121+
deny,\
122+
t:none,\
123+
log,\
124+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
125+
ver:'MRTS/0.1'"
126+
127+
SecRule ARGS_NAMES:/^attack_.*$/ "@contains attack" \
128+
"id:100078,\
129+
phase:3,\
130+
deny,\
131+
t:none,\
132+
log,\
133+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
134+
ver:'MRTS/0.1'"
135+
136+
SecRule ARGS_NAMES:/^attack_.*$/ "@contains attack" \
137+
"id:100079,\
138+
phase:4,\
139+
deny,\
140+
t:none,\
141+
log,\
142+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
143+
ver:'MRTS/0.1'"
144+

‎generated/rules/MRTS_006_ARGS_NAMES_B-POST.conf‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
SecRule ARGS_NAMES "@contains attack" \
2+
"id:100080,\
3+
phase:2,\
4+
deny,\
5+
t:none,\
6+
log,\
7+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
8+
ver:'MRTS/0.1'"
9+
10+
SecRule ARGS_NAMES "@contains attack" \
11+
"id:100081,\
12+
phase:3,\
13+
deny,\
14+
t:none,\
15+
log,\
16+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
17+
ver:'MRTS/0.1'"
18+
19+
SecRule ARGS_NAMES "@contains attack" \
20+
"id:100082,\
21+
phase:4,\
22+
deny,\
23+
t:none,\
24+
log,\
25+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
26+
ver:'MRTS/0.1'"
27+
28+
SecRule ARGS_NAMES:attack1 "@contains attack" \
29+
"id:100083,\
30+
phase:2,\
31+
deny,\
32+
t:none,\
33+
log,\
34+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
35+
ver:'MRTS/0.1'"
36+
37+
SecRule ARGS_NAMES:attack1 "@contains attack" \
38+
"id:100084,\
39+
phase:3,\
40+
deny,\
41+
t:none,\
42+
log,\
43+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
44+
ver:'MRTS/0.1'"
45+
46+
SecRule ARGS_NAMES:attack1 "@contains attack" \
47+
"id:100085,\
48+
phase:4,\
49+
deny,\
50+
t:none,\
51+
log,\
52+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
53+
ver:'MRTS/0.1'"
54+
55+
SecRule ARGS_NAMES:attack1|ARGS_NAMES:attack2 "@contains attack" \
56+
"id:100086,\
57+
phase:2,\
58+
deny,\
59+
t:none,\
60+
log,\
61+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
62+
ver:'MRTS/0.1'"
63+
64+
SecRule ARGS_NAMES:attack1|ARGS_NAMES:attack2 "@contains attack" \
65+
"id:100087,\
66+
phase:3,\
67+
deny,\
68+
t:none,\
69+
log,\
70+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
71+
ver:'MRTS/0.1'"
72+
73+
SecRule ARGS_NAMES:attack1|ARGS_NAMES:attack2 "@contains attack" \
74+
"id:100088,\
75+
phase:4,\
76+
deny,\
77+
t:none,\
78+
log,\
79+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
80+
ver:'MRTS/0.1'"
81+
82+
SecRule ARGS_NAMES:/^attack_.*$/ "@contains attack" \
83+
"id:100089,\
84+
phase:2,\
85+
deny,\
86+
t:none,\
87+
log,\
88+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
89+
ver:'MRTS/0.1'"
90+
91+
SecRule ARGS_NAMES:/^attack_.*$/ "@contains attack" \
92+
"id:100090,\
93+
phase:3,\
94+
deny,\
95+
t:none,\
96+
log,\
97+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
98+
ver:'MRTS/0.1'"
99+
100+
SecRule ARGS_NAMES:/^attack_.*$/ "@contains attack" \
101+
"id:100091,\
102+
phase:4,\
103+
deny,\
104+
t:none,\
105+
log,\
106+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
107+
ver:'MRTS/0.1'"
108+

‎generated/rules/MRTS_110_XML.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
SecRule XML:/* "@beginsWith foo" \
2-
"id:100064,\
2+
"id:100092,\
33
phase:2,\
44
deny,\
55
t:none,\
@@ -8,7 +8,7 @@ SecRule XML:/* "@beginsWith foo" \
88
ver:'MRTS/0.1'"
99

1010
SecRule XML:/* "@beginsWith foo" \
11-
"id:100065,\
11+
"id:100093,\
1212
phase:3,\
1313
deny,\
1414
t:none,\
@@ -17,7 +17,7 @@ SecRule XML:/* "@beginsWith foo" \
1717
ver:'MRTS/0.1'"
1818

1919
SecRule XML:/* "@beginsWith foo" \
20-
"id:100066,\
20+
"id:100094,\
2121
phase:4,\
2222
deny,\
2323
t:none,\

0 commit comments

Comments
 (0)