| Newsgroups |
gmane.comp.apache.mod-security.user |
| Message-ID |
<[email protected]> |
Hi all,
I feel like I'm going blind here, I'm sure the problem is obvious and (to me) embarrassing. But - I'm trying to write a whitelist rule that selectively disabled a specific rule:
# acs: Some clients stick charsets in content-type request headers
SecRule REQUEST_HEADERS:Content-Type "@rx charset\s*=\s*([^;\s]+)" \
"phase:request,id:1103,t:none,pass,nolog,tag:'md-debug',chain,\
ctl:ruleRemoveById=920480"
SecRule REQUEST_URI "@rx ^(/mdpayacs/pareq|/pan-tokenisation/PanTokenServiceImpl).*" "t:none"
I know the matcher works, because when I use
ctl:ruleRemoveTargetByTag='OWASP_CRS/PROTOCOL_VIOLATION/CONTENT_TYPE_CHARSET';REQUEST_HEADERS:Content-Type"
the whitelist works as expected. I just think disabling the explicit rule would be the more correct/cheap thing to do.
What am I doing wrong?
libmodsecurity 3.0.3 and nginx on FreeBSD, CRS 3.1.0.
Note that it works with CRS 3.0.0 but I think rule 920480 is new in 3.1, so that would explain that part.
/Eirik
_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/