Re: Setting a request header to value from POST data

Hi Christian,

I did some debuglogging, but quite soon detected what I now think was the culprit. We had comments mostly with ticket numbers for the SecRuleRemoveById statements in the config - but not in a separate line, but INLINE, meaning some lines like this one (ids randomized):
"SecRuleRemoveById  123456     # PRJ-1234"
or that one:
"SecRuleRemoveById         123456      # Request Missing an Accept Header (bad merchant implementations)"
and others...

I strongly suspect that these are not interpreted correctly as comments, but rather as part of the id list or range, and might be misinterpreted and therefore match the new SecRule (and probably some others as well). I know this kind of error from other configurations but simply didn't spot it when I first looked at the existing config when starting work on the new requirement. After cleaning up with perl things started working fine and it looks all good now. Thanks again for the hints!


cheers,
Andres

-----Ursprüngliche Nachricht-----
Von: Christian Folini <[email protected]> 
Gesendet: Freitag, 23. August 2019 14:45
An: [email protected]
Betreff: Re: [mod-security-users] Setting a request header to value from POST data

Hello Andres,

On Fri, Aug 23, 2019 at 12:33:55PM +0000, Andres Ofner wrote:
> thanks for all the tips - I made a separate vhost and some tests, and 
> indeed, when I remove ALL SecRuleRemoveById statements we have 
> collected over the time, it suddenly works. Have to dig deeper why, 
> though... or have you got any idea?

Not really. But the debuglog at level 9 is your friend.

Good luck!

Christian


--
Integrity without knowledge is weak and useless, and knowledge
without integrity is dangerous and dreadful.          
-- Samuel Johnson


_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/