Re: @pmFromFile for blocked vars

Hallo Harald,

I think the problem with your rule is order of execution of chained rules.

In your first example, the 1st SecRule is executed for base_dir and then
for x. VAR is now x. Then the 2nd rule is executed for var = x, which
does not bring a hit.

This is counterintuitive of course, but when you think about how things are
probably handled internally, then it makes sense. At least some sense. But
I wish it was different.

Is there a reason you do not do ARGS_NAMES @pmf 99_blocked... ?
I did not think this through, tough.

Building on your hack, you could do setvar:tx.var_%{MATCHED_VAR_NAME}
and then TX:/^var_/ "@pmf ...

Just my 2 cents,

Christian


On Mon, Feb 17, 2020 at 07:08:57PM +0100, Reindl Harald wrote:
> Hi
> 
> the rule below needs some love
> 
> no hit: ?base_dir=x&x=1
> hit: ?base_dir=x
> 
> why in the world does that only hit if the url ends with a listed param
> and is the some nicer way for "exact macth" than the ***var*** hack?
> 
> --------------------------------
> 
> SecRule ARGS_NAMES ^(.*)$
> "id:'89',chain,setvar:tx.var='***%{matched_var}***',msg:'blocked
> variable: %{matched_var}'"
> SecRule TX:VAR "@pmFromFile 99_blocked_vars.data"
> 
> --------------------------------
> 
> 99_blocked_vars.data:
> 
> ***base_dir***
> 
> 
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/


_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/