Skip to content

Commit b264dbf

Browse files
Easton97-JensEaston97-Jens
authored
Merge pull request #27 from Easton97-Jens/codex/add-regression-tests-for-modsecurity-operators
Add regression coverage for detectSQLi/detectXSS capture semantics
2 parents 9e66822 + 633f2eb commit b264dbf

2 files changed

Lines changed: 186 additions & 0 deletions

File tree

‎test/test-cases/regression/operator-detectsqli.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -368,5 +368,98 @@
368368
"SecRule ARGS \"@detectSQLi\" \"id:1208,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
369369
"SecRule TX:sqli_hit \"@eq 1\" \"id:2208,phase:2,deny,status:403\""
370370
]
371+
},
372+
{
373+
"enabled": 1,
374+
"version_min": 300000,
375+
"client": {
376+
"ip": "200.249.12.31",
377+
"port": 123
378+
},
379+
"server": {
380+
"ip": "200.249.12.31",
381+
"port": 80
382+
},
383+
"response": {
384+
"headers": {
385+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
386+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
387+
"Content-Type": "text/html",
388+
"Content-Length": "8"
389+
},
390+
"body": [
391+
"no need."
392+
]
393+
},
394+
"title": "Testing Operator :: @detectSQLi :: capture stores fingerprint in TX.0",
395+
"request": {
396+
"headers": {
397+
"Host": "localhost",
398+
"User-Agent": "curl/7.38.0",
399+
"Accept": "*/*",
400+
"Content-Length": "61",
401+
"Content-Type": "application/x-www-form-urlencoded"
402+
},
403+
"uri": "/",
404+
"method": "POST",
405+
"body": [
406+
"param1=ascii(substring(version() from 1 for 1))&param2=value2"
407+
]
408+
},
409+
"expected": {
410+
"http_code": 403
411+
},
412+
"rules": [
413+
"SecRuleEngine On",
414+
"SecRule ARGS \"@detectSQLi\" \"id:1209,phase:2,capture,pass,t:trim,setvar:tx.sqli_hit=1\"",
415+
"SecRule TX:0 \"@streq f(f(f\" \"id:2209,phase:2,deny,status:403\""
416+
]
417+
},
418+
{
419+
"enabled": 1,
420+
"version_min": 300000,
421+
"client": {
422+
"ip": "200.249.12.31",
423+
"port": 123
424+
},
425+
"server": {
426+
"ip": "200.249.12.31",
427+
"port": 80
428+
},
429+
"response": {
430+
"headers": {
431+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
432+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
433+
"Content-Type": "text/html",
434+
"Content-Length": "8"
435+
},
436+
"body": [
437+
"no need."
438+
]
439+
},
440+
"title": "Testing Operator :: @detectSQLi :: no capture keeps TX.0 unchanged",
441+
"request": {
442+
"headers": {
443+
"Host": "localhost",
444+
"User-Agent": "curl/7.38.0",
445+
"Accept": "*/*",
446+
"Content-Length": "61",
447+
"Content-Type": "application/x-www-form-urlencoded"
448+
},
449+
"uri": "/",
450+
"method": "POST",
451+
"body": [
452+
"param1=ascii(substring(version() from 1 for 1))&param2=value2"
453+
]
454+
},
455+
"expected": {
456+
"http_code": 403
457+
},
458+
"rules": [
459+
"SecRuleEngine On",
460+
"SecRule ARGS \"@detectSQLi\" \"id:1210,phase:2,pass,t:trim,setvar:tx.sqli_hit=1\"",
461+
"SecRule TX:0 \"@streq f(f(f\" \"id:2210,phase:2,deny,status:409\"",
462+
"SecRule TX:sqli_hit \"@eq 1\" \"id:2211,phase:2,deny,status:403\""
463+
]
371464
}
372465
]

‎test/test-cases/regression/operator-detectxss.json‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,5 +320,98 @@
320320
"SecRule ARGS \"@detectXSS\" \"id:1107,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
321321
"SecRule TX:xss_hit \"@eq 1\" \"id:2107,phase:2,deny,status:403\""
322322
]
323+
},
324+
{
325+
"enabled": 1,
326+
"version_min": 300000,
327+
"client": {
328+
"ip": "200.249.12.31",
329+
"port": 123
330+
},
331+
"server": {
332+
"ip": "200.249.12.31",
333+
"port": 80
334+
},
335+
"response": {
336+
"headers": {
337+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
338+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
339+
"Content-Type": "text/html",
340+
"Content-Length": "8"
341+
},
342+
"body": [
343+
"no need."
344+
]
345+
},
346+
"title": "Testing Operator :: @detectXSS :: capture stores original input in TX.0",
347+
"request": {
348+
"headers": {
349+
"Host": "localhost",
350+
"User-Agent": "curl/7.38.0",
351+
"Accept": "*/*",
352+
"Content-Length": "46",
353+
"Content-Type": "application/x-www-form-urlencoded"
354+
},
355+
"uri": "/",
356+
"method": "POST",
357+
"body": [
358+
"param1=<script>alert(1)</script>&param2=value2"
359+
]
360+
},
361+
"expected": {
362+
"http_code": 403
363+
},
364+
"rules": [
365+
"SecRuleEngine On",
366+
"SecRule ARGS \"@detectXSS\" \"id:1108,phase:2,capture,pass,t:trim,setvar:tx.xss_hit=1\"",
367+
"SecRule TX:0 \"@streq <script>alert(1)</script>\" \"id:2108,phase:2,deny,status:403\""
368+
]
369+
},
370+
{
371+
"enabled": 1,
372+
"version_min": 300000,
373+
"client": {
374+
"ip": "200.249.12.31",
375+
"port": 123
376+
},
377+
"server": {
378+
"ip": "200.249.12.31",
379+
"port": 80
380+
},
381+
"response": {
382+
"headers": {
383+
"Date": "Mon, 13 Jul 2015 20:02:41 GMT",
384+
"Last-Modified": "Sun, 26 Oct 2014 22:33:37 GMT",
385+
"Content-Type": "text/html",
386+
"Content-Length": "8"
387+
},
388+
"body": [
389+
"no need."
390+
]
391+
},
392+
"title": "Testing Operator :: @detectXSS :: no capture keeps TX.0 unchanged",
393+
"request": {
394+
"headers": {
395+
"Host": "localhost",
396+
"User-Agent": "curl/7.38.0",
397+
"Accept": "*/*",
398+
"Content-Length": "46",
399+
"Content-Type": "application/x-www-form-urlencoded"
400+
},
401+
"uri": "/",
402+
"method": "POST",
403+
"body": [
404+
"param1=<script>alert(1)</script>&param2=value2"
405+
]
406+
},
407+
"expected": {
408+
"http_code": 403
409+
},
410+
"rules": [
411+
"SecRuleEngine On",
412+
"SecRule ARGS \"@detectXSS\" \"id:1109,phase:2,pass,t:trim,setvar:tx.xss_hit=1\"",
413+
"SecRule TX:0 \"@streq <script>alert(1)</script>\" \"id:2109,phase:2,deny,status:409\"",
414+
"SecRule TX:xss_hit \"@eq 1\" \"id:2110,phase:2,deny,status:403\""
415+
]
323416
}
324417
]

0 commit comments

Comments
 (0)