Skip to content

Commit

Permalink
test case: Adds test case related to #1831
Browse files Browse the repository at this point in the history
  • Loading branch information
Felipe Zimmerle committed Sep 11, 2018
1 parent 764a2e4 commit dfbff09
Show file tree
Hide file tree
Showing 2 changed files with 201 additions and 0 deletions.
1 change: 1 addition & 0 deletions Makefile.am
View file
Expand Up @@ -89,6 +89,7 @@ TESTS=
TESTS+=test/test-cases/regression/issue-1591.json
TESTS+=test/test-cases/regression/issue-1785.json
TESTS+=test/test-cases/regression/issue-1812.json
TESTS+=test/test-cases/regression/issue-1831.json
TESTS+=test/test-cases/regression/variable-RESPONSE_HEADERS.json
TESTS+=test/test-cases/regression/config-include.json
TESTS+=test/test-cases/regression/variable-WEBSERVER_ERROR_LOG.json
Expand Down
200 changes: 200 additions & 0 deletions test/test-cases/regression/issue-1831.json
View file
@@ -0,0 +1,200 @@
[
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "Invalid actions break CRS 3.1 on rule 912160",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "net.tutsplus.com",
"User-Agent": "",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "\/test.pl?foo=£&bar=%C2%A3",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "text\/xml; charset=utf-8\n\r",
"Content-Length": "length\n\r"
}
},
"expected": {
"debug_log": "\\\\xc2\\\\xa3"
},
"rules": [
"SecRuleEngine On",
"SecRule ARGS:foo \"^$\" \"id:1,expirevar:'ip.dos_burst_counter=%{tx.dos_burst_time_slice}'"
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "Invalid actions break CRS 3.1 on rule 912160",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "net.tutsplus.com",
"User-Agent": "",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "\/test.pl?foo=£&bar=%C2%A3",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "text\/xml; charset=utf-8\n\r",
"Content-Length": "length\n\r"
}
},
"expected": {
"http_code": 200
},
"rules": [
"SecRuleEngine On",
"SecRule ARGS:foo \".\" \"id:1,setvar:'ip.dos_counter=1',log",
"SecRule ip.dos_counter \".\" \"id:4,log",
"SecRule ARGS:foo \".\" \"id:2,setvar:'!ip.dos_counter',log",
"SecRule ip.dos_counter \".\" \"id:3,log,status:123,block,deny"
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "Invalid actions break CRS 3.1 on rule 912160",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "net.tutsplus.com",
"User-Agent": "",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "\/test.pl?foo=£&bar=%C2%A3",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "text\/xml; charset=utf-8\n\r",
"Content-Length": "length\n\r"
}
},
"expected": {
"http_code": 200,
"debug_log": "Target value: \"1\""
},
"rules": [
"SecRuleEngine On",
"SecRule ARGS:foo \".\" \"id:1,setvar:'global.alerted_970018_iisDefLoc'\"",
"SecRule GLOBAL:alerted_970018_iisDefLoc \".\" \"id:4,log\""
]
},
{
"enabled": 1,
"version_min": 209000,
"version_max": -1,
"title": "Invalid actions break CRS 3.1 on rule 912160",
"url": "https:\/\/github.com\/SpiderLabs\/ModSecurity\/issues\/1830",
"client": {
"ip": "200.249.12.31",
"port": 2313
},
"server": {
"ip": "200.249.12.31",
"port": 80
},
"request": {
"headers": {
"Host": "net.tutsplus.com",
"User-Agent": "",
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
"Accept-Language": "en-us,en;q=0.5",
"Accept-Encoding": "gzip,deflate",
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
"Keep-Alive": "300",
"Connection": "keep-alive",
"Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120",
"Pragma": "no-cache",
"Cache-Control": "no-cache"
},
"uri": "\/test.pl?foo=£&bar=%C2%A3",
"method": "GET",
"http_version": 1.1,
"body": ""
},
"response": {
"headers": {
"Content-Type": "text\/xml; charset=utf-8\n\r",
"Content-Length": "length\n\r"
}
},
"expected": {
"http_code": 200,
"debug_log": "GLOBAL:alerted_970018_iisDefLoc with value: 1"
},
"rules": [
"SecRuleEngine On",
"SecRule ARGS \"@rx .\" \"id:954100,phase:1,block,capture,t:none,t:lowercase,msg:'Disclosure of IIS install location',logdata:'Matched Data',tag:'application-multi',tag:'language-multi',tag:'platform-iis',tag:'platform-windows',tag:'attack-disclosure',ctl:auditLogParts=+E,rev:3,ver:'OWASP_CRS/3.0.0',severity:'ERROR',chain\"",
"SecRule &GLOBAL:alerted_970018_iisDefLoc \"@eq 0\" \"setvar:'global.alerted_970018_iisDefLoc',setvar:'tx.msg=%{rule.msg}',setvar:'tx.outbound_anomaly_score=+%{tx.error_anomaly_score}',setvar:'tx.anomaly_score=+%{tx.error_anomaly_score}'\""
]
}
]



0 comments on commit dfbff09

Please sign in to comment.