Malicious file upload detection

.travis.yml

@@ -28,4 +28,4 @@ branches:
   - v3.0/master
   - v3.1/dev
 notifications:
-  irc: "chat.freenode.net#modsecurity"
+  irc: "chat.freenode.net#modsecurity"

README.md

@@ -7,7 +7,7 @@ The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection r
 
 ## CRS Resources
 
-Please see the [OWASP ModSecurity Core Rule Set page](https://modsecurity.org/crs/) to get introduced to the CRS and view resources on installation, configuration, and working with the CRS.
+Please see the [OWASP ModSecurity Core Rule Set page](https://coreruleset.org/) to get introduced to the CRS and view resources on installation, configuration, and working with the CRS.
 
 ## Contributing to the CRS
 

crs-setup.conf.example

@@ -1,5 +1,5 @@
 # ------------------------------------------------------------------------
-# OWASP ModSecurity Core Rule Set ver.3.0.2
+# OWASP ModSecurity Core Rule Set ver.3.2.0
 # Copyright (c) 2006-2017 Trustwave and contributors. All rights reserved.
 #
 # The OWASP ModSecurity Core Rule Set is distributed under
@@ -425,6 +425,16 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #  t:none,\
 #  setvar:'tx.static_extensions=/.jpg/ /.jpeg/ /.png/ /.gif/ /.js/ /.css/ /.ico/ /.svg/ /.webp/'"
 
+# Locations that will be inspected to enforce only images and documents uploads.
+# Default: /wp-admin/upload.php /wp-admin/media-new.php
+# Uncomment this rule to change the default set in 901180
+#SecAction \
+# "id:900270,\
+#  phase:1,\
+#  nolog,\
+#  pass,\
+#  t:none,\
+#  setvar:'tx.protected_uploads=#/wp-admin/upload.php# #/wp-admin/media-new.php#'"
 
 #
 # -- [[ HTTP Argument/Upload Limits ]] -----------------------------------------
@@ -802,4 +812,4 @@ SecAction \
   nolog,\
   pass,\
   t:none,\
-  setvar:tx.crs_setup_version=302"
+  setvar:tx.crs_setup_version=310"

rules/REQUEST-901-INITIALIZATION.conf

@@ -202,7 +202,9 @@ SecRule &TX:enforce_bodyproc_urlencoded "@eq 0" \
     nolog,\
     setvar:'tx.enforce_bodyproc_urlencoded=0'"
 
-SecAction \
+# If a default protected_uploads variable is not set in crs-setup rule 900270
+# then a generic default will be set here.
+SecRule &TX:protected_uploads "@eq 0" \
     "id:901180,\
     phase:1,\
     pass,\