-
Notifications
You must be signed in to change notification settings - Fork 40
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Bug] CRS rule 920171 is not applied on chunked-encoded requests #53
Comments
Hey ! First of all, thank you for the detailed issue. It's way easier to debug this way. I will validate but I think chunk transfers are removed from the http request objects in golang, which means coraza will never have access to it in this connector. Probably coraza receives the full buffered request. I think @M4tteoP has information on this |
Hi, many thanks for taking the time on providing lots of details!
I really think this is the issue. What we should maybe do is understand if it is possible from the Update: https://github.com/golang/go/blob/master/src/net/http/transfer.go#L586 this line is definitely interesting. Maybe something like the following code can fix it.
I will give it a go next week :) |
Thank you for your fast response! @M4tteoP This could do the trick and you should definitively give it a shot! In my opinion however, it is not a problem of this connector but of the go/http library which gives you a HTTP request without a header that indicates a body is available. As the RFC says, |
I believe the behavior Go is going for is that, because the body that is provided doesn't have chunked headers, the header is removed - I guess the idea is to present to business logic in the same way regardless of encoding. But even so the body is still streamed so it can't compute a content length. There doesn't seem to be a great reason to remove the encoding header anyways but I guess they'll keep the behavior for backwards compatibility. Probably synthesizing the header for the coraza transaction is going to be the way to go if it's possible. Otherwise maybe a phase 2 rule could be added that checks |
Dear Coraza-Caddy maintainer,
it seems if CRS rule 920171 is not applied on chunked-encoded requests (i.e., requests using
Transfer-Encoding: chunked
). I used the following request to identify this behavior:Issue
This request gets accepted by Coraza+Caddy as the screenshots below demostrate:
However, it is expected that a
GET
request with a message body is blocked by rule 920171.Side Note
Sending this request to another CRS engine (e.g., ModSecurity) triggers the expected rejection:
Here ModSecurity's logs indicating the resposible rule:
Impact
This has no severe impact since it seems all other rules are still applied on the body as expected. Here a further request line was embedded into the body which triggers the respective rule:
Setup
Summarized I've used:
Here is my Dockerfile I've used to build Caddy + Coraza:
nick/caddy:2.6.2-no-expose
is a customized Dockerfile which removed Docker'sEXPOSE
statements and an error (see this issue for more information). Here is its source code:Caddy configuration file:
Coraza configuration:
If I'm missing something please let me know. Otherwise I'm glad if I can contribute to your project!
King regards
Nick
The text was updated successfully, but these errors were encountered: