Skip to content

Conversation

marcstern
Copy link

In case we write a rule with an empty action, like the following
SecRule {pattern} {target} "action1,action2,,action3"
the behaviour is not consistent.

Preliminary explanation: although having empty actions is abnormal, it may happen very easily when using mod_macro, mod_define or to activate some actions or not depending on the context.

Behaviour:

  • An empty action is added to the actions table
  • When parsing the actions, sometimes the empty action is ignored, sometimes we get an error "Unknown action" (I'm not sure why, potentially if you have only one empty action or more)
  • When we get an error "Unknown action", we have absolutely no context (because the parsing only knows about the individual action at this time, which renders any troubleshooting almost impossible without enabling debug logs

This PR adds a trivial check to not store empty actions in the table and have a consistent behaviour.

@marcstern marcstern merged commit aac0bee into owasp-modsecurity:v2/master Feb 1, 2024
@marcstern marcstern deleted the v2/mst/empty_action branch February 1, 2024 10:18
@marcstern marcstern restored the v2/mst/empty_action branch June 7, 2024 12:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant