2

I'm trying to craft a rule which would match certain regex in POST requests.

Rule I have so far looks like;

SecRule REQUEST_FILENAME "form.php" \
  "id:'12345',chain,deny,status:406,log,msg:'foobar detected'"
SecRule REQUEST_METHOD "POST" chain
SecRule REQUEST_BODY "@rx (?i:(bad|words|to|be|blocked))"

Rule works when content type is not 'text/xml'

I'm testing with curl like

curl -vs http://domain.tld/form.php -d 'blocked'

However when I set 'Content-Type:text/xml'; rules fails to match; testing with

curl -vs http://domain.tld/form.php -H "Content-Type:text/xml" -d 'blocked'

There is additional rule which sets REQBODY_PROCESSOR to XML if content type 'text/xml' is found in headers. I'm interested to see how matching policy changes with different REQBODY_PROCESSOR because obviously when REQBODY_PROCESSOR is not XML (when Content-Type is ommited; rules match). I tried forcing other REQBODY_PROCESSOR options to get the rule chain working but without success.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.