I'm trying to craft a rule which would match certain regex in POST requests.
Rule I have so far looks like;
SecRule REQUEST_FILENAME "form.php" \ "id:'12345',chain,deny,status:406,log,msg:'foobar detected'" SecRule REQUEST_METHOD "POST" chain SecRule REQUEST_BODY "@rx (?i:(bad|words|to|be|blocked))"
Rule works when content type is not 'text/xml'
I'm testing with curl like
curl -vs http://domain.tld/form.php -d 'blocked'
However when I set 'Content-Type:text/xml'; rules fails to match; testing with
curl -vs http://domain.tld/form.php -H "Content-Type:text/xml" -d 'blocked'
There is additional rule which sets REQBODY_PROCESSOR to XML if content type 'text/xml' is found in headers. I'm interested to see how matching policy changes with different REQBODY_PROCESSOR because obviously when REQBODY_PROCESSOR is not XML (when Content-Type is ommited; rules match). I tried forcing other REQBODY_PROCESSOR options to get the rule chain working but without success.