Skip to content

Commit a9f9a59

Browse files
committed
Adding statement regarding potential issues with file upload with SecStreamInBodyInspection by @bostrt (owasp-modsecurity#1366)
1 parent a7ed9cb commit a9f9a59

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

Diff for: Reference-Manual.mediawiki

+5-3
Original file line numberDiff line numberDiff line change
@@ -1707,6 +1707,8 @@ This feature enables the creation of the STREAM_INPUT_BODY variable and is usefu
17071707
17081708
; Note : This directive is NOT supported for libModSecurity (v3). Naturally, STREAM_INPUT_BODY is also NOT supported on libModSecurity.
17091709
1710+
; Note : This directive may significantly impact file upload times. The impact depends on server resources and the nature of operations being performed on the request bodies being streamed in.
1711+
17101712
== SecStreamOutBodyInspection ==
17111713
'''Description:''' Configures the ability to use stream inspection for outbound request data in a re-allocable buffer. For security reasons we are still buffering the stream.
17121714

@@ -2587,9 +2589,9 @@ This variable holds the full status line sent by the server (including the reque
25872589
SecRule STATUS_LINE "@contains 500" "phase:3,id:49,log,pass,logdata:'Application error detected!,t:none"
25882590
</pre>
25892591

2590-
'''Version:''' 2.6.0-2.9.x
2592+
'''Version:''' 2.x
25912593

2592-
'''Supported on libModSecurity:''' No
2594+
'''Supported on libModSecurity:''' TBI
25932595

25942596
== STREAM_INPUT_BODY ==
25952597
'''Version:''' 2.6.0-2.9.x
@@ -4468,4 +4470,4 @@ While we will continue to enhance ModSecurity to deal with various evasion techn
44684470
#The order in which parameters are taken from the request and the environment is EGPCS (environment, GET, POST, Cookies, built-in variables). This means that a POST parameter will overwrite the parameters transported on the request line (in QUERY_STRING).
44694471
#When "magic_quotes_gpc" is set to "On" PHP will use backslash to escape the following characters: single quote, double quote, backslash, and the nul byte.
44704472
#If "magic_quotes_sybase" is set to "On" only the single quote will be escaped using another single quote. In this case the "magic_quotes_gpc" setting becomes irrelevant. The "magic_quotes_sybase" setting completely overrides the "magic_quotes_gpc" behaviour but "magic_quotes_gpc" still must be set to "On" for the Sybase-specific quoting to be work.
4471-
#PHP will also automatically create nested arrays for you. For example "p[x][y]=1" results in a total of three variables.
4473+
#PHP will also automatically create nested arrays for you. For example "p[x][y]=1" results in a total of three variables.

0 commit comments

Comments
 (0)