|
56 | 56 | SecRuleEngine On
|
57 | 57 | SecRequestBodyAccess Off
|
58 | 58 | SecRule REQUEST_BODY "@rx BAD BODY" "id:21,phase:request,deny,log,status:403"
|
| 59 | + SecRule ARGS_POST|ARGS_POST_NAMES "@rx BAD ARG" "id:22,phase:request,deny,log,status:403" |
59 | 60 | ';
|
60 | 61 | proxy_pass http://127.0.0.1:8081;
|
61 | 62 | }
|
|
88 | 89 | $t->run_daemon(\&http_daemon);
|
89 | 90 | $t->run()->waitforsocket('127.0.0.1:' . port(8081));
|
90 | 91 |
|
91 |
| -$t->plan(28); |
| 92 | +$t->plan(32); |
92 | 93 |
|
93 | 94 | ###############################################################################
|
94 | 95 |
|
95 | 96 | foreach my $method (('GET', 'POST', 'PUT', 'DELETE')) {
|
96 | 97 | like(http_req_body($method, '/bodyaccess', 'GOOD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body access on, pass");
|
97 | 98 | like(http_req_body($method, '/bodyaccess', 'VERY BAD BODY'), qr/403 Forbidden/, "$method request body access on, block");
|
98 | 99 | like(http_req_body($method, '/nobodyaccess', 'VERY BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body access off, pass");
|
| 100 | +like(http_req_body_postargs($method, '/nobodyaccess', 'BAD ARG'), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body access off (ARGS_POST), pass"); |
99 | 101 | like(http_req_body($method, '/bodylimitreject', 'BODY' x 32), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body limit reject, pass");
|
100 | 102 | like(http_req_body($method, '/bodylimitreject', 'BODY' x 33), qr/403 Forbidden/, "$method request body limit reject, block");
|
101 | 103 | like(http_req_body($method, '/bodylimitprocesspartial', 'BODY' x 32 . 'BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body limit process partial, pass");
|
@@ -159,4 +161,25 @@ sub http_req_body {
|
159 | 161 | );
|
160 | 162 | }
|
161 | 163 |
|
| 164 | +sub http_req_body_postargs { |
| 165 | + my $method = shift; |
| 166 | + my $uri = shift; |
| 167 | + my $last = pop; |
| 168 | + return http( join '', (map { |
| 169 | + my $body = $_; |
| 170 | + "$method $uri HTTP/1.1" . CRLF |
| 171 | + . "Host: localhost" . CRLF |
| 172 | + . "Content-Type: application/x-www-form-urlencoded" . CRLF |
| 173 | + . "Content-Length: " . (length "test=" . $body) . CRLF . CRLF |
| 174 | + . "test=" . $body |
| 175 | + } @_), |
| 176 | + "$method $uri HTTP/1.1" . CRLF |
| 177 | + . "Host: localhost" . CRLF |
| 178 | + . "Connection: close" . CRLF |
| 179 | + . "Content-Type: application/x-www-form-urlencoded" . CRLF |
| 180 | + . "Content-Length: " . (length "test=" . $last) . CRLF . CRLF |
| 181 | + . "test=" . $last |
| 182 | + ); |
| 183 | +} |
| 184 | + |
162 | 185 | ###############################################################################
|
0 commit comments