SecContentInjection is not yet supported

[dvyas]

I am getting below error when using ContentInjection rule vi /etc/nginx/nginx.conf nginx -s reload 10:26:25 [notice] 118#118: ModSecurity-nginx v1.0.0 10:26:25 [emerg] 118#118: "modsecurity_rules" directive Rules error. File: <>. Line: 1. Column: 16. SecContentInjection is not yet supported. in /etc/nginx/nginx

rg] "modsecurity_rules" directive Rules error. File: <>. Line: 1. Column: 16. SecContentInjection is not yet supported. in /etc/nginx/nginx.conf:66

[victorhora]

Yes. As stated by the error message and the reference manual, SecContentInjection is not supported in libModSecurity.

[dvyas]

Thanks, What are the rules setup for preventing CSRF in libmodsecurity

[victorhora]

@dvyas, You could try virtual patching the vulnerable parameters.

[dvyas]

@victorhora can you give me one example...I am newbie to modsecurity...is there any rules file for virtual patching

[dvyas]

How can I add a CSRF token like in modsecurity v2 it is SecContentinjection and then use append to ad token to desired forms

[victorhora]

You can't append content with SecContentInjection as of now with libModSecurity. This functionality is not planned to be implemented. See #1001 (comment).

This functionality was experimental in v2 and due to performance reasons and also due to the functionality also being too tied to the connector rather than the library it's currently deprecated.

I recommend that you follow OWASP guidelines on implementing CSRF protection:

https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project
https://www.owasp.org/index.php/CSRFProtector_Project
https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API

[meigea]

@victorhora Is there other setting to replace SecContentInjection that can produced token with every phaser.