Skip to content

MULTIPART_UNMATCHED_BOUNDARY=1 functionality is broken #2681

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

MULTIPART_UNMATCHED_BOUNDARY=1 functionality is broken #2681

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a053558
MULTIPART_UNMATCHED_BOUNDARY=1 functionality is broken
martinhsv Jan 29, 2022
ed4428d
Merge branch 'SpiderLabs:v3/master' into v3/master
martinhsv Apr 5, 2022
2145185
Merge branch 'SpiderLabs:v3/master' into v3/master
martinhsv Apr 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
201 changes: 201 additions & 0 deletions test/test-cases/regression/variable-MULTIPART_UNMATCHED_BOUNDARY.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,5 +57,206 @@
"SecRuleEngine On",
"SecRule MULTIPART_UNMATCHED_BOUNDARY \"@contains small_text_file.txt\" \"id:1,phase:3,pass,t:trim\""
]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: MULTIPART_UNMATCHED_BOUNDARY - 2nd unmatched",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Content-Length":"330",
"Content-Type":"multipart/form-data; boundary=--------------------------756b6d74fa1a8ee2",
"Expect":"100-continue"
},
"uri":"/",
"method":"POST",
"body":[
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"a\"",
"",
"1",
"----------------------------wrong-unmatched",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is not an unmatched boundary.

"Content-Disposition: form-data; name=\"b\"",
"",
"2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"c\"",
"",
"3",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"d\"",
"",
"4",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"e\"",
"",
"5",
"----------------------------756b6d74fa1a8ee2--",
""
]
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"Target value: \"1\" \\(Variable: MULTIPART_UNMATCHED_BOUNDARY\\)",
"http_code": 403
},
"rules":[
"SecRuleEngine On",
"SecRule MULTIPART_UNMATCHED_BOUNDARY \"@eq 1\" \"id:1,phase:2,deny,status:403\""
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You expect value 1 but the PR #1747 has modified the logic, that in this case the engine gives 2. See the detailed information in #1801.

]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: MULTIPART_UNMATCHED_BOUNDARY - 3rd unmatched",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Content-Length":"330",
"Content-Type":"multipart/form-data; boundary=--------------------------756b6d74fa1a8ee2",
"Expect":"100-continue"
},
"uri":"/",
"method":"POST",
"body":[
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"a\"",
"",
"1",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"b\"",
"",
"2",
"----------------------------wrong-unmatched",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is not an unmatched boundary.

"Content-Disposition: form-data; name=\"c\"",
"",
"3",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"d\"",
"",
"4",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"e\"",
"",
"5",
"----------------------------756b6d74fa1a8ee2--",
""
]
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"Target value: \"1\" \\(Variable: MULTIPART_UNMATCHED_BOUNDARY\\)",
"http_code": 403
},
"rules":[
"SecRuleEngine On",
"SecRule MULTIPART_UNMATCHED_BOUNDARY \"@eq 1\" \"id:1,phase:2,deny,status:403\""
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as in case of test #2.

]
},
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: MULTIPART_UNMATCHED_BOUNDARY - 4th unmatched",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Content-Length":"330",
"Content-Type":"multipart/form-data; boundary=--------------------------756b6d74fa1a8ee2",
"Expect":"100-continue"
},
"uri":"/",
"method":"POST",
"body":[
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"a\"",
"",
"1",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"b\"",
"",
"2",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"c\"",
"",
"3",
"----------------------------wrong-unmatched",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is not an unmatched boundary.

"Content-Disposition: form-data; name=\"d\"",
"",
"4",
"----------------------------756b6d74fa1a8ee2",
"Content-Disposition: form-data; name=\"e\"",
"",
"5",
"----------------------------756b6d74fa1a8ee2--",
""
]
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"Target value: \"1\" \\(Variable: MULTIPART_UNMATCHED_BOUNDARY\\)",
"http_code": 403
},
"rules":[
"SecRuleEngine On",
"SecRule MULTIPART_UNMATCHED_BOUNDARY \"@eq 1\" \"id:1,phase:2,deny,status:403\""
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as in case of test #2.

]
}
]