Skip to content

Change handling of invalid JSON and XML request body #177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: waf_nginx
Choose a base branch
from

Conversation

creepyghost
Copy link

Description

  • This MR changes the behaviour of modsecurity when handling invalid request JSON or XML.
  • Modsecurity currently fails at parsing these request bodies when content type is specified
    and throws an HTTP 500 status. This behaviour isn't exactly compliant with the HTTP RFC.
  • This MR proposes a standardized mechanism for handling body parser errors.
  • The return codes are standardized in the common header file and a special return code
    BODY_PARSER_ERR_INVALID_BODY now indicates that the body parser failed.
  • Modsecurity proceeds to evaluate the standard modsec-recommended rule 200002 which
    handles the REQBODY_ERROR target to return a block decision with HTTP 400.

Changes

modsecurity.h

  • Standardize body parser return codes

msc_json.c, msc_xml.c

  • Return special error code on body parsing failure

msc_reqbody.c, apache2_io.c, mod_security2.c

  • Change body parsing error codes to refer to constants
    defined in header.

@creepyghost creepyghost changed the title Change handling of invalid request body Change handling of invalid JSON and XML request body Oct 27, 2021
### modsecurity.h
* Standardize body parser return codes

### msc_json.c, msc_xml.c
* Return special error code on body parsing failure

### msc_reqbody.c, apache2_io.c, mod_security2.c
* Change body parsing error codes to refer to constants
  defined in header.
@creepyghost creepyghost force-pushed the akishore/fix/invalid-body-handling branch from 7f48e3a to 980561c Compare January 25, 2022 11:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant