Core Rule Set: Ghost's remaining fields pass with words that name commands (closes #359)
check / check (push) Waiting to run
check / check (push) Waiting to run
Ghost 6.76.0 was sent the fields the Ghost unit had not recorded with python3, powershell, ls -la and .htaccess. Fixes in ghost.conf: - the rules of plain text, now eight with 932235, for staff profiles, setup, invitations, tiers, offers, recommendations, integrations, webhooks, feature image captions, members' comments, the CSV import's labels, ActivityPub, and the analytics' query fields; - 932235 for the existing plain-text fields too, so "powershell & python3" passes there; - filter skips six more command rules, for the post picker's title:~'powershell & python3'; - staff invitation addresses, email_segment and a tag's code injection. Model: opus-5-5
This commit is contained in:
clawbot authored and sneak committed
1 parent
0cb6dded98
commit
4228f0ac9f
5 files changed
+577
-33
No files matched your search
@@ -7,7 +7,8 @@
|
||||
#
|
||||
# Ghost's admin and its integrations call the Admin API under /ghost/api/admin/,
|
||||
# themes and Ghost's own scripts call the Content API under /ghost/api/content/,
|
||||
# and members call /members/api/. Coraza names a field of a JSON body by its
|
||||
# and members call /members/api/. The admin calls ActivityPub, a service of its
|
||||
# own, under /.ghost/activitypub/. Coraza names a field of a JSON body by its
|
||||
# path, so the title of the first post saved is json.posts.0.title.
|
||||
|
||||
# Every rule below is skipped unless Inspect has set tx.app_ghost. It sets it
|
||||
@@ -17,11 +18,22 @@
|
||||
SecRule &TX:app_ghost "@eq 0" \
|
||||
"id:900365,phase:1,pass,nolog,skipAfter:END_GHOST"
|
||||
|
||||
# filter, a query in Ghost's own filter language, skips 932120 on the Admin API
|
||||
# and the Content API: filter=tag:powershell, filter=name:~'powershell'.
|
||||
# filter, a query in Ghost's own filter language, skips seven rules on the
|
||||
# Admin API and the Content API:
|
||||
# 932120: filter=tag:powershell, filter=name:~'powershell'
|
||||
# 932125, 932230, 932250: filter=title:~'powershell & ls -la'
|
||||
# 932235, 932260: filter=title:~'powershell & python3', which the admin's
|
||||
# post picker sends when a person types that title
|
||||
# 932380: filter=title:~'python3 & powershell'
|
||||
SecRule REQUEST_FILENAME "@rx ^/ghost/api/(?:admin|content)/" \
|
||||
"id:900350,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:filter"
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:filter,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:filter,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:filter,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:filter,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:filter,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:filter,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:filter"
|
||||
|
||||
# search, the search for a member by name or address, skips four rules on the
|
||||
# Admin API:
|
||||
@@ -45,10 +57,51 @@ SecRule REQUEST_FILENAME "@streq /ghost/api/admin/oembed/" \
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:url,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:url"
|
||||
|
||||
# The fields a person types plain text into skip seven rules on the Admin API:
|
||||
# The query fields of the analytics pages skip the eight rules of plain text,
|
||||
# which 900353 lists, on /ghost/api/admin/stats/:
|
||||
# 930120: pathname=/.htaccess
|
||||
# 932120: source=powershell.example.com
|
||||
# 932235, 932260: utm_campaign=powershell & python3
|
||||
# 932250: utm_term=ls -la
|
||||
# These fields filter the figures by a page, the site a visit came from, or a
|
||||
# campaign: pathname, source, utm_source, utm_medium, utm_campaign,
|
||||
# utm_content and utm_term.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/stats/" \
|
||||
"id:900367,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^(?:pathname|source|utm_(?:source|medium|campaign|content|term))$/"
|
||||
|
||||
# email_segment, the members a post is sent to as a newsletter, skips 932120
|
||||
# on the Admin API's posts: email_segment=label:powershell-users.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/posts/" \
|
||||
"id:900368,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:email_segment"
|
||||
|
||||
# query, a search for an account in ActivityPub, skips the eight rules of plain
|
||||
# text: query=python3, query=@powershell@example.com.
|
||||
SecRule REQUEST_FILENAME "@streq /.ghost/activitypub/v1/actions/search" \
|
||||
"id:900369,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:query,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:query,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:query,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:query,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:query,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:query,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:query,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:query"
|
||||
|
||||
# The fields a person types plain text into skip eight rules, the rules of
|
||||
# plain text, on the Admin API:
|
||||
# 930120: the title "Using python3 and ls -la to tidy .htaccess files"
|
||||
# 932120: the page's slug about-python3-powershell-htaccess
|
||||
# 932125, 932230, 932250: the tag "Linux & ls -la"
|
||||
# 932235: the title "powershell & python3"
|
||||
# 932260: the tag python3
|
||||
# 932380: the newsletter "Shell tips weekly: python3 & powershell"
|
||||
# These fields hold plain text:
|
||||
@@ -64,11 +117,12 @@ SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/"
|
||||
|
||||
# name, the name a member saves at /members/api/, skips the same seven rules.
|
||||
# name, the name a member saves at /members/api/, skips the same eight rules.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /members/api/" \
|
||||
"id:900359,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.name$/ "@eq 0" \
|
||||
@@ -76,10 +130,96 @@ SecRule REQUEST_FILENAME "@beginsWith /members/api/" \
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.name$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.name$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.name$/,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:/^json\.name$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.name$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.name$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.name$/"
|
||||
|
||||
# More fields of plain text skip the same eight rules on the Admin API, which
|
||||
# refused "python3 & powershell club", "Weekly ls -la and .htaccess tips" and
|
||||
# "powershell & python3 deal" in them:
|
||||
# users.<n>.name, slug, bio, location and website, a staff user's profile
|
||||
# setup.<n>.blogTitle and name, creating the first staff user
|
||||
# invitation.<n>.name, accepting a staff invitation
|
||||
# tiers.<n>.name, description and benefits
|
||||
# offers.<n>.name, code, display_title and display_description
|
||||
# recommendations.<n>.title, description and excerpt
|
||||
# integrations.<n>.name and description, and webhooks.<n>.name
|
||||
# posts.<n>.feature_image_alt and feature_image_caption, and the same fields
|
||||
# of pages
|
||||
# Coraza matches a field's name in lower case, so blogTitle is blogtitle.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
|
||||
"id:900370,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:users\.\d+\.(?:name|slug|bio|location|website)|setup\.\d+\.(?:blogtitle|name)|invitation\.\d+\.name|tiers\.\d+\.(?:name|description|benefits\.\d+)|offers\.\d+\.(?:name|code|display_title|display_description)|recommendations\.\d+\.(?:title|description|excerpt)|integrations\.\d+\.(?:name|description)|webhooks\.\d+\.name|(?:posts|pages)\.\d+\.feature_image_(?:alt|caption))$/"
|
||||
|
||||
# A member's comment, html at /members/api/comments/, skips the same eight
|
||||
# rules, which refused "I ran ls -la and fixed my .htaccess with python3". The
|
||||
# rules for scripts and HTML still refuse a <script> element, an event handler
|
||||
# and a javascript: link in it.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /members/api/comments/" \
|
||||
"id:900371,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.comments\.\d+\.html$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.comments\.\d+\.html$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.comments\.\d+\.html$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.comments\.\d+\.html$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.comments\.\d+\.html$/,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:/^json\.comments\.\d+\.html$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.comments\.\d+\.html$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.comments\.\d+\.html$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.comments\.\d+\.html$/"
|
||||
|
||||
# labels, which the admin gives the members imported from a CSV file at
|
||||
# /ghost/api/admin/members/upload/, skips the same eight rules, which refused
|
||||
# "python3 import" and "powershell & .htaccess".
|
||||
SecRule REQUEST_FILENAME "@streq /ghost/api/admin/members/upload/" \
|
||||
"id:900372,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:labels "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:labels,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:labels,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:labels,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:labels,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:labels,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:labels,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:labels,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:labels"
|
||||
|
||||
# In ActivityPub, a note's or a reply's content and an account's name, username
|
||||
# and bio skip the same eight rules, which refused "Trying python3 & powershell"
|
||||
# and the bio "ls -la and .htaccess tips". Each field skips them on its own path:
|
||||
# content, posting a note at /.ghost/activitypub/v1/actions/note or a reply
|
||||
# under /.ghost/activitypub/v1/actions/reply/
|
||||
# name, username and bio, saving the account at /.ghost/activitypub/v1/account
|
||||
SecRule REQUEST_FILENAME "@rx ^/\.ghost/activitypub/v1/actions/(?:note$|reply/)" \
|
||||
"id:900373,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.content$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.content$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.content$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.content$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.content$/,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:/^json\.content$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.content$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.content$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.content$/"
|
||||
SecRule REQUEST_FILENAME "@streq /.ghost/activitypub/v1/account" \
|
||||
"id:900374,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.(?:name|username|bio)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:name|username|bio)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:name|username|bio)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:name|username|bio)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:name|username|bio)$/,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:name|username|bio)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:name|username|bio)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:name|username|bio)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:name|username|bio)$/"
|
||||
|
||||
# A member's email address skips 930120, 932120 and 932260, which refused
|
||||
# erin.htaccess@example.com, dave.powershell@example.com and
|
||||
# python3.dev@example.com. These fields hold it:
|
||||
@@ -132,6 +272,30 @@ SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.users\.\d+\.email$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.users\.\d+\.email$/"
|
||||
|
||||
# The address of a staff invitation skips the same three rules. Each of these
|
||||
# fields skips them only on its own path:
|
||||
# invites.<n>.email, inviting a staff user at /ghost/api/admin/invites/
|
||||
# email in the query, checking an invitation at
|
||||
# /ghost/api/admin/authentication/invitation/
|
||||
# invitation.<n>.email, accepting it at the same path
|
||||
SecRule REQUEST_FILENAME "@streq /ghost/api/admin/invites/" \
|
||||
"id:900375,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.invites\.\d+\.email$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.invites\.\d+\.email$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.invites\.\d+\.email$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.invites\.\d+\.email$/"
|
||||
SecRule REQUEST_FILENAME "@streq /ghost/api/admin/authentication/invitation/" \
|
||||
"id:900376,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:email,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:email,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:email"
|
||||
SecRule REQUEST_FILENAME "@streq /ghost/api/admin/authentication/invitation/" \
|
||||
"id:900377,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.invitation\.\d+\.email$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.invitation\.\d+\.email$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.invitation\.\d+\.email$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.invitation\.\d+\.email$/"
|
||||
|
||||
# The articles skip these rules on the Admin API:
|
||||
# 930120: ls -la /var/www/html/.htaccess in a code block
|
||||
# 932120: powershell -ExecutionPolicy Bypass -File build.ps1
|
||||
@@ -207,6 +371,24 @@ SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
|
||||
SecRule &ARGS_GET:/^json\.users\.\d+\.profile_image$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS_NAMES:/^json\.users\.\d+\.profile_image$/"
|
||||
|
||||
# A tag's code injection, tags.<n>.codeinjection_head and _foot under
|
||||
# /ghost/api/admin/tags/, skips the same rules as the code injection of posts.
|
||||
# A <script> element and a javascript: link are still refused in it.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/tags/" \
|
||||
"id:900378,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=921130;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/,\
|
||||
ctl:ruleRemoveTargetById=941270;ARGS:/^json\.tags\.\d+\.codeinjection_(?:head|foot)$/"
|
||||
|
||||
# The passwords, which skip each rule that random passwords set off:
|
||||
# password, signing in at /ghost/api/admin/session/
|
||||
# setup.<n>.password, creating the first staff user
|
||||
|
||||
Reference in new issue
Block a user