Core Rule Set: more of Drupal's ordinary fields pass (closes #244)
check / check (push) Successful in 5m23s
check / check (push) Successful in 5m23s
Names, searches and the page to return to on more Drupal paths skip the rules that misfire on them: 930120, 932120, 932250 and 932260, plus 932230 and 932235 on destination only. An email address skips 930120, 932120 and 932260; the oEmbed url only 930120 and 932120. Every Drupal path may carry a language prefix such as /fr. Requests recorded from Drupal 11.4.11 with plain words, python3, powershell, ls -la and .htaccess are added to the test data; tests show attacks and "; wget ..." still refused on each new field. Model: opus-5-5
This commit is contained in:
sneak committed
1 parent
9f98982446
commit
7e97e905eb
4 files changed
+525
-62
No files matched your search
@@ -4,16 +4,23 @@
|
||||
# request, before the rules it switches off, so this file is loaded before the
|
||||
# Core Rule Set's rules. Each comment names a request a rule refused. An
|
||||
# exclusion on a field of a body applies only when the query has no parameter
|
||||
# of that name, so it matters only while SWW_WAF_BODY_LIMIT is set.
|
||||
# of that name, so it matters only while SWW_WAF_BODY_LIMIT is set. Rule 900805
|
||||
# is the exception: it removes the rules from name in a body even when the
|
||||
# query has name.
|
||||
#
|
||||
# Four rules read a search or a name as a command or a system file. Each query
|
||||
# exclusion below removes these four, and only these, from its fields:
|
||||
# Each path may start with a language prefix, such as /fr in
|
||||
# /fr/admin/content. The prefix is two or three letters, then optionally a
|
||||
# hyphen and more letters, as in /pt-br.
|
||||
#
|
||||
# Four rules read a search or a name as a command or a system file:
|
||||
# 930120: .htaccess
|
||||
# 932120: powershell
|
||||
# 932250: ls -la
|
||||
# 932260: python3
|
||||
# Two more misfire on destination, the address of a page of results, so
|
||||
# destination alone skips them:
|
||||
# Each query exclusion below removes these four from its fields, with two
|
||||
# exceptions. Rule 900806 removes only 930120 and 932120 from url. Two more
|
||||
# rules misfire on destination, the address of a page of results, so
|
||||
# destination alone skips them too:
|
||||
# 932230: ls -la
|
||||
# 932235: python3
|
||||
|
||||
@@ -27,7 +34,7 @@
|
||||
# search: /admin/config/search/path?search=python3
|
||||
# q: /admin/views/ajax/autocomplete/tag?q=python3
|
||||
# destination: /admin/content?destination=/admin/content%3Ftitle%3Dpython3
|
||||
SecRule REQUEST_FILENAME "@rx ^/admin(?:/|$)" \
|
||||
SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/admin(?:/|$)" \
|
||||
"id:900800,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:title|name|user|filename|filemime|info|subject|author_name|search|q|destination)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:title|name|user|filename|filemime|info|subject|author_name|search|q|destination)$/,\
|
||||
@@ -37,10 +44,11 @@ SecRule REQUEST_FILENAME "@rx ^/admin(?:/|$)" \
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:title|name|user|filename|filemime|info|subject|author_name|search|q|destination)$/"
|
||||
|
||||
# The page to return to, on the other pages Drupal links to with one, such as
|
||||
# /node/1/edit?destination=/search/node%3Fkeys%3Dpython3 and
|
||||
# /user/login?destination=/search/node%3Fkeys%3Dpython3.
|
||||
# /node/1/edit?destination=/search/node%3Fkeys%3Dpython3,
|
||||
# /node/2/revisions/3/revert?destination=/admin/content%3Ftitle%3Dpython3 and
|
||||
# /big_pipe/no-js?destination=/admin/content%3Ftitle%3Dpython3.
|
||||
SecRule REQUEST_FILENAME \
|
||||
"@rx ^/(?:node/(?:add/[^/]+|[0-9]+/[a-z]+)|comment/[0-9]+/[a-z]+|media/(?:add/[^/]+|[0-9]+/[a-z]+)|taxonomy/term/[0-9]+/[a-z]+|user/[^/]+(?:/[a-z]+)?)$" \
|
||||
"@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:node/(?:add/[^/]+|[0-9]+/[a-z]+|[0-9]+/revisions/[0-9]+/(?:revert|delete))|comment/[0-9]+/[a-z]+|media/(?:add/[^/]+|[0-9]+/[a-z]+)|taxonomy/term/[0-9]+/[a-z]+|user/[^/]+(?:/[a-z]+)?|block/add/[^/]+|big_pipe/no-js)$" \
|
||||
"id:900801,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:destination,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:destination,\
|
||||
@@ -50,16 +58,20 @@ SecRule REQUEST_FILENAME \
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:destination"
|
||||
|
||||
# The text searched for on the search pages: /search/node?keys=python3.
|
||||
SecRule REQUEST_FILENAME "@rx ^/search(?:/|$)" \
|
||||
SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/search(?:/|$)" \
|
||||
"id:900802,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:keys,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:keys,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:keys,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:keys"
|
||||
|
||||
# What is typed into a field that autocompletes a tag or a user:
|
||||
# /entity_reference_autocomplete/taxonomy_term/default/KEY?q=python3.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /entity_reference_autocomplete/" \
|
||||
# What is typed into a field that autocompletes a tag, a user, a link in the
|
||||
# rich text editor or a block's category:
|
||||
# /entity_reference_autocomplete/taxonomy_term/default/KEY?q=python3
|
||||
# /ckeditor5/basic_html/entity-link-suggestions?q=python3
|
||||
# /block-category/autocomplete?q=python3
|
||||
SecRule REQUEST_FILENAME \
|
||||
"@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:entity_reference_autocomplete/|ckeditor5/[^/]+/entity-link-suggestions$|block-category/autocomplete$)" \
|
||||
"id:900803,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:q,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:q,\
|
||||
@@ -69,19 +81,40 @@ SecRule REQUEST_FILENAME "@beginsWith /entity_reference_autocomplete/" \
|
||||
# The values a JSON:API client filters by, in fields named after what they
|
||||
# filter: /jsonapi/node/article?filter[title]=python3 and
|
||||
# filter[f][condition][value]=python3.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /jsonapi/" \
|
||||
SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/jsonapi/" \
|
||||
"id:900804,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^filter\[/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^filter\[/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^filter\[/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^filter\[/"
|
||||
|
||||
# A name, in the query or a body: the account whose password is reset, and
|
||||
# the media library's filter by name:
|
||||
# /user/password?name=python3
|
||||
# /media-library?media_library_opener_id=...&name=python3
|
||||
# /views/ajax?view_name=media_library&name=python3
|
||||
SecRule REQUEST_FILENAME \
|
||||
"@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:user/password|media-library|views/ajax)$" \
|
||||
"id:900805,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:name,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:name,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:name,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:name"
|
||||
|
||||
# The address of a remote video shown in a page:
|
||||
# 930120: /media/oembed?url=https%3A%2F%2Fvimeo.com%2Fchannels%2F.htaccess
|
||||
# 932120: /media/oembed?url=https%3A%2F%2Fvimeo.com%2Fchannels%2Fpowershell
|
||||
SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/media/oembed$" \
|
||||
"id:900806,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:url,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:url"
|
||||
|
||||
# The fields below are in bodies. Saving content sends its title, summary, tags,
|
||||
# address, revision note, comment subject, media name and image text, which
|
||||
# skip the same four rules there. A title such as "python3, ls -la and .htaccess"
|
||||
# refused saving a node.
|
||||
SecRule REQUEST_FILENAME \
|
||||
"@rx ^/(?:node/(?:add/[^/]+|[0-9]+/edit)|comment/(?:reply/[^/]+/[0-9]+/[^/]+(?:/[0-9]+)?|[0-9]+/edit)|media/(?:add/[^/]+|[0-9]+/edit))$" \
|
||||
"@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:node/(?:add/[^/]+|[0-9]+/edit)|comment/(?:reply/[^/]+/[0-9]+/[^/]+(?:/[0-9]+)?|[0-9]+/edit)|media/(?:add/[^/]+|[0-9]+/edit))$" \
|
||||
"id:900810,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:title|subject|name|body|revision_log|path|field_tags|field_)/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:(?:title|subject|name|revision_log|revision_log_message)\[0\]\[value\]|body\[0\]\[summary\]|path\[0\]\[alias\]|field_tags\[target_id\]|field_[a-z0-9_]+\[0\]\[(?:alt|title)\])$/,\
|
||||
@@ -95,7 +128,7 @@ SecRule REQUEST_FILENAME \
|
||||
# 930120, 932120, 932125, 932140, 932160, 932230, 932235, 932250, 932260,
|
||||
# 934100, 941160, 941390, 942170 and 942230.
|
||||
SecRule REQUEST_FILENAME \
|
||||
"@rx ^/(?:node/(?:add/[^/]+|[0-9]+/edit)|comment/(?:reply/[^/]+/[0-9]+/[^/]+(?:/[0-9]+)?|[0-9]+/edit))$" \
|
||||
"@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:node/(?:add/[^/]+|[0-9]+/edit)|comment/(?:reply/[^/]+/[0-9]+/[^/]+(?:/[0-9]+)?|[0-9]+/edit))$" \
|
||||
"id:900811,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:comment_)?body\[/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:comment_)?body\[0\]\[value\]$/,\
|
||||
@@ -115,14 +148,16 @@ SecRule REQUEST_FILENAME \
|
||||
|
||||
# A JSON:API client saving a node or a comment sends the same HTML in the
|
||||
# JSON field body.value or comment_body.value, which skips the rules above. A
|
||||
# title, summary or subject beside it skips 930120, 932120, 932250 and 932260.
|
||||
SecRule REQUEST_FILENAME "@beginsWith /jsonapi/" \
|
||||
# title, summary, subject, name, revision note, block description or tag
|
||||
# description beside it skips 930120, 932120, 932250 and 932260. A tag named
|
||||
# python3 refused saving it.
|
||||
SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/jsonapi/" \
|
||||
"id:900812,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.data\.attributes\./ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.data\.attributes\.(?:title|subject|body\.summary|(?:comment_)?body\.value)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.data\.attributes\.(?:title|subject|body\.summary|(?:comment_)?body\.value)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.data\.attributes\.(?:title|subject|body\.summary|(?:comment_)?body\.value)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.data\.attributes\.(?:title|subject|body\.summary|(?:comment_)?body\.value)$/,\
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.data\.attributes\.(?:title|subject|name|revision_log|info|description\.value|body\.summary|(?:comment_)?body\.value)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.data\.attributes\.(?:title|subject|name|revision_log|info|description\.value|body\.summary|(?:comment_)?body\.value)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.data\.attributes\.(?:title|subject|name|revision_log|info|description\.value|body\.summary|(?:comment_)?body\.value)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.data\.attributes\.(?:title|subject|name|revision_log|info|description\.value|body\.summary|(?:comment_)?body\.value)$/,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.data\.attributes\.(?:comment_)?body\.value$/,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:/^json\.data\.attributes\.(?:comment_)?body\.value$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.data\.attributes\.(?:comment_)?body\.value$/,\
|
||||
@@ -134,16 +169,51 @@ SecRule REQUEST_FILENAME "@beginsWith /jsonapi/" \
|
||||
ctl:ruleRemoveTargetById=942170;ARGS:/^json\.data\.attributes\.(?:comment_)?body\.value$/,\
|
||||
ctl:ruleRemoveTargetById=942230;ARGS:/^json\.data\.attributes\.(?:comment_)?body\.value$/"
|
||||
|
||||
# Signing in, in pass or the JSON field pass, where a password holds any
|
||||
# characters:
|
||||
# 930120: a password ending in /etc/hosts
|
||||
# 932120: a password of powershell
|
||||
# 932250: a password of ls -la
|
||||
# 932260: a password starting with python3
|
||||
SecRule REQUEST_FILENAME "@streq /user/login" \
|
||||
# Signing in, in name and pass or the JSON fields of the same names. A
|
||||
# password holds any characters:
|
||||
# 930120: a password ending in /etc/hosts, or a name of .htaccess
|
||||
# 932120: a password or a name of powershell
|
||||
# 932250: a password or a name of ls -la
|
||||
# 932260: a password or a name starting with python3
|
||||
SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/user/login$" \
|
||||
"id:900813,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:json\.)?pass$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?pass$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:json\.)?pass$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?pass$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?pass$/"
|
||||
SecRule &ARGS_GET:/^(?:json\.)?(?:name|pass)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:json\.)?(?:name|pass)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:json\.)?(?:name|pass)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:json\.)?(?:name|pass)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:json\.)?(?:name|pass)$/"
|
||||
|
||||
# A person's name and email address, when signing up, when editing an
|
||||
# account and when commenting without an account. A name of python3 refused
|
||||
# signing up, and python3@example.com refused saving an account. An address
|
||||
# keeps 932250, which no recorded address set off.
|
||||
SecRule REQUEST_FILENAME \
|
||||
"@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:user/register|user/[0-9]+/edit|comment/reply/[^/]+/[0-9]+/[^/]+(?:/[0-9]+)?)$" \
|
||||
"id:900814,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:name|mail)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:name|mail)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:name|mail)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:name,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:name|mail)$/"
|
||||
|
||||
# Saving a tag, a custom block or a contact message sends its name,
|
||||
# description, block description, body, subject or message, which skip the
|
||||
# same four rules. A tag named python3 refused saving it.
|
||||
SecRule REQUEST_FILENAME \
|
||||
"@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/(?:admin/structure/taxonomy/manage/[^/]+/add|taxonomy/term/[0-9]+/edit|block/add/[^/]+|admin/content/block/[0-9]+|contact(?:/[^/]+)?|user/[0-9]+/contact)$" \
|
||||
"id:900815,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^(?:name|description|info|body|subject|message)\[/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:name|description|info|body|subject|message)\[0\]\[value\]$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:name|description|info|body|subject|message)\[0\]\[value\]$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:name|description|info|body|subject|message)\[0\]\[value\]$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:name|description|info|body|subject|message)\[0\]\[value\]$/"
|
||||
|
||||
# A client saving a node in Drupal's JSON format sends its title in the JSON
|
||||
# field title.0.value: PATCH /node/2?_format=json with a title of python3.
|
||||
SecRule REQUEST_FILENAME "@rx ^(?:/[a-z]{2,3}(?:-[a-z]+)?)?/node/[0-9]+$" \
|
||||
"id:900816,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.title\./ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.title.0.value,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.title.0.value,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.title.0.value,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.title.0.value"
|
||||
Reference in new issue
Block a user