Core Rule Set: WordPress's ordinary requests pass by default (closes #235)
check / check (push) Failing after 1m23s
check / check (push) Failing after 1m23s
Add the ninth change: wordpress.conf switches off, per path and field, each rule that refused recorded WordPress 7.1.4 traffic. Add the recorded requests, a test at the defaults and reading bodies, and list WordPress in the README. Model: opus-5-5
This commit is contained in:
sneak committed
1 parent
aede434f6a
commit
95b5c447ee
6 files changed
+817
-18
No files matched your search
@@ -0,0 +1,134 @@
|
||||
# The ninth change: on WordPress's paths, some fields skip the rules that refused
|
||||
# ordinary WordPress requests there. Each exclusion runs with the request, before
|
||||
# the rules it switches off, so this file is loaded before the Core Rule Set's
|
||||
# rules. Each comment names a request the rule refused. An exclusion on a field
|
||||
# of a body applies only when the query has no parameter of that name, so it
|
||||
# matters only while SWW_WAF_BODY_LIMIT is set.
|
||||
|
||||
# WordPress sends a call to its REST API to one of three addresses, by its
|
||||
# permalink setting:
|
||||
# /wp-json/wp/v2/posts/1
|
||||
# /index.php/wp-json/wp/v2/posts/1
|
||||
# /index.php?rest_route=/wp/v2/posts/1
|
||||
# These two rules put the route, here /wp/v2/posts/1, in tx.rest_route for the
|
||||
# exclusions below. A call that names a route in both its path and its query
|
||||
# gets none of them, since WordPress follows the query.
|
||||
SecRule &ARGS_GET:rest_route "@eq 0" "id:900705,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?wp-json(/.*)$" \
|
||||
"capture,setvar:tx.rest_route=%{tx.1}"
|
||||
SecRule REQUEST_FILENAME "@streq /index.php" "id:900706,phase:1,pass,nolog,chain"
|
||||
SecRule ARGS_GET:rest_route "@rx ^(/.*)$" "capture,setvar:tx.rest_route=%{tx.1}"
|
||||
|
||||
# The block editor saves a post with POST and the header X-HTTP-Method-Override:
|
||||
# PUT, which the Core Rule Set refused (920450). So does saving a user's editor
|
||||
# preferences.
|
||||
SecRule TX:rest_route "@beginsWith /" \
|
||||
"id:900700,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=920450;REQUEST_HEADERS_NAMES:X-HTTP-Method-Override"
|
||||
|
||||
# The block editor and the site editor send HTML in the JSON field content, which
|
||||
# skips these rules when saving or autosaving a post, a page, a template or a
|
||||
# template part:
|
||||
# 930120: cat /etc/hosts
|
||||
# 932230: a code block with a shell pipeline and an SQL query
|
||||
# 932250: the same code block
|
||||
# 934100: console.log('ok')
|
||||
# 941100: <iframe src="..." onload="...">
|
||||
# 941110: <script>
|
||||
# 941120: onload=
|
||||
# 941160: <img src=
|
||||
# 941180: <!-- wp:paragraph -->, the comment that starts every block
|
||||
# 941390: console.log(
|
||||
# 942190: how to select a table from the catalog
|
||||
# 942270: how to select a table from the catalog
|
||||
SecRule TX:rest_route \
|
||||
"@rx ^/wp/v2/(?:(?:posts|pages)(?:/[0-9]+(?:/autosaves)?)?|template(?:s|-parts)(?:/[^/]+//[^/]+(?:/autosaves)?)?)$" \
|
||||
"id:900701,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.content "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=934100;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=941110;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=941120;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=941180;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=941390;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=942190;ARGS:json.content,\
|
||||
ctl:ruleRemoveTargetById=942270;ARGS:json.content"
|
||||
|
||||
# A reply to a comment from the list of comments, in content:
|
||||
# 932125: ls -la, in the reply's text
|
||||
# 932230: ls -la, in the reply's text
|
||||
# 932250: ls -la, in the reply's text
|
||||
SecRule REQUEST_FILENAME "@streq /wp-admin/admin-ajax.php" \
|
||||
"id:900702,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:content "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=932125;ARGS:content,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:content,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:content"
|
||||
|
||||
# Saving a plugin's or a theme's file from its file editor sends the file in
|
||||
# newcontent, which skips these rules, each of which refused saving the plugin
|
||||
# Hello Dolly's hello.php. Some of them refused only the whole file:
|
||||
# 932140: if ( 'en_' !== substr(
|
||||
# 932235: the whole file
|
||||
# 933100: the whole file
|
||||
# 933160: if ( 'en_' !== substr(
|
||||
# 933210: $lyrics = explode(
|
||||
# 941100: <style type='text/css'>
|
||||
# 941160: <style type='text/css'>
|
||||
# 941190: the whole file
|
||||
# 942151: if ( 'en_' !== substr(
|
||||
# 942540: Dolly'll never go away again";
|
||||
SecRule REQUEST_FILENAME "@streq /wp-admin/admin-ajax.php" \
|
||||
"id:900703,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:newcontent "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=932140;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=933100;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=933160;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=933210;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=941100;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=941160;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=941190;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=942151;ARGS:newcontent,\
|
||||
ctl:ruleRemoveTargetById=942540;ARGS:newcontent"
|
||||
|
||||
# Signing in, in pwd, where a password holds any characters:
|
||||
# 930120: a password ending in /etc/hosts
|
||||
SecRule REQUEST_FILENAME "@streq /wp-login.php" \
|
||||
"id:900704,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:pwd "@eq 0" "ctl:ruleRemoveTargetById=930120;ARGS:pwd"
|
||||
|
||||
# WordPress's searches for posts, media and plugins send the text searched for
|
||||
# in s, which skips these rules there:
|
||||
# 932120: powershell
|
||||
# 932250: ls -la
|
||||
# 932260: python3
|
||||
SecRule REQUEST_FILENAME \
|
||||
"@rx ^/(?:index\.php|wp-admin/(?:edit|upload|plugin-install)\.php)?$" \
|
||||
"id:900707,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:s,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:s,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:s"
|
||||
|
||||
# The REST API's searches of posts send it in search, which skips the same rules
|
||||
# there.
|
||||
SecRule TX:rest_route "@rx ^/wp/v2/(?:search|posts)$" \
|
||||
"id:900708,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:search,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:search,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:search"
|
||||
|
||||
# The plugin and theme file editors name the file open in file, which skips
|
||||
# these rules there:
|
||||
# 930120: akismet/views/config.php
|
||||
# 932160: bin/install.sh
|
||||
# 932260: docker-compose.yml
|
||||
SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:plugin|theme)-editor\.php$" \
|
||||
"id:900709,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:file,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:file,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:file"
|
||||
Reference in new issue
Block a user