clawbot
aaa9719f02
check / check (push) Waiting to run
While bodies are read, 941110 refused a `<script>` element in an HTML card that embeds a widget, and in code injection that loads analytics. The new exclusion 900366 switches 941110 off on the Admin API for `lexical`, `mobiledoc` and `html` of posts and pages, their `codeinjection_head` and `codeinjection_foot`, and settings `value`. Snippets, a newsletter's footer and every other field and path still refuse it; `javascript:` links stay refused everywhere. Model: opus-5-5
273 lines
23 KiB
Plaintext
273 lines
23 KiB
Plaintext
# Ghost's fixes: on Ghost's paths, some fields skip the rules that refused
|
|
# ordinary Ghost requests there. Each exclusion runs with the request, before the
|
|
# rules it switches off, so this file is loaded before the Core Rule Set's
|
|
# rules. Each comment names a request a rule refused. An exclusion on a field of
|
|
# a body applies only when the query has no parameter of that name, so it
|
|
# matters only while SWW_WAF_CORE_RULE_SET_BODY_LIMIT is set.
|
|
#
|
|
# Ghost's admin and its integrations call the Admin API under /ghost/api/admin/,
|
|
# themes and Ghost's own scripts call the Content API under /ghost/api/content/,
|
|
# and members call /members/api/. Coraza names a field of a JSON body by its
|
|
# path, so the title of the first post saved is json.posts.0.title.
|
|
|
|
# Every rule below is skipped unless Inspect has set tx.app_ghost. It sets it
|
|
# while SWW_WAF_APPS is unset, or lists ghost for the request's hostname.
|
|
# The skip reaches only phase 1, so a rule of a later phase must check
|
|
# tx.app_ghost itself.
|
|
SecRule &TX:app_ghost "@eq 0" \
|
|
"id:900365,phase:1,pass,nolog,skipAfter:END_GHOST"
|
|
|
|
# filter, a query in Ghost's own filter language, skips 932120 on the Admin API
|
|
# and the Content API: filter=tag:powershell, filter=name:~'powershell'.
|
|
SecRule REQUEST_FILENAME "@rx ^/ghost/api/(?:admin|content)/" \
|
|
"id:900350,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:filter"
|
|
|
|
# search, the search for a member by name or address, skips four rules on the
|
|
# Admin API:
|
|
# 930120: search=.htaccess
|
|
# 932120: search=powershell
|
|
# 932250: search=ls -la
|
|
# 932260: search=python3
|
|
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
|
|
"id:900351,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:search,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:search,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:search,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:search"
|
|
|
|
# url, the address the editor looks up for an embed or a bookmark, skips two
|
|
# rules:
|
|
# 930120: url=https://github.com/example/site/blob/main/.htaccess
|
|
# 932120: url=https://example.com/blog/powershell-tips
|
|
SecRule REQUEST_FILENAME "@streq /ghost/api/admin/oembed/" \
|
|
"id:900352,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:url,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:url"
|
|
|
|
# The fields a person types plain text into skip seven rules on the Admin API:
|
|
# 930120: the title "Using python3 and ls -la to tidy .htaccess files"
|
|
# 932120: the page's slug about-python3-powershell-htaccess
|
|
# 932125, 932230, 932250: the tag "Linux & ls -la"
|
|
# 932260: the tag python3
|
|
# 932380: the newsletter "Shell tips weekly: python3 & powershell"
|
|
# These fields hold plain text:
|
|
# title, name and slug of posts, pages, tags, labels, members, newsletters
|
|
# and snippets; a post's tags and a member's labels, by name or slug
|
|
# custom_excerpt, description, note and sender_name
|
|
# meta_title, meta_description, og_title, og_description, twitter_title and
|
|
# twitter_description
|
|
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
|
|
"id:900353,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
|
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
|
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:posts|pages|tags|labels|members|newsletters|snippets)\.\d+\.(?:title|name|slug|custom_excerpt|description|note|sender_name|(?:meta|og|twitter)_(?:title|description)|(?:tags|labels)\.\d+(?:\.(?:name|slug))?)$/"
|
|
|
|
# name, the name a member saves at /members/api/, skips the same seven rules.
|
|
SecRule REQUEST_FILENAME "@beginsWith /members/api/" \
|
|
"id:900359,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.name$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.name$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.name$/,\
|
|
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.name$/,\
|
|
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.name$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.name$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.name$/,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.name$/"
|
|
|
|
# A member's email address skips 930120, 932120 and 932260, which refused
|
|
# erin.htaccess@example.com, dave.powershell@example.com and
|
|
# python3.dev@example.com. These fields hold it:
|
|
# members.<n>.email, when the admin adds or edits a member under
|
|
# /ghost/api/admin/members/
|
|
# email, when a member signs up or in at /members/api/
|
|
# An address holds no spaces, so it keeps 932250, which needs ls -la.
|
|
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/members/" \
|
|
"id:900354,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.members\.\d+\.email$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.members\.\d+\.email$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.members\.\d+\.email$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.members\.\d+\.email$/"
|
|
SecRule REQUEST_FILENAME "@beginsWith /members/api/" \
|
|
"id:900360,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.email$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.email$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.email$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.email$/"
|
|
|
|
# A staff user's email address also skips 930120, 932120 and 932260, which
|
|
# refused erin.htaccess@example.com, dave.powershell@example.com and
|
|
# python3.dev@example.com. Each of these fields skips them only on its own path:
|
|
# username, signing in at /ghost/api/admin/session/
|
|
# setup.<n>.email, creating the first staff user
|
|
# password_reset.<n>.email, asking for a password reset
|
|
# users.<n>.email, saving a staff user's profile
|
|
SecRule REQUEST_FILENAME "@streq /ghost/api/admin/session/" \
|
|
"id:900361,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.username$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.username$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.username$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.username$/"
|
|
SecRule REQUEST_FILENAME "@streq /ghost/api/admin/authentication/setup/" \
|
|
"id:900362,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.setup\.\d+\.email$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.setup\.\d+\.email$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.setup\.\d+\.email$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.setup\.\d+\.email$/"
|
|
SecRule REQUEST_FILENAME "@streq /ghost/api/admin/authentication/password_reset/" \
|
|
"id:900363,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.password_reset\.\d+\.email$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.password_reset\.\d+\.email$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.password_reset\.\d+\.email$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.password_reset\.\d+\.email$/"
|
|
SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
|
|
"id:900364,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.users\.\d+\.email$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.users\.\d+\.email$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.users\.\d+\.email$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.users\.\d+\.email$/"
|
|
|
|
# The articles skip these rules on the Admin API:
|
|
# 930120: ls -la /var/www/html/.htaccess in a code block
|
|
# 932120: powershell -ExecutionPolicy Bypass -File build.ps1
|
|
# 932125, 932230, 932235, 932250: cat /etc/hosts | grep example
|
|
# 932160: #!/usr/bin/env python3
|
|
# 932260: python3 -m venv .venv
|
|
# 932370: the same list in the html of a post saved through the API
|
|
# 932380: a code block whose second line starts with powershell
|
|
# 934100: document.querySelectorAll('a').forEach((a) => console.log(a.href))
|
|
# 941100, 941160: an HTML card with an iframe
|
|
# 941120: onclick= in an HTML card
|
|
# 941180: window.onload in a code block
|
|
# 941390: console.log(
|
|
# 942190: a code block with an SQL query
|
|
# These fields hold an article:
|
|
# posts.<n>.lexical and pages.<n>.lexical, which the editor saves, and the
|
|
# same fields mobiledoc, in Ghost's older format, and html, which
|
|
# integrations send
|
|
# snippets.<n>.lexical and snippets.<n>.mobiledoc, a part of a post saved for
|
|
# reuse
|
|
# newsletters.<n>.footer_content, the footer of a newsletter
|
|
# A javascript: link (941170, 941210) is still refused in them. A <script>
|
|
# element (941110) passes only in posts and pages, by 900366.
|
|
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
|
|
"id:900355,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932235;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932370;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=934100;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=941100;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=941120;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=941160;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=941390;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/,\
|
|
ctl:ruleRemoveTargetById=942190;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html)|snippets\.\d+\.(?:lexical|mobiledoc)|newsletters\.\d+\.footer_content)$/"
|
|
|
|
# Code injection, the HTML Ghost adds to the head and the foot of a page, and
|
|
# the site's settings, which hold the site-wide code injection besides the
|
|
# title and the description, skip the rules of plain text above and these:
|
|
# 921130, 941100, 941160: <meta name="google-site-verification" ...>
|
|
# 941270: <link rel="preconnect" href="https://fonts.example.com">
|
|
# These fields hold it, and skip the rules anywhere on the Admin API:
|
|
# posts.<n>.codeinjection_head and _foot, and the same fields of pages
|
|
# settings.<n>.value, the value of a setting
|
|
# A javascript: link is still refused in them, and a <script> element passes
|
|
# by 900366.
|
|
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
|
|
"id:900356,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=921130;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=941100;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=941160;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/,\
|
|
ctl:ruleRemoveTargetById=941270;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.codeinjection_(?:head|foot)|settings\.\d+\.value)$/"
|
|
|
|
# A <script> element skips 941110 in posts, pages and code injection, on the
|
|
# Admin API, which refused:
|
|
# an HTML card that embeds a widget with its script
|
|
# code injection that loads analytics,
|
|
# <script defer src="https://analytics.example.com/script.js"></script>
|
|
# These fields take a <script> element on purpose:
|
|
# posts.<n>.lexical, mobiledoc and html, and the same fields of pages
|
|
# posts.<n>.codeinjection_head and _foot, and the same fields of pages
|
|
# settings.<n>.value, the value of a setting
|
|
# Snippets and a newsletter's footer still refuse it.
|
|
SecRule REQUEST_FILENAME "@beginsWith /ghost/api/admin/" \
|
|
"id:900366,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html|codeinjection_(?:head|foot))|settings\.\d+\.value)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=941110;ARGS:/^json\.(?:(?:posts|pages)\.\d+\.(?:lexical|mobiledoc|html|codeinjection_(?:head|foot))|settings\.\d+\.value)$/"
|
|
|
|
# Saving a staff user's profile sends the field profile_image, whose name holds
|
|
# .profile, a file the list of system files names (930120).
|
|
SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/users/[0-9a-f]{24}/$" \
|
|
"id:900357,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.users\.\d+\.profile_image$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS_NAMES:/^json\.users\.\d+\.profile_image$/"
|
|
|
|
# The passwords, which skip each rule that random passwords set off:
|
|
# password, signing in at /ghost/api/admin/session/
|
|
# setup.<n>.password, creating the first staff user
|
|
# invitation.<n>.password, accepting an invitation
|
|
# password_reset.<n>.newPassword and ne2Password, resetting a password
|
|
# password.<n>.oldPassword, newPassword and ne2Password, changing one at
|
|
# /ghost/api/admin/users/password/
|
|
SecRule REQUEST_FILENAME "@rx ^/ghost/api/admin/(?:session|authentication/(?:setup|invitation|password_reset)|users/password)/$" \
|
|
"id:900358,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=920270;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=920540;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=921200;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=930100;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=930110;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932125;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932130;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932160;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932230;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932270;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932280;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932330;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932340;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932370;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=932380;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=933100;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=933135;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=933180;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=933210;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=941100;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=941120;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=941160;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=941180;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=942100;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=942151;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=942190;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=942230;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=942290;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=942320;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=942540;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=942550;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/,\
|
|
ctl:ruleRemoveTargetById=944150;ARGS:/^json\.(?:password|(?:setup|invitation)\.\d+\.password|(?:password_reset|password)\.\d+\.(?:old|new|ne2)password)$/"
|
|
|
|
SecMarker END_GHOST
|