{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/742","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/742/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/742/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/742/events","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/742","id":35970869,"number":742,"title":"SecHashEngine not working","user":{"login":"blackenz","id":7921407,"avatar_url":"https://avatars.githubusercontent.com/u/7921407?v=3","gravatar_id":"","url":"https://api.github.com/users/blackenz","html_url":"https://github.com/blackenz","followers_url":"https://api.github.com/users/blackenz/followers","following_url":"https://api.github.com/users/blackenz/following{/other_user}","gists_url":"https://api.github.com/users/blackenz/gists{/gist_id}","starred_url":"https://api.github.com/users/blackenz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blackenz/subscriptions","organizations_url":"https://api.github.com/users/blackenz/orgs","repos_url":"https://api.github.com/users/blackenz/repos","events_url":"https://api.github.com/users/blackenz/events{/privacy}","received_events_url":"https://api.github.com/users/blackenz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/labels/Bug","name":"Bug","color":"e11d21"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-06-18T10:10:53Z","updated_at":"2016-05-05T04:41:26Z","closed_at":null,"body":"SecHashEngine on version 2.8.0 is currently not working as expected. With the following directives turned to On, mod_security is unable to change response body, in order to add the previously calculated hash:\r\n\r\nSecDisableBackendCompression On\r\nSecContentInjection On\r\nSecStreamOutBodyInspection On\r\nSecHashEngine On\r\nSecHashKey rand KeyOnly\r\nSecHashParam hmac\r\nSecHashMethodRx HashHref \"\\.php\"\r\n\r\nThe Debug log, shows the following:\r\n<addr>\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] init_response_body_html_parser: assuming ISO-8859-1.\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] init_response_body_html_parser: Successfully html parser generated.\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] Signing data [index.php]\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] hash_response_body_links: Processed [0] iframe src, [0] hashed.\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] hash_response_body_links: Processed [0] frame src, [0] hashed.\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] hash_response_body_links: Processed [1] form actions, [1] hashed.\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] hash_response_body_links: Processed [0] links, [0] hashed.\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] inject_hashed_response_body: Detected encoding type [ISO-8859-1].\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] inject_hashed_response_body: Using content-type [ISO-8859-1].\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] Hash completed in 754 usec.\r\n[17/Jun/2014:15:31:45 +0000] [OMMITED][/index.php][4] Starting phase RESPONSE_BODY.\r\n</addr>\r\nIn the resulting html, there is no reference to the hmac parameter in the href elements. \r\nModSecurity was compiled using the following libraries:\r\n<addr>\r\nModSecurity for Apache/2.8.0 (http://www.modsecurity.org/) configured.\r\nModSecurity: APR compiled version=\"1.5.1-dev\"; loaded version=\"1.5.1-dev\"\r\nModSecurity: PCRE compiled version=\"8.31 \"; loaded version=\"8.31 2012-07-06\"\r\nModSecurity: LUA compiled version=\"Lua 5.1\"\r\nModSecurity: LIBXML compiled version=\"2.9.1\"\r\n</addr>\r\nApache version is 2.4.7\r\nI'm also using the modsecurity.conf-recommended configuration file."},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/comments/217075639","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/742#issuecomment-217075639","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/742","id":217075639,"user":{"login":"dune73","id":618722,"avatar_url":"https://avatars.githubusercontent.com/u/618722?v=3","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"created_at":"2016-05-05T04:41:26Z","updated_at":"2016-05-05T04:41:26Z","body":"It's possible I am held back by this bug as well:\r\n\r\nHere is the output from my debug log:\r\n\r\n```\r\n[05/May/2016:06:29:57 +0200] [localhost/sid#d611e8][rid#7eff04002970][/form.html][4] hash_response_body_links: Processed [0] iframe src, [0] hashed.\r\n[05/May/2016:06:29:57 +0200] [localhost/sid#d611e8][rid#7eff04002970][/form.html][4] hash_response_body_links: Processed [0] frame src, [0] hashed.\r\n[05/May/2016:06:29:57 +0200] [localhost/sid#d611e8][rid#7eff04002970][/form.html][4] hash_response_body_links: Processed [1] form actions, [1] hashed.\r\n[05/May/2016:06:29:57 +0200] [localhost/sid#d611e8][rid#7eff04002970][/form.html][4] hash_response_body_links: Processed [1] links, [1] hashed.\r\n[05/May/2016:06:29:57 +0200] [localhost/sid#d611e8][rid#7eff04002970][/form.html][4] inject_hashed_response_body: Detected encoding type [ISO-8859-1].\r\n[05/May/2016:06:29:57 +0200] [localhost/sid#d611e8][rid#7eff04002970][/form.html][4] inject_hashed_response_body: Using content-type [ISO-8859-1].\r\n[05/May/2016:06:29:57 +0200] [localhost/sid#d611e8][rid#7eff04002970][/form.html][1] inject_hashed_response_body: Unable to inject hash into response body. Returning response without changes.\r\n[05/May/2016:06:29:57 +0200] [localhost/sid#d611e8][rid#7eff04002970][/form.html][4] Starting phase RESPONSE_BODY.\r\n\r\n```\r\n\r\nIt's the line \"Unable to inject hash into response body\" which is not available with the original author of this issue. So maybe this is something different. \r\n\r\nI looked into the code and did a few additional tests, it is obvious my server fails on\r\n```\r\nxmlOutputBufferFlush(output_bug)\r\n```\r\naround line 1075 in msc_crypt.c.\r\n\r\n"}}