{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/293","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/293/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/293/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/293/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/293","id":135550017,"number":293,"title":"php-variables.data evasions","user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-22T21:30:12Z","updated_at":"2016-02-28T21:23:16Z","closed_at":null,"body":"`php-variables.data` is easy to evade, since the data strings include the bracket.\r\n\r\nFor instance, `$HTTP_COOKIE_VARS\\t[` would evade it. Since there is little risk of false positives with these strings, a quick fix is to just list them without bracket. E.g. not `$_ENV[` but `$_ENV`.\r\n\r\nNote: Even then, this data file does not give complete coverage, since variable names can still be evaded easily. It'm fine with keeping it after the quick fix, certainly many simple scripts will be blocked. Evasion example to access `$_ENV` using 'variable variables':\r\n```\r\n$foo = '_E' . 'NV';\r\n$myenv = $$foo;\r\n$result = $myenv['something'];\r\n```\r\n\r\n(Sub-Note: Generic 'variable variables' syntax is hard to block since `$$` is unfortunately too generic to ever add to the CRS, but it could become a very paranoid rule. Personally not in favor of it.)"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/189947609","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/293#issuecomment-189947609","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/293","id":189947609,"user":{"login":"dune73","id":618722,"avatar_url":"https://avatars.githubusercontent.com/u/618722?v=3","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"created_at":"2016-02-28T21:23:16Z","updated_at":"2016-02-28T21:23:16Z","body":"So what do you propose Walter?"}}