{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/373","id":161986906,"number":373,"title":"CRS 3.0-Rc1 - 920430 & 911100 triggered on lots of requests","user":{"login":"quenenni","id":3638408,"avatar_url":"https://avatars.githubusercontent.com/u/3638408?v=3","gravatar_id":"","url":"https://api.github.com/users/quenenni","html_url":"https://github.com/quenenni","followers_url":"https://api.github.com/users/quenenni/followers","following_url":"https://api.github.com/users/quenenni/following{/other_user}","gists_url":"https://api.github.com/users/quenenni/gists{/gist_id}","starred_url":"https://api.github.com/users/quenenni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quenenni/subscriptions","organizations_url":"https://api.github.com/users/quenenni/orgs","repos_url":"https://api.github.com/users/quenenni/repos","events_url":"https://api.github.com/users/quenenni/events{/privacy}","received_events_url":"https://api.github.com/users/quenenni/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-06-23T18:09:03Z","updated_at":"2016-06-27T18:37:57Z","closed_at":"2016-06-27T18:37:57Z","body":"Server: Debian Wheezy\r\nPHP Version 5.4.45-0+deb7u3\r\nApache-npm-itk v2.2.22\r\nlibapache2-mod-security2: v2.8.0-2~bpo70+1\r\nModsec Crs:  v3.0.0-rc1\r\n\r\n-----------------------\r\n\r\nThis new Crs version looks very promising. Thanks a lot for all this.\r\n\r\nI have 2 warnings triggered on nearly all the requests, simple GET requests.. \r\n\r\nIt seems the values from the variables defined in rule id 900012 are not well checked:\r\n```\r\nSecAction \\\r\n \"id:'900012',\\\r\n  phase:request,\\\r\n  nolog,\\\r\n  pass,\\\r\n  t:none,\\\r\n  setvar:'tx.allowed_methods=GET HEAD POST OPTIONS', \\\r\n  setvar:'tx.static_resources=jpg|jpeg|png|gif|js|css|ico', \\\r\n  setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf|application/json|text/plain', \\\r\n  setvar:'tx.allowed_http_versions=HTTP/0.9 HTTP/1.0 HTTP/1.1', \\\r\n  setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/', \\\r\n  setvar:'tx.restricted_headers=/Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/'\"\r\n```\r\n\r\nThe warnings I have don't make sense:\r\n```\r\nWarning. Match of \"within %{tx.allowed_methods}\" against \"REQUEST_METHOD\" required. [file \"/etc/modsecurity/REQUEST-11-METHOD-ENFORCEMENT.conf\"] [line \"49\"] [id \"911100\"] [rev \"2\"] [msg \"Method is not allowed by policy\"] [data \"GET\"] ...\r\n\r\nRuel id 911100 (rules/REQUEST-11-METHOD-ENFORCEMENT.conf):\r\nSecRule REQUEST_METHOD \"!@within %{tx.allowed_methods}\"\r\n```\r\nGET is in the \"allowed_methods\".\r\n```\r\nMessage: Warning. Match of \"within %{tx.allowed_http_versions}\" against \"REQUEST_PROTOCOL\" required. [file \"/etc/modsecurity/REQUEST-20-PROTOCOL-ENFORCEMENT.conf\"] [line \"1051\"] [id \"920430\"] [rev \"2\"] [msg \"HTTP protocol version is not allowed by policy\"] [data \"HTTP/1.1\"] ...\r\n\r\nRule id 920430 (rules/REQUEST-20-PROTOCOL-ENFORCEMENT.conf):\r\nSecRule REQUEST_PROTOCOL \"!@within %{tx.allowed_http_versions}\"\r\n```\r\nHTTP/1.1 is in the \"allowed_http_versions\"\r\n\r\nIs there a problem with the function 'within'?\r\n\r\nSee attached log for more info.\r\n\r\n[event_28683.txt](https://github.com/SpiderLabs/owasp-modsecurity-crs/files/330538/event_28683.txt)\r\n"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/228835601","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/373#issuecomment-228835601","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373","id":228835601,"user":{"login":"csanders-git","id":4632287,"avatar_url":"https://avatars.githubusercontent.com/u/4632287?v=3","gravatar_id":"","url":"https://api.github.com/users/csanders-git","html_url":"https://github.com/csanders-git","followers_url":"https://api.github.com/users/csanders-git/followers","following_url":"https://api.github.com/users/csanders-git/following{/other_user}","gists_url":"https://api.github.com/users/csanders-git/gists{/gist_id}","starred_url":"https://api.github.com/users/csanders-git/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csanders-git/subscriptions","organizations_url":"https://api.github.com/users/csanders-git/orgs","repos_url":"https://api.github.com/users/csanders-git/repos","events_url":"https://api.github.com/users/csanders-git/events{/privacy}","received_events_url":"https://api.github.com/users/csanders-git/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T18:37:57Z","updated_at":"2016-06-27T18:37:57Z","body":"Closing this for now although we have great motivation to talk about this further in #368 "}}
{"actor":{"display_login":"csanders-git"}}