{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1924","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1924/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1924/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1924/events","html_url":"https://github.com/SpiderLabs/ModSecurity/pull/1924","id":369858871,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIyNjg3NDk4","number":1924,"title":"Make multipart boundary check a bit less strict by default","user":{"login":"victorhora","id":15767386,"node_id":"MDQ6VXNlcjE1NzY3Mzg2","avatar_url":"https://avatars3.githubusercontent.com/u/15767386?v=4","gravatar_id":"","url":"https://api.github.com/users/victorhora","html_url":"https://github.com/victorhora","followers_url":"https://api.github.com/users/victorhora/followers","following_url":"https://api.github.com/users/victorhora/following{/other_user}","gists_url":"https://api.github.com/users/victorhora/gists{/gist_id}","starred_url":"https://api.github.com/users/victorhora/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/victorhora/subscriptions","organizations_url":"https://api.github.com/users/victorhora/orgs","repos_url":"https://api.github.com/users/victorhora/repos","events_url":"https://api.github.com/users/victorhora/events{/privacy}","received_events_url":"https://api.github.com/users/victorhora/received_events","type":"User","site_admin":false},"labels":[{"id":846590132,"node_id":"MDU6TGFiZWw4NDY1OTAxMzI=","url":"https://api.github.com/repos/SpiderLabs/ModSecurity/labels/3.x","name":"3.x","color":"64d147","default":false},{"id":61400441,"node_id":"MDU6TGFiZWw2MTQwMDQ0MQ==","url":"https://api.github.com/repos/SpiderLabs/ModSecurity/labels/Type%20-%20Feature","name":"Type - Feature","color":"5319e7","default":false},{"id":231596616,"node_id":"MDU6TGFiZWwyMzE1OTY2MTY=","url":"https://api.github.com/repos/SpiderLabs/ModSecurity/labels/libmodsecurity","name":"libmodsecurity","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":{"login":"zimmerle","id":428268,"node_id":"MDQ6VXNlcjQyODI2OA==","avatar_url":"https://avatars3.githubusercontent.com/u/428268?v=4","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"assignees":[{"login":"zimmerle","id":428268,"node_id":"MDQ6VXNlcjQyODI2OA==","avatar_url":"https://avatars3.githubusercontent.com/u/428268?v=4","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/milestones/12","html_url":"https://github.com/SpiderLabs/ModSecurity/milestone/12","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/milestones/12/labels","id":3222248,"node_id":"MDk6TWlsZXN0b25lMzIyMjI0OA==","number":12,"title":"v3.0.3","description":"Tasks related to release 3.0.3","creator":{"login":"zimmerle","id":428268,"node_id":"MDQ6VXNlcjQyODI2OA==","avatar_url":"https://avatars3.githubusercontent.com/u/428268?v=4","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":65,"state":"open","created_at":"2018-03-27T14:34:35Z","updated_at":"2018-10-14T01:53:02Z","due_on":"2018-10-06T07:00:00Z","closed_at":null},"comments":1,"created_at":"2018-10-14T01:53:02Z","updated_at":"2018-10-14T07:47:07Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/pulls/1924","html_url":"https://github.com/SpiderLabs/ModSecurity/pull/1924","diff_url":"https://github.com/SpiderLabs/ModSecurity/pull/1924.diff","patch_url":"https://github.com/SpiderLabs/ModSecurity/pull/1924.patch"},"body":"This pull request is sort of a workaround for multipart/form-data requests that have multiple boundaries such as common ```Content-Disposition``` POST requests.\r\n\r\nThe issue is that the fix proposed at https://github.com/SpiderLabs/ModSecurity/pull/1747 and merged at https://github.com/SpiderLabs/ModSecurity/commit/4d0ca94490fdcc233228987c6b10ef010d967249 could lead to cases where ```Content-Disposition``` POST requests such as the one below are denied by default after this commit:\r\n\r\n```\r\nPOST /test.html HTTP/1.1\r\nHost: example.org\r\nContent-Type: multipart/form-data;boundary=boundary\r\nContent-Length: 174\r\n\r\n--boundary\r\nContent-Disposition: form-data; name=\"field1\"\r\n\r\nvalue1\r\n--boundary\r\nContent-Disposition: form-data; name=\"field2\"; filename=\"example.txt\"\r\n\r\nvalue2\r\n--boundary--\r\n```\r\n\r\nRef: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition\r\n\r\nI suggesting making rule 200004 less strict by replacing a \"deny\" with a \"pass\", but still alerting the WAF operator. The operator can choose the disable or change the rule to not log if need be.\r\n\r\nIn addition, a new rule (200006) would be created in order to actually block cases where an unmatched boundary is actually found in the request."},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/comments/429604228","html_url":"https://github.com/SpiderLabs/ModSecurity/pull/1924#issuecomment-429604228","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1924","id":429604228,"node_id":"MDEyOklzc3VlQ29tbWVudDQyOTYwNDIyOA==","user":{"login":"airween","id":238977,"node_id":"MDQ6VXNlcjIzODk3Nw==","avatar_url":"https://avatars1.githubusercontent.com/u/238977?v=4","gravatar_id":"","url":"https://api.github.com/users/airween","html_url":"https://github.com/airween","followers_url":"https://api.github.com/users/airween/followers","following_url":"https://api.github.com/users/airween/following{/other_user}","gists_url":"https://api.github.com/users/airween/gists{/gist_id}","starred_url":"https://api.github.com/users/airween/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/airween/subscriptions","organizations_url":"https://api.github.com/users/airween/orgs","repos_url":"https://api.github.com/users/airween/repos","events_url":"https://api.github.com/users/airween/events{/privacy}","received_events_url":"https://api.github.com/users/airween/received_events","type":"User","site_admin":false},"created_at":"2018-10-14T07:47:07Z","updated_at":"2018-10-14T07:47:07Z","author_association":"NONE","body":"Oh', I am honoured to be invited, thank you :).\r\n\r\nAfter first review, I didn't see the reason, why do you need to create a new rule with less security, but I can imagine that it helps for the administrators in most cases. I think this proposal is closer to the natural use of ModSecurity.\r\n\r\nI just reviewed the Owasp-CRS rule set, and didn't see any affected rule. Anyway, it would be good to notify the CRS team about this changes. I guess the ModSec users will know it from CHANGES :).\r\n\r\nI'm afraid I can not add more than above, sorry. :)\r\n\r\nThanks again."}}
{"actor":{"display_login":"airween"}}