{"action":"closed","number":36,"pull_request":{"url":"https://api.github.com/repos/Microsoft/ModSecurity/pulls/36","id":207227083,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA3MjI3MDgz","html_url":"https://github.com/Microsoft/ModSecurity/pull/36","diff_url":"https://github.com/Microsoft/ModSecurity/pull/36.diff","patch_url":"https://github.com/Microsoft/ModSecurity/pull/36.patch","issue_url":"https://api.github.com/repos/Microsoft/ModSecurity/issues/36","number":36,"state":"closed","locked":false,"title":"Nginx, scan all request bodies","user":{"login":"allanbomsft","id":21695978,"node_id":"MDQ6VXNlcjIxNjk1OTc4","avatar_url":"https://avatars1.githubusercontent.com/u/21695978?v=4","gravatar_id":"","url":"https://api.github.com/users/allanbomsft","html_url":"https://github.com/allanbomsft","followers_url":"https://api.github.com/users/allanbomsft/followers","following_url":"https://api.github.com/users/allanbomsft/following{/other_user}","gists_url":"https://api.github.com/users/allanbomsft/gists{/gist_id}","starred_url":"https://api.github.com/users/allanbomsft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/allanbomsft/subscriptions","organizations_url":"https://api.github.com/users/allanbomsft/orgs","repos_url":"https://api.github.com/users/allanbomsft/repos","events_url":"https://api.github.com/users/allanbomsft/events{/privacy}","received_events_url":"https://api.github.com/users/allanbomsft/received_events","type":"User","site_admin":false},"body":"This is to let Nginx scan not only POST requests bodies, but all request bodies.\r\n\r\nI was hoping to find an indicator in Nginx's structs that tell a bit more definitive whether there was a body, but couldn't find such a variable. Checking whether there was either a length or chunked was the best I could find.\r\n\r\nTested manually by issuing the following requests which I believe covers the edge cases:\r\n - A simple GET with no req body\r\n - A GET with a req body (this is strange yes, but I believe valid)\r\n - A GET with a chunked req body\r\n - A GET with a 0 length chunked body\r\n - A GET with some trailing data after the headers where there would normally be a body\r\n - A GET with a body, and some trailing data after that\r\n - A POST with a body of type multipart/form-data\r\n - A POST with a chunked body of type multipart/form-data\r\n - A POST with a chunked body of type XML\r\n - A request with a non-standard made up verb rather than POST/GET/PUT/etc.\r\n - A request with a non-standard verb that was several kilobytes long\r\n","created_at":"2018-08-09T07:41:54Z","updated_at":"2018-08-09T18:06:35Z","closed_at":"2018-08-09T18:06:35Z","merged_at":"2018-08-09T18:06:35Z","merge_commit_sha":"3effdf45073caffd018d0753a089f548ac9d2c11","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/Microsoft/ModSecurity/pulls/36/commits","review_comments_url":"https://api.github.com/repos/Microsoft/ModSecurity/pulls/36/comments","review_comment_url":"https://api.github.com/repos/Microsoft/ModSecurity/pulls/comments{/number}","comments_url":"https://api.github.com/repos/Microsoft/ModSecurity/issues/36/comments","statuses_url":"https://api.github.com/repos/Microsoft/ModSecurity/statuses/eb00a4a6c4cf74985f5f6bd594c3a355ad5bd915","head":{"label":"Microsoft:v2/nginxScanAllReqBody","ref":"v2/nginxScanAllReqBody","sha":"eb00a4a6c4cf74985f5f6bd594c3a355ad5bd915","user":{"login":"Microsoft","id":6154722,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYxNTQ3MjI=","avatar_url":"https://avatars2.githubusercontent.com/u/6154722?v=4","gravatar_id":"","url":"https://api.github.com/users/Microsoft","html_url":"https://github.com/Microsoft","followers_url":"https://api.github.com/users/Microsoft/followers","following_url":"https://api.github.com/users/Microsoft/following{/other_user}","gists_url":"https://api.github.com/users/Microsoft/gists{/gist_id}","starred_url":"https://api.github.com/users/Microsoft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Microsoft/subscriptions","organizations_url":"https://api.github.com/users/Microsoft/orgs","repos_url":"https://api.github.com/users/Microsoft/repos","events_url":"https://api.github.com/users/Microsoft/events{/privacy}","received_events_url":"https://api.github.com/users/Microsoft/received_events","type":"Organization","site_admin":false},"repo":{"id":90289274,"node_id":"MDEwOlJlcG9zaXRvcnk5MDI4OTI3NA==","name":"ModSecurity","full_name":"Microsoft/ModSecurity","owner":{"login":"Microsoft","id":6154722,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYxNTQ3MjI=","avatar_url":"https://avatars2.githubusercontent.com/u/6154722?v=4","gravatar_id":"","url":"https://api.github.com/users/Microsoft","html_url":"https://github.com/Microsoft","followers_url":"https://api.github.com/users/Microsoft/followers","following_url":"https://api.github.com/users/Microsoft/following{/other_user}","gists_url":"https://api.github.com/users/Microsoft/gists{/gist_id}","starred_url":"https://api.github.com/users/Microsoft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Microsoft/subscriptions","organizations_url":"https://api.github.com/users/Microsoft/orgs","repos_url":"https://api.github.com/users/Microsoft/repos","events_url":"https://api.github.com/users/Microsoft/events{/privacy}","received_events_url":"https://api.github.com/users/Microsoft/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/Microsoft/ModSecurity","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence. ","fork":true,"url":"https://api.github.com/repos/Microsoft/ModSecurity","forks_url":"https://api.github.com/repos/Microsoft/ModSecurity/forks","keys_url":"https://api.github.com/repos/Microsoft/ModSecurity/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Microsoft/ModSecurity/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Microsoft/ModSecurity/teams","hooks_url":"https://api.github.com/repos/Microsoft/ModSecurity/hooks","issue_events_url":"https://api.github.com/repos/Microsoft/ModSecurity/issues/events{/number}","events_url":"https://api.github.com/repos/Microsoft/ModSecurity/events","assignees_url":"https://api.github.com/repos/Microsoft/ModSecurity/assignees{/user}","branches_url":"https://api.github.com/repos/Microsoft/ModSecurity/branches{/branch}","tags_url":"https://api.github.com/repos/Microsoft/ModSecurity/tags","blobs_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/refs{/sha}","trees_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Microsoft/ModSecurity/statuses/{sha}","languages_url":"https://api.github.com/repos/Microsoft/ModSecurity/languages","stargazers_url":"https://api.github.com/repos/Microsoft/ModSecurity/stargazers","contributors_url":"https://api.github.com/repos/Microsoft/ModSecurity/contributors","subscribers_url":"https://api.github.com/repos/Microsoft/ModSecurity/subscribers","subscription_url":"https://api.github.com/repos/Microsoft/ModSecurity/subscription","commits_url":"https://api.github.com/repos/Microsoft/ModSecurity/commits{/sha}","git_commits_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/commits{/sha}","comments_url":"https://api.github.com/repos/Microsoft/ModSecurity/comments{/number}","issue_comment_url":"https://api.github.com/repos/Microsoft/ModSecurity/issues/comments{/number}","contents_url":"https://api.github.com/repos/Microsoft/ModSecurity/contents/{+path}","compare_url":"https://api.github.com/repos/Microsoft/ModSecurity/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Microsoft/ModSecurity/merges","archive_url":"https://api.github.com/repos/Microsoft/ModSecurity/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Microsoft/ModSecurity/downloads","issues_url":"https://api.github.com/repos/Microsoft/ModSecurity/issues{/number}","pulls_url":"https://api.github.com/repos/Microsoft/ModSecurity/pulls{/number}","milestones_url":"https://api.github.com/repos/Microsoft/ModSecurity/milestones{/number}","notifications_url":"https://api.github.com/repos/Microsoft/ModSecurity/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Microsoft/ModSecurity/labels{/name}","releases_url":"https://api.github.com/repos/Microsoft/ModSecurity/releases{/id}","deployments_url":"https://api.github.com/repos/Microsoft/ModSecurity/deployments","created_at":"2017-05-04T17:11:53Z","updated_at":"2018-08-02T21:10:52Z","pushed_at":"2018-08-09T18:06:35Z","git_url":"git://github.com/Microsoft/ModSecurity.git","ssh_url":"git@github.com:Microsoft/ModSecurity.git","clone_url":"https://github.com/Microsoft/ModSecurity.git","svn_url":"https://github.com/Microsoft/ModSecurity","homepage":"www.modsecurity.org","size":41358,"stargazers_count":11,"watchers_count":11,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":5,"mirror_url":null,"archived":false,"open_issues_count":3,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":5,"open_issues":3,"watchers":11,"default_branch":"v2/master"}},"base":{"label":"Microsoft:v2/master","ref":"v2/master","sha":"65372207f90cbfbe82e1224afcf66fd2947da527","user":{"login":"Microsoft","id":6154722,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYxNTQ3MjI=","avatar_url":"https://avatars2.githubusercontent.com/u/6154722?v=4","gravatar_id":"","url":"https://api.github.com/users/Microsoft","html_url":"https://github.com/Microsoft","followers_url":"https://api.github.com/users/Microsoft/followers","following_url":"https://api.github.com/users/Microsoft/following{/other_user}","gists_url":"https://api.github.com/users/Microsoft/gists{/gist_id}","starred_url":"https://api.github.com/users/Microsoft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Microsoft/subscriptions","organizations_url":"https://api.github.com/users/Microsoft/orgs","repos_url":"https://api.github.com/users/Microsoft/repos","events_url":"https://api.github.com/users/Microsoft/events{/privacy}","received_events_url":"https://api.github.com/users/Microsoft/received_events","type":"Organization","site_admin":false},"repo":{"id":90289274,"node_id":"MDEwOlJlcG9zaXRvcnk5MDI4OTI3NA==","name":"ModSecurity","full_name":"Microsoft/ModSecurity","owner":{"login":"Microsoft","id":6154722,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYxNTQ3MjI=","avatar_url":"https://avatars2.githubusercontent.com/u/6154722?v=4","gravatar_id":"","url":"https://api.github.com/users/Microsoft","html_url":"https://github.com/Microsoft","followers_url":"https://api.github.com/users/Microsoft/followers","following_url":"https://api.github.com/users/Microsoft/following{/other_user}","gists_url":"https://api.github.com/users/Microsoft/gists{/gist_id}","starred_url":"https://api.github.com/users/Microsoft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Microsoft/subscriptions","organizations_url":"https://api.github.com/users/Microsoft/orgs","repos_url":"https://api.github.com/users/Microsoft/repos","events_url":"https://api.github.com/users/Microsoft/events{/privacy}","received_events_url":"https://api.github.com/users/Microsoft/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/Microsoft/ModSecurity","description":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence. ","fork":true,"url":"https://api.github.com/repos/Microsoft/ModSecurity","forks_url":"https://api.github.com/repos/Microsoft/ModSecurity/forks","keys_url":"https://api.github.com/repos/Microsoft/ModSecurity/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Microsoft/ModSecurity/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Microsoft/ModSecurity/teams","hooks_url":"https://api.github.com/repos/Microsoft/ModSecurity/hooks","issue_events_url":"https://api.github.com/repos/Microsoft/ModSecurity/issues/events{/number}","events_url":"https://api.github.com/repos/Microsoft/ModSecurity/events","assignees_url":"https://api.github.com/repos/Microsoft/ModSecurity/assignees{/user}","branches_url":"https://api.github.com/repos/Microsoft/ModSecurity/branches{/branch}","tags_url":"https://api.github.com/repos/Microsoft/ModSecurity/tags","blobs_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/refs{/sha}","trees_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Microsoft/ModSecurity/statuses/{sha}","languages_url":"https://api.github.com/repos/Microsoft/ModSecurity/languages","stargazers_url":"https://api.github.com/repos/Microsoft/ModSecurity/stargazers","contributors_url":"https://api.github.com/repos/Microsoft/ModSecurity/contributors","subscribers_url":"https://api.github.com/repos/Microsoft/ModSecurity/subscribers","subscription_url":"https://api.github.com/repos/Microsoft/ModSecurity/subscription","commits_url":"https://api.github.com/repos/Microsoft/ModSecurity/commits{/sha}","git_commits_url":"https://api.github.com/repos/Microsoft/ModSecurity/git/commits{/sha}","comments_url":"https://api.github.com/repos/Microsoft/ModSecurity/comments{/number}","issue_comment_url":"https://api.github.com/repos/Microsoft/ModSecurity/issues/comments{/number}","contents_url":"https://api.github.com/repos/Microsoft/ModSecurity/contents/{+path}","compare_url":"https://api.github.com/repos/Microsoft/ModSecurity/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Microsoft/ModSecurity/merges","archive_url":"https://api.github.com/repos/Microsoft/ModSecurity/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Microsoft/ModSecurity/downloads","issues_url":"https://api.github.com/repos/Microsoft/ModSecurity/issues{/number}","pulls_url":"https://api.github.com/repos/Microsoft/ModSecurity/pulls{/number}","milestones_url":"https://api.github.com/repos/Microsoft/ModSecurity/milestones{/number}","notifications_url":"https://api.github.com/repos/Microsoft/ModSecurity/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Microsoft/ModSecurity/labels{/name}","releases_url":"https://api.github.com/repos/Microsoft/ModSecurity/releases{/id}","deployments_url":"https://api.github.com/repos/Microsoft/ModSecurity/deployments","created_at":"2017-05-04T17:11:53Z","updated_at":"2018-08-02T21:10:52Z","pushed_at":"2018-08-09T18:06:35Z","git_url":"git://github.com/Microsoft/ModSecurity.git","ssh_url":"git@github.com:Microsoft/ModSecurity.git","clone_url":"https://github.com/Microsoft/ModSecurity.git","svn_url":"https://github.com/Microsoft/ModSecurity","homepage":"www.modsecurity.org","size":41358,"stargazers_count":11,"watchers_count":11,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":5,"mirror_url":null,"archived":false,"open_issues_count":3,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":5,"open_issues":3,"watchers":11,"default_branch":"v2/master"}},"_links":{"self":{"href":"https://api.github.com/repos/Microsoft/ModSecurity/pulls/36"},"html":{"href":"https://github.com/Microsoft/ModSecurity/pull/36"},"issue":{"href":"https://api.github.com/repos/Microsoft/ModSecurity/issues/36"},"comments":{"href":"https://api.github.com/repos/Microsoft/ModSecurity/issues/36/comments"},"review_comments":{"href":"https://api.github.com/repos/Microsoft/ModSecurity/pulls/36/comments"},"review_comment":{"href":"https://api.github.com/repos/Microsoft/ModSecurity/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/Microsoft/ModSecurity/pulls/36/commits"},"statuses":{"href":"https://api.github.com/repos/Microsoft/ModSecurity/statuses/eb00a4a6c4cf74985f5f6bd594c3a355ad5bd915"}},"author_association":"COLLABORATOR","merged":true,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":{"login":"allanbomsft","id":21695978,"node_id":"MDQ6VXNlcjIxNjk1OTc4","avatar_url":"https://avatars1.githubusercontent.com/u/21695978?v=4","gravatar_id":"","url":"https://api.github.com/users/allanbomsft","html_url":"https://github.com/allanbomsft","followers_url":"https://api.github.com/users/allanbomsft/followers","following_url":"https://api.github.com/users/allanbomsft/following{/other_user}","gists_url":"https://api.github.com/users/allanbomsft/gists{/gist_id}","starred_url":"https://api.github.com/users/allanbomsft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/allanbomsft/subscriptions","organizations_url":"https://api.github.com/users/allanbomsft/orgs","repos_url":"https://api.github.com/users/allanbomsft/repos","events_url":"https://api.github.com/users/allanbomsft/events{/privacy}","received_events_url":"https://api.github.com/users/allanbomsft/received_events","type":"User","site_admin":false},"comments":0,"review_comments":2,"maintainer_can_modify":false,"commits":1,"additions":2,"deletions":5,"changed_files":1}}
{"actor":{"display_login":"allanbomsft"}}