Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: editing tag false positive #65

Merged
merged 6 commits into from
Dec 20, 2024
Merged

fix: editing tag false positive #65

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
64d88c1
fix: editing tag false positive
EsadCetiner Oct 28, 2024
cfb12aa
fix: editing tag false positive
EsadCetiner Oct 28, 2024
e17482c
Merge branch 'coreruleset:master' into fix-tags
EsadCetiner Nov 26, 2024
91889ff
fix: check log output correctly
EsadCetiner Nov 26, 2024
9d9a62a
fix: move `ARGS_NAMES:users[0]` to it's own rule
EsadCetiner Nov 26, 2024
4d405a5
up
EsadCetiner Nov 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions plugins/wordpress-rule-exclusions-before.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -457,6 +457,8 @@ SecRule REQUEST_FILENAME "@unconditionalMatch" \
pass,\
t:none,\
nolog,\
ctl:ruleRemoveTargetById=920273;ARGS_NAMES:users[0],\
ctl:ruleRemoveTargetById=942432;ARGS_NAMES:users[0],\
EsadCetiner marked this conversation as resolved.
Show resolved Hide resolved
ctl:ruleRemoveTargetById=932236;ARGS:nonce,\
ctl:ruleRemoveTargetById=942450;ARGS:nonce,\
ctl:ruleRemoveTargetById=932236;ARGS:ver,\
Expand All @@ -466,6 +468,7 @@ SecRule REQUEST_FILENAME "@unconditionalMatch" \
ctl:ruleRemoveTargetById=931130;ARGS:_wp_http_referer,\
ctl:ruleRemoveTargetById=932150;ARGS:_wp_http_referer,\
ctl:ruleRemoveTargetById=932200;ARGS:_wp_http_referer,\
ctl:ruleRemoveTargetById=932235;ARGS:_wp_http_referer,\
ctl:ruleRemoveTargetById=932236;ARGS:_wp_http_referer,\
ctl:ruleRemoveTargetById=941100;ARGS:_wp_http_referer,\
ctl:ruleRemoveTargetById=942130;ARGS:_wp_http_referer,\
Expand All @@ -477,6 +480,7 @@ SecRule REQUEST_FILENAME "@unconditionalMatch" \
ctl:ruleRemoveTargetById=942432;ARGS:_wp_http_referer,\
ctl:ruleRemoveTargetById=942440;ARGS:_wp_http_referer,\
ctl:ruleRemoveTargetById=920230;ARGS:wp_http_referer,\
ctl:ruleRemoveTargetById=920273;ARGS:wp_http_referer,\
ctl:ruleRemoveTargetById=931130;ARGS:wp_http_referer,\
ctl:ruleRemoveTargetById=932150;ARGS:wp_http_referer,\
ctl:ruleRemoveTargetById=932200;ARGS:wp_http_referer,\
Expand All @@ -488,6 +492,7 @@ SecRule REQUEST_FILENAME "@unconditionalMatch" \
ctl:ruleRemoveTargetById=942230;ARGS:wp_http_referer,\
ctl:ruleRemoveTargetById=942260;ARGS:wp_http_referer,\
ctl:ruleRemoveTargetById=942431;ARGS:wp_http_referer,\
ctl:ruleRemoveTargetById=942432;ARGS:wp_http_referer,\
ctl:ruleRemoveTargetById=932236;ARGS:_wpnonce,\
ctl:ruleRemoveTargetById=942450;ARGS:_wpnonce,\
ver:'wordpress-rule-exclusions-plugin/1.0.1'"
Expand Down
43 changes: 35 additions & 8 deletions tests/regression/wordpress-rule-exclusions-plugin/9507350.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,8 @@ tests:
version: "HTTP/1.1"
uri: /get/wp-admin/user-edit.php?user_id=9&wp_http_referer=%2Fwp-admin%2Fusers.php%3Fupdate%3Dadd%26id%3D9
output:
no_log_contains: id "932236"
no_log_contains: |
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"
- test_title: 9507350-2
desc: Deleteing a user account
stages:
Expand All @@ -38,7 +39,7 @@ tests:
uri: /post/wp-admin/users.php?s=&_wpnonce=random&_wp_http_referer=%2Fwp-admin%2Fusers.php&action=delete&new_role=&paged=1&users%5B0%5D=9&action2=delete&new_role2=
output:
no_log_contains: |
id "920230"|id "942430"|id "942431"|id "942432"
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"
- test_title: 9507350-3
desc: Disable 932236 for randomly generated nonce
stages:
Expand All @@ -54,7 +55,8 @@ tests:
version: "HTTP/1.1"
uri: /post/wp-admin/users.php?s=&_wpnonce=lsrandom&_wp_http_referer=%2Fwp-admin%2Fusers.php&action=delete&new_role=&paged=1&users%5B0%5D=9&action2=delete&new_role2=
output:
no_log_contains: id "932236"
no_log_contains: |
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"
- test_title: 9507350-4
desc: Disable 942450 for randomly generated nonce
stages:
Expand All @@ -70,7 +72,8 @@ tests:
version: "HTTP/1.1"
uri: /post/wp-admin/users.php?s=&_wpnonce=0x0800random&_wp_http_referer=%2Fwp-admin%2Fusers.php&action=delete&new_role=&paged=1&users%5B0%5D=9&action2=delete&new_role2=
output:
no_log_contains: id "942450"
no_log_contains: |
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"
- test_title: 9507350-5
desc: Disable 932236 for randomly generated nonce
stages:
Expand All @@ -86,7 +89,8 @@ tests:
version: "HTTP/1.1"
uri: /post/wp-admin/users.php?s=&nonce=lsrandom
output:
no_log_contains: id "932236"
no_log_contains: |
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"
- test_title: 9507350-6
desc: Disable 942450 for randomly generated nonce
stages:
Expand All @@ -102,7 +106,8 @@ tests:
version: "HTTP/1.1"
uri: /post/wp-admin/users.php?s=&nonce=0x0800random
output:
no_log_contains: id "942450"
no_log_contains: |
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"
- test_title: 9507350-7
desc: Requesting a static file with randomly generated version
stages:
Expand All @@ -118,7 +123,8 @@ tests:
version: "HTTP/1.1"
uri: /get/example.js?ver=lsrandom
output:
no_log_contains: id "932236"
no_log_contains: |
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"
- test_title: 9507350-8
desc: Requesting a static file with randomly generated version
stages:
Expand All @@ -134,4 +140,25 @@ tests:
version: "HTTP/1.1"
uri: /get/example.js?ver=0x0000
output:
no_log_contains: id "942450"
no_log_contains: |
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"
- test_title: 9507350-9
desc: Editing tags
stages:
- stage:
input:
dest_addr: 127.0.0.1
headers:
Host: localhost
User-Agent: OWASP CRS test agent
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Content-Type: application/x-www-form-urlencoded
port: 80
method: POST
version: "HTTP/1.1"
uri: /post/wp-admin/edit-tags.php
data: |
_wp_http_referer=/wp-admin/term.php?taxonomy=post_tag&tag_ID=12&post_type=post&wp_http_referer=%2Fwp-admin%2Fedit-tags.php%3Ftaxonomy%3Dpost_tag
output:
no_log_contains: |
id "920230"|id "932235"|id "932236"|id "942430"|id "942431"|id "942432"|id "942450"