search

SpiderLabs / owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)
https://modsecurity.org/crs
Apache License 2.0
2.44k stars 725 forks source link

Fix content type whitelist #1734

Closed franbuehler closed 4 years ago

franbuehler commented 4 years ago

Fix issue #1722 and expand content-type whitelisting.

action, type, start and start-info are allowed too. And these "flags" can appear several times.

I also added two regression tests that cover the new extensions and the false positives mentioned in the issue.

franbuehler commented 4 years ago

Monthly Chat Meeting April: @franbuehler and @lifeforms will test this rule in production.

franbuehler commented 4 years ago

In the monthly chat meeting from May 4 we decided to merge this PR: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1749#issuecomment-623634756