owasp-modsecurity / ModSecurity-apache

ModSecurity v3 Apache Connector
Apache License 2.0
88 stars 51 forks source link

Fix duplicate HTTP protocol version string #21

Closed victorhora closed 6 years ago

victorhora commented 6 years ago

Proposed patch to fix an issue on the REQUEST_PROTOCOL variable and log data:

---3pK3I6qx---A--

[05/Nov/2017:03:31:20 -0600] 15098742801.705792 192.168.37.1 56350 localhost.localdomain 0 ---3pK3I6qx---B-- POST /index.html?a=b HTTP/HTTP/1.1 Connection: Keep-Alive Content-Length: 6 Content-Type: application/x-www-form-urlencoded Host: localhost User-Agent: UA

---3pK3I6qx---C-- b=boom

---3pK3I6qx---D--

---3pK3I6qx---F-- HTTP/HTTP/1.1 403 Last-Modified: Thu, 02 Nov 2017 02:12:06 GMT ETag: "5-55cf683d0502d" Accept-Ranges: bytes Content-Length: 5

msc_process_uri() appends the string "HTTP/" to http_version probably because the Nginx connector doesn't.

The problem happens due the fact that in Apache, the request_rec:::protocol data field returns the protocol string in the form of "HTTP/1.1".

csanders-git commented 6 years ago

not sure it's the most elegant fix, but it worked for me.

zimmerle commented 6 years ago

Merged. Thanks.