owasp-modsecurity / ModSecurity-nginx

ModSecurity v3 Nginx Connector
Apache License 2.0
1.49k stars 277 forks source link

How to access rule details in lua #268

Closed sharmashivanand closed 2 years ago

sharmashivanand commented 2 years ago

How to access rule.msg or rule.tag via lua?

modsecurity_rules 'SecRule RESPONSE_STATUS "@streq 403" "id:221,log,logdata:\'!!!!!!!!!!!!! CAUGHT !!!!!!!!!!!!!!!!\',exec:/tmp/test.lua"';

Here's the Lua script

#!/usr/bin/lua

function main()
    -- This executes on service start
    m.log(1, "Starting script execution \n")
    local fileHandle = assert(io.open('/tmp/lua_output.txt', 'a+'))
    fileHandle:write("--- REMOTE_ADDR ---\n")
    fileHandle:write(m.getvar("REMOTE_ADDR"))
    fileHandle:write(m.getvar("rule var / specs"))
    fileHandle:write()
    fileHandle:write("\n")
    -- This executes on service shutdown
    m.log(1, "Script execution finished\n")
end
martinhsv commented 2 years ago

Hello @sharmashivanand ,

One option available to you is to use a TX variable to hold the string that you want to share with your lua script and use that same TX variable content for your 'logdata' (etc.) action. Have a look at https://github.com/SpiderLabs/ModSecurity/issues/2527 for a roughly similar idea.