search

owasp-modsecurity / ModSecurity-nginx

ModSecurity v3 Nginx Connector
Apache License 2.0
1.49k stars 277 forks source link

Restore method name for error_page in audit log #270

Closed liudongmiao closed 2 years ago

liudongmiao commented 2 years ago

Nginx handles error_page via ngx_http_internal_redirect, and audit log in ModSecurity-nginx is trigged in the next handler.

In nginx's code, it's harded to GET for non-HEAD, refers https://github.com/nginx/nginx/blob/master/src/http/ngx_http_special_response.c#L618-L621:

        if (r->method != NGX_HTTP_HEAD) {
            r->method = NGX_HTTP_GET;
            r->method_name = ngx_http_core_get_method;
        }

This patch use method_name from request_line to fix this issue.

This should fix method name in https://github.com/SpiderLabs/ModSecurity-nginx/issues/182, and solve https://github.com/SpiderLabs/ModSecurity-nginx/issues/258.