search

owasp-modsecurity / ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
https://www.modsecurity.org
Apache License 2.0
8.09k stars 1.58k forks source link

Feature Request: deflate HTTP parameter #1584

Open heaviss opened 6 years ago

heaviss commented 6 years ago

Hi! I need to deal with http parameter which have been zipped (deflate algorithm) and then base64-encoded. Is it possible to implement transformation function to deflate (t:unzipDeflate) ? What I need to do it? I have almost no experience in developing in C, but I'll try to do as much as I can.

victorhora commented 6 years ago

Hi @heaviss

Have you tried forcing decompression using mod_deflate or ngx_http_gunzip_module?

heaviss commented 6 years ago

Hi @victorhora From mod_deflate:

The deflate encoding is not supported

Also, as I understand, mod_deflate can't decode one specific parameter, only full request/response.

I tried to do this with lua script, but it was unstable. I need this to work with 3D-Secure service. There is a POST request with "content type: application/x-www-form-urlencoded", and parameter PaReq in the body. PaReq is an XML document, compressed using the DEFLATE algorithm, and then Base64-encoded and URL-encoded. I think this feature will be great for PCI DSS compliance.

zimmerle commented 3 years ago

@azurit proposed a Lua script in #2494. The idea is to have a transformation to perform gunzip.