search

owasp-modsecurity / ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
https://www.modsecurity.org
Apache License 2.0
8.26k stars 1.61k forks source link

Enhancement: increase SecPcreMatchLimit for specific file #3304

Open Orgoth opened 2 hours ago

Orgoth commented 2 hours ago

Is there a way to increase the SecPcreMatchLimit for a specific file? Our Application has an API which receives very large amounts of data and I only want to increase the limit for this API. The global limit should stay the same.

airween commented 2 hours ago

Hi @Orgoth,

which version do you use?

If you use libmodsecurity3 and Nginx, you should try to put into a location block:

    location /api/endpoint {
        modsecurity_rules '
          SecPcreMatchLimit 1024
        ';
    }

See this part of documentation.

Orgoth commented 2 hours ago

Sorry forgot to mention. I am using libapache2-mod-security2 2.9.3-3+deb11u2.

I suspect, I can create a files block within the vhost and set the rule for this specific file. Thank you very much.

airween commented 2 hours ago

Please feel free to close this issue if you could solve that.

Orgoth commented 2 hours ago

Sadly, this is not possible.

SecPcreMatchLimit not allowed in <Location> context SecPcreMatchLimit not allowed in <FilesMatch> context SecPcreMatchLimit not allowed in <Directory> context ModSecurity: SecPcreMatchLimit not allowed in VirtualHost

Orgoth commented 1 hour ago

I will disable modsecurity via exclude rule for this api, the coworker confirmed, he will take responsibility.

But could this behavior be changed? That you allow Apache in the module/lib that this rule can be set in the VHOST?

https://github.com/owasp-modsecurity/ModSecurity/tree/v2/master

Or is this something you do not have control and can not be changed within the module, to tell apache, it is allowed within the vhost?