Mod安全性-使用xml的请求正文

Question

在mod security中，请使用secrule request_body:https://github.com/spiderlabs/modsecurity/wiki/reference-manual#request_body，但在尝试解析XML body中Soap操作的缓冲区时，不能处理它。

保存原始请求正文。只有在使用了URLENCODED请求主体处理器的情况下，或者在强制使用URLENCODED请求主体解析器的情况下，该变量才可用，默认情况下，当检测到application/x-www-form-UrlenCoded内容类型时，会出现这种情况。

我试试这个：

SecRuleEngine on
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "text/xml" "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRule REQUEST_BODY "<password>\w{0,5}<\/password>" "id:77777771,log,deny,msg:'Week password'"

并且在post缓冲区中：

POST / HTTP/1.1
...
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: text/xml; charset=utf-8
SOAPAction: ""
Content-Length: 200

<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <SOAP-ENV:Body>
    <tns:authenticate xmlns:tns="http://.../">
      <password>abc</password>
      ...

如何检测SOAP数据的响应体并拒绝匹配expreg值？

Answer 1

我在https://serverfault.com/questions/727596/mod-security-how-to-process-text-xml-request-body中找到了一个解决方案

SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "text/xml" "phase:1,nolog,pass,ctl:requestBodyProcessor=URLENCODED,id:12345"
SecRule REQUEST_BODY "<password.*?>.{0,6}?</password>" "phase:2,t:none,deny,msg:'Very short password',status:403,auditlog,id:67890"