8000 fix: Replaced MATCHED_VAR in logdata argument by a real target name by airween · Pull Request #3543 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

fix: Replaced MATCHED_VAR in logdata argument by a real target name #3543

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 11, 2024

Conversation

airween
Copy link
Contributor
@airween airween commented Feb 10, 2024

This PR fixes the listed behaviors under issue #3428. The solution is similar like in case of #3409.

changelog comment:

fix: Added missing target name to logdata (942521 PL2, 943110 PL1, 943120 PL1) (Ervin Hegedüs)

Fixes #3428

@airween airween requested review from theseion and dune73 February 10, 2024 09:24
Copy link
Contributor
@theseion theseion left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Out of curiosity, doesn't the same issue also affect MATCHED_VAR?

@airween
Copy link
Contributor Author
airween commented Feb 10, 2024

Out of curiosity, doesn't the same issue also affect MATCHED_VAR?

Sorry, what "same issue" do you think? Is there any other issue that affects?

@theseion
Copy link
Contributor

Consider this:

logdata:'Matched Data: %{TX.0} found within %{TX.942521_MATCHED_VAR_NAME}: %{MATCHED_VAR}',\

Why does this work for MATCHED_VAR? Why is it not necessary to do this?

logdata:'Matched Data: %{TX.0} found within %{TX.942521_MATCHED_VAR_NAME}: %{TX.942521_MATCHED_VAR}',\

@M4tteoP
Copy link
Member
M4tteoP commented Feb 10, 2024

This workaround has been first introduced with #2347. I think that MATCHED_VAR is indeed affected, being populated by the last match of the chain. In the mentioned PR, the final match was performed against MATCHED_VAR or MATCHED_VARS variables therefore the final value of MATCHED_VAR is still consistent.

So, to the best of my understanding, It should be something to always look at when relying on this workaround. For example, looking at 943120, the final rule of the chain is SecRule &REQUEST_HEADERS:Referer "@eq 0" and MATCHED_VAR would result being always logged as 0. In that case, saving the initial MATCHED_VAR would provide a more meaningful log message.

@airween
Copy link
Contributor Author
airween commented Feb 11, 2024

Ah, thanks!

Why does this work for MATCHED_VAR? Why is it not necessary to do this?

I think this is because of the engines behavior. @M4tteoP explained here the reason, I can add only my notes regarding this:

the final match was performed against MATCHED_VAR or MATCHED_VARS variables

that MATCHED_VARS is not affected! Please take a look to this comment at the original issue.

So we can try to use this variable, but even though we started using this kind of workaround, I think it would be better to use it consistently.

I just wanted to fix that issue before the release.

And may be we (I) should add the check against this behavior to crs-rules-check. I don't know if it would have any effect to release or not.

@theseion
Copy link
Contributor

@airween I'm sure you checked that the workaround works for you, so I'll merge now. However, I believe it would be good to check for the use of these variables in conjunction with chain rules and to require that the workaround is being applied.

@theseion theseion merged commit fa4db98 into coreruleset:v4.0/dev Feb 11, 2024
@airween
Copy link
Contributor Author
airween commented Feb 11, 2024

I'm sure you checked that the workaround works for you

I didn't check but I found a rule which used that, namely 942440. In that case this behavior did not appear, I checked that. Anyway, we started to use this type of solution, so I suggest we keep on this way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Enhance 3 remaining rules (942521, 943110, 943120) where affected parameter is not visible in alert message
3 participants
0