Ensure that all rules with ARGS also consider XML:*

[csanders-git]

Type of Issue

Feature Request

Description

In general we'll like to have XML considered for all rules, where it is evaluated. This can be done by adding the TARGET of XML:* to the rules. But we need to be careful to ensure only the rules that need it, get it. Starting with rules that have ARGS, is a good start

Confirmation

[x] I have removed any personal data (email addresses, IP addresses,
passwords, domain names) from any logs posted.

[spartantri]

I think that XML:/* would be the equivalent for XML to ARGS in URLENCODED, so it makes sense to have them together by default

[ghost]

Taking this issue. I think I understand it, and if that's the case, I'll have it done in two weeks...testing for a cert this weekend or would have it all sooner :)

[dune73]

Looking forward to that! Thanks.

[ghost]

Does someone have an example of what this rule would look like? The only way I can see to specifically target XML coming in is to check the Headers. E.g.:

SecRule REQUEST_HEADERS:Content-Type ^text/xml ?

or maybe

SecRule ARGS|XML:/* blahblahblah id:2000 ?

I actually don't see a mention of XML:/* anywhere in the documentation I'm looking at, although it is for 2.9.

[ghost]

@dune73 Just look at this comment:

Actually, I think this is the answer.

Anything that has the word ARGS after SecRule should, if it doesn't right now, have |XML:/* appended to it?

E.g. like the following rule:

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@detectSQLi" \

[dune73]

Could you guys please support @danehrlich1? I'm overly busy at the moment.

[ghost]

@spartantri Can you look at my comment really quickly? Think I am correct but just want someone to double check.

[spartantri]

Hi @danehrlich1 it may be better to discuss this in slack, but basically, this one is to add XML:/* to all SecRule's that have ARGS as targets of the rule.
You may find all targets with running the command below on the rule set directory:
egrep -o "SecRule ([^\s])ARGS([^\s]) " *|grep -v "XML:"
You may find rules that do check both ARGS and XML removing the -v from the previous command:
egrep -o "SecRule ([^\s])ARGS([^\s]) " *|grep "XML:"

[fzipi]

@danehrlich1 Did you made any progress with this? Do you need more help/advise?

[github-actions]

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days

[dune73]

@lifeforms volunteered to fix this issue during the monthly CRS chat.

Meeting minutes: #1671 (comment)

[dune73]

@lifeforms: Any update here?