Christian Folini comments

Results 509 comments of


                                            Christian Folini

Block proxy requests (GET http://example.org/ HTTP/1.1)

Still hoping somebody is picking this up.

Block proxy requests (GET http://example.org/ HTTP/1.1)

During the monthly CRS chat, @theMiddleBlue volunteered to develop the proposed rule above into a working PR. Meeting minutes: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1671#issuecomment-584320407

Block proxy requests (GET http://example.org/ HTTP/1.1)

@theMiddleBlue : Do you have an update here?

Consider using extended format for logging

Nginx does not allow you to display arbitrary env variables in the logfile. About half of the useful information above can not be displayed via nginx. A workaround is to...

Compatibility for Raspberry Pi 5

Same here with Whadda WPI400 3.5" (using the LCD35-show). Works on Raspberry 3 and 4.

Bug: Premature EOF in JSON leads to status 500 instead of REQBODY_ERROR

Thank you for your swift response Martin. I thought I had seen status 500 with XML before but it was new with JSON for me. Then playing around I made...

Bug: Premature EOF in JSON leads to status 500 instead of REQBODY_ERROR

+1 on the interpretation why this might be the case. That makes sense. As for the behaviour that is preferable, I agree. Providing a PR is probably outside my capability...

Bug: Premature EOF in JSON leads to status 500 instead of REQBODY_ERROR

Wow, this is interesting. Maybe worth a separate feature! Did you or can you try out my curl call from above on 2.9.2?

Bug: Premature EOF in JSON leads to status 500 instead of REQBODY_ERROR

Thank you very much for checking this for me, @RedXanadu.

Bug: Premature EOF in JSON leads to status 500 instead of REQBODY_ERROR

I have just met this bug again and tried to fight it with `SecRequestBodyLimitAction Reject` But no effect. Debug Log: ``` ... Adding JSON argument 'glossary.GlossDiv.GlossList.GlossEntry.GlossSee' with value 'markup' Input...