ModSecurity

ModSecurity copied to clipboard

feature request: cache transformed value

4

In our case (180 rules), after cache, the performance increase about 5% - 10%. Currently, we use a map on Transactions, and the key is key + path.

liudongmiao

ModSecurity should able to analyse gRPC request body.

5

**Expected behavior** ModSecurity should able to analyse gRPC request body. gRPC is binary protocol, ModSecurity is not able to parse it and hence, not able to block simple injection.

pandey-adarsh147

nginx worker hangs while logging to the audit log

20

Hello, In our company we use **ModSecurity** in our nginx. We noticed that sometimes **nginx** workers just hangs and do nothing, however when we `strace` the process (or attach the...

wutchzone

Fix memory leak in lmdb.cc + improve performance while reading collections in resolveMultiMatches

4

What have been done ? 1. Removed memory leak in lmdb.cc while passing data from MDB_val to VariableValue: - added new VariableValue constructors for rvalue strings - decreased memory footprint...

ziollek

REQUEST_BODY is set when it should not according to documentation

16

I think there is a mismatch between modsec-3 implementation and modsec documentation. According to https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#request_body the REQUEST_BODY variable should be set only under 2 conditions. 1. If the WWWFormURLEncoded body...

mirkodziadzka-avi

## Description Previously, calls to msre_generate_target_string() from inside update_rule_target_ex() would accumulate memory allocations from ruleset memory pool that is never released. For reasonably large exclusion lists memory consumption grows exponentially...

vkrivopalov

We are using ModSecurity at a download service for large files (hundreds of MB to multiple GB) to manage usage quotas (currently the number of connections per IP address). ModSecurity...

Nakaner

Can I use m.getvar("RULE.id") to get the current rule id in 3.x version?

4

Can I use `m.getvar("RULE.id")` to get the current rule id in the 3.x version? It is normal for me to use `m.getvar("REMOTE_ADDR")`. How do I get the rule in the...

hygeiavvv

Multipart: Final boundary missing.

24

I have a customer uploading a 200mb mp4 file through AJAX in Drupal. With mod_security2 enabled, this results in a stopped 57% upload. The following is visible in the debug...

tomsommer

Users cannot block /aux/ using IIS.

4

When a user using ModSecurity for IIS tries to deny access to a reserved folder URL - the log indicates that it blocked the site successfully, but a 500-level error...

csanders-git