deps: zentinel-modsec 0.2.0 -> 0.3.0 (JSON body inspection) - #6
Merged
Conversation
Picks up JSON request body inspection (zentinel-modsec#24), which is the reason this bump matters rather than being routine. Before 0.3.0 a JSON body fell through to the urlencoded parser, so ARGS was empty for every JSON request and `SecRule ARGS "@detectSQLi"` had nothing to look at. This agent sits in front of APIs that are overwhelmingly JSON, so that was most of the traffic it exists to protect. Also gains per-transaction ctl: actions (#23) -- so CRS exclusions written as `ctl:ruleRemoveTargetById=942100;ARGS:json.token` now apply -- and unusable @rx patterns reported at load instead of silently never matching (#25). The engine went to a minor version deliberately: this changes which requests are blocked in both directions, and the caret requirement on "0.2" would have picked up a patch silently. Extends tests/engine_behaviour.rs with the JSON cases: SQLi in a JSON body, the same payload in a form body as a control, a nested object, clean JSON passing, and an empty JSON body not tripping a REQBODY_ERROR rule -- routine on POST and DELETE, and a false positive if mishandled. 8 tests, full suite green, clippy and fmt clean. Operators should re-test their ruleset against representative traffic: JSON bodies are now inspected where they were not, so genuine detections will appear that did not before, along with any false positives a ruleset has for JSON traffic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Picks up zentinel-modsec 0.3.0.
Why this one matters
Before 0.3.0, a JSON request body fell through to the urlencoded parser, which extracts nothing usable from it.
ARGSwas empty for every JSON request, soSecRule ARGS "@detectSQLi"— CRS 942100, the core SQLi rule — had nothing to inspect:This agent sits in front of APIs that are overwhelmingly JSON. That was most of the traffic it exists to protect.
Also gained: per-transaction
ctl:actions, so CRS exclusions written asctl:ruleRemoveTargetById=942100;ARGS:json.tokennow actually apply; and unusable@rxpatterns reported at load rather than silently never matching.Why a minor version, not a patch
The engine went to
0.3.0deliberately. This changes which requests are blocked in both directions, and the caret requirement on"0.2"would have picked up a patch release silently. For a WAF that is not a routine dependency bump.Verification
tests/engine_behaviour.rsgains the JSON cases. That file exists because this crate's own tests cover its configuration and protocol surface but not blocking decisions — an engine bump could otherwise change security behaviour with nothing here to catch it.Added: SQLi in a JSON body, the same payload in a form body as a control (without it, the JSON assertion would pass just as well against an engine that blocked everything), a nested object, clean JSON passing, and an empty JSON body not tripping a
REQBODY_ERRORrule — routine on POST and DELETE, and a false positive if mishandled.8 tests, full suite green, clippy and fmt clean.
For operators
Re-test your ruleset against representative traffic. JSON bodies are now inspected where they were not, so genuine detections will appear that did not before — along with any false positives your ruleset has for JSON traffic that were previously invisible because the body was never parsed.