Skip to content

Instantly share code, notes, and snippets.

@SniperSister

SniperSister/gist:96bbf89a579f763884ceb0b434d73b36

Last active June 10, 2018 17:57
Show Gist options
  • Star 14 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save SniperSister/96bbf89a579f763884ceb0b434d73b36 to your computer and use it in GitHub Desktop.
Save SniperSister/96bbf89a579f763884ceb0b434d73b36 to your computer and use it in GitHub Desktop.
Download ZIP
SA-CORE-2018-002 ruleset
Raw
gistfile1.txt
# SPECIFIC: Block #submit #validate #process #pre_render #post_render #element_validate #after_build #value_callback parameters
SecRule REQUEST_FILENAME "(index\.php|\/$)" "chain,id:003294,t:lowercase,t:none,t:utf8toUnicode,t:urlDecodeUni,t:urldecode,block"
SecRule REQUEST_METHOD "^(GET|POST|HEAD)$" chain
SecRule ARGS_NAMES|REQUEST_COOKIES_NAMES "^\#(submit|validate|pre_render|post_render|element_validate|after_build|value_callback|process)$|\[(?:\'|\")?#(submit|validate|pre_render|post_render|element_validate|after_build|value_callback|process)"
# GENERIC: Block all parameters starting with #
SecRule REQUEST_FILENAME "(index\.php|\/$)" "chain,id:003309,t:lowercase,t:none,t:utf8toUnicode,t:urlDecodeUni,t:urldecode,block"
SecRule REQUEST_METHOD "^(GET|POST|HEAD)$" chain
SecRule ARGS_NAMES|REQUEST_COOKIES_NAMES "^\#|\[(?:\'|\")?\#.*\]"
@decafgeek
Copy link

decafgeek commented Apr 26, 2018 •
edited

@silvaf6 - it's a ruleset for mod_security

@straav
Copy link

straav commented Apr 26, 2018

So in light of SA-CORE-2018-004 would adding destination to the pattern of chain ID 003294 add coverage?

@ylapin
Copy link

ylapin commented Apr 29, 2018

it's this good for drupalgeddon3 ??

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment