ModSecurity icon indicating copy to clipboard operation
ModSecurity copied to clipboard

Broken Examples Between v3.04 and v3.05 + master

Open mthbrown opened this issue 4 years ago • 0 comments

Describe the bug

Hi,

While trying to run the example simple_request (under examples/using_bodies_in_chunks/), I noticed that it works fine under 3.04 but breaks under 3.05. The build steps are the same in both. Here is the difference in output. First, we have the working version (v3.04):

# ./simple_request example.conf
[163121835441.179979] [] [4] Initializing transaction
[163121835441.179979] [] [4] Transaction context created.
[163121835441.179979] [] [4] Starting phase CONNECTION. (SecRules 0)
[163121835441.179979] [] [9] This phase consists of 0 rule(s).
[163121835441.179979] [] [4] Starting phase URI. (SecRules 0 + 1/2)
[163121835441.179979] [/test.pl?param1=test&para2=test2] [4] Adding request argument (GET): name "param1", value "test"
[163121835441.179979] [/test.pl?param1=test&para2=test2] [4] Adding request argument (GET): name "para2", value "test2"
...
[163121835441.179979] [/test.pl?param1=test&para2=test2] [8] Request was relevant to be saved. Parts: 4430

and then on v3.05

# ./simple_request example.conf
Problems loading the rules...
Rules error. File: /tmp/1/ModSecurity/examples/using_bodies_in_chunks/.libs/lt-simple_request. Line: 1. Column: 8. Invalid input:  ELF

I get the same error regardless of the rule file used. The same broken behavior is seen in master as well

In the above example, I'm using the default example.conf that comes with the example:

SecDebugLog /dev/stdout
SecDebugLogLevel 9
SecRule RESPONSE_BODY "/soap:Body" "id:1,phase:5,deny"

Thanks

Logs and dumps

See above

To Reproduce

See above

Expected behavior

See above

Additional context

See above

mthbrown avatar Sep 09 '21 20:09 mthbrown