Repository navigation
Conversation
…from m.setvar Port of the internal part of owasp-modsecurity#3657 to 2.x: - The Content-Disposition parser returned bare negative numbers that only showed up as "Invalid Content-Disposition header (-15)" in the logs, and -15 was shared by the duplicate filename and duplicate filename* cases. The codes are now an enum with a message table, the log line reads "(-20: duplicate filename parameter)", and the two duplicate cases get their own codes (-20, -21). Existing numeric values are unchanged because tests and log matching pin them. - l_setvar returned -1 on bad arguments; a Lua C function must return the number of results, so it now returns 0. Related to owasp-modsecurity#3655 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0181jBv5JdNQviwDzfnkf1Gy
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
2.x counterpart of the internal part of #3657:
apache2/msc_multipart.c: the Content-Disposition parser's bare negative return codes become an enum with a message table, and the error text now readsInvalid Content-Disposition header (-20: duplicate filename parameter): ...instead of(-15). The two duplicate cases that shared-15get their own codes (-20filename,-21filename*). All other numeric values are unchanged, since tests and log matching pin them;-9stays reserved (the tolerated IE escaping case) and-15is retired.apache2/msc_lua.c:l_setvarreturned-1on bad arguments. A Lua C function returns the number of results, so it now returns0.Why
The numbers alone were useless in the logs and
-15was ambiguous. Same reasoning as #3655, applied to 2.x.Tests
New
tests/regression/misc/70-multipart-cd-errors.t: duplicatefilenameand duplicatefilename*parts, asserting the new-20/-21text throughREQBODY_ERROR_MSG.Verified in a Debian bookworm container (apache2 2.4): on untouched
v2/masterboth cases fail (the log says(-15)); on this branch both pass, and the existing00-multipart-parser.t(42) and10-multipart-filenamestar.t(7) still pass.References
Related to #3655, #3657
🤖 Generated with Claude Code