Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit 156341e

Browse files
authored
Update KNOWN_BUGS with SOAP-XML Data
Updated KNOWN_BUGS as suggested by @dune73 dealing with a better home for the details surrounding ModSecurity implementation compliance with SOAP-XML.
1 parent 57baca5 commit 156341e

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

KNOWN_BUGS

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,17 @@ or the CRS mailinglist at
3333
JSON support was enabled in Debian's package version 2.8.0-4 (Nov 2014).
3434
You can either use backports.debian.org to install the latest ModSecurity
3535
release or disable rule id 200001.
36+
* As of CRS version 3.0.1, support has been added for the application/soap+xml MIME
37+
type by default, as specified in RFC 3902. OF IMPORTANCE, application/soap+xml is
38+
indicative that XML will be provided. In accordance with this, ModSecurity's XML
39+
Request Body Processor should also be configured to support this MIME type. Within
40+
the ModSecurity project, commit 5e4e2af
41+
(https://github.com/SpiderLabs/ModSecurity/commit/5e4e2af7a6f07854fee6ed36ef4a381d4e03960e)
42+
has been merged to support this endevour. However, if you are running a modified or
43+
preexisting version of the modsecurity.conf provided by this repository, you may
44+
wish to upgrade rule '200000' accordingly. The rule now appears as follows:
45+
46+
```
47+
SecRule REQUEST_HEADERS:Content-Type "(?:application(?:/soap\+|/)|text/)xml" \
48+
"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
49+
```

0 commit comments

Comments
 (0)