|
5 | 5 | or the CRS mailinglist at
|
6 | 6 | * https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
|
7 | 7 |
|
8 |
| -== Version 3.0.1 - 4/16/2017 == |
9 |
| - |
10 |
| -* As of CRS version 3.0.1, support has been added for the application/soap+xml MIME |
11 |
| - type by default, as specified in RFC 3902. OF IMPORTANCE, application/soap+xml is |
12 |
| - indicative that XML will be provided. In accordance with this, ModSecurity's XML |
13 |
| - Request Body Processor should also be configured to support this MIME type. Within |
14 |
| - the ModSecurity project, commit 5e4e2af |
15 |
| - (https://github.com/SpiderLabs/ModSecurity/commit/5e4e2af7a6f07854fee6ed36ef4a381d4e03960e) |
16 |
| - has been merged to support this endevour. However, if you are running a modified or |
17 |
| - preexisting version of the modsecurity.conf provided by this repository, you may |
18 |
| - wish to upgrade rule '200000' accordingly. The rule now appears as follows: |
| 8 | +== Version 3.0.1 - 5/FIXME/2017 == |
| 9 | + |
| 10 | + * As of CRS version 3.0.1, support has been added for the application/soap+xml MIME |
| 11 | + type by default, as specified in RFC 3902. OF IMPORTANCE, application/soap+xml is |
| 12 | + indicative that XML will be provided. In accordance with this, ModSecurity's XML |
| 13 | + Request Body Processor should also be configured to support this MIME type. Within |
| 14 | + the ModSecurity project, commit 5e4e2af |
| 15 | + (https://github.com/SpiderLabs/ModSecurity/commit/5e4e2af7a6f07854fee6ed36ef4a381d4e03960e) |
| 16 | + has been merged to support this endevour. However, if you are running a modified or |
| 17 | + preexisting version of the modsecurity.conf provided by this repository, you may |
| 18 | + wish to upgrade rule '200000' accordingly. The rule now appears as follows: |
19 | 19 |
|
20 | 20 | ```
|
21 | 21 | SecRule REQUEST_HEADERS:Content-Type "(?:application(?:/soap\+|/)|text/)xml" \
|
22 | 22 | "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
|
23 | 23 | ```
|
24 | 24 |
|
| 25 | + * Fixed documentation errors in RESPONSE-999-... (Chaim Sanders) |
| 26 | + * Reduced FPs on 942190 by adding a word boundary to regex (Franziska Bühler) |
| 27 | + * Reduced FPs on 932150 by removing keyword reset (Franziska Bühler) |
| 28 | + * Tidied exceptions in 930100 (Roberto Paprocki) |
| 29 | + * Reduced FPs for 920120 by splitting into stricter sibling (Franziska Bühler) |
| 30 | + * Simplified some Drupal rule exclusions (Damien McKenna, Christian Folini) |
| 31 | + * Extended KNOWN_BUGS with remarks on JSON support on Debian (Franziska Bühler) |
| 32 | + * Updated README to add gitter support (Chaim Sanders) |
| 33 | + * Clarified DoS documentation for static extensions (Roberto Paprocki) |
| 34 | + * Added application/octet-stream to allowed content types (Christian Folini) |
| 35 | + * Typo in 942220 alert message (Chaim Sanders, @bossloper) |
| 36 | + * Moved referrer check of 941100 into new PL2 rule (Franziska Bühler) |
| 37 | + * Closed multiple @pmf evasions via lowercase transformation (Roberto Paprocki) |
| 38 | + * Clarified libinjection bundling in INSTALL file (@cjdp) |
| 39 | + * Reduced FPs via Wordpress Rule Exclusions (Walter Hop) |
| 40 | + * Support for RFC 3902 (Content Type application/soap+xml; Christoph Hansen) |
| 41 | + * Bugfix in 942410 regex (Christian Folini) |
| 42 | + * Reduced FPs for 942360 (Walter Hop) |
| 43 | + * Reduced FPs for 941120 by restricting event handler names (Franziska Bühler) |
| 44 | + * Extended 931000 with scheme "file" to fix false negative (Federico Schwindt) |
| 45 | + * Extended 905100 and 905110 for HTTP/2.0 (includes bugfix, Christoph Hansen) |
| 46 | + * Moved 941150 from PL1 to PL2; includes Bugfix for rule (Christian Folini) |
| 47 | + * Updated documentation for 920260 (Chaim Sanders) |
| 48 | + * Bugfix in upgrade.py (Victor Hora) |
| 49 | + * Fixed FP in RCE rule 932140 (Walter Hop) |
| 50 | + * Fixed comment for arg limit check rule 920370 (Christian Folini) |
| 51 | + * Created CONTRIBUTORS file |
| 52 | + * Added Christoph Hansen (emphazer) to CONTRIBUTORS file |
| 53 | + * Added Franziska Bühler (franbuehler) to CONTRIBUTORS file |
| 54 | + |
| 55 | + |
25 | 56 |
|
26 | 57 | == Version 3.0.0 - 11/10/2016 ==
|
27 | 58 |
|
|
0 commit comments