Modsecurity: How can I consolidate all SecRules to ignore aparameter

Asked Jan 14 '16 at 00:02

Active Jan 14 '16 at 06:49

Viewed 157 times

How can I consolidate all or any secrule to ignore a parameter with modsecurity?

I have a form that will always flag as XSS, unfortunately, my rule list is getting rather large as the site grows.

I now have a list of about 10 or so rules ignoring the parameter bacon.tuna

SecRuleUpdateTargetById 981176 !ARGS:/^bacon.tuna/

I noticed that one of those rules wasn't white listed came back up and I was curious to know if there was a way to make this simpler.

Maybe something like SecRuleUpdateTargetById * !ARGS:/^bacon.tuna/ ?

Thanks in advance

edited Jan 14 '16 at 06:49

Eko Junaidi Salam

asked Jan 14 '16 at 00:02

LUser

I doubt your parameter is named bacon.tuna. What is the _real_ parameter name? What rules are you setting off? – Michael Hampton Jan 14 '16 at 00:20
The parameter is custom to our site. The parameter is event.save – LUser Jan 14 '16 at 00:31
The param is taking in a form that has html which will flag as xss of course . but I have been trying to whitelist these forms – LUser Jan 14 '16 at 00:32
1

Your example rule doesn't check ARGS. You may be able to use `SecRuleUpdateTargetByTag` if they share a common tag. – user9517 Jan 14 '16 at 07:24
This worked! Make an answer for this to accept credit for it. – LUser Jan 15 '16 at 21:51

0 Answers0