Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect argument assignment for restpath with query string or extra path info #1266

Closed
cognitivegears opened this issue Jan 4, 2025 · 0 comments · May be fixed by corazawaf/coraza-spoa#164

Comments

@cognitivegears
Copy link
Contributor

Description

When using restpath with a final argument against a URL that has either a query string or extra path info, this data is incorrectly included in the argument.

Steps to reproduce

As an example, take the @restpath example from the coraza documentation (https://coraza.io/docs/seclang/operators/):

SecRule REQUEST_URI "@restpath /some/random/url/{id}/{name}" \
  "deny,chain"
  SecRule ARGS_PATH:id "!@eq %{user:session_id}" "t:none"

If we try using the value of the name parameter in a subsequent rule, and then send a query string like:

/some/random/url/123/foo?q=query

Expected result

What should happen?

In this case, the value of name should be foo.

Actual result

What happened.

The value of name here is foo?q=query

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant