owasp-modsecurity-crs | OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository) | Cybersecurity library

The SecRuleUpdateTargetById rule exclusion you provided looks good to me.

To be clear, the effect of that rule exclusion is:

• Rule 941170 no longer applies to the screen argument
• Rule 941170 still applies to all other arguments as usual
• All other rules still apply to all arguments, including screen, as usual

Is there a reason you're not happy with this?

If you're running a super-high security setup which means that the SecRuleUpdateTargetById rule exclusion is too coarse, two suggestions I would make:

• If appropriate for your web application, limit the rule exclusion for rule 941170 to only apply to the screen argument and only for a given location (for example, only for requests to /login.php)

• Limit the rule exclusion for rule 941170 to only apply to the screen argument and only when screen begins with the string data:image/jpeg;base64

You could even combine both of those suggestions to be extremely specific.

If either, or both, of those sound applicable to your situation, let me know if you would like help to put those rule exclusions together.

Also, what paranoia level are you currently running in, out of interest?

Regarding your suggestion to modify rule 941170's regular expression, it's a bad idea to directly modify third-party rules, such as the Core Rule Set rules. You essentially end up creating your own fork of the rule set, and you're left with the responsibility for maintaining any modifications you make. Upgrading the rule set would become difficult: you would have to remember to keep re-applying, and possibly change, your modifications. In short: rule exclusions are the way to go!

The second rule exclusion described above may look something like this:

Looking at the part of the regular expression for rule 920100 that deals with the CONNECT method:

Your exclusion rule is almost correct. But the & in front of REQUEST_HEADERS:Transfer-Encoding is missing.

&REQUEST_HEADERS:Transfer-Encoding (with the ampersand) counts the numbers of Transfer-Encoding headers.

Without the & (ampersand), the content of the Transfer-Encoding header is compared to the value 0.

I'm not sure whether you really want to remove the rule in general for nonexistent Transfer-Encoding headers, or whether you want to restrict this to certain clients (IP addresses, user agents, ...). But that is your decision. I don't know exactly what you need.

But in any case, this exclusion rule will now work.

By the way: The current OWASP Core Rule Set repository is https://github.com/coreruleset/coreruleset/.

I was trying to solve the issue with a ModSecurity exception. It turns out, the answer was simply adding modsecurity off to the location.

If it helps anyone else, here is my GDPR snippet that include in my site definitions:

Easy way in Python using json module