Whitelist rule not respected (ARGS_VAR)?

Question

Whitelist rule not respected (ARGS_VAR)?

Napsty opened this issue 2 years ago · comments

Probably more a question (once again) and probably not a bug. But I have this whitelist entry, covering multiple rules on a certain URI:

BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|BODY";
BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|BODY|NAME";
BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|ARGS|NAME";

Yet there were still some blocks happening, here's the nx_util output:

# total_count:4 (12.9%), peer_count:1 (50.0%) | sql keywords
BasicRule wl:1000 "mz:$URL:/secure/AssignIssue!default.jspa|$ARGS_VAR:returnurl";

I thought that $ARGS_VAR is covered by ARGS|NAME? Or am I mistken?

Giovanni · Answer 1 · Fri Nov 11 2022 17:12:07 GMT+0800 (China Standard Time)

it does, but is the equivalent of ARGS not ARGS|NAME
https://github.com/nbs-system/naxsi/wiki/matchzones-bnf#match-zone

Claudio Kuenzler · Answer 2 · Fri Nov 11 2022 18:40:22 GMT+0800 (China Standard Time)

So in this case I need to create an additional rule?

BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|BODY";
BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|BODY|NAME";
BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|ARGS"; <-- new
BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|ARGS|NAME";

I thought the rule would match both, as discussed in #44 (comment) ? Or is it the other way around?

Giovanni · Answer 3 · Fri Nov 11 2022 21:39:51 GMT+0800 (China Standard Time)

just combine BODY|ARGS and avoid an additional line

Giovanni · Answer 4 · Fri Nov 11 2022 21:41:01 GMT+0800 (China Standard Time)

Also 1008-1011 is an illegal identifier. https://github.com/nbs-system/naxsi/wiki/whitelists-bnf#whitelisted-id-wl

Claudio Kuenzler · Answer 5 · Fri Nov 11 2022 21:42:59 GMT+0800 (China Standard Time)

just combine BODY|ARGS and avoid an additional line

will do, thanks again

Also 1008-1011 is illegal

Thanks for the hint! Config check didn't complain so I assumed this would work. ;-)

Giovanni · Answer 6 · Fri Nov 11 2022 21:45:23 GMT+0800 (China Standard Time)

i think it took only 1008 as id.

Claudio Kuenzler · Answer 7 · Sat Nov 19 2022 15:42:59 GMT+0800 (China Standard Time)

Using the new "ANY" match zone, could the following snippet:

BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|BODY";
BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|BODY|NAME";
BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|ARGS"; <-- new
BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|ARGS|NAME";

therefore be replaced with:

BasicRule wl:1000,1008-1011,1200,1205 "mz:$URL:/secure/AssignIssue!default.jspa|ANY";

?

Giovanni · Answer 8 · Sat Nov 19 2022 18:20:50 GMT+0800 (China Standard Time)

yes., but as said before 1008-1011 is illegal.