diff --git a/plugins/sogo-rule-exclusions-before.conf b/plugins/sogo-rule-exclusions-before.conf index 8420a80..bf9e045 100644 --- a/plugins/sogo-rule-exclusions-before.conf +++ b/plugins/sogo-rule-exclusions-before.conf @@ -63,6 +63,10 @@ SecRule REQUEST_FILENAME "@streq /SOGo/connect" \ pass,\ t:none,\ nolog,\ + ctl:ruleRemoveTargetById=920273;ARGS:userName,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.userName,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:password,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.password,\ ver:'sogo-rule-exclusions-plugin/1.0.1'" @@ -89,22 +93,36 @@ SecRule REQUEST_FILENAME "@beginsWith /SOGo" \ # Writing or saving an email # Email content can be anything +# Some rules are disabled for all ARGS since the paramater name keeps on changing SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Mail/[0-9]/folderDrafts/newDraft[0-9\-]+/(?:send|save)$" \ "id:9520104,\ phase:1,\ pass,\ t:none,\ nolog,\ - ctl:ruleRemoveTargetById=942131;ARGS:from,\ - ctl:ruleRemoveTargetById=942131;ARGS:json.from,\ - ctl:ruleRemoveTargetById=942131;ARGS:json.to.array_0,\ - ctl:ruleRemoveTargetById=942131;ARGS:to.array_0,\ + ctl:ruleRemoveTargetById=920273;ARGS,\ + ctl:ruleRemoveTargetById=942131;ARGS,\ + ctl:ruleRemoveTargetById=942432;ARGS,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.subject,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.text,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:subject,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:text,\ ver:'sogo-rule-exclusions-plugin/1.0.1'" +# Entering an invalid password on login +SecRule REQUEST_FILENAME "@streq /SOGo/so/passwordRecoveryEnabled" \ + "id:9520105,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetById=920273;ARGS:userName,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.userName,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ + ver:'sogo-rule-exclusions-plugin/1.0.1'" # # [ SOGo Settings ] # @@ -116,6 +134,8 @@ SecRule REQUEST_FILENAME "@streq /SOGo/so/changePassword" \ pass,\ t:none,\ nolog,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.oldPassword,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.newPassword,\ ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:oldPassword,\ @@ -123,29 +143,30 @@ SecRule REQUEST_FILENAME "@streq /SOGo/so/changePassword" \ ver:'sogo-rule-exclusions-plugin/1.0.1'" # When changing settings in SOGo +# Some rules are disabled for all ARGS_NAMES or ARGS since the +# paramater keeps on changing and isn't predictable. SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Preferences/save$" \ "id:9520111,\ phase:1,\ pass,\ t:none,\ nolog,\ - ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ - ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ + ctl:ruleRemoveById=921180,\ + ctl:ruleRemoveTargetById=920273;ARGS,\ + ctl:ruleRemoveTargetById=931130;ARGS,\ + ctl:ruleRemoveTargetById=932236;ARGS,\ + ctl:ruleRemoveTargetById=942131;ARGS,\ + ctl:ruleRemoveTargetById=942432;ARGS,\ + ctl:ruleRemoveTargetById=920273;ARGS_NAMES,\ + ctl:ruleRemoveTargetById=942432;ARGS_NAMES,\ ctl:ruleRemoveTargetById=920272;ARGS:defaults.SOGoTimeFormat,\ - ctl:ruleRemoveTargetById=920273;ARGS:defaults.SOGoTimeFormat,\ ctl:ruleRemoveTargetById=920272;ARGS:defaults.SOGoLongDateFormat,\ - ctl:ruleRemoveTargetById=920273;ARGS:defaults.SOGoLongDateFormat,\ ctl:ruleRemoveTargetById=920272;ARGS:defaults.SOGoShortDateFormat,\ - ctl:ruleRemoveTargetById=920273;ARGS:defaults.SOGoShortDateFormat,\ ctl:ruleRemoveTargetById=920272;ARGS:json.defaults.SOGoTimeFormat,\ - ctl:ruleRemoveTargetById=920273;ARGS:json.defaults.SOGoTimeFormat,\ ctl:ruleRemoveTargetById=920272;ARGS:json.defaults.SOGoLongDateFormat,\ - ctl:ruleRemoveTargetById=920273;ARGS:json.defaults.SOGoLongDateFormat,\ ctl:ruleRemoveTargetById=920272;ARGS:json.defaults.SOGoShortDateFormat,\ - ctl:ruleRemoveTargetById=920273;ARGS:json.defaults.SOGoShortDateFormat,\ - ctl:ruleRemoveTargetById=931130;ARGS,\ - ctl:ruleRemoveTargetById=932236;ARGS,\ - ctl:ruleRemoveTargetById=942131;ARGS,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ver:'sogo-rule-exclusions-plugin/1.0.1'" # @@ -154,21 +175,20 @@ SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Preferences/save$" \ # When creating/modifying contacts # Adding websites for contacts +# Some rules are disabled for all ARGS since the paramater keeps on changing SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Contacts/[^/]+/[^/]+\.vcf/saveAsContact$" \ "id:9520120,\ phase:1,\ pass,\ t:none,\ nolog,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.urls.array_0.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.urls.array_1.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.urls.array_2.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.urls.array_3.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.urls.array_4.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.urls.array_5.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.urls.array_6.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.urls.array_7.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:urls.urls.value,\ + ctl:ruleRemoveTargetById=920273;ARGS,\ + ctl:ruleRemoveTargetById=931130;ARGS,\ + ctl:ruleRemoveTargetById=942432;ARGS:id,\ + ctl:ruleRemoveTargetById=942432;ARGS:json.id,\ + ctl:ruleRemoveTargetById=932236;ARGS_NAMES:id,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ver:'sogo-rule-exclusions-plugin/1.0.1'" # When modifying properties for Addressbook @@ -179,8 +199,21 @@ SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Contacts/[^/]+/save$" \ pass,\ t:none,\ nolog,\ + ctl:ruleRemoveTargetById=920273;ARGS:cardDavURL,\ ctl:ruleRemoveTargetById=931130;ARGS:cardDavURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:cardDavURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:id,\ + ctl:ruleRemoveTargetById=942432;ARGS:id,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.cardDavURL,\ ctl:ruleRemoveTargetById=931130;ARGS:json.cardDavURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:json.cardDavURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.id,\ + ctl:ruleRemoveTargetById=942432;ARGS:json.id,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.owner,\ + ctl:ruleRemoveTargetById=920273;ARGS:owner,\ + ctl:ruleRemoveTargetById=932236;ARGS_NAMES:id,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ver:'sogo-rule-exclusions-plugin/1.0.1'" # @@ -189,41 +222,21 @@ SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Contacts/[^/]+/save$" \ # When creating/modifying a calendar task # Attaching external URLs to a calendar task -SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Calendar/[^/]+/[^/]+\.ics/(?:saveAsTask|save)$" \ +# Some rules are disabled for all ARGS because the paramater keeps on changing +SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Calendar/[^/]+/[^/]+\.ics/(?:occurence[0-9]+/save|save|saveAsAppointment|saveAsTask)$" \ "id:9520130,\ phase:1,\ pass,\ t:none,\ nolog,\ - ctl:ruleRemoveTargetById=931130;ARGS:attachUrls.attachUrls.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_0.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_1.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_2.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_3.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_4.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_5.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_6.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_7.value,\ - ver:'sogo-rule-exclusions-plugin/1.0.1'" - -# When creating/modifying a calendar event -# Attaching external URLs to a calendar event -SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Calendar/[^/]+/[^/]+\.ics/(?:saveAsAppointment|occurence[0-9]+/save)$" \ - "id:9520131,\ - phase:1,\ - pass,\ - t:none,\ - nolog,\ - ctl:ruleRemoveTargetById=931130;ARGS:attachUrls.attachUrls.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_0.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_1.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_2.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_2.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_3.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_4.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_5.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_6.value,\ - ctl:ruleRemoveTargetById=931130;ARGS:json.attachUrls.array_7.value,\ + ctl:ruleRemoveTargetById=920273;ARGS,\ + ctl:ruleRemoveTargetById=931130;ARGS,\ + ctl:ruleRemoveTargetById=942432;ARGS,\ + ctl:ruleRemoveTargetById=920273;ARGS_NAMES:json.$hasAlarm,\ + ctl:ruleRemoveTargetById=920273;ARGS_NAMES:$hasAlarm,\ + ctl:ruleRemoveTargetById=932236;ARGS_NAMES:id,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ver:'sogo-rule-exclusions-plugin/1.0.1'" # When modifying properties for Calendars @@ -234,16 +247,41 @@ SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Calendar/[^/]+/save$" \ pass,\ t:none,\ nolog,\ + ctl:ruleRemoveTargetById=920273;ARGS:color,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.color,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.name,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.owner,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.urls.webDavICSURL,\ ctl:ruleRemoveTargetById=931130;ARGS:json.urls.webDavICSURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:json.urls.webDavICSURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.urls.webDavXMLURL,\ ctl:ruleRemoveTargetById=931130;ARGS:json.urls.webDavXMLURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:json.urls.webDavXMLURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.urls.webDavURL,\ ctl:ruleRemoveTargetById=931130;ARGS:json.urls.webDavURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:json.urls.webDavURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.urls.calDavURL,\ ctl:ruleRemoveTargetById=931130;ARGS:json.urls.calDavURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:json.urls.calDavURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.urls.webCalendarURL,\ ctl:ruleRemoveTargetById=931130;ARGS:json.urls.webCalendarURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.urls.webCalendarURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:name,\ + ctl:ruleRemoveTargetById=920273;ARGS:owner,\ + ctl:ruleRemoveTargetById=920273;ARGS:urls.webDavICSURL,\ ctl:ruleRemoveTargetById=931130;ARGS:urls.webDavICSURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:urls.webDavXMLURL,\ ctl:ruleRemoveTargetById=931130;ARGS:urls.webDavXMLURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:urls.webDavXMLURL,\ ctl:ruleRemoveTargetById=931130;ARGS:urls.webDavURL,\ + ctl:ruleRemoveTargetById=920273;ARGS:urls.calDavURL,\ ctl:ruleRemoveTargetById=931130;ARGS:urls.calDavURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:urls.calDavURL,\ + ctl:ruleRemoveTargetById=942432;ARGS:urls.webDavICSURL,\ ctl:ruleRemoveTargetById=931130;ARGS:urls.webCalendarURL,\ + ctl:ruleRemoveTargetById=932236;ARGS_NAMES:id,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ver:'sogo-rule-exclusions-plugin/1.0.1'" # When adding a remote web calendar @@ -253,8 +291,12 @@ SecRule REQUEST_FILENAME "@rx ^/SOGo/so/[^/]+/Calendar/addWebCalendar$" \ pass,\ t:none,\ nolog,\ + ctl:ruleRemoveTargetById=920273;ARGS:json.url,\ ctl:ruleRemoveTargetById=931130;ARGS:json.url,\ + ctl:ruleRemoveTargetById=920273;ARGS:url,\ ctl:ruleRemoveTargetById=931130;ARGS:url,\ + ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ + ctl:ruleRemoveTargetById=920273;REQUEST_BODY,\ ver:'sogo-rule-exclusions-plugin/1.0.1'" # diff --git a/tests/regression/sogo-rule-exclusions-plugin/9520101.yaml b/tests/regression/sogo-rule-exclusions-plugin/9520101.yaml index b9e87b0..f1e95b5 100644 --- a/tests/regression/sogo-rule-exclusions-plugin/9520101.yaml +++ b/tests/regression/sogo-rule-exclusions-plugin/9520101.yaml @@ -23,4 +23,5 @@ tests: { "userName": "postmaster@example.com", "password": "