Skip to content

Add ARGS JSON body test configuration#35

Open
0xst3m wants to merge 1 commit intoowasp-modsecurity:mainfrom
0xst3m:add-args-json-test
Open

Add ARGS JSON body test configuration#35
0xst3m wants to merge 1 commit intoowasp-modsecurity:mainfrom
0xst3m:add-args-json-test

Conversation

@0xst3m
Copy link
Copy Markdown

@0xst3m 0xst3m commented Mar 5, 2026

Summary

The existing ARGS test cases (CONF_002_TARGET_ARGS_A-GET and CONF_002_TARGET_ARGS_B-POST) only cover application/x-www-form-urlencoded bodies. This PR adds coverage for JSON request bodies, which are processed through a different code path via ctl:requestBodyProcessor=JSON.

Changes

Added config_tests/CONF_009_TARGET_ARGS_JSON.yaml which tests:

  • Targets: ARGS (any key) and ARGS:foo (specific key)
  • Phases: 2, 3, and 4
  • Method: POST with Content-Type: application/json
  • Operator: @contains attack

The test sends {"foo": "attack"} as the request body, relying on the existing JSON processor rule (id:200001 in modsecurity.conf) to populate ARGS from the parsed JSON.

Test Results

All 6 generated rules passed on mod_security2 (Apache)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant