New rule 941360 to detect JSFuck and Hieroglyphy at PL1

[dune73]

This includes a new rule among the XSS rules and a couple of tests to go with it.

[fgsch]

Reminder: capture might be missing.

[dune73]

You're right @fgsch. Thanks for pointing this out. I'll update the PR.

[spartantri]

The space in the regex doesn't change the detection rate "@rx ![!+]\[\]"

[spartantri]

jsfuck payloads are huge and not really understandable, I'm ok to have the E part in the auditlog but I'm curious about why adding %{MATCHED_VAR}?

[dune73]

The comments carry the following remark:

ModSecurity always transforms "+" into " " with query strings and the
URLENCODE body processor
...

Did you notice that?

[spartantri]

:)

[spartantri]

The comments carry the following remark:

ModSecurity always transforms "+" into " " with query strings and the
URLENCODE body processor
...

Did you notice that?

my bad sorry :) it may be interesting to have this tested in front of a WP or some other CMS that uses lots of [] on their payloads before releasing 3.2

[fgsch]

@dune73 you might want to rebase your branch using the latest commit in v3.2/dev so the tests pass.

[dune73]

@fgsch: That's what I planned to do, but did not have time earlier. Now I did and it messed it up. So I'm planning to throw this away and do a new, clean PR.

Here is what I did. What's wrong with this?

$> git checkout jsfuck-support
$> git remote add upstream [email protected]:SpiderLabs/owasp-modsecurity-crs.git
$> git rebase upstream/v3.2/dev
$> git push origin

I see the tests passing now. But anyways, I guess I should have cherrypicked the right commit.

[fgsch]

@dune73 not sure. I normally do the following (assuming origin points to this repo):

1. git co v3.2/dev
2. git pull origin
3. git co jsfuck-support
4. git rebase v3.2/dev
5. git push -f origin

You should be able to fix this PR without closing it, for example:

1. git branch -M jsfuck-support jsfuck-support-old
2. git co v3.2/dev
3. git pull
4. git co -b jsfuck-support
5. git cherry-pick <rev for commit in jsfuck-support-old>
6. git push -f

[dune73]

That worked nicely. Thank you @fgs.

Merging now. At last. :-)