Create support to t:jsonDecode

[zimmerle]

Should be very interesting to have such functionality. One utility will be to deal with JSON values in cookies...

Further information: SpiderLabs/owasp-modsecurity-crs#46

[sakalajuraj]

+1

... and to deal with standard parameters with JSON values ...

[zoltan-fedor]

+1

[adrianbn]

I'm looking forward to this too. I'm dealing with some applications that use form-url-enconded as the content-type but some of the arguments are then a JSON string. The current parser doesn't handle this well.

[alaa-ahmed]

I'm looking forward to this too. I'm dealing with an application that sends a lot of arguments including json parameters. I guess the need of this "t:jsonDecode" will increase.
is the only solution available now is to exclude the json ARGS from a triggering rules target ?

[linhart1]

Hello, how is the state of this issue today? We want to activate mod_security but with the frameworks like ExtJS etc. the applications are using JSON objects in a huge amount, so there is the question, how to modify the rules they still protect before SQL injection and similar attacks but allow the JSON objects to be passed without problems. It there any workaround until this issue will be implemented? I'm sorry if I ask stupid question, but I am a newbie to mod_security and all this stuff...

[P-a-d-r-a-i-g]

I'm also interested in finding out about this. Has any progress been make on working with JSON encoded parameters?

[zimmerle]

Hi @padraigdoran,

Most likely it will be implemented as part of ModSecurity version 3, (aka libmodsecurity).

[P-a-d-r-a-i-g]

Hi again, just wondering what's the progress since last time I commented on this back in July 2016?

With modsecurity v2.9.2 there are still a lot of false positives when you have a Content-Type "application/x-www-form-urlencoded" post with some of the ARGS being JSON data.

The general Content-Type "application/json" with ctl:requestBodyProcessor=JSON works fine.