Set correct line end in case of MULTIPART_PART_HEADER
variable
#2870
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Looks like variable
MULTIPART_PART_HEADER
variable contains the EOL characters.This can lead false positive, and we (CRS team) discovered with help of an issue 3046. There is a full detail of the unexpected behavior, with many examples.
Here is what I get in the debug.log:
As it seems, the log contains the
Added part header line:
with the header of the part of multipart payload. Both lines ended with EOL - but not as like in case ofAdded part header
.After the fix, the same part of debug log is this:
The lines are without
\r\n
, and both variables (part header and part header line) are the same. This is the same behavior as in case of mod_security2 (this is why I thought it's an unexpected behavior).I added a new test case, anyone can check the regression test if picks up that commit.