Stream inspection about modsecurity HOT 7 CLOSED

Original reporter: ivanr

from modsecurity.

ivanr: A more generic implementation would probably be a better choice. For example:

SecStreamInspect REQUEST_BODY "@pm one two" log,pass,t:none

from modsecurity.

Already implemented:

https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#REQUEST_BODY
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#RESPONSE_BODY
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#STREAM_INPUT_BODY
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#STREAM_OUTPUT_BODY

from modsecurity.

You are not understanding what stream inspection means

from modsecurity.

Thank you @csanders-git. Could you please clarify the meaning of stream inspection on this issue? And please let us know if this a feature that the community is missing.

from modsecurity.

@zimmerle could also easily explain what this means, this means treating HTTP requests incoming as a stream instead of assembling them into a buffered request.

from modsecurity.

Nice. Thanks for clarifying @csanders-git. Is this something that the CRS and / or the community are currently missing? If yes, I'll happily tag it for libModSecurity and see if we get some traction, otherwise it should be treated as #304 as it had no update / interest or for the past 5 years.

Thanks for letting us know.

from modsecurity.