validate_quotes and flag_invalid_quoting about modsecurity HOT 3 CLOSED

Yes. We expected to see false-positives with this flag. However this is necessary since we had cases where people try to attack Apps sending SQLi data inside the filename=.

We cannot remove this checking because the multipart code is not being checked by RuleEngine. This is work mod_security was designed.
You could try add some exceptions to work with this false-positive.

from modsecurity.

I'm adding new variables MULTIPART_FILENAME and MULTIPART_NAME. I think we can update the CRS to use those variables and remove this checking in the future

from modsecurity.

Done. However before remove this checking we must update CRS and see if the rules will do the job. I will check with Ryan (CRS lead) if he can update it for 2.7.3 or not.

from modsecurity.