Skip to content

Commit 9ae6871

Browse files
joostdekeijzerjoostdekeijzer
committed
Updated x-http-method-override rules for rest-api usage:
- 9507144 without permalinks - 9507146 With permalinks 1. Added test that REQUEST_METHOD *must be* POST 2. Added support for DELETE override 3. Added tests Please note that the WordPress developer docs state that any WordPress API call may use the x-http-method-override-header (see https://developer.wordpress.org/rest-api/using-the-rest-api/global-parameters/#_method-or-x-http-method-override-header) With current implementation eg. Custom Post Types are not supported.
1 parent e4dbddb commit 9ae6871

File tree

3 files changed

+202
-6
lines changed

3 files changed

+202
-6
lines changed

‎plugins/wordpress-rule-exclusions-before.conf‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,7 @@ SecRule REQUEST_FILENAME "@endsWith /index.php" \
237237
ctl:ruleRemoveById=200002,\
238238
ctl:ruleRemoveById=200004"
239239

240-
# Editing a page/post with gutenberg editor
240+
# Cannot update items using WordPress API due to `x-http-method-override` header (eg. for Gutenberg, pretty permalinks disabled).
241241
SecRule REQUEST_FILENAME "@endsWith /index.php" \
242242
"id:9507144,\
243243
phase:1,\
@@ -246,9 +246,17 @@ SecRule REQUEST_FILENAME "@endsWith /index.php" \
246246
nolog,\
247247
ver:'wordpress-rule-exclusions-plugin/1.1.0',\
248248
chain"
249-
SecRule REQUEST_HEADERS:x-http-method-override "@streq PUT" \
249+
SecRule &ARGS:rest_route "@eq 1" \
250250
"t:none,\
251-
ctl:ruleRemoveById=920450"
251+
nolog,\
252+
chain"
253+
SecRule REQUEST_METHOD "@streq POST" \
254+
"t:none,\
255+
nolog,\
256+
chain"
257+
SecRule REQUEST_HEADERS:x-http-method-override "@pm PUT DELETE" \
258+
"t:none,\
259+
ctl:ruleRemoveById=920450"
252260

253261
# Gutenberg full site editor (v6.3.1+).
254262
# Requests can contain CSS data, which are detected by libinjection.
@@ -270,7 +278,7 @@ SecRule REQUEST_FILENAME "@endsWith /index.php" \
270278
"t:none,\
271279
ctl:ruleRemoveTargetById=942100;ARGS"
272280

273-
# Cannot update page|post in WordPress due to `x-http-method-override` header.
281+
# Cannot update items using WordPress API due to `x-http-method-override` header (eg. for Gutenberg, pretty permalinks enabled).
274282
SecRule REQUEST_FILENAME "@rx /wp-json/wp/v[0-9]+/(?:global-styles|navigation|pages|posts|sidebars|template-parts|templates|users)" \
275283
"id:9507146,\
276284
phase:1,\
@@ -279,9 +287,13 @@ SecRule REQUEST_FILENAME "@rx /wp-json/wp/v[0-9]+/(?:global-styles|navigation|pa
279287
nolog,\
280288
ver:'wordpress-rule-exclusions-plugin/1.1.0',\
281289
chain"
282-
SecRule &REQUEST_HEADERS:x-http-method-override "!@eq 0" \
290+
SecRule REQUEST_METHOD "@streq POST" \
283291
"t:none,\
284-
ctl:ruleRemoveById=920450"
292+
nolog,\
293+
chain"
294+
SecRule REQUEST_HEADERS:x-http-method-override "@pm PUT DELETE" \
295+
"t:none,\
296+
ctl:ruleRemoveById=920450"
285297

286298
# Loading tags/catagories for pages/posts
287299
# Obtaining metadata for pages/posts

‎tests/regression/wordpress-rule-exclusions-plugin/9507144.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
---
2+
meta:
3+
author: "Esad Cetiner"
4+
description: "Wordpress Rule Exclusions Plugin"
5+
rule_id: 9507144
6+
tests:
7+
- test_id: 1
8+
desc: Editing template part of a website i.e header or footer
9+
stages:
10+
- input:
11+
dest_addr: 127.0.0.1
12+
headers:
13+
Host: localhost
14+
User-Agent: OWASP CRS test agent
15+
Accept: application/json, */*;q=0.1
16+
Content-Type: application/json
17+
x-http-method-override: PUT
18+
port: 80
19+
method: POST
20+
version: "HTTP/1.1"
21+
# URI is actually sent with double slashes
22+
uri: /index.php?rest_route=/wp/v2/template-parts/twentytwentyfour//header&_locale=user
23+
# Data is sent with some special characters escaped
24+
data: |
25+
{"id":"twentytwentyfour//header","content":"<!-- wp:group {\"align\":\"wide\",\"style\":{\"spacing\":{\"padding\":{\"top\":\"20px\",\"bottom\":\"20px\"}}},\"backgroundColor\":\"base\",\"layout\":{\"type\":\"constrained\"}} -->\n<div class=\"wp-block-group alignwide has-base-background-color has-background\" style=\"padding-top:20px;padding-bottom:20px\"><!-- wp:group {\"align\":\"wide\",\"layout\":{\"type\":\"flex\",\"justifyContent\":\"space-between\",\"flexWrap\":\"wrap\"}} -->\n<div class=\"wp-block-group alignwide\"><!-- wp:group {\"style\":{\"spacing\":{\"blockGap\":\"var:preset|spacing|20\"},\"layout\":{\"selfStretch\":\"fit\",\"flexSize\":null}},\"layout\":{\"type\":\"flex\"}} -->\n<div class=\"wp-block-group\"><!-- wp:site-logo {\"width\":60} /-->\n\n<!-- wp:group {\"style\":{\"spacing\":{\"blockGap\":\"0px\"}}} -->\n<div class=\"wp-block-group\"><!-- wp:site-title {\"level\":0} /--></div>\n<!-- /wp:group --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>testing</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group {\"layout\":{\"type\":\"flex\",\"flexWrap\":\"wrap\",\"justifyContent\":\"left\"}} -->\n<div class=\"wp-block-group\"><!-- wp:navigation {\"ref\":21,\"style\":{\"spacing\":{\"margin\":{\"top\":\"0\"},\"blockGap\":\"var:preset|spacing|20\"},\"layout\":{\"selfStretch\":\"fit\",\"flexSize\":null}},\"layout\":{\"type\":\"flex\",\"justifyContent\":\"right\",\"orientation\":\"horizontal\"}} /--></div>\n<!-- /wp:group --></div>\n<!-- /wp:group --></div>\n<!-- /wp:group -->"}
26+
output:
27+
log:
28+
no_expect_ids: [920450]
29+
- test_id: 2
30+
desc: Editing global styles for a theme
31+
stages:
32+
- input:
33+
dest_addr: 127.0.0.1
34+
headers:
35+
Host: localhost
36+
User-Agent: OWASP CRS test agent
37+
Accept: application/json, */*;q=0.1
38+
Content-Type: application/json
39+
x-http-method-override: PUT
40+
port: 80
41+
method: POST
42+
version: "HTTP/1.1"
43+
uri: /index.php?rest_route=/wp/v2/global-styles/26&_locale=user
44+
data: |
45+
{"id":26,"settings":{"color":{"duotone":{"theme":[{"colors":["#272727","#f9f9f9"],"slug":"duotone-1","name":"Donkergrijs en wit"},{"colors":["#272727","#5F584F"],"slug":"duotone-2","name":"Donkergrijs en walnoot"},{"colors":["#272727","#973C20"],"slug":"duotone-3","name":"Donkergrijs en kaneel"},{"colors":["#272727","#4D5B48"],"slug":"duotone-4","name":"Donkergrijs en olijfgroen"},{"colors":["#272727","#4F5959"],"slug":"duotone-5","name":"Donkergrijs en staal"}]},"gradients":{"theme":[{"slug":"gradient-1","gradient":"linear-gradient(to bottom, #5F584F 0%, #272727 100%)","name":"Verticaal zacht drijfhout naar donkergrijs"},{"slug":"gradient-2","gradient":"linear-gradient(to bottom, #6D533C 0%, #272727 100%)","name":"Verticaal zacht walnoot naar donkergrijs"},{"slug":"gradient-3","gradient":"linear-gradient(to bottom, #973C20 0%, #272727 100%)","name":"Verticaal zacht kaneel naar donkergrijs"},{"slug":"gradient-4","gradient":"linear-gradient(to bottom, #4D5B48 0%, #272727 100%)","name":"Verticaal zacht olijf naar donkergrijs"},{"slug":"gradient-5","gradient":"linear-gradient(to bottom, #4F5959 0%, #272727 100%)","name":"Verticaal zacht staal naar donkergrijs"},{"slug":"gradient-6","gradient":"linear-gradient(to bottom, #909090 0%, #272727 100%)","name":"Verticaal zacht tin naar donkergrijs"},{"slug":"gradient-7","gradient":"linear-gradient(to bottom, #5F584F 50%, #272727 50%)","name":"Verticaal hard beige naar donkergrijs"},{"slug":"gradient-8","gradient":"linear-gradient(to bottom, #6D533C 50%, #272727 50%)","name":"Verticaal hard walnoot naar donkergrijs"},{"slug":"gradient-9","gradient":"linear-gradient(to bottom, #973C20 50%, #272727 50%)","name":"Verticaal hard kaneel naar donkergrijs"},{"slug":"gradient-10","gradient":"linear-gradient(to bottom, #4D5B48 50%, #272727 50%)","name":"Verticaal hard olijf naar donkergrijs"},{"slug":"gradient-11","gradient":"linear-gradient(to bottom, #4F5959 50%, #272727 50%)","name":"Verticaal hard staal naar donkergrijs"},{"slug":"gradient-12","gradient":"linear-gradient(to bottom, #A4A4A4 50%, #272727 50%)","name":"Verticaal hard tin naar donkergrijs"}]},"palette":{"theme":[{"color":"#272727","name":"Basis","slug":"base"},{"color":"#303030","name":"Basis / Twee","slug":"base-2"},{"color":"#f9f9f9","name":"Contrast","slug":"contrast"},{"color":"#B7B7B7","name":"Contrast / Twee","slug":"contrast-2"},{"color":"#909090","name":"Contrast / Drie","slug":"contrast-3"},{"color":"#5F584F","name":"Accent","slug":"accent"},{"color":"#6D533C","name":"Accent / Twee","slug":"accent-2"},{"color":"#973C20","name":"Accent / Drie","slug":"accent-3"},{"color":"#4D5B48","name":"Accent / Vier","slug":"accent-4"},{"color":"#4F5959","name":"Accent / Vijf","slug":"accent-5"}]}}}}
46+
output:
47+
log:
48+
no_expect_ids: [920450]
49+
- test_id: 3
50+
desc: Editing widgets
51+
stages:
52+
- input:
53+
dest_addr: 127.0.0.1
54+
headers:
55+
Host: localhost
56+
User-Agent: "OWASP CRS test agent"
57+
Accept: application/json, */*;q=0.1
58+
Content-Type: application/json
59+
x-http-method-override: PUT
60+
port: 80
61+
method: POST
62+
version: "HTTP/1.1"
63+
uri: /index.php?rest_route=/wp/v2/sidebars/sidebar-1&_locale=user
64+
data: |
65+
{"id":"sidebar-1","widgets":["search-2","recent-posts-2","recent-comments-2","archives-2","categories-2","meta-2","block-2","block-3"]}
66+
output:
67+
log:
68+
no_expect_ids: [920450]
69+
- test_id: 4
70+
desc: Save post
71+
stages:
72+
- input:
73+
dest_addr: 127.0.0.1
74+
headers:
75+
Host: localhost
76+
User-Agent: "OWASP CRS test agent"
77+
Accept: application/json, */*;q=0.1
78+
Content-Type: application/json
79+
x-http-method-override: PUT
80+
port: 80
81+
method: POST
82+
version: "HTTP/1.1"
83+
uri: /index.php?rest_route=/wp/v2/posts/1&_locale=user
84+
data: |
85+
{"id":1,"content":"<p>Welcome to WordPress. This is your first post. Edit or delete it, then start blogging!</p>\n\n<!-- wp:paragraph -->\n<p>dddd</p>\n<!-- /wp:paragraph -->"}
86+
output:
87+
log:
88+
no_expect_ids: [920450]
89+
- test_id: 5
90+
desc: Delete post
91+
stages:
92+
- input:
93+
dest_addr: 127.0.0.1
94+
headers:
95+
Host: localhost
96+
User-Agent: "OWASP CRS test agent"
97+
Accept: application/json, */*;q=0.1
98+
Content-Type: application/json
99+
x-http-method-override: DELETE
100+
port: 80
101+
method: POST
102+
version: "HTTP/1.1"
103+
uri: /index.php?rest_route=/wp/v2/posts/1&_locale=user
104+
output:
105+
log:
106+
no_expect_ids: [920450]

‎tests/regression/wordpress-rule-exclusions-plugin/9507146.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,81 @@ tests:
6767
output:
6868
log:
6969
no_expect_ids: [920450]
70+
- test_id: 4
71+
desc: Save post
72+
stages:
73+
- input:
74+
dest_addr: 127.0.0.1
75+
headers:
76+
Host: localhost
77+
User-Agent: "OWASP CRS test agent"
78+
Accept: application/json, */*;q=0.1
79+
Content-Type: application/json
80+
x-http-method-override: PUT
81+
port: 80
82+
method: POST
83+
version: "HTTP/1.1"
84+
uri: /wp-json/wp/v2/posts/1&_locale=user
85+
data: |
86+
{"id":1,"content":"<p>Welcome to WordPress. This is your first post. Edit or delete it, then start blogging!</p>\n\n<!-- wp:paragraph -->\n<p>dddd</p>\n<!-- /wp:paragraph -->"}
87+
output:
88+
log:
89+
no_expect_ids: [920450]
90+
- test_id: 5
91+
desc: Delete post
92+
stages:
93+
- input:
94+
dest_addr: 127.0.0.1
95+
headers:
96+
Host: localhost
97+
User-Agent: "OWASP CRS test agent"
98+
Accept: application/json, */*;q=0.1
99+
Content-Type: application/json
100+
x-http-method-override: DELETE
101+
port: 80
102+
method: POST
103+
version: "HTTP/1.1"
104+
uri: /wp-json/wp/v2/posts/1&_locale=user
105+
output:
106+
log:
107+
no_expect_ids: [920450]
108+
- test_id: 6
109+
desc: Save post when permalink struct starts with /index.php/
110+
stages:
111+
- input:
112+
dest_addr: 127.0.0.1
113+
headers:
114+
Host: localhost
115+
User-Agent: "OWASP CRS test agent"
116+
Accept: application/json, */*;q=0.1
117+
Content-Type: application/json
118+
x-http-method-override: PUT
119+
port: 80
120+
method: POST
121+
version: "HTTP/1.1"
122+
uri: /index.php/wp-json/wp/v2/posts/1&_locale=user
123+
data: |
124+
{"id":1,"content":"<p>Welcome to WordPress. This is your first post. Edit or delete it, then start blogging!</p>\n\n<!-- wp:paragraph -->\n<p>dddd</p>\n<!-- /wp:paragraph -->"}
125+
output:
126+
log:
127+
no_expect_ids: [920450]
128+
- test_id: 7
129+
desc: Save post for multisite or a WordPress installation in "nested directories"
130+
stages:
131+
- input:
132+
dest_addr: 127.0.0.1
133+
headers:
134+
Host: localhost
135+
User-Agent: "OWASP CRS test agent"
136+
Accept: application/json, */*;q=0.1
137+
Content-Type: application/json
138+
x-http-method-override: PUT
139+
port: 80
140+
method: POST
141+
version: "HTTP/1.1"
142+
uri: /subdir/wordpress-here/wp-json/wp/v2/posts/1&_locale=user
143+
data: |
144+
{"id":1,"content":"<p>Welcome to WordPress. This is your first post. Edit or delete it, then start blogging!</p>\n\n<!-- wp:paragraph -->\n<p>dddd</p>\n<!-- /wp:paragraph -->"}
145+
output:
146+
log:
147+
no_expect_ids: [920450]

0 commit comments

Comments
 (0)