---
meta:
  author: "zmallen"
  enabled: true
  name: "941210.yaml"
  description: "Tests to trigger, or not trigger 941210. This checks for abuses of javascript: with different encodings/html etc"
tests:
  - test_title: 941210-1
    desc: Obsfucated javascript tag in GET data, ARGS
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/foo'
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
            data: '941210-1=ja%26tab%3Bvascript%3A%20'
          output:
            log_contains: id "941210"
  - test_title: 941210-2
    desc: Obfuscated javascript tag in ARGS_NAMES, with tab
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/bar'
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
            data: 'ja%26tab%3Bvascript%3A%09=941210-2'
          output:
            log_contains: id "941210"
  - test_title: 941210-3
    desc: Microsoft vmlframe xss, REQUEST_COOKIE_NAMES
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/baz'
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
              Cookie: 'ja%26newline%3Bvascript%3A%20=941210-3'
          output:
            log_contains: id "941210"
