---
meta:
  author: "csanders-git"
  enabled: true
  name: "920200.yaml"
  description: "Description"
tests:
  - test_title: 920200-1
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
              Range: "bytes=1-10,11-20,21-30,31-40,41-50,51-60"
          output:
            log_contains: "id \"920200\""
  - # Sample taken from https://github.com/alienwithin/php-utilities/blob/master/apache-byte-range-server-dos/apache_byte_range_server_dos.php
    test_title: 920200-2
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
              Request-Range: "bytes=5-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10,11-11"
          output:
            log_contains: "id \"920200\""
  - test_title: 920200-3
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
              Range: "bytes=1-10,   11-20, 21-30,   31-40, 41-50"
          output:
            no_log_contains: "id \"920200\""
  - test_title: 920200-4
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              User-Agent: "ModSecurity CRS 3 Tests #FP"
              Host: "localhost"
              Range: "bytes=-10,-, 21-30,31-40,41-50,51-500,"
          output:
            log_contains: "id \"920200\""
  - test_title: 920200-5
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              User-Agent: "ModSecurity CRS 3 Tests #FP"
              Host: "localhost"
              Range: "bytes=1-,11-20, 21-30,31-40,41-50,51-500"
          output:
            log_contains: "id \"920200\""
  - test_title: 920200-6
    desc: 'Range: Too many fields (920200) from old modsec regressions'
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
              Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
              Accept-Language: en-us,en;q=0.5
              Connection: close
              Host: localhost
              Keep-Alive: '300'
              Proxy-Connection: keep-alive
              Range: bytes=0-,5-0,5-1,5-2,5-3,5-4,5-5,5-6,5-7,5-8,5-9,5-10,5-11,5-12,5-13,5-14,5-15
              User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
            method: GET
            port: 80
            uri: /
            version: HTTP/1.1
          output:
            log_contains: id "920200"
  - test_title: 920200-7
    desc: This should PASS (PL2)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              Range: bytes=10-11, 20-21, 30-31, 40-41, 50-51
              User-Agent: "ModSecurity CRS 3 Tests"
            method: GET
            port: 80
            uri: /index.html
          output:
            no_log_contains: id "920200"
  - test_title: 920200-8
    desc: "This should FAIL with rule 920200 (PL2)"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              Range: "bytes=10-11, 20-21, 30-31, 40-41, 50-51, 60-61"
              User-Agent: "ModSecurity CRS 3 Tests"
            method: GET
            port: 80
            uri: /index.html
          output:
            log_contains: id "920200"
  - test_title: 920200-9
    desc: This should PASS (PL2)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              Range: "bytes=10-11, 20-21, 30-31, 40-41, 50-51, 60-61"
              User-Agent: "ModSecurity CRS 3 Tests"
            method: GET
            port: 80
            uri: /index.pdf
          output:
            no_log_contains: id "920200"
  - test_title: 920200-10
    desc: This should PASS (PL2)
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: localhost
              Range: "bytes=10-11, 20-21, 30-31, 40-41, 50-51, 60-61, 70-71, 80-81, 90-91, 100-101, 110-11, 120-21, 130-31, 140-41, 150-51, 160-61, 170-71, 180-81, 190-91, 200-101, 210-11, 220-21, 230-31, 240-41, 250-51, 260-61, 270-71, 280-81, 290-91, 300-101, 310-311, 320-321, 330-331, 340-341"
              User-Agent: "ModSecurity CRS 3 Tests"
            method: GET
            port: 80
            uri: /index.pdf
          output:
            no_log_contains: id "920200"
