---
meta:
  author: "csanders-git"
  enabled: true
  name: "920120.yaml"
  description: "Tests to trigger rule 920120"
tests:
  - test_title: 920120-1
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            method: "POST"
            port: 80
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
              Accept: "*/*"
              Accept-Language: "en"
              Connection: "close"
              Referer: "http://localhost/"
              Content-Type: "multipart/form-data; boundary=--------397236876"
            data: |
              ----------397236876
              Content-Disposition: form-data; name="fileRap"; filename="file=.txt"
              Content-Type: text/plain

              555-555-0199@example.com
              ----------397236876--
            protocol: "http"
          output:
            log_contains: "id \"920120\""
  - test_title: 920120-2
    desc: Attempted multipart/form-data bypass (920120) from old modsec regressions
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
              Accept-Encoding: gzip, deflate
              Accept-Language: en-us,en;q=0.5
              Connection: keep-alive
              Content-Type: multipart/form-data; boundary=---------------------------627652292512397580456702590
              Host: localhost
              Keep-Alive: '300'
              Proxy-Connection: keep-alive
              Referer: http
              User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv
            method: POST
            port: 80
            uri: /cgi-bin/fup.cgi
            version: HTTP/1.1
            data: |
              -----------------------------627652292512397580456702590
              Content-Disposition: form-data; name="fi=le"; filename="test"
              Content-Type: text/plain

              email: security@modsecurity.org

              -----------------------------627652292512397580456702590
              Content-Disposition: form-data; name="note"

              Contact info.
              -----------------------------627652292512397580456702590--
          output:
            log_contains: id "920120"
  - test_title: 920120-3
    desc: Invalid Request Body (920120)  from old modsec regressions
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
              Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
              Accept-Language: en-us,en;q=0.5
              Content-Type: multipart/form-data; boundary=---------------------------265001916915724
              Host: localhost
              Keep-Alive: '300'
              Proxy-Connection: keep-alive
              Referer: http
              User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv
            method: POST
            port: 80
            uri: /
            version: HTTP/1.1
            data: |
              -----------------------------265001916915724
              Content-Disposition: form-data; name="fi;le"; filename="test"
              Content-Type: application/octet-stream

              Rotem & Ayala

              -----------------------------265001916915724
              Content-Disposition: form-data; name="name"

              t2
              -----------------------------265001916915724
              Content-Disposition: form-data; name="B1"

              Submit
              -----------------------------265001916915724--
          output:
            log_contains: id "920120"
  - test_title: 920120-4
    desc: 'Attempted multipart/form-data bypass (920120). Match \ in FILES.'
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "OWASP CRS test agent"
              Host: "localhost"
              Content-Type: multipart/form-data; boundary=---------------------------265001916915724
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
            method: POST
            port: 80
            uri: /
            data: |
              -----------------------------265001916915724
              Content-Disposition: form-data; name="test"; filename="1.j\s\p"
              Content-Type: application/octet-stream

              helloworld
              -----------------------------265001916915724--
            version: "HTTP/1.1"
          output:
            log_contains: id "920120"
  - test_title: 920120-5
    desc: 'Attempted multipart/form-data bypass (920121). Match \ in FILES_NAMES.'
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              User-Agent: "OWASP CRS test agent"
              Host: "localhost"
              Content-Type: multipart/form-data; boundary=---------------------------265001916915724
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
            method: POST
            port: 80
            uri: /
            data: |
              -----------------------------265001916915724
              Content-Disposition: form-data; name="cv.j\s\p"; filename="cv.jsp"
              Content-Type: application/octet-stream

              helloworld
              -----------------------------265001916915724--
            version: "HTTP/1.1"
          output:
            log_contains: id "920120"
