---
meta:
  author: "spartantri"
  enabled: true
  name: "944250.yaml"
  description: "Positive tests for rule 944250"
tests:
  - test_title: 944250-0
    desc: "Argument test includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=java.evil.runtime"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-1
    desc: "Argument name includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "java.evil.runtime=test"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-2
    desc: "Cookie test includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: test=java.evil.runtime
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-3
    desc: "Cookie name includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: java.evil.runtime=test
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-4
    desc: "Request header test includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              test: java.evil.runtime
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-5
    desc: "XML attribute value includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"java.evil.runtime\">element_value</element></xml>"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-6
    desc: "XML element value includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"attribute_value\">java.evil.runtime</element></xml>"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-7
    desc: "Nested XML element value includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><l1><l2><l3><element attribute_name=\"attribute_value\">java.evil.runtime</element></l3></l2></l1></xml>"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-8
    desc: "Content-Type text/plain includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "text/plain"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=java.evil.runtime"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-9
    desc: "Content-Type application/json arg value includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"test\": \"java.evil.runtime\"}"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-10
    desc: "Content-Type application/json arg name includes keyword java.evil.runtime"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"java.evil.runtime\": \"test\"}"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-11
    desc: "Argument test includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=java.evil.processbuilder"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-12
    desc: "Argument name includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "java.evil.processbuilder=test"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-13
    desc: "Cookie test includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: test=java.evil.processbuilder
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-14
    desc: "Cookie name includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: java.evil.processbuilder=test
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-15
    desc: "Request header test includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              test: java.evil.processbuilder
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-16
    desc: "XML attribute value includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"java.evil.processbuilder\">element_value</element></xml>"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-17
    desc: "XML element value includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"attribute_value\">java.evil.processbuilder</element></xml>"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-18
    desc: "Nested XML element value includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><l1><l2><l3><element attribute_name=\"attribute_value\">java.evil.processbuilder</element></l3></l2></l1></xml>"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-19
    desc: "Content-Type text/plain includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "text/plain"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=java.evil.processbuilder"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-20
    desc: "Content-Type application/json arg value includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"test\": \"java.evil.processbuilder\"}"
          output:
            log_contains: "id \"944250\""
  - test_title: 944250-21
    desc: "Content-Type application/json arg name includes keyword java.evil.processbuilder"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"java.evil.processbuilder\": \"test\"}"
          output:
            log_contains: "id \"944250\""
