---
meta:
  author: "spartantri"
  enabled: true
  name: "944210.yaml"
  description: "Positive tests for rule 944210"
tests:
  - test_title: 944210-0
    desc: "Argument test includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=rO0ABQ"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-1
    desc: "Argument name includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "rO0ABQ=test"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-2
    desc: "Cookie test includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: test=rO0ABQ
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-3
    desc: "Cookie name includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: rO0ABQ=test
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-4
    desc: "Request header test includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              test: rO0ABQ
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-5
    desc: "XML element includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><rO0ABQ attribute_name=\"attribute_value\">value</rO0ABQ></xml>"
          output:
            no_log_contains: "id \"944210\""
  - test_title: 944210-6
    desc: "XML attribute name includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element rO0ABQ=\"attribute_value\">element_value</element></xml>"
          output:
            no_log_contains: "id \"944210\""
  - test_title: 944210-7
    desc: "XML attribute value includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"rO0ABQ\">element_value</element></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-8
    desc: "XML element value includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"attribute_value\">rO0ABQ</element></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-9
    desc: "Nested XML element value includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><l1><l2><l3><element attribute_name=\"attribute_value\">rO0ABQ</element></l3></l2></l1></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-10
    desc: "Content-Type text/plain includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "text/plain"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=rO0ABQ"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-11
    desc: "Content-Type application/json arg value includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"test\": \"rO0ABQ\"}"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-12
    desc: "Content-Type application/json arg name includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"rO0ABQ\": \"test\"}"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-13
    desc: "Content-Type multipart/form-data json arg name includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/json

              {"rO0ABQ": "test"}
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-14
    desc: "Content-Type multipart/form-data json arg value includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/json

              {"rO0ABQ": "test"}
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-15
    desc: "Content-Type multipart/form-data XML element value includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/xml

              <?xml version="1.0"?><xml><element attribute_name="attribute_value">rO0ABQ</element></xml>
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-16
    desc: "Content-Type multipart/form-data XML element value includes keyword rO0ABQ"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/xml

              <?xml version="1.0"?><xml><element attribute_name="attribute_value">rO0ABQ</element></xml>
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-17
    desc: "Argument test includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=KztAAU"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-18
    desc: "Argument name includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "KztAAU=test"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-19
    desc: "Cookie test includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: test=KztAAU
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-20
    desc: "Cookie name includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: KztAAU=test
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-21
    desc: "Request header test includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              test: KztAAU
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-22
    desc: "XML element includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><KztAAU attribute_name=\"attribute_value\">value</KztAAU></xml>"
          output:
            no_log_contains: "id \"944210\""
  - test_title: 944210-23
    desc: "XML attribute name includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element KztAAU=\"attribute_value\">element_value</element></xml>"
          output:
            no_log_contains: "id \"944210\""
  - test_title: 944210-24
    desc: "XML attribute value includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"KztAAU\">element_value</element></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-25
    desc: "XML element value includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"attribute_value\">KztAAU</element></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-26
    desc: "Nested XML element value includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><l1><l2><l3><element attribute_name=\"attribute_value\">KztAAU</element></l3></l2></l1></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-27
    desc: "Content-Type text/plain includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "text/plain"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=KztAAU"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-28
    desc: "Content-Type application/json arg value includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"test\": \"KztAAU\"}"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-29
    desc: "Content-Type application/json arg name includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"KztAAU\": \"test\"}"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-30
    desc: "Content-Type multipart/form-data json arg name includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/json

              {"KztAAU": "test"}
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-31
    desc: "Content-Type multipart/form-data json arg value includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/json

              {"KztAAU": "test\}
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-32
    desc: "Content-Type multipart/form-data XML element value includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/xml

              <?xml version="1.0"?><xml><element attribute_name="attribute_value">KztAAU</element></xml>
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-33
    desc: "Content-Type multipart/form-data XML element value includes keyword KztAAU"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/xml

              <?xml version="1.0"?><xml><element attribute_name="attribute_value">KztAAU</element></xml>
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-34
    desc: "Argument test includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=Cs7QAF"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-35
    desc: "Argument name includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
            method: "POST"
            version: "HTTP/1.0"
            data: "Cs7QAF=test"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-36
    desc: "Cookie test includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: test=Cs7QAF
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-37
    desc: "Cookie name includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              Cookie: Cs7QAF=test
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-38
    desc: "Request header test includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/x-www-form-urlencoded"
              test: Cs7QAF
            method: "POST"
            version: "HTTP/1.0"
            data: "test=value"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-39
    desc: "XML element includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><Cs7QAF attribute_name=\"attribute_value\">value</Cs7QAF></xml>"
          output:
            no_log_contains: "id \"944210\""
  - test_title: 944210-40
    desc: "XML attribute name includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element Cs7QAF=\"attribute_value\">element_value</element></xml>"
          output:
            no_log_contains: "id \"944210\""
  - test_title: 944210-41
    desc: "XML attribute value includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"Cs7QAF\">element_value</element></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-42
    desc: "XML element value includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><element attribute_name=\"attribute_value\">Cs7QAF</element></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-43
    desc: "Nested XML element value includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/xml"
            method: "POST"
            version: "HTTP/1.0"
            data: "<?xml version=\"1.0\"?><xml><l1><l2><l3><element attribute_name=\"attribute_value\">Cs7QAF</element></l3></l2></l1></xml>"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-44
    desc: "Content-Type text/plain includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "text/plain"
            method: "POST"
            version: "HTTP/1.0"
            data: "test=Cs7QAF"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-45
    desc: "Content-Type application/json arg value includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"test\": \"Cs7QAF\"}"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-46
    desc: "Content-Type application/json arg name includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "application/json"
            method: "POST"
            version: "HTTP/1.0"
            data: "{\"Cs7QAF\": \"test\"}"
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-47
    desc: "Content-Type multipart/form-data json arg name includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/json

              {"Cs7QAF": "test"}
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-48
    desc: "Content-Type multipart/form-data json arg value includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/json

              {"Cs7QAF": "test"}
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-49
    desc: "Content-Type multipart/form-data XML element value includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/xml

              <?xml version="1.0"?><xml><element attribute_name="attribute_value">Cs7QAF</element></xml>
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
  - test_title: 944210-50
    desc: "Content-Type multipart/form-data XML element value includes keyword Cs7QAF"
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            headers:
              Host: "localhost"
              User-Agent: "ModSecurity CRS 3 Tests"
              Accept: "text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"
              Accept-Charset: "ISO-8859-1,utf-8;q=0.7,*;q=0.7"
              Accept-Encoding: "gzip,deflate"
              Accept-Language: "en-us,en;q=0.5"
              Content-Type: "multipart/form-data; boundary=---------------------------thisissparta"
            method: "POST"
            version: "HTTP/1.0"
            data: |
              -----------------------------thisissparta
              Content-Disposition: form-data; name="payload"
              Content-Type: application/xml

              <?xml version="1.0"?><xml><element attribute_name="attribute_value">Cs7QAF</element></xml>
              -----------------------------thisissparta--
          output:
            log_contains: "id \"944210\""
