---
meta:
  author: "csanders-git"
  enabled: true
  name: "920220.yaml"
  description: "Tests to trigger rule 920220"
tests:
  - # This gets a percent but not a number after, invalid
    test_title: 920220-1
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            uri: "/?x=%w20"
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
          output:
            log_contains: "id \"920220\""
  - # We have a valid percent encoding here
    test_title: 920220-2
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            uri: "/?x=xyz%20%99"
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
          output:
            no_log_contains: "id \"920220\""
  - # url encoding includes spaces as plusses, this is valid
    test_title: 920220-3
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            uri: "/?test=This+is+a+test"
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
          output:
            no_log_contains: "id \"920220\""
  - # testURL Encoding Abuse Attack Attempt from old modsec regressions
    test_title: 920220-4
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            uri: "/?parm=%7%6F%6D%65%74%65%78%74%5F%31%32%33%"
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
          output:
            log_contains: "id \"920220\""
  - # testURL Encoding Abuse Attack Attempt from old modsec regressions
    test_title: 920220-5
    stages:
      - stage:
          input:
            dest_addr: "127.0.0.1"
            port: 80
            uri: "/?parm=%1G"
            headers:
              User-Agent: "ModSecurity CRS 3 Tests"
              Host: "localhost"
          output:
            log_contains: "id \"920220\""
