---
meta:
  author: "Felipe Zipitria"
  description: Test Multipart/form-data
  enabled: true
  name: 922120.yaml
tests:
  - test_title: 922120-1
    desc: "Positive test: utf-7 is not in allowed charsets"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: "localhost"
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: multipart/form-data; boundary=boundary
              Accept: "*/*"
            method: POST
            port: 80
            uri: "/post"
            version: "HTTP/1.1"
            data: |
              --boundary
              Content-Disposition: form-data; name="flavors"
              Content-Transfer-Encoding: 8bit
              Content-Type: text/plain; charset=utf-7

              Pineapple. Pizza.
              --boundary--
          output:
            log_contains: id "922120"
  - test_title: 922120-2
    desc: "Negative test: no content-transfer-encoding header should be good"
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            headers:
              Host: "localhost"
              User-Agent: OWASP ModSecurity Core Rule Set
              Content-Type: multipart/form-data; boundary=boundary
              Accept: "*/*"
            method: POST
            port: 80
            uri: "/post"
            version: "HTTP/1.1"
            data: |
              --boundary
              Content-disposition: form-data; name="negative"
              Content-Type: text/plain

              This should be good as there is no content-transfer-encoding header.
              --boundary--
          output:
            no_log_contains: id "922120"
