---
meta:
  author: "zmallen"
  enabled: true
  name: "941200.yaml"
  description: "Tests to trigger, or not trigger 941200"
tests:
  - test_title: 941200-1
    desc: Microsoft vmlframe xss, ARGS
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/foo'
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
            data: '941200-1=%3Cv%3Avmlframe%20src%3D%22foo.com%2Fsup.fml%22%2F%3E'
          output:
            log_contains: id "941200"
  - test_title: 941200-2
    desc: Microsoft vmlframe xss, ARGS_NAMES
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/bar'
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
            data: '%3Cv%3Avmlframe%20src%3D%22foo.com%2Fsup.fml%22%2F%3E=941200-2'
          output:
            log_contains: id "941200"
  - test_title: 941200-3
    desc: Microsoft vmlframe xss, REQUEST_COOKIE_NAMES
    stages:
      - stage:
          input:
            dest_addr: 127.0.0.1
            method: GET
            port: 80
            uri: '/baz'
            headers:
              User-Agent: ModSecurity CRS 3 Tests
              Host: localhost
              Cookie: '%3Cv%3Avmlframe%20src%3D%22foo.com%2Fsup.fml%22%2F%3E=941200-3'
          output:
            log_contains: id "941200"
