Repository navigation
fix: CRS4 compatibility - #20
Merged
Merged
Conversation
|
Tested ca3ad4b with Coraza v3.7.0 + CRS 4.25.0 (plugin include order). The issue's case is fixed: a draft autosave (urlencoded POST to Media uploads still fail on Coraza: 200 of 200 PNGs with random pixels, and a plain solid-colour PNG, posted as Note that renumbering 9509100/9509110 breaks setups that remove those ids. |
Member
Author
|
Can you post full audit log for blocked requests?
These are exclusion rules, no need to remove them. |
|
I reproduced this with a real browser and a real server this time: Chromium (headless, via Playwright) uploading through the media manager of DokuWiki 2026-07-14c "Mort", served by FrankenPHP 1.12.7 with coraza-caddy v2.6.1 (Coraza v3.7.0, CRS 4.25.0). The plugin directory holds only this PR's two files at ca3ad4b, with no other exclusions. Both uploads were blocked with 403 and the uploader showed "Failed". These are the audit log entries Coraza wrote, unchanged except that the cookie values are redacted, part C (the binary request body) is base64, and in the second entry every Solid-colour 64x64 PNG (136 bytes): score 15 from 920270 and 921150Random-pixel 64x64 PNG (12,420 bytes): score 340 from 920270, 921150, 932130 and 942100In the same setup I also tried the change I mentioned before, adding I haven't checked ModSecurity.
Fair enough. We only removed 9509110 to work around #19, because it left octet-stream as the only allowed content type. With this PR's fix we can drop that removal, so the renumbering only means we have to update our config in the same change. |
Member
Author
|
@DSpeichert Problem here is that your Coraza is interpreting binary data (application/octet-stream) as form data (application/x-www-form-urlencoded) and is trying to parse it. You need to fix this in your web server config. |
Member
|
@DSpeichert By default Coraza sets the default body processor to |
EsadCetiner
requested changes
Oct 22, 2026
|
Thanks, that's the cause: 901340's |
|
A correction to my last comment: the charset problem is specific to Coraza v3.7.0, which set URLENCODED only for the exact header |
EsadCetiner
approved these changes
Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #19.