SOAPUI SOAP Tx multipart/related call False Positive id: 920470 about owasp-modsecurity-crs HOT 4 CLOSED

Thank you for reporting. I'm more and more seeing a need to review all the content-type rules in its own little project to overhaul them all. Thanks for the contribution.

from owasp-modsecurity-crs.

I also see start-info in this multipart/related Content-Type.
And I see this is also a valid param: https://tools.ietf.org/html/rfc2387

So the full list would be: (?:boundary|charset|type|start|start-info) or (?:boundary|charset|type|start(?:-info)?).

I haven't tested that yet.

Example Request Header:
Content-Type: multipart/related; type="application/xop+xml"; boundary="uuid:a111aaa1-aa11-1a11-a11a-11a1111aa11a"; start="<[email protected]>"; start-info="application/soap+xml

And here I see more params like action:
https://issues.apache.org/jira/browse/CXF-6431

Example for action:
Content-Type: application/soap+xml; action="urn:hl7-org:v3:PRPA_IN201305UV02"; charset=UTF-8
Source: https://groups.google.com/forum/#!topic/ipf-user/evT5vZb42_w

from owasp-modsecurity-crs.

I'll open a PR with the following suggestion for rule 920470:

^[\w\d\/\.\-\+]+(?:\s?;\s?(?:action|boundary|charset|type|start(?:-info)?)\s?=\s?['\"\w\d\.\-\/+<>@:]+)*$

from owasp-modsecurity-crs.

Not the best at fixing them but playing the role of QA and providing FP's is right up my wheelhouse, I can make small fixes 😄 .

from owasp-modsecurity-crs.