Sanitize XML

[rcbarnett-zz]

MODSEC-206: Sainitize XML payload (ex. Web Services credentials in a SOAP Envelope)

[rcbarnett-zz]

Original reporter: gcaminer

[rcbarnett-zz]

rbarnett: Can you please provide more information about what functionality you are looking for? Do you want to sanitize portions of XML data within the logs?

[mpizzoli]

Hi,
I am interested too in this feature.
I don't understand the reason of closing it without explanation.

Thanks in advance

[zimmerle]

Hi @mpizzoli,

Can you give more details on exactly what you want to achieve?

[mpizzoli]

Hi @zimmerle,
yes of course.
We are receiving soap requests having both in the envelope and in the body sensitive informations.

In the envelope we have and
In the body, among the others, .

In case of modsec triggered 403, we effectively can see what happened getting the audit log and we can send it to our developers. Problem is we cannot automatically filter out those fields, therefore we need to do it manually.

[mpizzoli]

Sorry, the system blocked my xml representation of the data.
I was meaning in the envelope elements called "username" and "password"
In the body, among the others, credit card numbers

[zimmerle]

Hi @mpizzoli,

We have the action: sanitiseMatched.

Further information available here:
https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#sanitisematched

I am not sure if it is working well with the XML variable.

[mpizzoli]

Hi @zimmerle ,
I knew it, but (to the best of my knowledge) it cannot work with XML elements.
For instance, I cannot sanitize < username > myusername </ username > to
< username > XXXXXXXX </ username >

Or you know I can?
Thank you again