Test: 026 - MATCHED_VARS_NAMES

[Sebitosh]

Description

#27
Based on issue owasp-modsecurity/ModSecurity#3382
Positive and negative tests for target MATCHED_VARS_NAMES

Added features

I added two features to the generator script to create these tests:

1. Enable no_expect_ids to get the current rule id. This is my proposition to implement negative tests. Of course, negative tests for MRTS will have a different motivation than for CRS regression tests. CRS cares about avoiding false positives on the rule set, MRTS should use it to verify correct feature implementation. In the case of targets, negative tests will probably not be created for each target, and when they are it will be for reasons specific to that target or category of targets. In our case, a negative test helps us recreate the scenario of Issue 3382. In general, enabling no_expect_ids with the current rule id is quite useful for negative tests.

2. Enable multiple request arguments. Allows multiple dictionary entries in the test.data section to define test requests. In this case it is useful to recreate the test proposed by the issue author.

Evaluation on ModSecurity2

Quite surprisingly, the positive test fails. The reason for this is that the semantics of MATCHED_VARS_NAMES on V2 seems to be "vars names of the current rule being matched". I verified manually and it works inside rule actions and in chained rules, but in the example from issue 3382 when it tests for rules following each other, MATCHED_VARS_NAMES is resolved to empty.

For the same reason, the negative tests pass.

Evaluation on libmodsecurity3

The positive tests pass, and the negative tests fail demonstrating issue 3382.

[Sebitosh]

I have reworked the positive test a bit: since MATCHED_VARS_NAMES is a collection, I tested it by making match the ARGS, ARGS_NAME, and REQUEST_COOKIES targets and check the presence of each target by creating combinations using oparg.

The tests pass on V3, fail on V2 for the same previous reasons. This way, we confirm that the target holds ALL previously matched variable names.

[airween]

Let me review this with @M4tteoP. Moreover there is an issue for v3, we should investigate first that.