Fix SecRequestBody(NoFiles)Limit overflow

[airween]

what

This PR fixes the possible overflow of SecRequestBodyLimit and SecRequestBodyNoFilesLimit directives.

why

There are two reported issues:

• libModSecurity3: requests are blocked when SecRequestBodyNoFilesLimit is set to a very high value #3356
• curl with PUT method can upload a huge file (>2GB) on remote server but hangs and timeout #3352

There are a few problems in handling these config variables:

• the type of variables were double before this patch - this makes no sense, there is no 1234.6 bytes...
• the type of variables were signed - also makes sense, there is no negative value
• the parser converted the read value with atoi(), which gives an integer with different bitsize

Therefore if a user gave an extra high value, then the atoi() converted it into a negative value.

references

Fixes #3356 and #3352

side note

Now there is no hardcoded limit for these values. Beside of that if the admin gives 0 (zero) value then the engine allows unlimited bytes.

I want to stop this, which means if the value of these variables aren't set or set to 0, that means the value is 0 and engine will allow only 0 byte. Hopefully this will force the admin to set an explicit value.

[airween]

This PR is working in progress.

@jonathansmith9485, @SonNgo2211, @EsadCetiner - please take a review this.

[EsadCetiner]

@airween I just tested your PR and I'm still getting blocked by 200002, however this time the value is reported as 0 in the debug log

[175253424070.699027] [/remote.php/dav/files/esadc/] [5] Request body excluding files is bigger than the maximum expected. Limit: 0

[airween]

@airween I just tested your PR and I'm still getting blocked by 200002, however this time the value is reported as 0 in the debug log

[175253424070.699027] [/remote.php/dav/files/esadc/] [5] Request body excluding files is bigger than the maximum expected. Limit: 0

Thanks, I can check this soon.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud