Question Allow specific Content types in Mod Security

[tbachner]

Server operating system version

Ubuntu 22.04.3 LTS

Plesk version and microupdate number

18.0.55 Update #2

When I activate ModSecurity I have a problem with content types:

[msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||app.domain.de|F|2"] [data "TX:0=application/merge-patch+json"]

Where I find die file userdata_wl_content_type to add the content type application/merge-patch+json?

 

[tbachner]

Ok. I found the file userdata_wl_content_type in the folder etc/apache2/modsecurity.d/rule/comodo_free. But I change this file, it always gets overwritten with default rules. How I can prevent this?

 

[Peter Debik]

I've checked on a server here and it seems the files are not overwritten. Where did you see that they are?

 

[Wade]

I have the same problem - `/etc/apache2/modsecurity.d/rules/comodo_free/userdata_wl_content_type` is periodically reset to some factory default, neutering my changes.

 

[Gauthier]

I also have the same problem. Can someone help us, please?

 

[Gauthier]

Peter Debik, the file is overwritten every 24H by a process I cannot identify. This process should probably not be stoped anyway.

Plesk has a text box to "Input a ModSecurity directive" but it does not specify how we can write the directive.

Can someone help us, please?

 

[Kaspar@Plesk]

The list with available directives for ModSecurity can be found on the ModSecurity documentation:

Reference Manual (v2.x) Configuration Directives

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a rang...

github.com

 

[Gauthier]

Thank you very much for your appreciated help Kaspar.

I already saw this reference manual, and I tried to add a directive in the "Custom directive" text box available in plesk/modsecurity/settings.

The directive I added is: "SecResponseBodyMimeType text/x-gwt-rpc".

I am not sure that this is the correct directive and format, but the 210710 modSecurity rule still bans client IP. The modsec_audit.log file still reports that the 210710 rule does not accept text/x-gwt-rpc content type.

I removed the directive as I am not sure that it was the right one.