chore: apply code review suggestions

coreruleset · Oct 16, 2023 · 32df7ce · 32df7ce
1 parent f742aac
commit 32df7ce
Showing 1 changed file with 13 additions and 4 deletions.
diff --git a/plugins/wordpress-rule-exclusions-before.conf b/plugins/wordpress-rule-exclusions-before.conf
@@ -192,14 +192,23 @@ SecRule REQUEST_FILENAME "@endsWith /index.php" \
 
 # Gutenberg full site editor (v6.3.1+).
 # Requests can contain CSS data, which are detected by libinjection.
-SecRule ARGS_GET "@rx /wp/v[0-9]/global-styles/" \
+# Uses an additional chain rule to prevent evasion by supplying another
+# argument with the same name.
+SecRule REQUEST_FILENAME "@endsWith /index.php" \
     "id:9507145,\
-    phase:1,\
+    phase:2,\
     pass,\
     t:none,\
     nolog,\
-    ctl:ruleRemoveTargetById=942100;ARGS,\
-    ver:'wordpress-rule-exclusions-plugin/1.0.0'"
+    ver:'wordpress-rule-exclusions-plugin/1.0.1',\
+    chain"
+    SecRule &ARGS:rest_route "@eq 1" \
+        "t:none,\
+        nolog,\
+        chain"
+        SecRule ARGS:rest_route "@rx ^/wp/v[0-9]+/global-styles/[0-9]+$" \
+            "t:none,\
+            ctl:ruleRemoveTargetById=942100;ARGS"
 
 #
 # [ Live preview ]