On Wed, Oct 9, 2013 at 2:28 PM, Steve Stonebraker <steve.stonebraker@gmail.com> wrote:
I'll answer my own question.  The body has JSON which is not processed by sanitiseArg.

Hi Steve,

Not sure how stable this is yet, but take a look at: https://www.modsecurity.org/tracker/browse/MODSEC-253
Perhaps with the patch you could use santiseMatched.

 - Josh

On Tue, Oct 8, 2013 at 12:10 PM, Steve Stonebraker <steve.stonebraker@gmail.com> wrote:
I am unable to sanitize a password in the request body.

--2a688459-C-- {"username":"someuser","password":"somepassword"}

What i've tried:
SecAction "phase:2,id:131,nolog,pass,sanitiseArg:password"
SecAction "phase:5,id:131,nolog,pass,sanitiseArg:password"
SecRule ARGS_NAMES password nolog,pass,id:132,sanitiseMatched

Any suggestions?

October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
the latest Intel processors and coprocessors. See abstracts and register >
mod-security-users mailing list
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: