Development

Contributions Discovered in Development

In the process of developing waflz, using the open source modsecurity as a reference, several potential issues were discovered in the standard implementation.

• heap overflows:

  • ip tree: off-by-one on the heap

  • parse_arguments: off-by-one

• logic issues:

  • utf8 character detection

  • query string with slashes

• data mangling:

  • suricata/snort data mangling