fix: false positive loading favicon exactly at /favicon.ico with subsites

plugins/roundcube-rule-exclusions-before.conf

@@ -38,6 +38,10 @@ SecRule &TX:allowed_request_content_type "@eq 0" \
 # Roundcube sends all requests to the same URL path (Depending on the HTTP server configuration) this plugin avoids grouping all
 # rule exclusions into one rule for improved readability.
 
+#
+# [ General Rule Exclusions ]
+#
+
 # Fix RoundCube cookie false positive
 # Cookies are always sent regardless of the URL path
 SecRule REQUEST_FILENAME "@unconditionalMatch" \
@@ -75,6 +79,7 @@ SecRule REQUEST_FILENAME "@beginsWith %{tx.roundcube-rule-exclusions-path}" \
         ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:_pass"
 
 # Keywords like settings and mail frequently appear in the referrer header when doing pretty much anything
+# Note: Keep referer regex in sync with 9519103
 SecRule REQUEST_FILENAME "@beginsWith %{tx.roundcube-rule-exclusions-path}" \
     "id:9519102,\
     phase:1,\
@@ -85,6 +90,26 @@ SecRule REQUEST_FILENAME "@beginsWith %{tx.roundcube-rule-exclusions-path}" \
     chain"
     SecRule REQUEST_HEADERS:referer "@rx ^https://.+/\?_task=(?:mail|settings|logout&_token=[a-zA-Z0-9]+$)" \
         "t:none,\
+        ctl:ruleRemoveTargetById=932237;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=932239;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=932237;REQUEST_HEADERS:referer,\
+        ctl:ruleRemoveTargetById=932239;REQUEST_HEADERS:referer"
+
+# If Roundcube is installed on a subsite such as `/mail/` then the client may still attempt to fetch the favicon
+# from `/favicon.ico`. This request may be blocked if the request is while viewing the mailbox and similar.
+# Note: Keep referer regex in sync with 9519102
+SecRule REQUEST_FILENAME "@streq /favicon.ico" \
+    "id:9519103,\
+    phase:1,\
+    pass,\
+    t:none,\
+    nolog,\
+    ver:'roundcube-rule-exclusions-plugin/1.0.4',\
+    chain"
+    SecRule REQUEST_HEADERS:referer "@rx ^https://.+/\?_task=(?:mail|settings|logout&_token=[a-zA-Z0-9]+$)" \
+        "t:none,\
+        ctl:ruleRemoveTargetById=932237;REQUEST_HEADERS:Referer,\
+        ctl:ruleRemoveTargetById=932239;REQUEST_HEADERS:Referer,\
         ctl:ruleRemoveTargetById=932237;REQUEST_HEADERS:referer,\
         ctl:ruleRemoveTargetById=932239;REQUEST_HEADERS:referer"
 

tests/regression/roundcube-rule-exclusions-plugin/9519102.yaml

@@ -3,9 +3,10 @@ meta:
   author: "Esad Cetiner"
   description: "Roundcube Rule Exclusions Plugin"
 rule_id: 9519102
+# Note: Keep these tests in sync with 9519103.yaml and adjust the `uri` to `/get`
 tests:
   - test_id: 1
-    desc: Disable 932237 and 932239 for referrers if the referrer is valid
+    desc: Settings Referer
     stages:
       - input:
           dest_addr: 127.0.0.1
@@ -24,7 +25,7 @@ tests:
               - 932237
               - 932239
   - test_id: 2
-    desc: Disable 932237 and 932239 for logout token in referer
+    desc: Logout Referrer
     stages:
       - input:
           dest_addr: 127.0.0.1
@@ -42,3 +43,22 @@ tests:
             no_expect_ids:
               - 932237
               - 932239
+  - test_id: 3
+    desc: Referer for viewing an email
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: Roundcube rule exclusions plugin
+            Referer: https://mail.example.com/mail/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=22859&_mbox=INBOX&_framed=1&_action=preview
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          port: 80
+          method: GET
+          uri: /get
+          version: HTTP/1.1
+        output:
+          log:
+            no_expect_ids:
+              - 932237
+              - 932239

tests/regression/roundcube-rule-exclusions-plugin/9519103.yaml

@@ -0,0 +1,64 @@
+---
+meta:
+  author: "Esad Cetiner"
+  description: "Roundcube Rule Exclusions Plugin: Obtaining favicon"
+rule_id: 9519103
+# Note: Keep these tests in sync with 9519102.yaml and adjust the `uri` to `/favicon.ico`
+tests:
+  - test_id: 1
+    desc: Settings Referer
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: Roundcube rule exclusions plugin
+            Referer: https://example.com/?_task=settings
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          port: 80
+          method: GET
+          uri: /favicon.ico
+          version: HTTP/1.1
+        output:
+          log:
+            no_expect_ids:
+              - 932237
+              - 932239
+  - test_id: 2
+    desc: Logout Referrer
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: Roundcube rule exclusions plugin
+            Referer: https://mail.example.com/?_task=logout&_token=lsArandom
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          port: 80
+          method: GET
+          uri: /favicon.ico
+          version: HTTP/1.1
+        output:
+          log:
+            no_expect_ids:
+              - 932237
+              - 932239
+  - test_id: 3
+    desc: Referer for viewing an email
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: Roundcube rule exclusions plugin
+            Referer: https://mail.example.com/mail/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=22859&_mbox=INBOX&_framed=1&_action=preview
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          port: 80
+          method: GET
+          uri: /favicon.ico
+          version: HTTP/1.1
+        output:
+          log:
+            no_expect_ids:
+              - 932237
+              - 932239