transformation base64Decode failed

[sodd]

Hi guys,
i have successfully compile and run make check ModSecurity v3.

============================================================================
Testsuite summary for modsecurity 3.0
============================================================================
# TOTAL: 4717
# PASS:  4717
# SKIP:  0
# XFAIL: 0
# FAIL:  0
# XPASS: 0
# ERROR: 0
============================================================================

but when i run tools/rules-check/modsec-rules-check /tmp/rule.conf
rule.conf:

#example from https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#base64decode
SecRule REQUEST_HEADERS:Authorization "^Basic ([a-zA-Z0-9]+=*)$" "phase:1,id:93,capture,chain,logdata:%{TX.1}"
  SecRule TX:1 ^(\w+): t:base64Decode,capture,chain
    SecRule TX:1 ^(admin|root|backup)$ 

I'll get this error:

 : /tmp/rule.conf  --  Loaded -1 rules.
    Rules error. File: /tmp/rule.conf. Line: 1. Column: 112. Invalid action:  data:%{TX.1}"
Test failed.

I tried to reduce whole rule to something like this, but without success :( :

 SecRule REQUEST_HEADERS:Authorization "^Basic ([a-zA-Z0-9]+=*)$" "id:93,log,t:none,t:base64Decode,pass"

 : /tmp/rule.conf  --  Loaded -1 rules.
    Rules error. File: /tmp/rule.conf. Line: 1. Column: 105. Invalid action:  t:base64Decode,pass"
Test failed.

what am I doing wrong ?

[zimmerle]

Hi @sodd,

The parser failed to identify the action: logdata:%{TX.1}. This needs to be fixed in the code. In the meanwhile try to use msg instead.

[sodd]

thx for your answer 👍
I tried your solution and get a rid off the error message but without functional success... i think something is not right with base64Decode transformation...
When i try this rule

SecRule ARGS "root" "id:3,t:base64Decode,log"

the result is

 : /etc/nginx/modsecurity/main.conf  --  Loaded -1 rules.
    Rules error. File: /etc/nginx/modsecurity/main.conf. Line: 18. Column: 74. Invalid action:  t:base64Decode,log,msg:'test base64 decoding'"
Test failed.

[victorhora]

There were a few missing statements in the parser. #1675 should fix it.

Let us know if there's any issue.

Thanks!