Inserting media, WP 5.2 classic editor

[msassmann]

As @lifeforms suggested, I'm opening a new issue for this.
Using WP 5.2.1 Rule 941160 is causing a false positive when inserting media into the wp classic editor. Wordpress Exceptions are enabled, using OWASP 3.1.

modsec_audit.log

[theMiddleBlue]

Thanks @msassmann!

In this case, the exclusion rule 9002770 should remove ARGS:html from all rules, but it does only if you're using ModSecurity v2. If you're using libmodsecurity (v3.0) your problem should be related to owasp-modsecurity/ModSecurity#2110. We're still waiting for this PR owasp-modsecurity/ModSecurity#2114 😞

[github-actions]

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days

[diablodale]

Still waiting on PR dependency

[lifeforms]

This problem should have been fixed in CRS 3.2.0 by working around the ModSec issues theMiddleBlue described. Rule 9002770 should catch the problem correctly now.

If you are still having problems after the upgrade, please open a new issue with the log!