Problem/Motivation

On certain web server setups, root.js?v=<version> file, which is loaded from the global-styling library in root theme, fails to load with a 406 Access Denied error due to Apache Modsecurity rules.

Request:	GET /themes/contrib/root/assets/js/root.js?v=3.0.0-alpha2

Action Description:	Access denied with code 406 (phase 2).

Justification:	Pattern match "/(new(cmd|command)|(cmd|command)[0-9]+|pro18|shell|sh|bash|get|root|nmap|asc|lila)\\.(c|dat|gif|jpe?g|jpeg|png|sh|txt|bmp|dat|txt|js|htm|html|tmp|php|asp)\\?" at REQUEST_URI.

I have setup a Drupal installation on a AlmaLinux Server using WHM/cPANEL (https://cpanel.net/products/cpanel-whm-features/) which is a very popular web hosting manager. Out of the box, the modsecurity rules where already in place when the web server was setup by hosting provider.

This can be an issue with hosting services where end users may not have administrative access to modsecurity configurations.

Steps to reproduce

  1. Set up web server with apache modsecurity restriction that does not permit usages of root.js?v=<version_number> like the pattern shown above
  2. Set up Drupal application on web server with root theme set as the admin theme
  3. Login and attempt to add content, once on that page, click on three dots on the top right of the web page, javascript interaction broken
  4. accessing http(s):///themes/contrib/root/assets/js/root.js?v=3.0.0-alpha2 returns access denied error

Proposed resolution

Renaming the root.js file to a non restricted naming convention.

CommentFileSizeAuthor
#4 rename_root_js_file-3365968-4.patch454 bytesasierrajr

Comments

asierrajr created an issue. See original summary.

asierrajr’s picture

Issue summary: View changes
m.abdulqader’s picture

Issue tags: -JavaScript +JavaScript

Thank you

Could you please upload a patch for that to deploy it.

Thank you

asierrajr’s picture

Issue tags: -JavaScript +JavaScript
StatusFileSize
new454 bytes

Here is the patch.

I pre-append the name of the file with seeds, following your naming conventions in other modules you manage

I tested this on the server with the modsecurity restrictions and patch works.

Because I am renaming a file, please note that the patch only works in Linux environments via Composer Patches.
It does work using git apply

If you are trying to test this on Mac OS, note that the patch may not work (renaming the fie) unless you install an OS packages via hombrew
https://github.com/cweagans/composer-patches/issues/326

m.abdulqader’s picture

Version: 2.0.0-alpha4 » 2.x-dev
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.