Both yajl_get_error call sites in the JSON request body processor
assigned yajl's message verbatim, and yajl terminates it with a
newline. The newline ended up inside REQBODY_ERROR_MSG and therefore in
the middle of the error log line and the audit log entry, breaking the
single line format of both.
Trailing whitespace is now removed before the message is stored.
Fixes owasp-modsecurity#2278
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0181jBv5JdNQviwDzfnkf1Gy
What
Both
yajl_get_errorcall sites insrc/request_body_processor/json.ccnow run the message throughutils::string::chompbefore storing it, soREQBODY_ERROR_MSGno longer ends with the newline that yajl appends.Why
The newline ended up inside the error log line and the audit log entry. The native writers escape it as
\x0a, so the line readand connectors or log pipelines that print the message raw got a broken line.
Tests
New
test/test-cases/regression/request-body-parser-json-error-message.json(registered intest/test-suite.in): a malformed JSON body,REQBODY_ERRORrule withlogdata:'%{REQBODY_ERROR_MSG}', and an error log assertion that the data field closes right after the yajl text. Fails without the fix (the\x0ais in the way), passes with it.make checkpasses except the 9 pre-existingremoveComments.jsonfailures from the local submodule mismatch.References
Fixes #2278
🤖 Generated with Claude Code
Summary by CodeRabbit