Misleading information regarding "ProcessRequestBody()"

[noboruma]

The documentation around this function says:

	// ProcessRequestBody Performs the analysis of the request body (if any)
	//
	// This method perform the analysis on the request body. It is optional to
	// call that function. If this API consumer already knows that there isn't a
	// body for inspect it is recommended to skip this step.
	//
	// Remember to check for a possible intervention.

Implying that if you don't have any body, there is no need to call this function.
Unless I am missing another way of achieving this, there is currently no other way to go beyond phase 1 without calling this function?
Meaning that even if there is no body, this function should be called to process phase 2 rules that would match headers for instance.

[jcchavezs]

Yeah, sounds misleading to me for the reasons you mention. What do you think @M4tteoP?

…

On Fri, May 10, 2024 at 6:32 AM Thomas Legris ***@***.***> wrote: The documentation around this function says: // ProcessRequestBody Performs the analysis of the request body (if any) // // This method perform the analysis on the request body. It is optional to // call that function. If this API consumer already knows that there isn't a // body for inspect it is recommended to skip this step. // // Remember to check for a possible intervention. Implying that if you don't have any body, there is no need to call this function. Unless I am missing another way of achieving this, there is currently no other way to go beyond phase 2 without calling this function? Meaning that even if there is no body, this function should be called to process phase 2 rules that would match headers for instance. — Reply to this email directly, view it on GitHub <#1063>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAXPXSICUCYNS3EBVQDZBREWJAVCNFSM6AAAAABHP57CHGVHI2DSMVQWIX3LMV43ERDJONRXK43TNFXW4OZWGYZTQNRUGE> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[M4tteoP]

Thanks for reporting it, that's interesting and I agree that sounds misleading, especially taking into account CRS rules where quite a lot of headers and args are checked with phase 2 rules. At first sight, I think we should rewrite it.

I recall that also libmodsecurity comes with this description, so I dropped a line in the modsec slack also to have their opinion.