CloudFlare can unexpectedly block REST API requests

[thenets]

Issue Overview

Don't save when my list item has parentheses.

Steps to Reproduce

1. Open the editor
2. Create an list block
3. Try to save
4. Error raise (Can not save)

Expected Behavior

Should save.

Versions

Wordpress 4.9
Gutenberg 1.7.0

[youknowriad]

Not able to reproduce, can you add more details? Do you see a failing request? Are you able to get the response of the request...?

[thenets]

I'll check the Apache log later. The Firefox don't return any error log msg.

[thenets]

There's no log error on Firefox console or Apache. Can I enable some debug mode on Wordpress?
I'm using the CloudFlare as my proxy. Should it be related to this bug?

[youknowriad]

I'm using the CloudFlare as my proxy. Should it be related to this bug?

Yes, I think it's related. Can you take a look at this issue, there's a workaround there #2704 (even if it seems CloudFlare is not blocking the API anymore)

[thenets]

Thanks a lot, @youknowriad!
CloudFlare was the problem. I disable the security request to API and now it's working:

[thenets]

Talking with CloudFlare support and later analyzing the "request" content I found the problem with API request. The CloudFlare firewall identifies the Gutenberg request as a possible SQL Injection attack.

The way the requests is made looks like an SQL Injection can be done. Maybe is better encode and strip special chars before sending to Wordpress API.

[jaswrks]

I had a similar problem just this morning in Gutenberg v1.8.0. Setting a background or text color on the block seems to push CloudFlare over the edge. Here's the full JSON export of the triggers that caused this. See: https://gist.github.com/jaswrks/e1985e071502099b53aac01f33b97b27

Inbound Anomaly Score Exceeded (Total Score: 66, SQLi=11, XSS=25)

[swarchen]

I have a similar problem just like @jaswrks . While updating the table or button elements of gutenberg editor. I will get 403 forbidden from cloudflare with

ID	Description	Group
981176	Inbound Anomaly Score Exceeded (Total Score: 69, SQLi=10, XSS=30): Last Matched Message: IE XSS Filters - Attack Detected.	OWASP Inbound Blocking	Filter
950109	Multiple URL Encoding Detected	OWASP Protocol Violations	Filter
950901	SQL Injection Attack: SQL Tautology Detected.	OWASP SQL Injection Attacks	Filter
960024	Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters	OWASP SQL Injection Attacks	Filter
960032	Method is not allowed by policy	OWASP HTTP Policy	Filter
973300	Possible XSS Attack Detected - HTML Tag Handler	OWASP XSS Attacks	Filter
973304	XSS Attack Detected	OWASP XSS Attacks	Filter
973306	XSS Attack Detected	OWASP XSS Attacks	Filter
973332	IE XSS Filters - Attack Detected.	OWASP XSS Attacks	Filter
973333	IE XSS Filters - Attack Detected.	OWASP XSS Attacks	Filter
973338	XSS Filter - Category 3: Javascript URI Vector	OWASP XSS Attacks	Filter
981133	Prequalify PM	OWASP Generic Attacks	Filter
981136	Check simple XSS patterns	OWASP XSS Attacks	Filter
981231	SQL Comment Sequence Detected.	OWASP SQL Injection Attacks	Filter
981243	Detects classic SQL injection probings 2/2	OWASP SQL Injection Attacks	Filter
981245	Detects basic SQL authentication bypass attempts 2/3	OWASP SQL Injection Attacks	Filter
981246	Detects basic SQL authentication bypass attempts 3/3	OWASP SQL Injection Attacks	Filter
981257	Detects MySQL comment-/space-obfuscated injections and backtick termination	OWASP SQL Injection Attacks	Filter

[youknowriad]

I'm afraid we can't do anything about this on our side. The REST API should allow storing any post content string and this is not a security issue IMO.

[jaswrks]

I wonder if anyone working on the REST API has been in contact with the OWASP team that works on the core ruleset, which is used by Mod Security and many web application firewalls, including CloudFlare. Referencing: https://coreruleset.org/

There's a file in the core ruleset with several WordPress exceptions, and it helps to avoid things like this. However, I don't see that any of the existing rules deal with raw HTML content being POSTd to JSON API endpoints. That seems like a problem.

If we have someone who has a contact at CloudFlare or with the OWASP core ruleset team, it would be awesome if they could inquire about adding JSON API exceptions. That may improve this situation, over time, across many hosts that use the core ruleset, including at CloudFlare.

[danielbachhuber]

For now, we should solve this problem with documentation. I've captured the CloudFlare issue to #4646

[zackkatz]

I had to whitelist my IP address to get this working. The rule that was triggered for me was Rule 981176.

ID	Description	Group
981176	Inbound Anomaly Score Exceeded (Total Score: 66, SQLi=14, XSS=25): Last Matched Message: XSS Attack Detected	OWASP Inbound Blocking	Filter
950901	SQL Injection Attack: SQL Tautology Detected.	OWASP SQL Injection Attacks	Filter
960024	Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters	OWASP Generic Attacks	Filter
973300	Possible XSS Attack Detected - HTML Tag Handler	OWASP XSS Attacks	Filter
973304	XSS Attack Detected	OWASP XSS Attacks	Filter
973306	XSS Attack Detected	OWASP XSS Attacks	Filter
973333	IE XSS Filters - Attack Detected.	OWASP XSS Attacks	Filter
973338	XSS Filter - Category 3: Javascript URI Vector	OWASP XSS Attacks	Filter
981018	End XSS pattern check	OWASP XSS Attacks	Filter
981133	Prequalify PM	OWASP Generic Attacks	Filter
981231	SQL Comment Sequence Detected.	OWASP SQL Injection Attacks	Filter
981243	Detects classic SQL injection probings 2/2	OWASP SQL Injection Attacks	Filter
981245	Detects basic SQL authentication bypass attempts 2/3	OWASP SQL Injection Attacks	Filter
981246	Detects basic SQL authentication bypass attempts 3/3	OWASP SQL Injection Attacks	Filter
981248	Detects chained SQL injection attempts 1/2	OWASP SQL Injection Attacks	Filter
981257	Detects MySQL comment-/space-obfuscated injections and backtick termination	OWASP SQL Injection Attacks	Filter
981306	SQL dual	OWASP SQL Injection Attacks	Filter
981307	SQL where	OWASP SQL Injection Attacks	Filter
2000001	Skip LFI Rules	OWASP Slr Et Lfi Attacks	Filter
2000003	Skip RFI Rules	OWASP Slr Et RFI Attacks	Filter
2000004	Skip SQLi Rules	OWASP Slr Et SQLi Attacks	Filter
2000005	Skip WordPress Rules	OWASP Slr Et WordPress Attacks	Filter
2000006	Skip XSS Rules	OWASP Slr Et XSS Attacks	Filter