SWAMPy

✎ CARVE FLESH

EDITING: modsec_scan.py

#!/bin/bash
# FIXME: workaround for bug https://cloudlinux.atlassian.net/browse/DEF-2271

# enable_scan_modsec lives in the (world-readable) nonprivileged config now;
# fall back to the privileged file if the key isn't there yet (upgrade window).
config=/etc/sysconfig/imunify360/imunify360-merged-nonprivileged.config
grep -q 'enable_scan_modsec:' "$config" 2>/dev/null \
    || config=/etc/sysconfig/imunify360/imunify360-merged.config

# Fail closed: skip the scan only when the config is readable AND scanning is
# explicitly off. An unreadable config means scan anyway, never silently pass.
if [ -r "$config" ] && ! grep -q 'enable_scan_modsec:\s*true' "$config"; then
    echo "1 OK"
    exit 1
fi

out=($(/usr/share/imunify360/scripts/modsec_scan_real.py "$@"))
echo "${out[@]}"
# Script prints one of two possible lines:
#   '1 OK' - when malware is not found in the file
#   '0 Attempt to upload malware' - when malware has been found in the file
# At the moment, Coraza does not handle script output properly:
#   https://github.com/corazawaf/coraza/pull/1311
# Thus we exit with code 1 to make Coraza pass the file and with code 0 to block the file.
# The original modsec 2.x don't care about exit code either, so it should handle it fine.
code=${out[0]}
[[ "$code" =~ ^[0-9]+$ ]] || code=1
exit $code

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 modsec_scan.py	PY	1.3 KB	2026-08-11 10:41	EDIT