v2: Accept requests whose body length is exactly equal to SecRequestBodyNoFilesLimit

[hnakamur]

what

Accept requests whose body length is exactly equal to SecRequestBodyNoFilesLimit.

why

The current implementation rejects requests when their body length is equal to SecRequestBodyNoFilesLimit.
However, according to the documented behavior, requests up to and including this limit should be accepted.

references

• The documentation states: “Configures the maximum request body size ModSecurity will accept for buffering, excluding the size of any files being transported in the request.” https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-%28v2.x%29#user-content-SecRequestBodyNoFilesLimit
• Tests verifying that requests with a body length equal to SecRequestBodyNoFilesLimit are accepted in v3:: Refine SecRequestBodyNoFilesLimit test cases to cover edge scenarios #3479

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
2 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR fixes an off-by-one error in the SecRequestBodyNoFilesLimit implementation to correctly accept requests whose body length is exactly equal to the configured limit, aligning with documented behavior and v3 implementation.

Changes:

• Changed comparison operator from >= to > in two locations in apache2/msc_reqbody.c to allow bodies exactly equal to the limit
• Added comprehensive regression tests to verify both the boundary case (body length equals limit) and the rejection case (body length exceeds limit)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
apache2/msc_reqbody.c	Fixed two comparison checks to use > instead of >= for SecRequestBodyNoFilesLimit validation
tests/regression/config/10-request-directives.t	Added test cases to verify requests with body length equal to and exceeding the limit are handled correctly

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[airween]

Hi @hnakamur,

nice catch, thank you! I'm surprised this operational anomaly has remained hidden until now.

Special thanks for new tests.