Don't run request body completion checks when ProcessPartial and the input filter has't seen all of the body

[rainerjung]

Version: 2.9.3

Only run completion checks for request bodies, if we have
actually seen all of the body. In case ProcessPartial is configured
and our input filter only processed part of the request body, checking
for a complete request body makes no sense.

I will provide a pull request.

[dune73]

Thank you Rainer.

[tomsommer]

Relates to #1600 #1471

[markblackman]

Also relates to #1827

[zimmerle]

Relates to #1600 #1471

Also relates to #1827

All these three issues seem to be a consequence of ModSecurity been holding the filter data whenever the limit threshold is reached. However, in this very issue @rainerjung is not treating this specific problem. He did treat on #2092, therefore I am making a comment there mention the relation with the listed issues.

[zimmerle]

Hi @rainerjung,

Thank you for your patch.

I do have some concerns that, if you don't mind, I would like to discuss and understand your point of view.

SecRequestBodyLimitAction can assume two different values: Reject and ProcessPartial. When it is marked to Reject I understand that we may not need to inspect the request body contents. However, in the case of ProcessPartial we need to go over the request data no matter what. Because the user may have configured ModSecurity to validate a JSON, XML, or multipart considering the limit values. In other words: He may be looking for a JSON error to drop a request (or any other action). If we remove that check, we won't be processing the content partially, rather ignoring the content. Therefore not generating the error which is expected by the end user.

What do you think about that?