feat: updates to CRS 4.1. (#19)

corazawaf · Apr 1, 2024 · 4ab9fb3 · 4ab9fb3
1 parent f8119fa
commit 4ab9fb3
Show file tree

Hide file tree

Showing 44 changed files with 2,219 additions and 794 deletions.
diff --git a/rules/@crs-setup.conf.example b/rules/@crs-setup.conf.example
@@ -1,5 +1,5 @@
 # ------------------------------------------------------------------------
-# OWASP CRS ver.4.0.0
+# OWASP CRS ver.4.1.0
 # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
 # Copyright (c) 2021-2024 CRS project. All rights reserved.
 #
@@ -180,6 +180,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.blocking_paranoia_level=1"
 
 
@@ -206,6 +208,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.detection_paranoia_level=1"
 
 
@@ -230,6 +234,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.enforce_bodyproc_urlencoded=1"
 
 
@@ -263,6 +269,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.critical_anomaly_score=5,\
 #    setvar:tx.error_anomaly_score=4,\
 #    setvar:tx.warning_anomaly_score=3,\
@@ -315,6 +323,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.inbound_anomaly_score_threshold=5,\
 #    setvar:tx.outbound_anomaly_score_threshold=4"
 
@@ -374,6 +384,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.reporting_level=4"
 
 
@@ -404,6 +416,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.early_blocking=1"
 
 
@@ -423,6 +437,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.enable_default_collections=1"
 
 
@@ -449,6 +465,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
 
 # Content-Types that a client is allowed to send in a request.
@@ -476,7 +494,9 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
 #    ctl:ruleRemoveById=920420,\
+#    ver:'OWASP_CRS/4.1.0',\
 #    chain"
 #    SecRule REQUEST_URI "@rx ^/foo/bar" \
 #        "t:none"
@@ -489,6 +509,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json|'"
 
 # Allowed HTTP versions.
@@ -503,6 +525,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0'"
 
 # Forbidden file extensions.
@@ -525,6 +549,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"
 
 # Restricted request headers.
@@ -568,6 +594,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:'tx.restricted_headers_basic=/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'"
 #
 # [ Extended ]
@@ -592,6 +620,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:'tx.restricted_headers_extended=/accept-charset/'"
 
 # Content-Types charsets that a client is allowed to send in a request.
@@ -604,6 +634,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'"
 
 #
@@ -628,6 +660,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.max_num_args=255"
 
 # Block request if the length of any argument name is too high
@@ -640,6 +674,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.arg_name_length=100"
 
 # Block request if the length of any argument value is too high
@@ -652,6 +688,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.arg_length=400"
 
 # Block request if the total length of all combined arguments is too high
@@ -664,6 +702,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.total_arg_length=64000"
 
 # Block request if the file size of any individual uploaded file is too high
@@ -676,6 +716,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.max_file_size=1048576"
 
 # Block request if the total size of all combined uploaded files is too high
@@ -688,6 +730,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.combined_file_sizes=1048576"
 
 
@@ -726,6 +770,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    phase:1,\
 #    pass,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.sampling_percentage=100"
 
 
@@ -745,6 +791,8 @@ SecDefaultAction "phase:2,log,auditlog,pass"
 #    pass,\
 #    t:none,\
 #    nolog,\
+#    tag:'OWASP_CRS',\
+#    ver:'OWASP_CRS/4.1.0',\
 #    setvar:tx.crs_validate_utf8_encoding=1"
 
 
@@ -765,4 +813,6 @@ SecAction \
     pass,\
     t:none,\
     nolog,\
-    setvar:tx.crs_setup_version=400"
+    tag:'OWASP_CRS',\
+    ver:'OWASP_CRS/4.1.0',\
+    setvar:tx.crs_setup_version=410"