Skip to content

Commit

Permalink
updates to CRS 4.5 (#26)
Browse files Browse the repository at this point in the history
  • Loading branch information
@M4tteoP
M4tteoP authored Jul 25, 2024
1 parent 70e5053 commit 705a226
Show file tree
Hide file tree
Showing 318 changed files with 65,366 additions and 65,695 deletions.
54 changes: 27 additions & 27 deletions rules/@crs-setup.conf.example
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ------------------------------------------------------------------------
# OWASP CRS ver.4.4.0
# OWASP CRS ver.4.5.0
# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
# Copyright (c) 2021-2024 CRS project. All rights reserved.
#
Expand Down Expand Up @@ -181,7 +181,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.blocking_paranoia_level=1"


Expand Down Expand Up @@ -209,7 +209,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.detection_paranoia_level=1"


Expand All @@ -235,7 +235,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.enforce_bodyproc_urlencoded=1"


Expand Down Expand Up @@ -270,7 +270,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.critical_anomaly_score=5,\
# setvar:tx.error_anomaly_score=4,\
# setvar:tx.warning_anomaly_score=3,\
Expand Down Expand Up @@ -324,7 +324,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.inbound_anomaly_score_threshold=5,\
# setvar:tx.outbound_anomaly_score_threshold=4"

Expand Down Expand Up @@ -385,7 +385,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.reporting_level=4"


Expand Down Expand Up @@ -417,7 +417,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.early_blocking=1"


Expand All @@ -438,7 +438,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.enable_default_collections=1"


Expand Down Expand Up @@ -466,7 +466,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"

# Content-Types that a client is allowed to send in a request.
Expand Down Expand Up @@ -496,7 +496,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# nolog,\
# tag:'OWASP_CRS',\
# ctl:ruleRemoveById=920420,\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# chain"
# SecRule REQUEST_URI "@rx ^/foo/bar" \
# "t:none"
Expand All @@ -510,7 +510,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/cloudevents+json| |application/cloudevents-batch+json|'"

# Allowed HTTP versions.
Expand All @@ -526,7 +526,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0'"

# Forbidden file extensions.
Expand All @@ -550,7 +550,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'"

# Restricted request headers.
Expand Down Expand Up @@ -595,7 +595,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:'tx.restricted_headers_basic=/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/'"
#
# [ Extended ]
Expand All @@ -621,7 +621,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:'tx.restricted_headers_extended=/accept-charset/'"

# Content-Types charsets that a client is allowed to send in a request.
Expand All @@ -635,7 +635,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'"

#
Expand All @@ -661,7 +661,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.max_num_args=255"

# Block request if the length of any argument name is too high
Expand All @@ -675,7 +675,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.arg_name_length=100"

# Block request if the length of any argument value is too high
Expand All @@ -689,7 +689,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.arg_length=400"

# Block request if the total length of all combined arguments is too high
Expand All @@ -703,7 +703,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.total_arg_length=64000"

# Block request if the file size of any individual uploaded file is too high
Expand All @@ -717,7 +717,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.max_file_size=1048576"

# Block request if the total size of all combined uploaded files is too high
Expand All @@ -731,7 +731,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.combined_file_sizes=1048576"


Expand Down Expand Up @@ -771,7 +771,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# pass,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.sampling_percentage=100"


Expand All @@ -792,7 +792,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# t:none,\
# nolog,\
# tag:'OWASP_CRS',\
# ver:'OWASP_CRS/4.4.0',\
# ver:'OWASP_CRS/4.5.0',\
# setvar:tx.crs_validate_utf8_encoding=1"


Expand All @@ -814,5 +814,5 @@ SecAction \
t:none,\
nolog,\
tag:'OWASP_CRS',\
ver:'OWASP_CRS/4.4.0',\
setvar:tx.crs_setup_version=440"
ver:'OWASP_CRS/4.5.0',\
setvar:tx.crs_setup_version=450"
Loading

0 comments on commit 705a226

Please sign in to comment.