Christian Folini

icon indicating a website link https://www.christian-folini.ch

icon company https://www.netnea.com icon location Berne, Switzerland icon location Webserver Fortification Engineer and Advisor in the Art of Defense. OWASP ModSecurity Core Rule Set Co-Lead.

Results 509 comments of Christian Folini

SecCollectionTimeout still being set in crs-setup.conf

A joint decision by the project. I'm adding it to the agenda for the next start of the month chat. In the hypothetical case RC comes out before that, we...

SecCollectionTimeout still being set in crs-setup.conf

So we decided in Oct 2023, to remove this and document accordingly. But we did not follow suit. Creating the necessary PRs now.

SecCollectionTimeout still being set in crs-setup.conf

Documentation PR: https://github.com/coreruleset/documentation/pull/113 crs-setup.conf PR: https://github.com/coreruleset/coreruleset/pull/3559 Closing this in favor of these PRs. And this should have been labelled v4, not sure why it slipped my attention.

feat: add test overrides for nginx

Thanks @theseion. Can we help you get this PR over the line? What is still missing here?

feat: add test overrides for nginx

That's a reasonable time frame. Thanks for the info. Do we need this for v4, or can the label be removed?

feat: add test overrides for nginx

Thank you

feat: add test overrides for nginx

Keeping my fingers crossed here ... :)

JSON-Based SQL Injection - Slow regex

Any update here? Also, is this something that **has to go into CRSv4**?

JSON-Based SQL Injection - Slow regex

Thank you. We'll just keep it open then.

Documentation covering when rule ranges can be used in rule exclusions is incorrect/incomplete

I confirm the ModSec2 column. I do not have a v3 readily at hand. Is there some merit in doing the same table for definitions of targets via regex?