Christian Folini

icon indicating a website link https://www.christian-folini.ch

icon company https://www.netnea.com icon location Berne, Switzerland icon location Webserver Fortification Engineer and Advisor in the Art of Defense. OWASP ModSecurity Core Rule Set Co-Lead.

Results 509 comments of Christian Folini

Unicode encoding (table) problem on engine level leading to CRS false positives (U+062F and U+D8AF resolving to slash)

On the ModSecurity front, Marc Stern found out, this is pretty much bogus. https://github.com/owasp-modsecurity/ModSecurity/issues/3294#issuecomment-2488400720

Plans for production readyness?

Thanks for writing in. We are working based on a preliminary project plan developed in Dec 2023 and Jan 2024. The project plan proposes to keep v2 productive and supported...

Inconsistent use of SecArgumentsLimit in Recommended Rules

I'm not sure I get your argument about the engine. All the blocking recommended rules do nothing unless you put the engine in - well - blocking mode. So what's...

Inconsistent use of SecArgumentsLimit in Recommended Rules

I see the redundancy and keeping multiple values in sync is annoying. If we recommend 200007, then I think the comment for `SecArgumentsLimit` should make it clear that a violation...

Inconsistent use of SecArgumentsLimit in Recommended Rules

That's a good thought. Would make sense.

RCE Bypass

Nice find.

feat: Block AI scraping bots

Thank you for your contribution @highpingblorg. I see the problem, yet I am skeptical about the proposed solution (like @RedXanadu in the original issue). For me, this is another iteration...

2,9,7 Appl Error 1000 in w3wp.exe Module ucrtbase.dll

Photo got here just find. Thanks.

Unicode encoding (table) problem on engine level leading to CRS false positives (U+062F and U+D8AF resolving to slash)

Is sent it to you via DM. I hope the problem is not on my client side. I did check the traffic with tcpdump.

Unicode encoding (table) problem on engine level leading to CRS false positives (U+062F and U+D8AF resolving to slash)

Ah sucks. You are totally right. We're sending raw unicode when we should be url-encoding it. This may explain other problems as well. @airween, @fzipi: Is ftw quantitative doing this...