Christian Folini

Document rule exclusion pkg to plugin migration from CRS3 to CRS4 in separate blog post

7

No need to rush this before the CRS4 release. But it's something to accompany the documentation.

Investigate WAF-Payload-Collection on github

1

This is a list of links to online collections of WAF (bypass) payloads. Worth a closer look. https://github.com/mgm-sp/WAF-Payload-Collection

Investigate nemesida WAF Bypass tool

5

I took a peek at https://github.com/nemesida-waf/waf-bypass It runs a great many payloads against WAFs and reports bypasses and also a few FPs. CRS does OK, but still quite a few...

https://www.youtube.com/@owaspmodsecuritycoreruleset

Frequent use of content-encoding HTTP header by mobile clients

4

### Description Here is a selection of clients using the Content-Encoding HTTP request header that is now restricted via tx.restricted_header. Selection: ``` 160 imo-android 7334376963547694939 162 iPhone7,2/12.5.4 (16H50) 164 imo-android...

False negative on XML (941100 and 941120)

3

### Description An XML containing the following XSS is not flagged as attack. Ignored up to PL4: ``` $ curl -H "x-crs-paranoia-level: 4" -H "x-format-output: txt-matched-rules" -H "x-backend: apache" -H...

Contact listed in contributing doc is not accepting mail

2

## Describe the bug I sent an email to contact address listed in https://github.com/cloudflare/pingora/blob/main/.github/CONTRIBUTING.md This is the delivery failure I got: ``` Hello xxxx, We're writing to let you know...

Compilation failure on Ubuntu 22.04

1

Version: castget-rel_2_0_0 ``` $ configure --prefix=/usr/local/castget ... $ make make all-recursive make[1]: Entering directory '/tmp/castget-rel_2_0_0' Making all in tests make[2]: Entering directory '/tmp/castget-rel_2_0_0/tests' make[2]: Nothing to be done for 'all'....

Block proxy requests (GET http://example.org/ HTTP/1.1)

16

http://www.tutorialspoint.com/http/http_requests.htm mentions: ``` The absoluteURI is used when an HTTP request is being made to a proxy. The proxy is requested to forward the request or service from a valid...

Whitelist format of key HTTP request headers

5

We are blacklisting illegal request headers, but with Apache concatenating duplicate headers before we get a chance to count them etc. it makes sense to whitelist the format of several...