Monthly Chat Agenda October 2021 (2021-10-04 and 2021-10-18)

[dune73]

This is the Agenda for the Monthly CRS Chat.

The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2021-10-04, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, 2021-10-18. That's the 3rd Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Items on the Agenda: (see previous meetings decisions: here)

What happend in the meantime since the chat last month

Outside development

• Trustwave has announced they stop selling ModSecurity services effective immediately and they will terminate existing support contracts by 2024.
• Swiss Post released a document where they describe the CRS tuning process to be able to run CRS at PL4 with anomaly thresholds 5/5.
• @dune73 did a detailed walk-though of the Swiss Post high security CRS setup built for internet voting in a presentation at RomHack2021
• New ELK support for ModSec Audit Logs

PRs that have been merged since the last meeting

• Fix broken links to spiderlabs blog #2213
• fix(links): update old links #2204
• Move ctl action in chained rule to 2nd rule #2202
• Amend rule 9004110 to use newer format for var #2200
• Added Max Leske to list of CRS devs #2196
• Add Paul Beckett to contributors file #2195
• Update CONTRIBUTORS.md #2194
• eradicate XMLNS FP in rule 941130 #2192
• Added test against FP when using urlDecode for 932140 #2191
• fix_2118 #2189
• feat(ci): use latest crs containers for testing #2188

We merged 11 PRs since the last monthly project chat.

Open PRs

• Don't cook hex escapes #2215 - review needed
• 941101 add request filename #2208 - tests are failing and we do not know why
• Amend regular expression pattern for rule 942440 #2201 - tests are failing and we do not know why
• feat(nightly): add nightly latest releases #2207 - nightly builds almost ready
• fix: consistent backslash escaping #2183 - we need to discuss this, also the failing tests
• Replace NodeJS Rule Set #2163 - need for a discussion
• Add prefix, suffix, and comments to regexp assemble data files #2149 - ready to be merged after conflicts are resolved
• Fix FP 953120 brotli compression #2101 - broetli woes
• fix ReDoS on 941140 #2050 - tests failing, otherwise, this might be good2go
• Draft: Plugins support + response body decompress plugin #1993 - minor changes needed

Open PRs marked DRAFT or work in progress or needs action

• Adding 'drop' keyword #2218 - tests are failing
• Exclusion list fot RoundCube webmail #2217 - marked as draft
• Fix 933210 Regex #2214 - marked as draft
• Refactored and tested version of rule-ctl script #2193 - not ready until the promised tests are there
• Fixing a typo in rule ID 9002840 #2190 - odd behaviour that @dune73 promised to investigate
• Detect JavaScript prototype pollution injection attempts #2070 - marked as draft
• Override modsec rule 200001 #2049 - postponed until dev retreat in October
• Proposal for a new plugin: Machine Learning on ModSecurity #2067
• Nextcloud 20 false-positives #1975

Open Issues - Separate Issues Meeting (Monday, 2021-10-18)

We concentrated on the dev retreat the week from October-23 instead of a regular issue chat.

Dev Retreat

See the two wiki docs:

• https://github.com/coreruleset/coreruleset/wiki/Dev-Retreat-Topics
• https://github.com/coreruleset/coreruleset/wiki/Dev-Retreat-2021-Infos

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp-slack.herokuapp.com/ .

Everybody is welcome to join our community chat.

[franbuehler]

Decisions

PRs

• Don't cook hex escapes #2215 - @franbuehler will review it
• 941101 add request filename #2208 - @RedXanadu will provide a better description and do a rebase to fix the failing tests
• Amend regular expression pattern for rule 942440 #2201 - also here, a rebase should fix the failing tests
• feat(nightly): add nightly latest releases #2207 - merged during meeting
• fix: consistent backslash escaping #2183 - PR is on good tracks, but we are really not sure of the exact syntax and of the effect. Skip PR and comment on the ticket.
• Replace NodeJS Rule Set #2163 - @theMiddleBlue will change REQUEST_BODY to FULL_REQUEST so that it works for both v2 and v3. Add some tests that proves that.
• Add prefix, suffix, and comments to regexp assemble data files #2149 - ready to be merged after conflicts are resolved
• Fix FP 953120 brotli compression #2101 - In fact there is no way to really detect broetli and if broetli is executed on the RP, we won't really know and it's all a mess and despite all the work that went into the review of this PR I think we have to close this. @spartantri proposed to do this as a plugin. closed
• fix ReDoS on 941140 #2050 - tests failing, otherwise, this might be good2go
• Draft: Plugins support + response body decompress plugin #1993 - stalled because dune73 need to communicate with azurit about this. It's all OK from his side, but it takes some adjustments how Walter and dune73 want the plugins to work.

Other items

Issues