Add RateLimit to list of acceptable rate limiting headers

[darrenspurgeon]

Enhancement request

In looking at the rule owasp-rate-limit and comparing against the RateLimit IETF draft, I wonder if we could add one more header string to the list of acceptable header names.

In the function GetOWASPRateLimitRule() (vacuum/rulesets/owasp_ruleset_functions.go), the following acceptable string values for RateLimit headers are defined:

• xRatelimitLimit = "X-RateLimit-Limit"
• xRateLimitLimit = "X-Rate-Limit-Limit"
• ratelimitLimit = "RateLimit-Limit||RateLimit-Reset"

Those are certainly common, and in the draft the authors refer to the combined header RateLimit as a dictionary and examples show a combined header for limit, remaining, and reset tokens. In reviewing some of that team's Github PRs and commentary, they refer to RateLimit and its dictionary as the new style being proposed. For example:

HTTP/1.1 200 Ok
Content-Type: application/json
RateLimit: limit=100, remaining=0, reset=50

Can we add this to the list of acceptable values? It would be an additional var entry like: ratelimit = "RateLimit" and then adding it to the FunctionOptions below in the model rule.

[daveshanley]

Yes, we can add it. Please feel free to submit a PR!

[daveshanley]

This was added in v0.9.9

https://github.com/daveshanley/vacuum/blob/main/rulesets/owasp_ruleset_functions.go#L277

[darrenspurgeon]

An official thank you, sir!