Skip to content

0.4.1

Choose a tag to compare

View all tags
@sascha-egerer sascha-egerer released this 20 Aug 20:37
· 53 commits to main since this release
0.4.1
0f2bbd6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Phirewall OWASP CRS Preset 0.4.1

A patch release with a behavioral fix and a refresh of the bundled OWASP Core Rule Set. There are no breaking changes and no upgrade steps.

📦 Ruleset update

  • OWASP Core Rule Set updated from v4.27.0 to v4.29.0. Automated import via the scheduled CRS Update workflow; the rules are filtered and split per paranoia level as before. See the upstream CRS release notes for the rule-level changes.

🔧 Behavioral fix

  • Nested cookie params no longer break REQUEST_COOKIES collection. PHP parses a bracketed cookie name (Cookie: foo[a]=1) into a nested array, exactly like query parameters. The collector cast every cookie value to string, so such a request raised an "Array to string conversion" warning (fatal under strict production error handlers) and the rules scanned the literal string Array instead of the cookie payload. The collector now flattens cookie params to their scalar leaf values, matching how ARGS already handles nested parameters, so nested cookie payloads are scanned by the rules. Requests without nested cookies behave exactly as before.

What's Changed

  • Flatten nested cookie params in REQUEST_COOKIES collection by @sascha-egerer in #9
  • Move the CRS update test gate to the pull request CI by @sascha-egerer in #10
  • Update OWASP CRS to v4.29.0 in #11

Full Changelog: 0.4.0...0.4.1

Contributors

sascha-egerer
Assets 2
Loading