Update OWASP CRS to 4.4.0

[jessebot]

I'd like to see the bundled OWASP_CRS/3.3.5 be updated to 4.4.0. You can view the changes to the major version in the release notes for 4.0.0.

Currently, in the logs, while using the helm chart (version 4.10.1), I see:

    "producer": {
      "modsecurity": "ModSecurity v3.0.12 (Linux)",
      "connector": "ModSecurity-nginx v1.0.3",
      "secrules_engine": "Enabled",
      "components": [
        "OWASP_CRS/3.3.5\""
      ]
    },

Which tracks with:

ingress-nginx/images/nginx/rootfs/build.sh

Line 66 in f228895

export OWASP_MODSECURITY_CRS_VERSION=v3.3.5

3.3.5 is from July last year. 4.4.0 would put us at June of this year.

Semi related to #10744 but that one is about updating ModSecurity itself, not the core rule set.

If all that's needed is submitting a PR to update that one line in images/nginx/rootfs/build.sh, I can submit that PR.

Thanks!

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jessebot]

It may also be worth noting that 4.x introduces the concept of plugins to the CRS:

Plugins are not part of the CRS 3.3.x release line. They are released officially with CRS 4.0.

• https://coreruleset.org/docs/concepts/plugins/

Perhaps in a future PR, it makes sense to take the plugin configs as ConfigMaps or Secrets to be templated out as volumeMounts that are present in /etc/nginx/owasp-modsecurity-crs/crs/plugins/. This is mostly useful when a user is running something with a large (or small but very serious) attack vector such as Nextcloud, which OWASP provides this plugin for: https://github.com/coreruleset/nextcloud-rule-exclusions-plugin

Getting the CRS updated to 4.4.0 is my first priority though.

[longwuyuan]

oh, this plugin thing is not 100% info. As in the impact on controller and managing expectations related to it.

cc @tao12345666333 seek comments because there is a PR now to bump OWASP which introduces previsously non0-existing feature of plugins for rulesets