Monthly Chat Agenda December (2019-12-02)

[fzipi]

This is the Agenda for the Monthly CRS Chat.

The chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, December 2, at 20:30 CET.

Items on the Agenda:

PRs

• Fix potential ReDoS in 933180  #1495 - Fix potential ReDoS in 933180
• Migration of the CRS site on the OWASP wiki #1601 - Migration of the CRS site on the OWASP wiki
• New Rule 921190: HTTP Splitting #1610 - HTTP splitting
• Refactoring ModSecurity CRS Branch v3.3/dev #1627, Refactoring ModSecurity CRS Branch v3.2/dev  #1628, Refactoring ModSecurity CRS Branch v3.2/master #1629, Refactoring ModSecurity CRS Branch v3.1/dev  #1630 Repo refactoring, step 1 (See Make ModSecurity CRS repositories easier to manage #1600)

Open Issues

Other items

We have pulls for Refactoring ModSecurity CRS Branch v3.x/dev to further discuss or merge.

Feel free to add items as you see fit either above, or below as comments.

If you are not yet on the OWASP Slack, here is your invite: https://join.slack.com/t/owasp/shared_invite/enQtNjExMTc3MTg0MzU4LWQ2Nzg3NGJiZGQ2MjRmNzkzN2Q4YzU1MWYyZTdjYjA2ZTA5M2RkNzE2ZjdkNzI5ZThhOWY5MjljYWZmYmY4ZjM .
Everybody is welcome to join our community chat.

[theMiddleBlue]

should this be removed/changed? Isn't it no longer true? If yes, I can open a PR during the meeting:

owasp-modsecurity-crs/crs-setup.conf.example

Lines 166 to 168 in 7f22803

	# Rules in paranoia level 2 or higher will log their PL to the audit log;
	# example: [tag "paranoia-level/2"]. This allows you to deduct from the
	# audit log how the WAF behavior is affected by paranoia level.

[theMiddleBlue]

If we all agree, I would like to remove REQUEST_FILENAME from 933210 because it could lead to FPs as @emphazer reported in #1626 need more time to test, removed from agenda

[dune73]

Decisions

• Fix potential ReDoS in 933180  #1495 is being assigned to Walter (issue)
• Migration of the CRS site on the OWASP wiki #1601 is good to go from our perspective.
• New Rule 921190: HTTP Splitting #1610 has been used in prod without any FPs and is ready to be merged (Many millions of requests served)
• Refactoring ModSecurity CRS Branch v3.3/dev #1627 is merged as is. Older stable branches are not changed, crs-setup.conf won't be moved to example folder
• Make ModSecurity CRS repositories easier to manage #1600 We agree on the refactoring of the docker repo with a folder (vs branch) structure. A PR implementing this is welcome.
• dune73 will come with a proposal to get more sponsoring for our project until the next meeting