flowd/phirewall-preset-owasp-crs 0.11.0

on PHP Packagist

Added

• A dead exclusion tag logs a warning. A tag-scoped exclusion is a silent no-op when no loaded rule carries its tag (e.g. a CRS 3 tag like OWASP_CRS/WEB_ATTACK/SQL_INJECTION against the CRS 4 snapshot, whose tags are attack-sqli and friends); with a PSR-3 logger on CoreRuleSetMatcher such a tag now logs a warning once the rules are loaded. Covers excludeTargetByTag() and the tag-scoped CRS exclusion directives and ctl: actions.
• Conditional target exclusions. Every excludeTarget* method on CoreRuleSet and CoreRuleSetMatcher accepts a when: condition (TargetExclusionConditionInterface or a closure fn (string $variable, ?string $name, string $value, ServerRequestInterface $request): bool - the manipulator argument order plus the request; a closure declaring fewer parameters ignores the rest): the selected entry is only excluded while the condition approves its value - e.g. skip SQLi inspection of ARGS:token only when the value is a signature-verified JWT. The request parameter enables context-dependent validation (per-host issuers, path-scoped rules). The condition runs only for entries the selector matches; exceptions it throws propagate like manipulator exceptions and follow the failure policy.
• Closure manipulators receive the request. addManipulator() / addManipulatorById() closures get the request as an additional fourth argument (string $variable, ?string $name, string $value, ServerRequestInterface $request) for context-dependent transformations; existing closures with fewer parameters are unaffected, and the three-parameter RequestValueManipulatorInterface is unchanged.
• CRS rule-exclusion syntax. applyRuleExclusions() / applyRuleExclusionsFromFile() on CoreRuleSet and CoreRuleSetMatcher (queued until the rules load, validated eagerly) parse the CRS tuning subset: the configure-time directives SecRuleRemoveById (ids and ranges), SecRuleRemoveByTag (exact tag), SecRuleUpdateTargetById / SecRuleUpdateTargetByTag (negated !TARGET removals), and runtime exclusion rules (SecRule ... "...,ctl:..." with ruleRemoveById, ruleRemoveByTag, ruleRemoveTargetById, ruleRemoveTargetByTag) evaluated before the scoring rules on every request. Forms the engine cannot evaluate faithfully fail eagerly (chained rules, unsupported operators or variables, target additions); unknown directives and other ctl: options are skipped. Exclusions remain runtime tuning and never enter the compiled-data cache.

Released together with the other Phirewall packages, see the release in flowd/phirewall-src. This repository is a read-only mirror.