Monthly Chat Agendas October (2020-10-05 and 2020-10-19) #1892

dune73 · 2020-10-02T14:01:41Z

This is the Agenda for the Monthly CRS Chats.

The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, October 5th, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, October 19th. That's the 3rd Monday of the month.

Items on the Agenda: (see previous meetings decisions: here)

PRs

WordPress: add exclusion for site-health.php 'SQL server' response #1895 WordPress: add exclusion for site-health.php 'SQL server' response
Wordpress FP fixes #1894 Wordpress FP fixes
phpBB exclusion rules file #1893 new phpBB exclusion package
Eliminate FPs in 932100 by ignoring html decimal entities before dot sign and space or new line #1887 Eliminate FPs in 932100 by ignoring html decimal entities before dot sign and space or new line
Link fix for docs/OWASP-CRS-Documentation submodule #1885 Link fix for docs/OWASP-CRS-Documentation submodule
Fix FP while creating/editing a post in vanilla WordPress #1879 Fix FP while creating/editing a post in vanilla WordPress
Permit "version" string in content-type header, rebased to 3.4 + test #1877 Permit "version" string in content-type header, rebased to 3.4 + test
Drop log from most rules #1876 Drop log from most rules
Migrate PR: RE2 compatibility for 920120 #1868 Migrate PR: RE2 compatibility for 921120
Permit "version" string in content-type header #1848 Permit "version" string in content-type header (PR needs some love from a team member)
Stop decoding things twice #1845 Stop decoding things twice

PRs mared "work in progress" / needs action

Ntimo v3.4/nextcloud settings overview #1878 Ntimo v3.4/nextcloud settings overview
feat(ftw): use master to get py3 support #1846 feat(ftw): use master to get py3 support
Fix false positives with rule 942360 #1817 Fix false positives with rule 942360
Rebase PR #1794 #1910 Fix bypass 942190
SQLi using set var at PL2 #1793 SQLi using set var at PL1
Suppress rule 200002 when Nextcloud mobile app accesses shares through API #1847 Suppress rule 200002 when Nextcloud mobile app accesses shares through API (probably superseded by Ntimo v3.4/nextcloud settings overview #1878)
Rule 921110 #1883 FP at 921110, request smuggling rule

Other items

Results of the CRS Kindergarden request for comment. This side project is now fully fleshed out with feedback incorporated, but CRS Meetings needs to decide on the name
CVE-2020-15998, the publication and the development of the situation since the publication.
Ever since we released 3.3, the reports of FP are accelerating and we're not keeping up with the issues. The separate issue chat is seeing low attention (it was only 3 of us in September)
@azurit would like to create a new rule file to cover various new CVEs. This ought to be discussed. Namely the idea to cover them in a separate rule file.
Developer Meetup in Eindhoven: Security feedback from production with OWASP CRS (October 8, 4pm CEST): https://www.meetup.com/Eindhoven-Developers-Meetup/events/272843991/
RedHat article covering CRS: https://www.redhat.com/sysadmin/introducing-wafs

Open Issues - Separate Issues Meeting (Monday, October 19th)

We generally cover 10 issues per month in a separate issue meeting. Add them as you see fit.

Issue slot 1: False positives on default Nextcloud exception enabled #1197: False positives on default Nextcloud exception enabled
Issue slot 2: Proposal to include monitoring agents exceptions in a new data file #1589: Proposal to include monitoring agents exceptions in a new data file
Issue slot 3: Stop decoding things twice #1845: Stop decoding things twice - ModSec developer replied
Issue slot 4: Rule 921110 #1883: Rule 921110 - a possible solution: here.
Issue slot 5: Eliminate FPs in 932100 by ignoring html decimal entities before dot sign and space or new line #1887: Actually a Pull Request. It wants to add negative look behinds. Don't we want to avoid them because of re2 compatibility (see RE2 compatibility for 920120 #1663). I need to know that for my review.
Issue slot 6: Many false positives with 942360 #1816: Many false positives with 942360
Issue slot 7: Unable to load photos in NextCloud - receiving error 403 for PROPFIND #1891: Unable to load photos in NextCloud - receiving error 403 for PROPFIND
Issue slot 8: Bug in how the variables tx.inbound_anomaly_score is used? #1896: Bug in how the variables tx.inbound_anomaly_score is used?
Issue slot 9: Simple request header SQL injection not triggered untill paranoia level 3 #1904: Simple request header SQL injection not triggered until paranoia level 3
Issue slot 10: False positives from 931100, 931120, and 931130 #1905: False positives from 931100, 931120, and 931130

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp-slack.herokuapp.com/ .

Everybody is welcome to join our community chat.

The text was updated successfully, but these errors were encountered:

franbuehler · 2020-10-05T19:11:47Z

Decisions

PRs

WordPress: add exclusion for site-health.php 'SQL server' response #1895 WordPress: add exclusion for site-health.php 'SQL server' response - merged
Wordpress FP fixes #1894 Wordpress FP fixes - @lifeforms will withdraw his commit from the PR - issue rescheduled for the next chat meeting
phpBB exclusion rules file #1893 new phpBB exclusion package - replace rx with within, outcomment last rule, will be discussed further in the PR
Eliminate FPs in 932100 by ignoring html decimal entities before dot sign and space or new line #1887 Eliminate FPs in 932100 by ignoring html decimal entities before dot sign and space or new line - @piotrpazola will add tests, @franbuehler will review it, rescheduled for next meeting
Link fix for docs/OWASP-CRS-Documentation submodule #1885 Link fix for docs/OWASP-CRS-Documentation submodule - merged
Fix FP while creating/editing a post in vanilla WordPress #1879 Fix FP while creating/editing a post in vanilla WordPress - needs action
Permit "version" string in content-type header, rebased to 3.4 + test #1877 Permit "version" string in content-type header, rebased to 3.4 + test - needs action
Drop log from most rules #1876 Drop log from most rules - merged
Migrate PR: RE2 compatibility for 920120 #1868 Migrate PR: RE2 compatibility for 921120 - @dune73 wants to write a blog post about it, rescheduled for next meeting
Permit "version" string in content-type header #1848 Permit "version" string in content-type header (PR needs some love from a team member) - closed, will be added in #Permit "version" string in content-type header, rebased to 3.4 + test #1877
Stop decoding things twice #1845 Stop decoding things twice - PR has conflict now, @fgsch adds more information, then it could be merged, rescheduled for next meeting

PRs mared "work in progress" / needs action

Ntimo v3.4/nextcloud settings overview #1878 Ntimo v3.4/nextcloud settings overview - merged
feat(ftw): use master to get py3 support #1846 feat(ftw): use master to get py3 support - one test still fails, needs some more work, leave the PR open
Fix false positives with rule 942360 #1817 Fix false positives with rule 942360 - not ready to merge right now, @franbuehler and @lifeforms will look into it
Fix bypass 942190 #1794 Fix bypass 942190 - @theMiddleBlue wants to finish it
SQLi using set var at PL2 #1793 SQLi using set var at PL1 - @theMiddleBlue wants to finish it*
Suppress rule 200002 when Nextcloud mobile app accesses shares through API #1847 Suppress rule 200002 when Nextcloud mobile app accesses shares through API - rebase open, can be merged afterwards
Issue: Rule 921110 #1883 FP at 921110, request smuggling rule - rescheduled for next meeting

Other items

Name of CRS Kindergarten is......... incubator voting ended at 22:25:00.000 ;-)
CVE-2020-15998, the publication and the development of the situation since the publication - CVE is still in reserved state

Slack is down

We postpone the following other 'other items' because of Slack downtime:

Ever since we released 3.3, the reports of FP are accelerating and we're not keeping up with the issues. The separate issue chat is seeing low attention (it was only 3 of us in September)
@azurit would like to create a new rule file to cover various new CVEs. This ought to be discussed. Namely the idea to cover them in a separate rule file.
Developer Meetup in Eindhoven: Security feedback from production with OWASP CRS (October 8, 4pm CEST): https://www.meetup.com/Eindhoven-Developers-Meetup/events/272843991/
RedHat article covering CRS: https://www.redhat.com/sysadmin/introducing-wafs

Open Issues

Issue slot 1: False positives on default Nextcloud exception enabled #1197: False positives on default Nextcloud exception enabled (we'll ask @emphazer to take this one)
Issue slot 2: Proposal to include monitoring agents exceptions in a new data file #1589: Proposal to include monitoring agents exceptions in a new data file (@theMiddleBlue takes this one)
Issue slot 3: Stop decoding things twice #1845: Stop decoding things twice - ModSec developer replied (@airween would like to discuss that with @fgsch)
Issue slot 4: Rule 921110 #1883: Rule 921110 - a possible solution: here. (@airween will open a PR)
Issue slot 5: Eliminate FPs in 932100 by ignoring html decimal entities before dot sign and space or new line #1887: Actually a Pull Request. It wants to add negative look behinds. Don't we want to avoid them because of re2 compatibility (see RE2 compatibility for 920120 #1663). I need to know that for my review. (@piotrpazola tries to find a solution without negative look behinds)
Issue slot 6: Many false positives with 942360 #1816: Many false positives with 942360 (@Taiki-San will check it)
Issue slot 7: phpBB exclusion rules file #1893: phpBB exclusion rules file (@lifeforms)
Issue slot 8: Unable to load photos in NextCloud - receiving error 403 for PROPFIND #1891: Unable to load photos in NextCloud (we will ask @emphazer)
Issue slot 9: Bug in how the variables tx.inbound_anomaly_score is used? #1896: Bug in how variable is used (@dune73 volunteers to take this one)
Issue slot 10: Simple request header SQL injection not triggered untill paranoia level 3 #1904: Simple request header SQL injection not triggered until paranoia level 3 (@franbuehler volunteers to have a look at this one)

dune73 added ➕ False Positive 🔖 Meeting Agenda and removed ➕ False Positive labels Oct 2, 2020

franbuehler mentioned this issue Oct 19, 2020

Eliminate FPs in 932100 by ignoring html decimal entities before dot sign and space or new line #1887

Closed

dune73 mentioned this issue Nov 2, 2020

Monthly Chat Agendas November (2020-11-02 and 2020-11-16) #1916

Closed

franbuehler closed this as completed Dec 5, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Monthly Chat Agendas October (2020-10-05 and 2020-10-19) #1892

Monthly Chat Agendas October (2020-10-05 and 2020-10-19) #1892

Uh oh!

Uh oh!

Monthly Chat Agendas October (2020-10-05 and 2020-10-19) #1892

Monthly Chat Agendas October (2020-10-05 and 2020-10-19) #1892

Comments

Uh oh!

PRs

PRs mared "work in progress" / needs action

Other items

Open Issues - Separate Issues Meeting (Monday, October 19th)

How to get to our slack and join the meeting?

Uh oh!

Decisions

PRs

PRs mared "work in progress" / needs action

Other items

Open Issues

Uh oh!