Monthly Chat Agenda June (2021-06-07 and 2021-06-21) #2074

dune73 · 2021-05-13T13:13:17Z

This is the Agenda for the Monthly CRS Chat.

The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, June 7, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, June 21. That's the 3rd Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Items on the Agenda: (see previous meetings decisions: here)

What happend in the meantime since the chat last month

Outside development

Domain coreruleset.org supports DNSSEC now: https://dnssec-analyzer.verisignlabs.com/coreruleset.org
Coraza-WAF is a go-lang implementation of a WAF meant to run CRS: https://github.com/jptosso/coraza-waf
How to audit a CRS installation: Blog Post by Mark Zeman / @MazeOfThoughts: https://www.scip.ch/en/?labs.20210513
Blog post about the CRS Sampling Mode https://www.netnea.com/cms/2021/05/25/the-owasp-crs-sampling-mode/
Blog post how to handle (CRS) false positives with the Kemp Loadmaster by @dune73 https://kemptechnologies.com/blog/false-positive-handling-loadbalancer/
Blog post how to create custom rules on the Kemp Loadmaster by @dune73 https://kemptechnologies.com/blog/deploying-custom-rules-on-loadmaster/
CRS was featured on Mark Miller's OWASP Flagship project series podcast together with OWASP Zap and OWASP Dependency Check https://try.jupiterone.com/podcast-owasp-flagship-projects-episode-01
The 10,000th blog post how to get CRS up and running on Apache2 https://www.linode.com/docs/guides/securing-apache2-with-modsecurity

PRs that have been merged since the last meeting

Fix for issue #1922 #1958: Fix for issue Rules blocking Google OAuth2 redirect (callback) URLs #1922 (FP with Google OAuth2)
Fixes for few phpBB FPs #2057: Fixes for few phpBB FPs
Rewording CONTRIBUTING.md #2077: Rewording CONTRIBUTING.md
fix(tests): use only valid yaml in tests #2080: fix(tests): use only valid yaml in tests
Added change version helper tool #2085: Added change version helper tool
feat(copyright): update copyright to new organization #2086: feat(copyright): update copyright to new organization
Moved --> keyword from 941180 (PL1) into new stricter sibling rule 941181 (PL2) #2060 #2088: keyword from 941180 (PL1) into new stricter sibling rule 941181 (PL2) PL 1 False Positive on Blacklist Keywords from Node-Validator #2060
Typo in Sampling Mode description pointing to the wrong rule in crs-setup.conf #2090: Typo in Sampling Mode description pointing to the wrong rule in crs-setup.conf
Adding WEB-INF into restricted-files.data #2092: Adding WEB-INF into restricted-files.data
A small cosmetic fix: added missing space after comment mark #2097: A small cosmetic fix: added missing space after comment mark
Added a note to a commented rule about unsupported action in v3 #2098: Added a note to a commented rule about unsupported action in v3
Solve FP 942300 and add tests #2099: Solve FP 942300 and add tests
Update version strings to 3.4.0-dev #2100: Update version strings to 3.4.0-dev
Add two tests for fp 921110 request smuggling #2102: Add two tests for fp 921110 request smuggling
Added directories needed for volume mounts to Git. #2103: Added directories needed for volume mounts to Git.
fix(ci): try fixing stale issues workflow #2111: fix(ci): try fixing stale issues workflow

We merged 16 PRs since the last monthly project chat.

Open PRs

Add rule-ctl.py script #2068: Add rule-ctl.py script
Detect JavaScript prototype pollution injection attempts #2070: Detect JavaScript prototype pollution injection attempts
Remove statement that is confusing in this context #2072: Remove statement that is confusing in this context
Adding word boundary to lower FPs #2078: Adding word boundary to lower FPs
Improve sampling efficiency2 #2094: Improve sampling efficiency2
Fix FP 953120 brotli compression #2101: Fix FP 953120 brotli compression
Little performance fixies #2106: Little performance fixies
Use chained end tag detection for rule 941310 #2107: Use chained end tag detection for rule 941310
fix_#2110 #2112: fix_#2110 (FP)
Fix_#2113 #2115: fix_#2113
Web shells - alternative version #2116: Web shells: Alternative version

Open PRs marked DRAFT or work in progress or needs action

Nextcloud 20 false-positives #1975: Nextcloud 20 false-positives
Draft: Plugins support + response body decompress plugin #1993: Draft: Plugins support + response body decompress plugin
Move 941310 from PL1 to PL2 #2014: Move 941310 from PL1 to PL2
Override modsec rule 200001 #2049: Override modsec rule 200001
fix ReDoS on 941140 #2050: fix ReDoS on 941140
932200 Linux RCE evasion with (more) uninitialized bash parameters #2052: 932200 Linux RCE evasion with (more) uninitialized bash parameters
New XXE rule file (again) #2061: New XXE rule file (again)
Proposal for a new plugin: Machine Learning on ModSecurity #2067: Proposal for a new plugin: Machine Learning on ModSecurity
Replace blacklist and whitelist with deny list and allow list #2084: Replace blacklist and whitelist with deny list and allow list

Other items

Sponsoring status
Dev on Duty status
Do we want to replace the terms "blacklist" and "whitelist" with terms like "denylist" and "allowlist" where this is suiteable? See PR Replace blacklist and whitelist with deny list and allow list #2084.
Testing

Open Issues - Separate Issues Meeting (Monday, 21-06-2021)

Status of issues covered last month:

Issue slot 1: Rule: 942100 False positive 0202 #2076 - Rule: 942100 False positive 0202 - closed
Issue slot 2: OData queries and FetchXML queries result in a lot of false positives, even for Paranoia Level 1 #2073 - OData queries and FetchXML queries result in a lot of false positives, even for Paranoia Level 1 - closed
Issue slot 3: False positive on parameter value XMLNS #2071 - False positive on parameter value XMLNS - rescheduled
Issue slot 4: Enabling nextdloud exclusion --> Expecting an action, got: ctl:requestBodyLimit=1073741824" #2069 - Enabling nextcloud exclusion --> Expecting an action, got: ctl:requestBodyLimit=1073741824" (lack of ctl:requestBodyLimit in v3) - closed
Issue slot 5: brotli compression - false positive #2064 - brotli compression - false positive - closed
Issue slot 6: Broken testcase for 932100 #2062 - Broken testcase for 932100 - rescheduled
Issue slot 7: PL 1 False Positive on Blacklist Keywords from Node-Validator #2060 - PL 1 False Positive on Blacklist Keywords from Node-Validator - closed
Issue slot 8: Rule Id: 932150 false positive on time keyword #2044 - Rule Id: 932150 false positive on time keyword False Positive - rescheduled
Issue slot 9: 942300 matching "for ? (" when it's expected to find OR? #2007 - 942300 matching "for ? (" when it's expected to find OR? - closed
Issue slot 10: Rule: 942190: False positive 0202 #2075 - Rule: 942190: False positive 0202 - closed
Issue slot 11: False positive for rule 921110 #2054 - False positive for rule 921110 - closed
Issue slot 12: Use the upcoming version in 'ver' actions on our dev branch #1917 - Use the upcoming version in 'ver' actions on our dev branch - closed

Stats:

Covered in chat: 12
Pending: 3 (re-scheduled)
Closed: 9

We generally cover 10 issues per month in a separate issue meeting. Add them as you see fit.

Issue slot 1: FPs with Cloudflare proxy and paranoia 4 #2117 FPs with Cloudflare proxy and paranoia 4 - to solve or not to solve?
Issue slot 2: Extend util/regexp-assemble/regexp-93210X.txt with additional unix commands #2128 Extend util/regexp-assemble/regexp-93210X.txt with additional unix commands
Issue slot 3: Add exclusion set for OData standard #2127 Add exclusion set for OData standard
Issue slot 4: Sort out FPs around Matomo cookies #2109 Sort out FPs around Matomo cookies
Issue slot 5: Rule id: 930100 does not check for Single dot directory and semicolon #2105 Rule id: 930100 does not check for Single dot directory and semicolon
Issue slot 6: Error 403 when saving settings at /wp-admin/index.php?page=aioseo-setup-wizard#/category #2095 Error 403 when saving settings at /wp-admin/index.php?page=aioseo-setup-wizard#/category
Issue slot 7: Replace references to blacklist and whitelist with denylist and allowlist respectively #2083 Replace references to blacklist and whitelist with denylist and allowlist respectively
Issue slot 8: False positive on parameter value XMLNS #2071 False positive on parameter value XMLNS
Issue slot 9: Broken testcase for 932100 #2062 Broken testcase for 932100
Issue slot 10: Rule Id: 932150 false positive on time keyword #2044 Rule Id: 932150 false positive on time keyword

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp-slack.herokuapp.com/ .

Everybody is welcome to join our community chat.

The text was updated successfully, but these errors were encountered:

franbuehler · 2021-06-07T18:44:56Z

Decisions

PRs

Add rule-ctl.py script #2068: Add rule-ctl.py script - @airween, @fzipi and Paul Beckett will test this
Detect JavaScript prototype pollution injection attempts #2070: Detect JavaScript prototype pollution injection attempts: we merge into v3.4/dev and we also add it to the incubator. @lifeforms will do a PR.
Remove statement that is confusing in this context #2072: Remove statement that is confusing in this context - this PR is not correct. The original text is correct, that's what header injection does. We'll reject this PR.
Adding word boundary to lower FPs #2078: Adding word boundary to lower FPs - @theseion will review this one
Improve sampling efficiency2 #2094: Improve sampling efficiency2 - @theMiddleBlue will review this one
Fix FP 953120 brotli compression #2101: Fix FP 953120 brotli compression - @azurit will review it (@franbuehler will first implement @theseion's hint)
Little performance fixies #2106: Little performance fixies - merged during chat meeting
Use chained end tag detection for rule 941310 #2107: Use chained end tag detection for rule 941310 - @franbuehler will setup a call with @theseion who will help with the review (next week)
fix_#2110 #2112: fix_#2110 (FP) - @theseion will review this PR
Fix_#2113 #2115: fix_#2113 - @theseion will review this PR.
Web shells - alternative version #2116: Web shells: Alternative version - merge into 3.4/dev after @fzipi and @lifeforms's review. And also add it to the incubator. @azurit will provide a PR.

Other items

Sponsoring status
Dev on Duty status - we continue, it's good for the project and we learn a lot during these weeks.
Do we want to replace the terms "blacklist" and "whitelist" with terms like "denylist" and "allowlist" where this is suiteable? See PR Replace blacklist and whitelist with deny list and allow list #2084. -> yes. We agree on not changing the CHANGES file.
Testing - regex assemble scripts - @theseion will maybe provide a PR with some documentation
- There are 3 situations
  - (1) the traditional situation uses the perl scrip to get a performance optimized regex
  - (2) thre are some situations, namely in bash context IIRC where we want to make sure escape attempts are not working. Walter wrote a python script to exclude these. Apply it after the traditional perl script.
  - (3) somewhere in the 3.3. release cycle we encountered a special situation where we had to adopt the traditional perl script and we pushed the plan to sync the two scripts into a single one again into the future and nobody sat down to execute on this plan.

Open Issues - Separate Issues Meeting (Monday, June 21st)

Issue slot 1: FPs with Cloudflare proxy and paranoia 4 #2117 FPs with Cloudflare proxy and paranoia 4 - to solve or not to solve? - closed - Policy is, we don't fix PL4.
Issue slot 2: Extend util/regexp-assemble/regexp-93210X.txt with additional unix commands #2128 Extend util/regexp-assemble/regexp-93210X.txt with additional unix commands - PR available: feat(rce): extend Unix RCE commands #2129
Issue slot 3: Add exclusion set for OData standard #2127 Add exclusion set for OData standard - @theseion takes this and @fzipitria coaches him
Issue slot 4: Sort out FPs around Matomo cookies #2109 Sort out FPs around Matomo cookies - It only affects PL2 -> blog post on how to handle this - @lifeforms
Issue slot 5: Rule id: 930100 does not check for Single dot directory and semicolon #2105 Rule id: 930100 does not check for Single dot directory and semicolon - close this with explanation and ask the reporter to explain the problem
Issue slot 6: Error 403 when saving settings at /wp-admin/index.php?page=aioseo-setup-wizard#/category #2095 Error 403 when saving settings at /wp-admin/index.php?page=aioseo-setup-wizard#/category - @lifeforms
Issue slot 7: Replace references to blacklist and whitelist with denylist and allowlist respectively #2083 Replace references to blacklist and whitelist with denylist and allowlist respectively - is addressed by Replace blacklist and whitelist with deny list and allow list #2084, but a new PR will be created by Paul
Issue slot 8: False positive on parameter value XMLNS #2071 False positive on parameter value XMLNS - @lifeforms
Issue slot 9: Broken testcase for 932100 #2062 Broken testcase for 932100 - @fzipi
Issue slot 10: Rule Id: 932150 false positive on time keyword #2044 Rule Id: 932150 false positive on time keyword - @franbuehler and @lifeforms

dune73 added the 🔖 Meeting Agenda label May 13, 2021

dune73 changed the title ~~Monthly Chat Agendas Junecal (2021-05-03 and 2021-05-17) Meeting Agenda #2053~~ Monthly Chat Agendas Junecal (2021-06-07 and 2021-06-31) Meeting Agenda May 13, 2021

dune73 changed the title ~~Monthly Chat Agendas Junecal (2021-06-07 and 2021-06-31) Meeting Agenda~~ Monthly Chat Agenda June (2021-06-07 and 2021-06-31) May 13, 2021

dune73 mentioned this issue Jun 7, 2021

Use chained end tag detection for rule 941310 #2107

Merged

franbuehler changed the title ~~Monthly Chat Agenda June (2021-06-07 and 2021-06-31)~~ Monthly Chat Agenda June (2021-06-07 and 2021-06-21) Jun 8, 2021

franbuehler mentioned this issue Jun 11, 2021

Remove statement that is confusing in this context #2072

Closed

dune73 closed this as completed Jun 23, 2021

dune73 mentioned this issue Jun 25, 2021

Monthly Chat Agenda July (2021-07-05 and 2021-07-19) #2141

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Monthly Chat Agenda June (2021-06-07 and 2021-06-21) #2074

Monthly Chat Agenda June (2021-06-07 and 2021-06-21) #2074

Uh oh!

Uh oh!

Monthly Chat Agenda June (2021-06-07 and 2021-06-21) #2074

Monthly Chat Agenda June (2021-06-07 and 2021-06-21) #2074

Comments

Uh oh!

What happend in the meantime since the chat last month

Outside development

PRs that have been merged since the last meeting

Open PRs

Open PRs marked DRAFT or work in progress or needs action

Other items

Open Issues - Separate Issues Meeting (Monday, 21-06-2021)

Status of issues covered last month:

Stats:

How to get to our slack and join the meeting?

Uh oh!

Decisions

PRs

Other items

Open Issues - Separate Issues Meeting (Monday, June 21st)

Uh oh!