Monthly Chat Agenda September 2021 (2021-09-06 and 2021-09-20) False Positive Meeting Agenda #2185

dune73 · 2021-08-30T09:06:55Z

This is the Agenda for the Monthly CRS Chat.

The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2021-09-06, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, 2021-09-20. That's the 3rd Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Items on the Agenda: (see previous meetings decisions: here)

What happend in the meantime since the chat last month

Outside development

Trustwave announced the End of Support for ModSecurity in a move to return ModSecurity to the Open Source community.
netnea.com (-> @dune73) has released C-Rex, a GUI that integrates with existing logviewers and DevOps setup so it can assist with the creation of rule exclusions.
Andrew Howe (-> @RedXanadu) has written a lengthy post about Extending ModSecurity: How to add completely custom WAF functionality
New tool to fuzz machine learning WAFs - maybe it can be put the good use for CRS as well

PRs that have been merged since the last meeting

We merged 7 PRs since the last monthly project chat.

Open PRs

Refactored and tested version of rule-ctl script #2193 - replaces Add rule-ctl.py script #2068, in need of a reviewer
eradicate XMLNS FP in rule 941130 #2192 - volunteer for review?
fix_2118 #2189 - volunteer for review?
fix: consistent backslash escaping #2183 - ready?
Fixing phpMyAdmin FPs #2172 - review?
< 8000 a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="899717949" data-permission-text="Title is private" data-url="https://github.com/coreruleset/coreruleset/issues/2101" data-hovercard-type="pull_request" data-hovercard-url="/coreruleset/coreruleset/pull/2101/hovercard" href="https://github.com/coreruleset/coreruleset/pull/2101">Fix FP 953120 brotli compression #2101 - we need to decide what to do here, it's really complicated since we are no real position to decide if we face brotli or not

Open PRs marked DRAFT or work in progress or needs action - or where review is currently ongoing (-> no intervention necessary)

Draft: Plugins support + response body decompress plugin #1993 - project leaders have met and made a decision - but no time to write it up properly. This PR is almost ready.
Fixing a typo in rule ID 9002840 #2190 - not sure this is really needed, discussion ongoing
feat(ci): use latest crs containers for testing #2188 - has just been assigned to @franbuehler
Add prefix, suffix, and comments to regexp assemble data files #2149 - this is a work in progress and ongoing review (recreating existing regexes with new script) lead to several discoveries already.
Detect JavaScript prototype pollution injection attempts #2070 - draft PR with more work pending
Add rule-ctl.py script #2068 - PR is coming along nicely. Good review so far and we're getting tests.
Proposal for a new plugin: Machine Learning on ModSecurity #2067 - ML plugin, not ready, idling, looking for a volunteer
Replace NodeJS Rule Set #2163 - this is changing rule file names which lead to problems and yaml issues and review ongoing
fix ReDoS on 941140 #2050 - review is in full swing
Override modsec rule 200001 #2049 - override recommended rule 200001
Nextcloud 20 false-positives #1975 - still looking for a qualified reviewer

Other items

Dev-on-duty from week 39 to the end of the year
Up for comments: CRS Expense Policy
Dev Retreat: Status, list of potential activities, create small preparation committee

Open Issues - Separate Issues Meeting (Monday, FIXME)

Status of issues covered last month

Issue slot 1: Rule 941140 FP #2162 - closed
Issue slot 2: HTTP PUT being blocked in WordPress is a false positive #2167 - pending
Issue slot 3: Unable to access a user's post PHPBB 3.3.3 #2150 - pending
Issue slot 4: WordPress /wp-admin/site-health.php triggers #2142 - pending
Issue slot 5: Rule id 930110 Bypass #2140 - closed
Issue slot 6: LogPart E (ctl:auditLogParts=+E) being added without matching as a rule #2139 - pending
Issue slot 7: False Positive with word Ping in 932115 #2135 - closed
Issue slot 8: 942310 regular suspected error #2118 - closed
Issue slot 9: Help create rule for Wordpress and ACF (Advanced Custom Fields) #2066 - pending
Issue slot 10: Go Test WAF bypasses #1991 - pending

Stats

Covered in chat: 10
Closed: 4
Pending: 6

This month's issues

We generally cover 10 issues per month in a separate issue meeting. Add them as you see fit.

Issue slot 1: WordPress /wp-admin/site-health.php triggers #2142 - we have hit a roadblock where it is not quite clear if the fix works everywhere or not
Issue slot 2: Inconsistent representation of the backslash character in search patterns #2179 - discussion of status and related PRs fix: consistent backslash escaping #2183, Amend regular expression pattern for rule 942440 #2201
Issue slot 3: HTTP PUT being blocked in WordPress is a false positive #2167 - picking this up again
Issue slot 4: Prepare canned responses for dev-on-duty #2187 - looking for a volunteer to provide a 1st draft
Issue slot 5: 941310 - Double escape and problem with german ü #2171 - FPs in two different languages
Issue slot 6: XSS Bypass #2170 - volunteer to copy&paste + enhance a rule
Issue slot 7: copy, time and more false positives #2166 - volunteer to expand existing rules (currently assigned to @lifeforms)
Issue slot 8: Rule 941120: false positive for the Russian language #1943 - we need a volunteer to dig into cyrillic encoding...

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp-slack.herokuapp.com/ .

Everybody is welcome to join our community chat.

dune73 · 2021-09-06T18:29:09Z

Decisions

PRs

Refactored and tested version of rule-ctl script #2193 : review: @themiddle
eradicate XMLNS FP in rule 941130 #2192 : review: @spartantri
fix_2118 #2189 : review: @maxleske
fix: consistent backslash escaping #2183 : review: @andrew Howe
Fixing phpMyAdmin FPs #2172 : review: @walter
Fix FP 953120 brotli compression #2101 : @spartantri brings up the idea of a brotli rule exclusion package.

Other items

Expense policy is up for discussion for a few weeks and will then the decided on.
@fzipitria and @airween join @dune73 to form the dev-summit project committee

Issues

Issue slot 1: WordPress /wp-admin/site-health.php triggers #2142 - we have hit a roadblock where it is not quite clear if the fix works everywhere or not - assigned to @azurit and @lifeforms
Issue slot 2: Inconsistent representation of the backslash character in search patterns #2179 - discussion of status and related PRs fix: consistent backslash escaping #2183, Amend regular expression pattern for rule 942440 #2201 - PRs need tweaks and a re-test. Issue can be closed after merging these 2 PRs.
Issue slot 3: HTTP PUT being blocked in WordPress is a false positive #2167 - course of action: 1. solve 2167 by doing a RE, 2. move WP into a plugin, 3. launch initiative to expand WP RE plugin with support for most wanted plugins.
Issue slot 4: Prepare canned responses for dev-on-duty #2187 - looking for a volunteer to provide a 1st draft - @theseion volunteers to write drafts
Issue slot 5: 941310 - Double escape and problem with german ü #2171 - FPs in two different languages - @franbuehler tests if PR Use chained end tag detection for rule 941310 #2107 resolves this issue
Issue slot 6: XSS Bypass #2170 - volunteer to copy&paste + enhance a rule - @RedXanadu volunteers to write a stricter sibling at PL2 that will inspect the REQUEST_FILENAME
Issue slot 7: copy, time and more false positives #2166 - volunteer to expand existing rules (currently assigned to @lifeforms, stays in his capable hands)
Issue slot 8: Rule 941120: false positive for the Russian language #1943 - we need a volunteer to dig into cyrillic encoding... - @theseion volunteers to take a look
Issue slot 9: Add Windows triple dot to a PL1 rule #2205 - @franbuehler self-assigned this one

dune73 added ➕ False Positive 🔖 Meeting Agenda and removed ➕ False Positive labels Aug 30, 2021

This was referenced Sep 8, 2021

Monthly Chat Agenda October 2021 (2021-10-04 and 2021-10-18) #2197

Closed

fix_2118 #2189

Merged

Fixing phpMyAdmin FPs #2172

Merged

Fix FP 953120 brotli compression #2101

Closed

dune73 closed this as completed Sep 20, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Monthly Chat Agenda September 2021 (2021-09-06 and 2021-09-20) False Positive Meeting Agenda #2185

Monthly Chat Agenda September 2021 (2021-09-06 and 2021-09-20) False Positive Meeting Agenda #2185

Uh oh!

Uh oh!

Monthly Chat Agenda September 2021 (2021-09-06 and 2021-09-20) False Positive Meeting Agenda #2185

Monthly Chat Agenda September 2021 (2021-09-06 and 2021-09-20) False Positive Meeting Agenda #2185

Comments

Uh oh!

What happend in the meantime since the chat last month

Outside development

PRs that have been merged since the last meeting

Open PRs

Open PRs marked DRAFT or work in progress or needs action - or where review is currently ongoing (-> no intervention necessary)

Other items

Open Issues - Separate Issues Meeting (Monday, FIXME)

Status of issues covered last month

This month's issues

How to get to our slack and join the meeting?

Uh oh!

Decisions

PRs

Other items

Issues

Uh oh!