Monthly Chat Agenda October 2021 (2021-10-04 and 2021-10-18) #2197

dune73 · 2021-09-08T09:32:24Z

This is the Agenda for the Monthly CRS Chat.

The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2021-10-04, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, 2021-10-18. That's the 3rd Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Items on the Agenda: (see previous meetings decisions: here)

What happend in the meantime since the chat last month

Outside development

Trustwave has announced they stop selling ModSecurity services effective immediately and they will terminate existing support contracts by 2024.
Swiss Post released a document where they describe the CRS tuning process to be able to run CRS at PL4 with anomaly thresholds 5/5.
@dune73 did a detailed walk-though of the Swiss Post high security CRS setup built for internet voting in a presentation at RomHack2021
New ELK support for ModSec Audit Logs

PRs that have been merged since the last meeting

We merged 11 PRs since the last monthly project chat.

Open PRs

Don't cook hex escapes #2215 - review needed
941101 add request filename #2208 - tests are failing and we do not know why
Amend regular expression pattern for rule 942440 #2201 - tests are failing and we do not know why
feat(nightly): add nightly latest releases #2207 - nightly builds almost ready
fix: consistent backslash escaping #2183 - we need to discuss this, also the failing tests
Replace NodeJS Rule Set #2163 - need for a discussion
Add prefix, suffix, and comments to regexp assemble data files #2149 - ready to be merged after conflicts are resolved
Fix FP 953120 brotli compression #2101 - broetli woes
fix ReDoS on 941140 #2050 - tests failing, otherwise, this might be good2go
Draft: Plugins support + response body decompress plugin #1993 - minor changes needed

Open PRs marked DRAFT or work in progress or needs action

Adding 'drop' keyword #2218 - tests are failing
Exclusion list fot RoundCube webmail #2217 - marked as draft
Fix 933210 Regex #2214 - marked as draft
Refactored and tested version of rule-ctl script #2193 - not ready until the promised tests are there
Fixing a typo in rule ID 9002840 #2190 - odd behaviour that @dune73 promised to investigate
Detect JavaScript prototype pollution injection attempts #2070 - marked as draft
Override modsec rule 200001 #2049 - postponed until dev retreat in October
Proposal for a new plugin: Machine Learning on ModSecurity #2067
Nextcloud 20 false-positives #1975

Open Issues - Separate Issues Meeting (Monday, 2021-10-18)

We concentrated on the dev retreat the week from October-23 instead of a regular issue chat.

Dev Retreat

See the two wiki docs:

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp-slack.herokuapp.com/ .

Everybody is welcome to join our community chat.

franbuehler · 2021-10-04T18:42:20Z

Decisions

PRs

Don't cook hex escapes #2215 - @franbuehler will review it
941101 add request filename #2208 - @RedXanadu will provide a better description and do a rebase to fix the failing tests
Amend regular expression pattern for rule 942440 #2201 - also here, a rebase should fix the failing tests
feat(nightly): add nightly latest releases #2207 - merged during meeting
fix: consistent backslash escaping #2183 - PR is on good tracks, but we are really not sure of the exact syntax and of the effect. Skip PR and comment on the ticket.
Replace NodeJS Rule Set #2163 - @theMiddleBlue will change REQUEST_BODY to FULL_REQUEST so that it works for both v2 and v3. Add some tests that proves that.
Add prefix, suffix, and comments to regexp assemble data files #2149 - ready to be merged after conflicts are resolved
Fix FP 953120 brotli compression #2101 - In fact there is no way to really detect broetli and if broetli is executed on the RP, we won't really know and it's all a mess and despite all the work that went into the review of this PR I think we have to close this. @spartantri proposed to do this as a plugin. closed
fix ReDoS on 941140 #2050 - tests failing, otherwise, this might be good2go
Draft: Plugins support + response body decompress plugin #1993 - stalled because dune73 need to communicate with azurit about this. It's all OK from his side, but it takes some adjustments how Walter and dune73 want the plugins to work.

Other items

Issues

dune73 added ➕ False Positive 🔖 Meeting Agenda and removed ➕ False Positive labels Sep 8, 2021

dune73 closed this as completed Oct 18, 2021

dune73 mentioned this issue Nov 1, 2021

Monthly Chat Agenda November 2021 (2021-11-01 and 2021-11-15) #2239

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Monthly Chat Agenda October 2021 (2021-10-04 and 2021-10-18) #2197

Monthly Chat Agenda October 2021 (2021-10-04 and 2021-10-18) #2197

Uh oh!

Uh oh!

Monthly Chat Agenda October 2021 (2021-10-04 and 2021-10-18) #2197

Monthly Chat Agenda October 2021 (2021-10-04 and 2021-10-18) #2197

Comments

Uh oh!

What happend in the meantime since the chat last month

Outside development

PRs that have been merged since the last meeting

Open PRs

Open PRs marked DRAFT or work in progress or needs action

Open Issues - Separate Issues Meeting (Monday, 2021-10-18)

Dev Retreat

How to get to our slack and join the meeting?

Uh oh!

Decisions

PRs

Other items

Issues

Uh oh!