Closed
1 of 1 issue completedDescription
This is the Agenda for the Monthly CRS Chat.
The chat is going to happen on https://owasp.slack.com in the channel #coreruleset on the first Monday of the month (usually), at 20:30 CET (CEST during summer in the Northern Hemisphere). Please note that we have a CRS calendar (maintained by @fzipi).
Archived previous meetings and their decision are here.
What happened in the meantime since the chat last month
Outside development
- No news here.
Inside development
Rules
- No news here.
CRS Sandbox
- No news here.
Security
- We still have some pending issues to triage.
Plugins
- No news here.
Documentation and Public Relations
- We still have pending the documentation refactoring PR.
Project Administration and Sponsor relationships
- Let's discuss our organisational setup. We only have one leader now but used to have three. Also, @fzipi can't do everything and we don't want him to burn out.
Tools
- New go-ftw version 1.2.0 is out! 🎉
- Release of crs-toolchain 2.3.2! 🎉 (not yet ready for CRS to use)
- CRS CI updated to use the new versions of
go-ftwandsecrule_parsing
Containers
- Nginx container has a new configuration when WAF returns 403 for CORS preflights.
- Improved validation and configuration of rules through environment variables
Project discussions and decisions
- Shall we include utf-16 as a default, approved allowed charset?
- Proposal: use lowercase in all rules that ignore case. If we decide 👍 , then create a follow-up issue to change the rules that do not comply, and add documentation in the contribution page.
- There is a dataset with AI prompt injections at https://huggingface.co/datasets/hackaprompt/hackaprompt-dataset. This could be a base to develop AI prompt injection rules, possibly as a plugin. The guys behind the data set are interested in a call. Who from CRS would like to join?
- LTS status update (this should be a standing item on the agenda up until the LTS release)
- ⌚ Proposal: Timeliness for future project meetings: We should make a fresh effort to keep project meetings within time.
We should aim for and advertise 60 minute meetings and have a cut-off time of 90 minutes for flexibility (e.g. discussion of a more complex topic). If 2 or 3 people need a longer chat on a tricky topic, have the chat outside of the project meeting. Reasons:- Respect everybody's time
- Easier to attend & broader time zone representation (for some people the meeting time is very early, very late, or during work hours)
- Encourage participation (few people want to voluntarily attend long meetings…)
- Quick test of Slack Hangouts for first live Q&A
Rules development, key project numbers
PRs that have been merged since the last meeting
- chore: update go-ftw and secrules_parsing versions #3974
- fix: remove where, if, for and vol and resolve false positives (932380 PL1) #3972
- fix: remove aliases man, mi, si and resolve positives (932125 PL1) #3971
- feat: Remove rules for lack of viable attack scenario (920220 PL1, 920221 PL1) #3969
- feat: release yaml support for new label release:remove-rules #3970
- fix: FP against
patternwith=following at arbitrary position #3963 - 8000 chore: post-release v4.11.0-dev #3968
- chore: release v4.10.0 #3967
- feat: added empty multipart headers test for 922130 #3966
- feat: Add empty REQUEST_BASENAME test for 920221 #3959
- fix: add 'tx.max_num_args' to rule 900005 for testing #3957
- fix: add 'tx.total_arg_length' to rule 900005 for testing #3956
- feat: block CVE-2023-5003 #3955
- feat: prevent accessing PHP variables #3965
We merged 14 PRs since the last monthly project chat.
Open PRs
Open PRs marked DRAFT or work in progress or needs action
- fix: prevent invalid commands matches on 5 characters or less (932220 PL-2, 932230 PL-1, 932232 PL-3, 932235 PL-1, 932236 PL-2, 932237 PL-3, 932238 PL-3, 932239 PL-2, 932250 PL-1, 932260 PL-1) #3735
- feat: added detection for quote evasion #3813
- fix: 932270 FP #3917
- fix: move sql operators to include file #3901
- chore: add quant as comment #3925
- feat: accidental firewall disability prevention #3650
- fix: remove sql function names to resolve false positives (942151 PL1) #3973
- fix(933150): moving printf to 933160 for additional php syntax check (933150 PL-1, 933160 PL-1) #3840
- feat: Add product name tags #3960
- chore: find rules without test #3881
- fix(security): resolve SQL injection protection bypass (942380 PL2) #3720
- feat: added rule to detect Bash Brace Expansion #3780
- fix(932130): use lazy regex #3730
How to get to our slack and join the meeting?
If you are not yet on the OWASP Slack, here is your invite: https://owasp.org/slack/invite .
Everybody is welcome to join our community chat.