Check the cardinality of the args about swagger2modsec

[dune73]

That was quick. Thank you. Could you update the sample1.conf, so I can check how this really looks now?

I have not yet tried your code, nor the rules, but this looks really promising.

May I point you to my whitelisting recipe in the https://www.netnea.com/cms/apache-tutorial-6_embedding-modsecurity/ tutorial. It could serve as an inspiration and further validation of your approach.

For example, my rule id 11000 is really crucial when it comes to prevent bypasses.

[angeloxx]

Thank you, sample updated. My first objective is to get a simple script to create a stub for the modsecurity configuration, the second one is to use pymodsecurity (based on modsecurity 3) to validate output file and use a "standard" set of attacks and test rules, but I'm unable to compile the module at the moment. The second change is to start a docker container with apache+modsecurity, load the generated rules and test it. I've to think about it.

About you rule set, you are right (I've clearly remember your training course), but I suppose that the generated rules are inserted in a wider set of rules. I'm also not so sure that I'm using the right approach to whitelist paths.

As usual, any comment is appreciated.

[dune73]

I second your plan. I think this is a viable approach. If unsure about a container, you may want to look in Franziska Bühler's docker container. But it's ModSec 2.9...

As for the right approach to the rules: I am intrigued by your approach. I have not tried out the sample, but I am very interested to really understand how it is working.

Good luck with your project!