coreruleset / ftw-tests-schema

FTW Testing YAML Schema Definition

Branch	Status
main
v3.3/master

OWASP CRS

The OWASP CRS is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.

CRS Resources

Please see the OWASP CRS page to get introduced to the CRS and view resources on installation, configuration, and working with the CRS.

Contributing to the CRS

We strive to make the OWASP ModSecurity CRS accessible to a wide audience of beginner and experienced users. We are interested in hearing any bug reports, false-positive alert reports, evasions, usability issues, and suggestions for new detections.

Create an issue on GitHub to report a false positive or false negative (evasion). Please include your installed version and the relevant portions of your ModSecurity audit log. We will try and address your issue and potentially ask for additional information to reproduce your problem. Please also note that stale issues will be flagged and closed after 120 days. You can search for stale issues with the following search query.

Sign up for our Google Group to ask general usage questions and participate in discussions on the CRS. Also here you can find the archives for the previous mailing list.

Join the #coreruleset channel on OWASP Slack to chat about the CRS. (Click here to get an invitation if you are not yet registered on the OWASP slack. It's open to non-members too.)

License

Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
Copyright (c) 2021-2024 CRS project. All rights reserved.

The OWASP CRS is distributed under Apache Software License (ASL) version 2. Please see the enclosed LICENSE file for full details.

ftw-tests-schema's Issues

Support for "isolated test" flag

Definition "isolated test"

An "isolated test" is a test that triggers only the corresponding rule on the paranoia level of the rule and lower paranoia levels.

This means that an isolated test for a rule on PL1 may only trigger the corresponding rule on PL1, but it may also trigger rules on PL2 and higher.

Reasoning

The CRS Status Page depends on isolated tests. Carrying a separate list of isolated tests will lead to redundancy and an outdated list. So the information whether a test is isolated or not, should be kept together with the test.

Implementation

The information is meant to be with the test, next to the description.

Implementation variant 1: New flag next to description

  - test_title: 942100-1
    desc: "Simple SQL Injection"
    isolated: true
    stages:
      - stage:

Implementation variant 2: Create metadata array next to description, add flag to new metadata collection

  - test_title: 942100-1
    desc: "Simple SQL Injection"
    metadata:
      - isolated: true
    stages:
      - stage:

Implementation variant 3: Create metadata array, move description into new metadata collection, add flag to new metadata collection

 - test_title: 942100-1
   metadata:
     - desc: "Simple SQL Injection"
     - isolated: true
   stages:
     - stage:

CAVEAT

For the CI of the rule set it is important to make sure the tests flagged as isolated are really isolated, also when we edit rules. See definition above.

Update generated versions list in main readme

The list in the main readme is empty.. we should probably update it automagically whenever a new version is out.