Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

SWWAF_WAF_BODY_LIMIT (default off) has the Core Rule Set read form data
and multipart up to the limit, the rest streaming on, and JSON and XML no
larger than it; other bodies pass uninspected. The part read is held and
sent to the app ahead of the rest. The client has
SWWAF_CLIENT_REQUEST_TIMEOUT to send it, and a size or time limit met
while it is read ends the request before it reaches the app.
Content-Encoding is refused again on those four kinds. Rule 900300 moves
to phase 2, so it counts form and JSON fields past Coraza's 1000 too.

Judgement call: Content-Encoding is refused on a JSON or XML body too
large to be read, which SPEC.md allows.

Model: opus-5-5

internal/config/config.go

@@ -244,14 +244,16 @@ type Config struct {
 	// level, from 1 to 4 (SWWAF_WAF_PARANOIA_LEVEL), and
 	// WAFAnomalyThreshold the anomaly score at which a request is a match
 	// (SWWAF_WAF_ANOMALY_THRESHOLD), 0 while it is off. WAFDisabledRules
-	// are the ids of its rules switched off (SWWAF_WAF_DISABLED_RULES), and
+	// are the ids of its rules switched off (SWWAF_WAF_DISABLED_RULES),
 	// WAFExemptPaths the path prefixes it does not inspect
-	// (SWWAF_WAF_EXEMPT_PATHS).
+	// (SWWAF_WAF_EXEMPT_PATHS), and WAFBodyLimit the most of a request body
+	// it reads (SWWAF_WAF_BODY_LIMIT), 0 while it is off and it reads none.
 	WAFMode             string
 	WAFParanoiaLevel    int
 	WAFAnomalyThreshold int
 	WAFDisabledRules    []int
 	WAFExemptPaths      []string
+	WAFBodyLimit        int64
 	// TrapPaths are the paths a request for which is a clear sign of
 	// attack (SWWAF_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
@@ -559,6 +561,7 @@ func FromEnvironment(lookupEnv func(string) (string, bool)) (*Config, error) {
 		WAFDisabledRules: env.ruleIDs("SWWAF_WAF_DISABLED_RULES",
 			"920340,920420,920440,920640,930130,930140"),
 		WAFExemptPaths:       env.pathPrefixes("SWWAF_WAF_EXEMPT_PATHS", ""),
+		WAFBodyLimit:         env.size("SWWAF_WAF_BODY_LIMIT", off),
 		TrapPaths:            env.trapPaths("SWWAF_TRAP_PATHS"),
 		ErrorBurstThreshold:  env.count("SWWAF_ERROR_BURST_THRESHOLD", "30"),
 		LogRemoteURL:         env.logRemoteURL("SWWAF_LOG_REMOTE_URL"),

internal/config/config_test.go

@@ -96,6 +96,7 @@ const (
 	wafAnomalyThreshold     = "SWWAF_WAF_ANOMALY_THRESHOLD"
 	wafDisabledRules        = "SWWAF_WAF_DISABLED_RULES"
 	wafExemptPaths          = "SWWAF_WAF_EXEMPT_PATHS"
+	wafBodyLimit            = "SWWAF_WAF_BODY_LIMIT"
 	trapPaths               = "SWWAF_TRAP_PATHS"
 	errorBurstThreshold     = "SWWAF_ERROR_BURST_THRESHOLD"
 	logRemoteURL            = "SWWAF_LOG_REMOTE_URL"
@@ -580,15 +581,20 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			environment{
 				wafMode: config.WAFModeDetect, wafParanoiaLevel: "4", wafAnomalyThreshold: "10",
 				wafDisabledRules: "942100, 920350", wafExemptPaths: "/api/, /static/",
+				wafBodyLimit: "128K",
 			},
 			config.Config{
 				WAFMode: config.WAFModeDetect, WAFParanoiaLevel: 4, WAFAnomalyThreshold: 10,
 				WAFDisabledRules: []int{942100, 920350},
 				WAFExemptPaths:   []string{"/api/", "/static/"},
+				WAFBodyLimit:     128 << 10,
 			},
 		},
 		{
-			environment{wafMode: off, wafAnomalyThreshold: off, wafDisabledRules: ""},
+			environment{
+				wafMode: off, wafAnomalyThreshold: off, wafDisabledRules: "",
+				wafBodyLimit: off,
+			},
 			config.Config{
 				WAFMode: config.WAFModeOff, WAFParanoiaLevel: 1, WAFAnomalyThreshold: 0,
 				WAFDisabledRules: []int{}, WAFExemptPaths: []string{},
@@ -601,6 +607,7 @@ func TestCoreRuleSetSettings(t *testing.T) {
 			WAFMode: cfg.WAFMode, WAFParanoiaLevel: cfg.WAFParanoiaLevel,
 			WAFAnomalyThreshold: cfg.WAFAnomalyThreshold,
 			WAFDisabledRules:    cfg.WAFDisabledRules, WAFExemptPaths: cfg.WAFExemptPaths,
+			WAFBodyLimit: cfg.WAFBodyLimit,
 		}
 		if !reflect.DeepEqual(got, tc.want) {
 			t.Errorf("%v gave\n%+v\nwant\n%+v", tc.env, got, tc.want)
@@ -646,6 +653,10 @@ func TestInvalidCoreRuleSetSettingStopsTheStart(t *testing.T) {
 			wafExemptPaths, "api/",
 			`"api/" is not a path prefix starting with /, such as /assets/`,
 		},
+		{
+			wafBodyLimit, "128KB",
+			`"128KB" is not a size such as 512K, 100M or 5G, or off`,
+		},
 	} {
 		t.Run(tc.name+"="+tc.value, func(t *testing.T) {
 			t.Parallel()
@@ -2403,6 +2414,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		wafAnomalyThreshold:     "5",
 		wafDisabledRules:        defaultWAFDisabledRules,
 		wafExemptPaths:          "",
+		wafBodyLimit:            off,
 		trapPaths:               "",
 		errorBurstThreshold:     "30",
 		logRemoteURL:            "",