The Core Rule Set, run by Coraza, on each request's method, URL and headers (closes #25)

Coraza v3.8.1 runs the Core Rule Set 4.25.0 (coraza-coreruleset v4.25.0)
after the rule files, with the six changes and the default
SWWAF_WAF_DISABLED_RULES that SPEC.md gives; no body, no response.
SWWAF_WAF_MODE, SWWAF_WAF_PARANOIA_LEVEL, SWWAF_WAF_ANOMALY_THRESHOLD and
SWWAF_WAF_EXEMPT_PATHS as specified; SWWAF_WAF_DISABLED_RULES refuses
900000 to 900999, smallwebwaf's own rules among them. A request with more
query parameters than Coraza reads, 1000, adds 5 (rule 900300). In block
mode a match is refused with 403, an offence counted toward the error
burst; in detect mode it is let through. Both log waf_rule_ids, waf_score
and duration_waf, raise waf_block, and count
smallwebwaf_waf_matches_total.

Judgement call: waf_block is raised in block mode too.
Deviation: no engine-error path; with no body read, Coraza cannot fail.

Model: opus-5-5

README.md

@@ -232,9 +232,7 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
       command names (932260), so that a file such as `.gitignore` or a branch
       such as `docker-build` gets through there. So does what only these rules
       refuse, such as `|cat /etc/passwd`; path traversal and SQL injection are
-      still refused there. These names, and `redirect_uri` above, are matched
-      without regard to case, as Coraza matches them, so `Path` or `PATH` is
-      treated as `path`.
+      still refused there.
     - The cookies `gitea_flash` and `redirect_to` are not read, and `Referer` is
       not checked for a Unix command given without arguments (932340) or for
       Java starting a process (944110); it is checked by every other rule.

SPEC.md

@@ -618,12 +618,10 @@ The settings, by group:
           `|cat /etc/passwd`, `wget http://…` and `nc -e /bin/sh …`, and
           `file:///etc/passwd`, pass as well. Path traversal (`../`), SQL and
           script injection and PHP, Java and Node.js code are still refused
-          there, and every other parameter keeps all three rules. These names,
-          and `redirect_uri` in the change before, are matched without regard to
-          case, as Coraza matches them, so `Path` or `PATH` is treated as
-          `path`. An app that uses one of these parameters as a file on the
-          server, or passes it to a shell, gets no help from the three rules
-          there (see "Risks the design has to handle").
+          there, and every other parameter keeps all three rules. An app that
+          uses one of these parameters as a file on the server, or passes it to
+          a shell, gets no help from the three rules there (see "Risks the
+          design has to handle").
         - The Core Rule Set reads the request without the `gitea_flash` and
           `redirect_to` cookies, and does not check `Referer` for a Unix command
           given without arguments (932340) or for Java starting a process

internal/waf/waf.go

@@ -56,8 +56,7 @@ SecAction "id:900250,phase:1,pass,nolog,\
 Include @owasp_crs/REQUEST-*.conf
 
 # The third: redirect_uri is not checked for a URL naming an IP address or
-# localhost. Coraza matches a parameter name here, and in the fourth,
-# without regard to case.
+# localhost.
 SecRuleUpdateTargetById 931100 "!ARGS:redirect_uri"
 SecRuleUpdateTargetById 934110 "!ARGS:redirect_uri"
 

internal/waf/waf_test.go

@@ -233,16 +233,6 @@ func TestParametersGiteaSendsNamesInSkipTheListsOfFilesPathsAndCommands(t *testi
 	wantResult(t, crs, get("/?path=1'%20OR%20'1'='1"), matched(942100))
 }
 
-func TestParameterNamesAreMatchedWithoutRegardToCase(t *testing.T) {
-	t.Parallel()
-
-	crs := atDefaults(t)
-
-	wantChange(t, crs, get("/?Path=.gitignore"), get("/?q=.gitignore"), matched(930120))
-	wantChange(t, crs, get("/?REDIRECT_URI=http://127.0.0.1:52341/"),
-		get("/?next=http://127.0.0.1:52341/"), matched(931100, 934110))
-}
-
 func TestCookiesGiteaFlashAndRedirectToAreNotRead(t *testing.T) {
 	t.Parallel()