# The Core Rule Set

The OWASP Core Rule Set 4.25.0 runs on each request after the rule files, unless
`SWWAF_WAF_MODE` is `off`. It reads the method, the URL with its query, and the
headers. Once `SWWAF_WAF_BODY_LIMIT` is set, it also reads a body that is form
data, multipart, JSON or XML. No answer is inspected. The settings are under
"Attack detection" in [`settings.md`](settings.md). The same section of
[`SPEC.md`](../SPEC.md) says why bodies are not read by default, and gives the
six changes `smallwebwaf` makes to the Core Rule Set, with the reason for each.

Each rule that matches adds to the request's score. A score at or over
`SWWAF_WAF_ANOMALY_THRESHOLD` is a match. A match is refused with `403` while
`SWWAF_WAF_MODE` is `block`, and let through while it is `detect`. Either way
the log line gives the rule ids and the score, and a `waf_block` alert is sent.
A request with more than 1000 query parameters or body fields adds 5 to its
score, since Coraza reads only the first 1000. The Core Rule Set inspects only a
request that every earlier check let through. It skips a path under
`SWWAF_WAF_EXEMPT_PATHS` and a client in `SWWAF_ALLOW_NETS`. An engine error on
a request forwards the request, and is logged and counted.

Body inspection suits apps whose forms carry no code. In front of a code forge
it refuses issue and comment text, wiki pages and files saved in the web editor
that hold shell commands or code. The log line names the rule ids, which
`SWWAF_WAF_DISABLED_RULES` can switch off. A body the Core Rule Set cannot parse
adds 5 to the score. So does a multipart body cut by the limit in the middle of
a part's header. The client has until `SWWAF_CLIENT_REQUEST_TIMEOUT` runs out to
send the part that is read. Any other body, such as a git push, reaches the app
uninspected.

[`gitea.md`](gitea.md) records what the Core Rule Set still refuses in front of
gitea, with and without body inspection.