clawbot
80f4c2cc61
check / check (push) Waiting to run
Coraza v3.8.1 runs the Core Rule Set 4.25.0 (coraza-coreruleset v4.25.0) after the rule files, with the six changes and the default SWWAF_WAF_DISABLED_RULES that SPEC.md gives; no body, no response. The parameter names in the third and fourth changes are matched in any case, as Coraza does. SWWAF_WAF_DISABLED_RULES refuses 900000 to 900999, smallwebwaf's own rules. A request with more than 1000 query parameters adds 5 (rule 900300). In block mode a match is refused with 403, an offence counted toward the error burst; in detect mode it is let through. Both log waf_rule_ids, waf_score and duration_waf, raise waf_block, and count smallwebwaf_waf_matches_total. Judgement call: waf_block is raised in block mode too. Deviation: no engine-error path; with no body read, Coraza cannot fail. Model: opus-5-5
44 lines
1.8 KiB
AMPL
44 lines
1.8 KiB
AMPL
module sneak.berlin/go/smallwebwaf
|
|
|
|
go 1.26.0
|
|
|
|
require (
|
|
github.com/corazawaf/coraza-coreruleset/v4 v4.25.0
|
|
github.com/corazawaf/coraza/v3 v3.8.1
|
|
github.com/fsnotify/fsnotify v1.10.1
|
|
github.com/hashicorp/golang-lru/v2 v2.0.7
|
|
github.com/maxmind/mmdbwriter v1.2.0
|
|
github.com/oschwald/maxminddb-golang/v2 v2.7.0
|
|
github.com/prometheus/client_golang v1.24.1
|
|
)
|
|
|
|
require (
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/corazawaf/libinjection-go v0.3.3 // indirect
|
|
github.com/goccy/go-json v0.10.5 // indirect
|
|
github.com/goccy/go-yaml v1.19.2 // indirect
|
|
github.com/gotnospirit/makeplural v0.0.0-20180622080156-a5f48d94d976 // indirect
|
|
github.com/gotnospirit/messageformat v0.0.0-20221001023931-dfe49f1eb092 // indirect
|
|
github.com/kaptinlin/go-i18n v0.1.4 // indirect
|
|
github.com/kaptinlin/jsonschema v0.4.6 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/magefile/mage v1.17.0 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/petar-dambovaliev/aho-corasick v0.0.0-20250424160509-463d218d4745 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/prometheus/common v0.70.1 // indirect
|
|
github.com/prometheus/procfs v0.21.1 // indirect
|
|
github.com/tidwall/gjson v1.18.0 // indirect
|
|
github.com/tidwall/match v1.1.1 // indirect
|
|
github.com/tidwall/pretty v1.2.1 // indirect
|
|
github.com/valllabh/ocsf-schema-golang v1.0.3 // indirect
|
|
go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
|
|
golang.org/x/net v0.58.0 // indirect
|
|
golang.org/x/sync v0.23.0 // indirect
|
|
golang.org/x/sys v0.48.0 // indirect
|
|
golang.org/x/text v0.41.0 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
rsc.io/binaryregexp v0.2.0 // indirect
|
|
)
|